Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Windows 7: USB-Stick zeigt nur noch Verknüpfungen an + avira hat TR/Crypt.ZPACK.82398 gefunden (https://www.trojaner-board.de/157197-windows-7-usb-stick-zeigt-nur-noch-verknuepfungen-avira-hat-tr-crypt-zpack-82398-gefunden.html)

Freiseflei 03.08.2014 17:41
Windows 7: USB-Stick zeigt nur noch Verknüpfungen an + avira hat TR/Crypt.ZPACK.82398 gefunden
 
Liebe Trojaner-Board Community,

vor ca. 2 Wochen hat mein Virenscanner Avira Free (siehe log unten) nach einem Systemscan gemeldet einen Trojaner gefunden zu haben. Die betroffenen Dateien wurden von Avira in die Quarantäne verschoben. Ca. eine Woche später hatte ich das Problem, dass Dateien von meinen USB-Sticks verschwanden und nur noch Verknüpfungen (mit der c:\windows\system32 Datei) aufschienen. Ich bin mir nicht sicher, ob dieses Problem mit dem genannten Trojanerfund zusammenhängt oder an einem anderen Virus liegt, da ich die betroffenen USB sticks aufgrund einer Reise auf Rechnern von Internetcafes benutzt habe.

Glücklicherweise fand ich bei meiner Internetrecherche zu diesem Problem schnell heraus, dass ähnliche Probleme bereits mehrmals auf Trojaner-Board diskutiert und gelöst wurden. Auch habe ich gelesen, dass nicht geraten wird einfach so die selben Schritte zu befolgen, welche bei anderen zur Lösung des Problems führten. Im folgenden möchte ich deswegen die im Thread "Für alle Hilfesuchenden" beschriebenen Logfiles posten, und wäre sehr dankbar für etwas Hilfe.

Zuerst kopiere ich den Bericht von Avira, welcher am 17.07 einen Trojaner Fund meldete:

Code:
Avira Free Antivirus
Erstellungsdatum der Reportdatei: Donnerstag, 17. Juli 2014  18:34


Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.

Lizenznehmer  : Avira Antivirus Free
Seriennummer  : 0000149996-AVHOE-0000001
Plattform      : Windows 7 Professional
Windowsversion : (Service Pack 1)  [6.1.7601]
Boot Modus    : Normal gebootet
Benutzername  : SYSTEM
Computername  : COMPIUTA-PC

Versionsinformationen:
BUILD.DAT      : 14.0.5.450    91868 Bytes  24.06.2014 20:39:00
AVSCAN.EXE    : 14.0.5.396  1042512 Bytes  04.07.2014 01:14:39
AVSCANRC.DLL  : 14.0.5.364    62544 Bytes  04.07.2014 01:14:39
LUKE.DLL      : 14.0.5.336    57936 Bytes  04.07.2014 01:15:37
AVSCPLR.DLL    : 14.0.5.376    89680 Bytes  04.07.2014 01:14:39
AVREG.DLL      : 14.0.5.356    261200 Bytes  04.07.2014 01:14:34
avlode.dll    : 14.0.5.396    588368 Bytes  04.07.2014 01:14:32
avlode.rdf    : 14.0.4.42      65114 Bytes  17.07.2014 15:02:11
XBV00008.VDF  : 8.11.153.142    2048 Bytes  06.06.2014 00:05:03
XBV00009.VDF  : 8.11.153.142    2048 Bytes  06.06.2014 00:05:03
XBV00010.VDF  : 8.11.153.142    2048 Bytes  06.06.2014 00:05:03
XBV00011.VDF  : 8.11.153.142    2048 Bytes  06.06.2014 00:05:03
XBV00012.VDF  : 8.11.153.142    2048 Bytes  06.06.2014 00:05:03
XBV00013.VDF  : 8.11.153.142    2048 Bytes  06.06.2014 00:05:03
XBV00014.VDF  : 8.11.153.142    2048 Bytes  06.06.2014 00:05:04
XBV00015.VDF  : 8.11.153.142    2048 Bytes  06.06.2014 00:05:04
XBV00016.VDF  : 8.11.153.142    2048 Bytes  06.06.2014 00:05:04
XBV00017.VDF  : 8.11.153.142    2048 Bytes  06.06.2014 00:05:04
XBV00018.VDF  : 8.11.153.142    2048 Bytes  06.06.2014 00:05:04
XBV00019.VDF  : 8.11.153.142    2048 Bytes  06.06.2014 00:05:04
XBV00020.VDF  : 8.11.153.142    2048 Bytes  06.06.2014 00:05:04
XBV00021.VDF  : 8.11.153.142    2048 Bytes  06.06.2014 00:05:04
XBV00022.VDF  : 8.11.153.142    2048 Bytes  06.06.2014 00:05:05
XBV00023.VDF  : 8.11.153.142    2048 Bytes  06.06.2014 00:05:05
XBV00024.VDF  : 8.11.153.142    2048 Bytes  06.06.2014 00:05:05
XBV00025.VDF  : 8.11.153.142    2048 Bytes  06.06.2014 00:05:05
XBV00026.VDF  : 8.11.153.142    2048 Bytes  06.06.2014 00:05:05
XBV00027.VDF  : 8.11.153.142    2048 Bytes  06.06.2014 00:05:05
XBV00028.VDF  : 8.11.153.142    2048 Bytes  06.06.2014 00:05:05
XBV00029.VDF  : 8.11.153.142    2048 Bytes  06.06.2014 00:05:05
XBV00030.VDF  : 8.11.153.142    2048 Bytes  06.06.2014 00:05:05
XBV00031.VDF  : 8.11.153.142    2048 Bytes  06.06.2014 00:05:06
XBV00032.VDF  : 8.11.153.142    2048 Bytes  06.06.2014 00:05:06
XBV00033.VDF  : 8.11.153.142    2048 Bytes  06.06.2014 00:05:06
XBV00034.VDF  : 8.11.153.142    2048 Bytes  06.06.2014 00:05:06
XBV00035.VDF  : 8.11.153.142    2048 Bytes  06.06.2014 00:05:06
XBV00036.VDF  : 8.11.153.142    2048 Bytes  06.06.2014 00:05:06
XBV00037.VDF  : 8.11.153.142    2048 Bytes  06.06.2014 00:05:06
XBV00038.VDF  : 8.11.153.142    2048 Bytes  06.06.2014 00:05:06
XBV00039.VDF  : 8.11.153.142    2048 Bytes  06.06.2014 00:05:07
XBV00040.VDF  : 8.11.153.142    2048 Bytes  06.06.2014 00:05:07
XBV00041.VDF  : 8.11.153.142    2048 Bytes  06.06.2014 00:05:07
XBV00118.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:18
XBV00119.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:18
XBV00120.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:19
XBV00121.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:19
XBV00122.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:19
XBV00123.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:19
XBV00124.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:20
XBV00125.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:20
XBV00126.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:20
XBV00127.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:20
XBV00128.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:21
XBV00129.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:21
XBV00130.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:21
XBV00131.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:21
XBV00132.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:22
XBV00133.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:22
XBV00134.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:22
XBV00135.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:23
XBV00136.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:23
XBV00137.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:23
XBV00138.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:23
XBV00139.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:24
XBV00140.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:24
XBV00141.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:24
XBV00142.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:25
XBV00143.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:25
XBV00144.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:25
XBV00145.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:26
XBV00146.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:26
XBV00147.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:26
XBV00148.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:27
XBV00149.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:27
XBV00150.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:27
XBV00151.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:28
XBV00152.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:28
XBV00153.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:28
XBV00154.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:28
XBV00155.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:28
XBV00156.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:29
XBV00157.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:29
XBV00158.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:29
XBV00159.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:30
XBV00160.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:30
XBV00161.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:30
XBV00162.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:31
XBV00163.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:31
XBV00164.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:32
XBV00165.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:32
XBV00166.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:32
XBV00167.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:33
XBV00168.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:33
XBV00169.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:34
XBV00170.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:34
XBV00171.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:34
XBV00172.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:35
XBV00173.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:35
XBV00174.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:35
XBV00175.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:35
XBV00176.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:35
XBV00177.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:36
XBV00178.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:36
XBV00179.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:36
XBV00180.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:37
XBV00181.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:37
XBV00182.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:38
XBV00183.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:38
XBV00184.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:38
XBV00185.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:39
XBV00186.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:39
XBV00187.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:39
XBV00188.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:39
XBV00189.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:40
XBV00190.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:40
XBV00191.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:40
XBV00192.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:40
XBV00193.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:41
XBV00194.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:41
XBV00195.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:41
XBV00196.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:42
XBV00197.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:42
XBV00198.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:43
XBV00199.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:43
XBV00200.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:43
XBV00201.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:44
XBV00202.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:44
XBV00203.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:44
XBV00204.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:44
XBV00205.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:45
XBV00206.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:45
XBV00207.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:45
XBV00208.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:46
XBV00209.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:46
XBV00210.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:46
XBV00211.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:47
XBV00212.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:47
XBV00213.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:48
XBV00214.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:48
XBV00215.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:49
XBV00216.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:49
XBV00217.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:50
XBV00218.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:50
XBV00219.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:51
XBV00220.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:51
XBV00221.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:52
XBV00222.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:52
XBV00223.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:52
XBV00224.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:52
XBV00225.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:53
XBV00226.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:53
XBV00227.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:54
XBV00228.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:57
XBV00229.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:57
XBV00230.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:58
XBV00231.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:58
XBV00232.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:59
XBV00233.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 23:59:59
XBV00234.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 00:00:01
XBV00235.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 00:00:07
XBV00236.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 00:00:08
XBV00237.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 00:00:08
XBV00238.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 00:00:08
XBV00239.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 00:00:09
XBV00240.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 00:00:09
XBV00241.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 00:00:10
XBV00242.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 00:00:11
XBV00243.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 00:00:11
XBV00244.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 00:00:12
XBV00245.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 00:00:12
XBV00246.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 00:00:13
XBV00247.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 00:00:14
XBV00248.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 00:00:14
XBV00249.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 00:00:15
XBV00250.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 00:00:15
XBV00251.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 00:00:16
XBV00252.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 00:00:16
XBV00253.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 00:00:16
XBV00254.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 00:00:17
XBV00255.VDF  : 8.11.159.102    2048 Bytes  08.07.2014 00:00:17
XBV00000.VDF  : 7.11.70.0  66736640 Bytes  04.04.2013 09:41:06
XBV00001.VDF  : 7.11.74.226  2201600 Bytes  30.04.2013 09:41:06
XBV00002.VDF  : 7.11.80.60  2751488 Bytes  28.05.2013 09:41:06
XBV00003.VDF  : 7.11.85.214  2162688 Bytes  21.06.2013 09:41:06
XBV00004.VDF  : 7.11.91.176  3903488 Bytes  23.07.2013 09:41:06
XBV00005.VDF  : 7.11.98.186  6822912 Bytes  29.08.2013 09:41:06
XBV00006.VDF  : 7.11.139.38 15708672 Bytes  27.03.2014 15:27:47
XBV00007.VDF  : 7.11.152.100  4193792 Bytes  02.06.2014 13:29:15
XBV00042.VDF  : 8.11.153.142  710656 Bytes  06.06.2014 00:05:08
XBV00043.VDF  : 8.11.155.44  1013760 Bytes  16.06.2014 00:05:10
XBV00044.VDF  : 8.11.159.102  1662976 Bytes  08.07.2014 23:58:52
XBV00045.VDF  : 8.11.159.104    13824 Bytes  08.07.2014 23:58:52
XBV00046.VDF  : 8.11.159.108    13312 Bytes  08.07.2014 23:58:53
XBV00047.VDF  : 8.11.159.112    30720 Bytes  09.07.2014 19:22:05
XBV00048.VDF  : 8.11.159.114    6144 Bytes  09.07.2014 19:22:05
XBV00049.VDF  : 8.11.159.116    10240 Bytes  09.07.2014 19:22:05
XBV00050.VDF  : 8.11.159.118    5632 Bytes  09.07.2014 19:22:05
XBV00051.VDF  : 8.11.159.122    7168 Bytes  09.07.2014 19:22:05
XBV00052.VDF  : 8.11.159.126  180736 Bytes  09.07.2014 19:22:08
XBV00053.VDF  : 8.11.159.148  174080 Bytes  09.07.2014 19:22:09
XBV00054.VDF  : 8.11.159.168    2560 Bytes  09.07.2014 19:22:09
XBV00055.VDF  : 8.11.159.188    15360 Bytes  09.07.2014 19:22:09
XBV00056.VDF  : 8.11.159.210    25600 Bytes  09.07.2014 13:38:23
XBV00057.VDF  : 8.11.159.212    7168 Bytes  09.07.2014 13:38:24
XBV00058.VDF  : 8.11.159.218    27648 Bytes  10.07.2014 13:38:24
XBV00059.VDF  : 8.11.159.220    2048 Bytes  10.07.2014 13:38:25
XBV00060.VDF  : 8.11.159.222    29696 Bytes  10.07.2014 13:38:25
XBV00061.VDF  : 8.11.159.224  167936 Bytes  10.07.2014 13:38:26
XBV00062.VDF  : 8.11.159.226    35328 Bytes  10.07.2014 13:38:27
XBV00063.VDF  : 8.11.159.230  186368 Bytes  10.07.2014 19:47:43
XBV00064.VDF  : 8.11.159.250    16896 Bytes  10.07.2014 19:47:43
XBV00065.VDF  : 8.11.159.252    2048 Bytes  10.07.2014 19:47:43
XBV00066.VDF  : 8.11.160.16    6144 Bytes  10.07.2014 19:47:43
XBV00067.VDF  : 8.11.160.40    17408 Bytes  10.07.2014 02:30:47
XBV00068.VDF  : 8.11.160.42    2048 Bytes  11.07.2014 02:30:47
XBV00069.VDF  : 8.11.160.46  179200 Bytes  11.07.2014 13:34:14
XBV00070.VDF  : 8.11.160.48  203264 Bytes  11.07.2014 00:00:39
XBV00071.VDF  : 8.11.160.50    6144 Bytes  11.07.2014 00:00:39
XBV00072.VDF  : 8.11.160.52    2048 Bytes  11.07.2014 00:00:39
XBV00073.VDF  : 8.11.160.54    2048 Bytes  11.07.2014 00:00:39
XBV00074.VDF  : 8.11.160.58    22016 Bytes  11.07.2014 00:00:39
XBV00075.VDF  : 8.11.160.60    2048 Bytes  11.07.2014 00:00:39
XBV00076.VDF  : 8.11.160.62    8192 Bytes  11.07.2014 00:00:39
XBV00077.VDF  : 8.11.160.66  198656 Bytes  12.07.2014 00:00:40
XBV00078.VDF  : 8.11.160.68    7168 Bytes  12.07.2014 00:00:40
XBV00079.VDF  : 8.11.160.70    14848 Bytes  12.07.2014 00:00:40
XBV00080.VDF  : 8.11.160.72    7168 Bytes  12.07.2014 00:00:40
XBV00081.VDF  : 8.11.160.92    40448 Bytes  13.07.2014 00:00:40
XBV00082.VDF  : 8.11.160.112    2048 Bytes  13.07.2014 00:00:40
XBV00083.VDF  : 8.11.160.130  193024 Bytes  13.07.2014 00:00:40
XBV00084.VDF  : 8.11.160.132    2048 Bytes  13.07.2014 00:00:40
XBV00085.VDF  : 8.11.160.152    20480 Bytes  13.07.2014 00:00:40
XBV00086.VDF  : 8.11.160.154    2048 Bytes  13.07.2014 00:00:40
XBV00087.VDF  : 8.11.160.156    20992 Bytes  14.07.2014 21:17:40
XBV00088.VDF  : 8.11.160.158    2560 Bytes  14.07.2014 21:17:40
XBV00089.VDF  : 8.11.160.160    11264 Bytes  14.07.2014 21:17:40
XBV00090.VDF  : 8.11.160.162    2560 Bytes  14.07.2014 21:17:40
XBV00091.VDF  : 8.11.160.166    14336 Bytes  14.07.2014 21:17:40
XBV00092.VDF  : 8.11.160.168    5120 Bytes  14.07.2014 21:17:40
XBV00093.VDF  : 8.11.160.178    7168 Bytes  14.07.2014 21:17:40
XBV00094.VDF  : 8.11.160.180    2048 Bytes  14.07.2014 21:17:41
XBV00095.VDF  : 8.11.160.182    2048 Bytes  14.07.2014 21:17:41
XBV00096.VDF  : 8.11.160.188  256000 Bytes  14.07.2014 03:17:41
XBV00097.VDF  : 8.11.160.190    7680 Bytes  14.07.2014 03:17:41
XBV00098.VDF  : 8.11.160.194    18432 Bytes  15.07.2014 21:30:55
XBV00099.VDF  : 8.11.160.212  184832 Bytes  15.07.2014 21:30:55
XBV00100.VDF  : 8.11.160.230  289792 Bytes  15.07.2014 21:30:55
XBV00101.VDF  : 8.11.160.232    2048 Bytes  15.07.2014 21:30:55
XBV00102.VDF  : 8.11.160.234  176128 Bytes  15.07.2014 21:30:57
XBV00103.VDF  : 8.11.160.254    18432 Bytes  15.07.2014 03:30:52
XBV00104.VDF  : 8.11.161.16    6144 Bytes  16.07.2014 20:10:13
XBV00105.VDF  : 8.11.161.32    2048 Bytes  16.07.2014 20:10:13
XBV00106.VDF  : 8.11.161.34    2048 Bytes  16.07.2014 20:10:13
XBV00107.VDF  : 8.11.161.52    26624 Bytes  16.07.2014 20:10:13
XBV00108.VDF  : 8.11.161.68  184832 Bytes  16.07.2014 20:10:14
XBV00109.VDF  : 8.11.161.84    2048 Bytes  16.07.2014 20:10:14
XBV00110.VDF  : 8.11.162.2      2560 Bytes  16.07.2014 20:10:14
XBV00111.VDF  : 8.11.162.6    16896 Bytes  16.07.2014 02:10:10
XBV00112.VDF  : 8.11.162.8    24064 Bytes  16.07.2014 02:10:10
XBV00113.VDF  : 8.11.162.10    2560 Bytes  16.07.2014 02:10:10
XBV00114.VDF  : 8.11.162.14    41472 Bytes  17.07.2014 15:02:12
XBV00115.VDF  : 8.11.162.16    2048 Bytes  17.07.2014 15:02:12
XBV00116.VDF  : 8.11.162.18  215040 Bytes  17.07.2014 15:02:14
XBV00117.VDF  : 8.11.162.22  184320 Bytes  17.07.2014 15:02:16
LOCAL001.VDF  : 8.11.162.22 108717056 Bytes  17.07.2014 15:02:44
Engineversion  : 8.3.20.34
AEVDF.DLL      : 8.3.0.4      118976 Bytes  21.04.2014 15:25:01
AESCRIPT.DLL  : 8.1.4.220    532680 Bytes  11.07.2014 13:34:13
AESCN.DLL      : 8.3.1.2      135360 Bytes  28.05.2014 19:05:26
AESBX.DLL      : 8.2.20.24    1409224 Bytes  08.05.2014 14:27:48
AERDL.DLL      : 8.2.0.138    704888 Bytes  25.02.2014 09:41:04
AEPACK.DLL    : 8.4.0.42      786632 Bytes  04.07.2014 01:14:22
AEOFFICE.DLL  : 8.3.0.10      209096 Bytes  11.07.2014 13:34:11
AEHEUR.DLL    : 8.1.4.1160  7229640 Bytes  11.07.2014 13:34:11
AEHELP.DLL    : 8.3.1.0      278728 Bytes  28.05.2014 19:05:23
AEGEN.DLL      : 8.1.7.28      450752 Bytes  06.06.2014 19:24:22
AEEXP.DLL      : 8.4.2.6      237760 Bytes  28.06.2014 14:37:27
AEEMU.DLL      : 8.1.3.2      393587 Bytes  25.02.2014 09:41:04
AEDROID.DLL    : 8.4.2.24      442568 Bytes  04.06.2014 14:03:32
AECORE.DLL    : 8.3.1.4      241864 Bytes  06.06.2014 19:24:22
AEBB.DLL      : 8.1.1.4        53619 Bytes  25.02.2014 09:41:04
AVWINLL.DLL    : 14.0.5.320    24144 Bytes  04.07.2014 01:14:20
AVPREF.DLL    : 14.0.5.320    50256 Bytes  04.07.2014 01:14:34
AVREP.DLL      : 14.0.5.320    219216 Bytes  04.07.2014 01:14:35
AVARKT.DLL    : 14.0.5.368    226384 Bytes  04.07.2014 01:14:24
AVEVTLOG.DLL  : 14.0.5.320    182352 Bytes  04.07.2014 01:14:28
SQLITE3.DLL    : 14.0.5.320    452176 Bytes  04.07.2014 01:15:51
AVSMTP.DLL    : 14.0.5.320    76368 Bytes  04.07.2014 01:14:40
NETNT.DLL      : 14.0.5.320    13392 Bytes  04.07.2014 01:15:37
RCIMAGE.DLL    : 14.0.5.320  4998224 Bytes  04.07.2014 01:14:20
RCTEXT.DLL    : 14.0.5.322    73808 Bytes  04.07.2014 01:14:20

Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Vollständige Systemprüfung
Konfigurationsdatei...................: C:\Program Files\Avira\AntiVir Desktop\sysscan.avp
Protokollierung.......................: standard
Primäre Aktion........................: Interaktiv
Sekundäre Aktion......................: Ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:,
Durchsuche aktive Programme...........: ein
Laufende Programme erweitert..........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: ein
Integritätsprüfung von Systemdateien..: ein
Prüfe alle Dateien....................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: erweitert

Beginn des Suchlaufs: Donnerstag, 17. Juli 2014  18:34

Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'HDD0(C:)'
    [INFO]      Es wurde kein Virus gefunden!

Der Suchlauf nach versteckten Objekten wird begonnen.

Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'SearchFilterHost.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchProtocolHost.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'vssvc.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '114' Modul(e) wurden durchsucht
Durchsuche Prozess 'avcenter.exe' - '113' Modul(e) wurden durchsucht
Durchsuche Prozess 'Citavi.exe' - '131' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '59' Modul(e) wurden durchsucht
Durchsuche Prozess 'soffice.bin' - '254' Modul(e) wurden durchsucht
Durchsuche Prozess 'soffice.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'swriter.exe' - '13' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskhost.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'AcroRd32.exe' - '92' Modul(e) wurden durchsucht
Durchsuche Prozess 'AcroRd32.exe' - '118' Modul(e) wurden durchsucht
Durchsuche Prozess 'FlashPlayerPlugin_14_0_0_145.exe' - '73' Modul(e) wurden durchsucht
Durchsuche Prozess 'FlashPlayerPlugin_14_0_0_145.exe' - '73' Modul(e) wurden durchsucht
Durchsuche Prozess 'plugin-container.exe' - '78' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmpnetwk.exe' - '119' Modul(e) wurden durchsucht
Durchsuche Prozess 'firefox.exe' - '174' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchIndexer.exe' - '59' Modul(e) wurden durchsucht
Durchsuche Prozess 'SYNTPHELPER.EXE' - '16' Modul(e) wurden durchsucht
Durchsuche Prozess 'VoipStunt.exe' - '109' Modul(e) wurden durchsucht
Durchsuche Prozess 'Bonus.ScreenshotReader.exe' - '122' Modul(e) wurden durchsucht
Durchsuche Prozess 'Kies.exe' - '86' Modul(e) wurden durchsucht
Durchsuche Prozess 'SynTPLpr.exe' - '20' Modul(e) wurden durchsucht
Durchsuche Prozess 'BTSync.exe' - '85' Modul(e) wurden durchsucht
Durchsuche Prozess 'KiesTrayAgent.exe' - '82' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '94' Modul(e) wurden durchsucht
Durchsuche Prozess 'igfxsrvc.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'SynTPEnh.exe' - '43' Modul(e) wurden durchsucht
Durchsuche Prozess 'igfxpers.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'hkcmd.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'igfxtray.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'smax4pnp.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'MotoHelperAgent.exe' - '97' Modul(e) wurden durchsucht
Durchsuche Prozess 'Explorer.EXE' - '212' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dwm.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskhost.exe' - '69' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'avshadow.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'xaudio.exe' - '17' Modul(e) wurden durchsucht
Durchsuche Prozess 'TeamViewer_Service.exe' - '106' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '44' Modul(e) wurden durchsucht
Durchsuche Prozess 'MotoHelperService.exe' - '60' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '62' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '112' Modul(e) wurden durchsucht
Durchsuche Prozess 'AEADISRV.EXE' - '16' Modul(e) wurden durchsucht
Durchsuche Prozess 'armsvc.exe' - '23' Modul(e) wurden durchsucht
Durchsuche Prozess 'NetworkLicenseServer.exe' - '43' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '67' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '56' Modul(e) wurden durchsucht
Durchsuche Prozess 'spoolsv.exe' - '88' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '79' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '38' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '158' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '87' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '122' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '97' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '52' Modul(e) wurden durchsucht
Durchsuche Prozess 'winlogon.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsm.exe' - '16' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsass.exe' - '65' Modul(e) wurden durchsucht
Durchsuche Prozess 'services.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'wininit.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'smss.exe' - '2' Modul(e) wurden durchsucht

Untersuchung der Systemdateien wird begonnen:
Signiert -> 'C:\Windows\system32\svchost.exe'
Signiert -> 'C:\Windows\system32\winlogon.exe'
Signiert -> 'C:\Windows\explorer.exe'
Signiert -> 'C:\Windows\system32\smss.exe'
Signiert -> 'C:\Windows\system32\wininet.DLL'
Signiert -> 'C:\Windows\system32\wsock32.DLL'
Signiert -> 'C:\Windows\system32\ws2_32.DLL'
Signiert -> 'C:\Windows\system32\services.exe'
Signiert -> 'C:\Windows\system32\lsass.exe'
Signiert -> 'C:\Windows\system32\csrss.exe'
Signiert -> 'C:\Windows\system32\drivers\kbdclass.sys'
Signiert -> 'C:\Windows\system32\spoolsv.exe'
Signiert -> 'C:\Windows\system32\alg.exe'
Signiert -> 'C:\Windows\system32\wuauclt.exe'
Signiert -> 'C:\Windows\system32\advapi32.DLL'
Signiert -> 'C:\Windows\system32\user32.DLL'
Signiert -> 'C:\Windows\system32\gdi32.DLL'
Signiert -> 'C:\Windows\system32\kernel32.DLL'
Signiert -> 'C:\Windows\system32\ntdll.DLL'
Signiert -> 'C:\Windows\system32\ntoskrnl.exe'
Signiert -> 'C:\Windows\system32\drivers\beep.sys'
Signiert -> 'C:\Windows\system32\ctfmon.exe'
Signiert -> 'C:\Windows\system32\imm32.dll'
Signiert -> 'C:\Windows\system32\dsound.dll'
Signiert -> 'C:\Windows\system32\aclui.dll'
Signiert -> 'C:\Windows\system32\msvcrt.dll'
Signiert -> 'C:\Windows\system32\d3d9.dll'
Signiert -> 'C:\Windows\system32\dnsapi.dll'
Signiert -> 'C:\Windows\system32\mshtml.dll'
Signiert -> 'C:\Windows\system32\regsvr32.exe'
Signiert -> 'C:\Windows\system32\rundll32.exe'
Signiert -> 'C:\Windows\system32\userinit.exe'
Signiert -> 'C:\Windows\system32\reg.exe'
Signiert -> 'C:\Windows\system32\ntvdm.exe'
Signiert -> 'C:\Windows\regedit.exe'
Die Systemdateien wurden durchsucht ('35' Dateien)

Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
Die Registry wurde durchsucht ( '1681' Dateien ).


Der Suchlauf über die ausgewählten Dateien wird begonnen:

Beginne mit der Suche in 'C:\'
    [0] Archivtyp: Runtime Packed
    --> C:\Users\Compiuta\AppData\Local\Temp\system_auto_.zip
        [1] Archivtyp: ZIP
      --> system_auto_.exe
          [FUND]      Ist das Trojanische Pferd TR/Crypt.ZPACK.82398
          [WARNUNG]  Infizierte Dateien in Archiven können nicht repariert werden
C:\Users\Compiuta\AppData\Local\Temp\system_auto_.zip
  [FUND]      Ist das Trojanische Pferd TR/Crypt.ZPACK.82398

Beginne mit der Desinfektion:
C:\Users\Compiuta\AppData\Local\Temp\system_auto_.zip
  [FUND]      Ist das Trojanische Pferd TR/Crypt.ZPACK.82398
  [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5122b0f3.qua' verschoben!


Ende des Suchlaufs: Donnerstag, 17. Juli 2014  20:17
Benötigte Zeit:  1:40:53 Stunde(n)

Der Suchlauf wurde vollständig durchgeführt.

  27045 Verzeichnisse wurden überprüft
 820272 Dateien wurden geprüft
      2 Viren bzw. unerwünschte Programme wurden gefunden
      0 Dateien wurden als verdächtig eingestuft
      0 Dateien wurden gelöscht
      0 Viren bzw. unerwünschte Programme wurden repariert
      1 Dateien wurden in die Quarantäne verschoben
      0 Dateien wurden umbenannt
      0 Dateien konnten nicht durchsucht werden
 820270 Dateien ohne Befall
  26639 Archive wurden durchsucht
      1 Warnungen
      1 Hinweise
 461809 Objekte wurden beim Rootkitscan durchsucht
      0 Versteckte Objekte wurden gefunden

Als nächstes kopiere ich den Log von defogger_disable:

Code:
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 13:18 on 03/08/2014 (Compiuta)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
Nun den Log von FRST:

Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:2-08-2014
Ran by Compiuta (administrator) on COMPIUTA-PC on 03-08-2014 15:55:36
Running from C:\Users\Compiuta\Downloads
Platform: Microsoft Windows 7 Professional  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(ABBYY) C:\Program Files\ABBYY PDF Transformer 3.0\NetworkLicenseServer.exe
(Andrea Electronics Corporation) C:\Windows\System32\AEADISRV.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
() C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe
(Conexant Systems, Inc.) C:\Windows\System32\drivers\XAudio.exe
() C:\Program Files\Motorola\MotoHelper\MotoHelperAgent.exe
(Analog Devices, Inc.) C:\Program Files\Analog Devices\Core\smax4pnp.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(BitTorrent, Inc.) C:\Program Files\BitTorrent Sync\BTSync.exe
(Samsung) C:\Program Files\Samsung\Kies\Kies.exe
(ABBYY) C:\Program Files\ABBYY PDF Transformer 3.0\Bonus.ScreenshotReader.exe
(VoipStunt) C:\Program Files\VoipStunt.com\VoipStunt\VoipStunt.exe
(Microsoft Corporation) C:\Windows\System32\wscript.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_14_0_0_145.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_14_0_0_145.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [BitTorrent Sync] => C:\Program Files\BitTorrent Sync\BTSync.exe [3020136 2014-06-27] (BitTorrent, Inc.)
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [20917408 2014-02-10] (Skype Technologies S.A.)
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [KiesPreload] => C:\Program Files\Samsung\Kies\Kies.exe [1563440 2014-06-14] (Samsung)
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [KiesAirMessage] => C:\Program Files\Samsung\Kies\KiesAirMessage.exe -startup
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [Google Update] => C:\Users\Compiuta\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2014-05-17] (Google Inc.)
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [ABBYY Screenshot Reader Bonus] => C:\Program Files\ABBYY PDF Transformer 3.0\Bonus.ScreenshotReader.exe [939272 2014-04-23] (ABBYY)
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [VoipStunt] => C:\Program Files\VoipStunt.com\VoipStunt\VoipStunt.exe [19768640 2014-02-11] (VoipStunt)
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [1c2b1] => C:\Users\Compiuta\AppData\Roaming\0a3\1c2b1.js [46974 2014-08-03] ()
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\MountPoints2: {0b5e766e-f299-11e3-bc74-00197de848f3} - E:\setup.exe -a
Startup: C:\Users\Compiuta\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4c69.js ()

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xECE210E7535DCF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
BHO: SwissAcademic.Citavi.Picker.IEPicker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Compiuta\AppData\Roaming\Mozilla\Firefox\Profiles\kpvwewrm.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin: @java.com/DTPlugin,version=10.65.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.65.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @talk.google.com/GoogleTalkPlugin - C:\Users\Compiuta\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin HKCU: @talk.google.com/O1DPlugin - C:\Users\Compiuta\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Compiuta\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Compiuta\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\Compiuta\AppData\Roaming\mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin ProgramFiles/Appdata: C:\Users\Compiuta\AppData\Roaming\mozilla\plugins\npo1d.dll (Google)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF HKLM\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2014-04-21]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 ABBYY.Licensing.PDFTransformer.Classic.3.0; C:\Program Files\ABBYY PDF Transformer 3.0\NetworkLicenseServer.exe [759048 2014-04-23] (ABBYY)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-07-04] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-07-04] (Avira Operations GmbH & Co. KG)
R2 MotoHelper; C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe [223088 2011-04-26] ()

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [97648 2014-07-04] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-05-27] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2014-02-25] (Avira Operations GmbH & Co. KG)
R3 e1express; C:\Windows\System32\DRIVERS\e1e6232.sys [232312 2012-10-30] (Intel Corporation)
R3 PSKMAD; C:\Windows\System32\DRIVERS\PSKMAD.sys [47632 2013-04-29] (Panda Security, S.L.)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2014-02-25] (Avira GmbH)

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-03 15:55 - 2014-08-03 15:56 - 00009656 _____ () C:\Users\Compiuta\Downloads\FRST.txt
2014-08-03 15:55 - 2014-08-03 15:55 - 00000000 ____D () C:\FRST
2014-08-03 15:50 - 2014-08-03 15:50 - 01084928 _____ (Farbar) C:\Users\Compiuta\Downloads\FRST.exe
2014-08-03 13:18 - 2014-08-03 13:18 - 00000478 _____ () C:\Users\Compiuta\Downloads\defogger_disable.log
2014-08-03 13:18 - 2014-08-03 13:18 - 00000000 _____ () C:\Users\Compiuta\defogger_reenable
2014-08-03 13:04 - 2014-08-03 13:04 - 00050477 _____ () C:\Users\Compiuta\Downloads\Defogger.exe
2014-08-03 10:57 - 2014-08-03 10:57 - 00001244 _____ () C:\Users\Public\Desktop\Panda Cloud Cleaner.lnk
2014-08-03 10:57 - 2014-08-03 10:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Security
2014-08-03 10:57 - 2014-08-03 10:57 - 00000000 ____D () C:\Program Files\Panda Security
2014-08-03 10:57 - 2013-04-29 09:17 - 00047632 _____ (Panda Security, S.L.) C:\Windows\system32\Drivers\PSKMAD.sys
2014-08-03 10:43 - 2014-08-03 10:43 - 30412088 _____ (Panda Security ) C:\Users\Compiuta\Downloads\PandaCloudCleaner.exe
2014-08-03 10:42 - 2014-05-14 18:23 - 01973728 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-08-03 10:42 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-08-03 10:42 - 2014-05-14 18:23 - 00054240 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-08-03 10:42 - 2014-05-14 18:23 - 00045536 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-08-03 10:42 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-08-03 10:42 - 2014-05-14 18:17 - 02425856 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-08-03 10:42 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-08-03 10:41 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-08-03 10:41 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-07-31 11:12 - 2014-07-31 11:12 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-07-24 15:56 - 2014-07-24 15:56 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Compiuta\Downloads\mbam-setup-2.0.2.1012.exe
2014-07-24 15:45 - 2014-07-24 15:45 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216(2).exe
2014-07-24 15:28 - 2014-07-24 15:28 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216(1).exe
2014-07-24 15:21 - 2014-07-24 15:21 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216.exe
2014-07-24 01:07 - 2014-07-24 01:07 - 00000000 __SHD () C:\Users\Compiuta\AppData\Roaming\0a3
2014-07-24 01:07 - 2014-07-24 01:07 - 00000000 __SHD () C:\0b64
2014-07-21 20:05 - 2014-07-21 20:05 - 00000000 ____D () C:\Users\Compiuta\Desktop\Neuer Ordner
2014-07-20 04:40 - 2014-07-20 04:46 - 00009008 _____ () C:\Users\Compiuta\AppData\Roaming\.freeciv-client-rc-2.4
2014-07-20 04:35 - 2014-07-20 04:42 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\.freeciv
2014-07-19 22:08 - 2014-07-19 22:26 - 00000000 ____D () C:\Users\Compiuta\Desktop\Neuer Ordner (2)
2014-07-19 22:07 - 2014-07-19 22:08 - 11861420 _____ () C:\Users\Compiuta\Downloads\Gmail(1).zip
2014-07-19 22:07 - 2014-07-19 22:08 - 11811633 _____ () C:\Users\Compiuta\Downloads\Gmail.zip
2014-07-19 21:50 - 2014-07-19 21:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Freeciv 2.4.2 (GTK+2 client)
2014-07-19 21:50 - 2014-07-19 21:50 - 00000000 ____D () C:\Program Files\Freeciv-2.4.2-gtk2
2014-07-19 20:56 - 2014-07-19 20:57 - 28215140 _____ () C:\Users\Compiuta\Downloads\Freeciv-2.4.2-win32-gtk2-setup.exe
2014-07-19 01:40 - 2014-07-24 15:57 - 00000000 ____D () C:\Users\Compiuta\Desktop\abog
2014-07-17 17:24 - 2014-07-17 17:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-07-17 17:24 - 2014-07-17 17:24 - 00000000 ____D () C:\Program Files\Common Files\Java
2014-07-17 17:24 - 2014-07-11 03:02 - 00096680 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-07-17 17:24 - 2014-07-11 02:56 - 00272808 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-07-17 17:24 - 2014-07-11 02:56 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-07-17 17:24 - 2014-07-11 02:55 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-07-14 19:55 - 2014-07-14 20:06 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\Audacity
2014-07-09 18:24 - 2014-06-20 21:39 - 00240824 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-07-09 18:24 - 2014-06-19 02:16 - 17276416 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-07-09 18:24 - 2014-06-19 01:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-07-09 18:24 - 2014-06-19 01:56 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-07-09 18:24 - 2014-06-19 01:38 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-07-09 18:24 - 2014-06-19 01:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-07-09 18:24 - 2014-06-19 01:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-07-09 18:24 - 2014-06-19 01:35 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-07-09 18:24 - 2014-06-19 01:32 - 02179072 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-07-09 18:24 - 2014-06-19 01:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-07-09 18:24 - 2014-06-19 01:28 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-07-09 18:24 - 2014-06-19 01:25 - 00442368 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-07-09 18:24 - 2014-06-19 01:23 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-07-09 18:24 - 2014-06-19 01:23 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-07-09 18:24 - 2014-06-19 01:22 - 00592896 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-07-09 18:24 - 2014-06-19 01:16 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-07-09 18:24 - 2014-06-19 01:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-07-09 18:24 - 2014-06-19 01:06 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-07-09 18:24 - 2014-06-19 01:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-07-09 18:24 - 2014-06-19 00:59 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-07-09 18:24 - 2014-06-19 00:58 - 00239616 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-07-09 18:24 - 2014-06-19 00:52 - 04254720 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-07-09 18:24 - 2014-06-19 00:52 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-07-09 18:24 - 2014-06-19 00:49 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-07-09 18:24 - 2014-06-19 00:46 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-07-09 18:24 - 2014-06-19 00:45 - 01964544 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-07-09 18:24 - 2014-06-19 00:35 - 11742208 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-07-09 18:24 - 2014-06-19 00:13 - 01791488 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-07-09 18:24 - 2014-06-19 00:09 - 01139200 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-07-09 18:24 - 2014-06-19 00:07 - 00704512 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-07-09 17:14 - 2014-06-05 16:26 - 01059840 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-07-09 17:02 - 2014-06-18 03:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2014-07-09 17:02 - 2014-06-18 02:52 - 02350080 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-07-09 17:02 - 2014-06-06 11:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-07-09 17:02 - 2014-05-30 08:36 - 00338944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-07-08 14:33 - 2014-07-08 14:33 - 00284564 _____ () C:\Windows\msxml4-KB954430-enu.LOG
2014-07-08 14:33 - 2014-07-08 14:33 - 00000000 ____D () C:\Program Files\MSXML 4.0
2014-07-08 14:32 - 2014-07-08 14:33 - 00291106 _____ () C:\Windows\msxml4-KB973688-enu.LOG
2014-07-06 23:19 - 2014-07-06 23:46 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\VoipStunt
2014-07-06 23:19 - 2014-07-06 23:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VoipStunt
2014-07-06 23:19 - 2014-07-06 23:19 - 00000000 ____D () C:\Program Files\VoipStunt.com
2014-07-06 23:17 - 2014-07-06 23:17 - 06569296 _____ (Finarea S.A. Switzerland ) C:\Users\Compiuta\Downloads\setupVoipStunt.exe
2014-07-06 19:43 - 2014-07-19 22:26 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\XnView
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_motusbdevice_01007.Wdf
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_Motousbnet_01007.Wdf
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_motmodem_01007.Wdf
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_motfilt_01007.Wdf
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_motccgpfl_01007.Wdf
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_motccgp_01007.Wdf
2014-07-06 19:08 - 2014-07-06 19:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Motorola
2014-07-06 19:08 - 2014-07-06 19:08 - 00000000 ____D () C:\Program Files\Motorola
2014-07-06 19:08 - 2014-07-06 19:08 - 00000000 ____D () C:\Program Files\Common Files\Motorola Shared
2014-07-06 18:51 - 2014-04-11 10:39 - 00184192 _____ (DEVGURU Co., LTD.(www.devguru.co.kr)) C:\Windows\system32\Drivers\ssudmdm.sys
2014-07-06 18:51 - 2014-04-11 10:39 - 00089856 _____ (DEVGURU Co., LTD.(www.devguru.co.kr)) C:\Windows\system32\Drivers\ssudbus.sys

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-03 15:56 - 2014-08-03 15:55 - 00009656 _____ () C:\Users\Compiuta\Downloads\FRST.txt
2014-08-03 15:55 - 2014-08-03 15:55 - 00000000 ____D () C:\FRST
2014-08-03 15:50 - 2014-08-03 15:50 - 01084928 _____ (Farbar) C:\Users\Compiuta\Downloads\FRST.exe
2014-08-03 15:49 - 2014-05-17 16:36 - 00001132 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4045813022-1567936593-3779010734-1000UA.job
2014-08-03 15:48 - 2014-04-29 21:30 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-08-03 15:48 - 2014-04-21 12:24 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\BitTorrent Sync
2014-08-03 15:48 - 2014-01-04 20:06 - 01138755 _____ () C:\Windows\WindowsUpdate.log
2014-08-03 13:18 - 2014-08-03 13:18 - 00000478 _____ () C:\Users\Compiuta\Downloads\defogger_disable.log
2014-08-03 13:18 - 2014-08-03 13:18 - 00000000 _____ () C:\Users\Compiuta\defogger_reenable
2014-08-03 13:18 - 2014-01-04 20:28 - 00000000 ____D () C:\Users\Compiuta
2014-08-03 13:04 - 2014-08-03 13:04 - 00050477 _____ () C:\Users\Compiuta\Downloads\Defogger.exe
2014-08-03 11:57 - 2010-11-20 23:01 - 01618320 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-08-03 11:40 - 2009-07-14 06:34 - 00022208 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-03 11:40 - 2009-07-14 06:34 - 00022208 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-03 11:00 - 2014-04-21 21:52 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\Skype
2014-08-03 10:59 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-03 10:59 - 2009-07-14 06:39 - 00040893 _____ () C:\Windows\setupact.log
2014-08-03 10:57 - 2014-08-03 10:57 - 00001244 _____ () C:\Users\Public\Desktop\Panda Cloud Cleaner.lnk
2014-08-03 10:57 - 2014-08-03 10:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Security
2014-08-03 10:57 - 2014-08-03 10:57 - 00000000 ____D () C:\Program Files\Panda Security
2014-08-03 10:55 - 2014-04-21 15:31 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-08-03 10:48 - 2010-11-20 23:48 - 00110668 _____ () C:\Windows\PFRO.log
2014-08-03 10:48 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-08-03 10:46 - 2014-05-17 16:36 - 00001080 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4045813022-1567936593-3779010734-1000Core.job
2014-08-03 10:43 - 2014-08-03 10:43 - 30412088 _____ (Panda Security ) C:\Users\Compiuta\Downloads\PandaCloudCleaner.exe
2014-07-31 15:53 - 2014-04-23 11:00 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\vlc
2014-07-31 11:12 - 2014-07-31 11:12 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-07-24 18:50 - 2014-04-21 17:30 - 00035848 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-07-24 15:57 - 2014-07-19 01:40 - 00000000 ____D () C:\Users\Compiuta\Desktop\abog
2014-07-24 15:56 - 2014-07-24 15:56 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Compiuta\Downloads\mbam-setup-2.0.2.1012.exe
2014-07-24 15:45 - 2014-07-24 15:45 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216(2).exe
2014-07-24 15:28 - 2014-07-24 15:28 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216(1).exe
2014-07-24 15:21 - 2014-07-24 15:21 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216.exe
2014-07-24 03:33 - 2014-04-20 19:34 - 00000000 ____D () C:\BtSync
2014-07-24 01:07 - 2014-07-24 01:07 - 00000000 __SHD () C:\Users\Compiuta\AppData\Roaming\0a3
2014-07-24 01:07 - 2014-07-24 01:07 - 00000000 __SHD () C:\0b64
2014-07-21 20:05 - 2014-07-21 20:05 - 00000000 ____D () C:\Users\Compiuta\Desktop\Neuer Ordner
2014-07-20 04:46 - 2014-07-20 04:40 - 00009008 _____ () C:\Users\Compiuta\AppData\Roaming\.freeciv-client-rc-2.4
2014-07-20 04:42 - 2014-07-20 04:35 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\.freeciv
2014-07-19 22:26 - 2014-07-19 22:08 - 00000000 ____D () C:\Users\Compiuta\Desktop\Neuer Ordner (2)
2014-07-19 22:26 - 2014-07-06 19:43 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\XnView
2014-07-19 22:13 - 2014-04-21 16:58 - 00000000 ____D () C:\Users\Compiuta\AppData\Local\Paint.NET
2014-07-19 22:09 - 2014-01-04 21:11 - 00000000 ____D () C:\Users\Compiuta\Desktop\Soundfiles
2014-07-19 22:08 - 2014-07-19 22:07 - 11861420 _____ () C:\Users\Compiuta\Downloads\Gmail(1).zip
2014-07-19 22:08 - 2014-07-19 22:07 - 11811633 _____ () C:\Users\Compiuta\Downloads\Gmail.zip
2014-07-19 21:50 - 2014-07-19 21:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Freeciv 2.4.2 (GTK+2 client)
2014-07-19 21:50 - 2014-07-19 21:50 - 00000000 ____D () C:\Program Files\Freeciv-2.4.2-gtk2
2014-07-19 20:57 - 2014-07-19 20:56 - 28215140 _____ () C:\Users\Compiuta\Downloads\Freeciv-2.4.2-win32-gtk2-setup.exe
2014-07-18 18:03 - 2014-06-13 03:24 - 00000000 ____D () C:\Users\Compiuta\AppData\Local\Adobe
2014-07-17 17:24 - 2014-07-17 17:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-07-17 17:24 - 2014-07-17 17:24 - 00000000 ____D () C:\Program Files\Common Files\Java
2014-07-17 17:24 - 2014-05-02 10:24 - 00000000 ____D () C:\ProgramData\Oracle
2014-07-17 17:24 - 2014-05-02 10:24 - 00000000 ____D () C:\Program Files\Java
2014-07-15 15:54 - 2014-04-21 21:39 - 00000000 ____D () C:\Windows\system32\MRT
2014-07-15 15:52 - 2014-04-21 21:39 - 93585272 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-07-15 02:55 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2014-07-14 22:33 - 2014-06-03 23:45 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\FileZilla
2014-07-14 20:12 - 2014-06-03 23:45 - 04996210 _____ (Tim Kosse) C:\Users\Compiuta\Downloads\FileZilla_3.8.1_win32-setup.exe
2014-07-14 20:12 - 2014-04-21 15:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client
2014-07-14 20:12 - 2014-04-21 15:41 - 00000000 ____D () C:\Program Files\FileZilla FTP Client
2014-07-14 20:06 - 2014-07-14 19:55 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\Audacity
2014-07-14 06:12 - 2014-04-27 14:19 - 00000000 ____D () C:\Users\1
2014-07-12 05:40 - 2014-01-04 20:58 - 00000000 ____D () C:\Users\Compiuta\Desktop\Flugtickets
2014-07-11 03:02 - 2014-07-17 17:24 - 00096680 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-07-11 02:56 - 2014-07-17 17:24 - 00272808 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-07-11 02:56 - 2014-07-17 17:24 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-07-11 02:55 - 2014-07-17 17:24 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-07-10 01:18 - 2010-11-21 02:55 - 00000000 ____D () C:\Program Files\Windows Journal
2014-07-10 01:18 - 2009-07-14 06:33 - 00324032 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-07-09 01:59 - 2014-04-29 21:30 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-07-09 01:59 - 2014-04-29 21:30 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-07-08 14:33 - 2014-07-08 14:33 - 00284564 _____ () C:\Windows\msxml4-KB954430-enu.LOG
2014-07-08 14:33 - 2014-07-08 14:33 - 00000000 ____D () C:\Program Files\MSXML 4.0
2014-07-08 14:33 - 2014-07-08 14:32 - 00291106 _____ () C:\Windows\msxml4-KB973688-enu.LOG
2014-07-06 23:46 - 2014-07-06 23:19 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\VoipStunt
2014-07-06 23:19 - 2014-07-06 23:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VoipStunt
2014-07-06 23:19 - 2014-07-06 23:19 - 00000000 ____D () C:\Program Files\VoipStunt.com
2014-07-06 23:17 - 2014-07-06 23:17 - 06569296 _____ (Finarea S.A. Switzerland ) C:\Users\Compiuta\Downloads\setupVoipStunt.exe
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_motusbdevice_01007.Wdf
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_Motousbnet_01007.Wdf
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_motmodem_01007.Wdf
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_motfilt_01007.Wdf
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_motccgpfl_01007.Wdf
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_motccgp_01007.Wdf
2014-07-06 19:09 - 2014-01-04 20:28 - 00000000 ____D () C:\Users\Compiuta\AppData\Local\VirtualStore
2014-07-06 19:08 - 2014-07-06 19:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Motorola
2014-07-06 19:08 - 2014-07-06 19:08 - 00000000 ____D () C:\Program Files\Motorola
2014-07-06 19:08 - 2014-07-06 19:08 - 00000000 ____D () C:\Program Files\Common Files\Motorola Shared
2014-07-04 03:14 - 2014-04-21 17:20 - 00097648 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys

Some content of TEMP:
====================
C:\Users\1\AppData\Local\Temp\avgnt.exe
C:\Users\1\AppData\Local\Temp\fp_pl_pfs_installer-1.exe
C:\Users\1\AppData\Local\Temp\fp_pl_pfs_installer-2.exe
C:\Users\1\AppData\Local\Temp\fp_pl_pfs_installer.exe
C:\Users\Compiuta\AppData\Local\Temp\avgnt.exe
C:\Users\Compiuta\AppData\Local\Temp\jre-7u65-windows-i586-iftw.exe
C:\Users\Compiuta\AppData\Local\Temp\MotoHelper_2.0.51_Driver_5.2.0.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-07-15 01:40

==================== End Of Log ============================
Nun die von FRST erstellte Addition Log:

Code:
Additional scan result of Farbar Recovery Scan Tool (x86) Version:2-08-2014
Ran by Compiuta at 2014-08-03 15:56:26
Running from C:\Users\Compiuta\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

ABBYY PDF Transformer 3.0 (HKLM\...\ABBYY PDF Transformer 3.0) (Version: 3.00.162.6808 - ABBYY)
ABBYY PDF Transformer 3.0 (Version: 3.00.162.6808 - ABBYY) Hidden
Adobe Flash Player 14 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.07) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.07 - Adobe Systems Incorporated)
Audacity 2.0.5 (HKLM\...\Audacity_is1) (Version: 2.0.5 - Audacity Team)
Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 14.0.5.464 - Avira)
BitTorrent Sync (HKLM\...\BitTorrent Sync) (Version: 1.3.93 - )
CDBurnerXP (HKLM\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.3.4643 - CDBurnerXP)
Citavi (HKLM\...\{E12C6653-1FF0-4686-ADB8-589C13AE761F}) (Version: 3.3.0.0 - Swiss Academic Software)
FileZilla Client 3.8.1 (HKLM\...\FileZilla Client) (Version: 3.8.1 - Tim Kosse)
Freeciv 2.4.2 (GTK+2 client) (HKLM\...\Freeciv-2.4.2-gtk2) (Version:  - )
Google Talk Plugin (HKLM\...\{C1E3DFE7-4EAD-3E9E-A826-E06055BA5921}) (Version: 5.4.2.18903 - Google)
Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: 8.15.10.1867 - Intel Corporation)
Java 7 Update 65 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217055FF}) (Version: 7.0.650 - Oracle)
Java Auto Updater (Version: 2.1.65.20 - Oracle, Inc.) Hidden
LibreOffice 4.2.3.3 (HKLM\...\{4117DF3C-6677-4A22-90B7-FF06923417E9}) (Version: 4.2.3.3 - The Document Foundation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
MotoHelper 2.0.51 Driver 5.2.0 (HKLM\...\MotoHelper) (Version: 2.0.51 - Motorola)
MotoHelper MergeModules (Version: 1.2.0 - Motorola) Hidden
Motorola Mobile Drivers Installation 5.2.0 (Version: 5.2.0 - Motorola Inc.) Hidden
Mozilla Firefox 31.0 (x86 de) (HKLM\...\Mozilla Firefox 31.0 (x86 de)) (Version: 31.0 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MyFreeCodec (HKCU\...\MyFreeCodec) (Version:  - )
Paint.NET v3.5.11 (HKLM\...\{72EF03F5-0507-4861-9A44-D99FD4C41417}) (Version: 3.61.0 - dotPDN LLC)
Panda Cloud Cleaner (HKLM\...\{92B2B132-C7F0-43DC-921A-4493C04F78A4}_is1) (Version: 1.0.103 - Panda Security)
Samsung Kies (HKLM\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.6.2.14014_7 - Samsung Electronics Co., Ltd.)
Samsung Kies (Version: 2.6.2.14014_7 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.43.0 - SAMSUNG Electronics Co., Ltd.)
Skype™ 6.14 (HKLM\...\{1845470B-EB14-4ABC-835B-E36C693DC07D}) (Version: 6.14.104 - Skype Technologies S.A.)
TeamViewer 9 (HKLM\...\TeamViewer 9) (Version: 9.0.27614 - TeamViewer)
ThinkPad Modem (HKLM\...\CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFA&SUBSYS_10140588) (Version: 7.62.00 - )
ThinkPad UltraNav Driver (HKLM\...\SynTPDeinstKey) (Version: 16.2.19.7 - )
VLC media player 2.1.3 (HKLM\...\VLC media player) (Version: 2.1.3 - VideoLAN)
VoipStunt (HKLM\...\VoipStunt_is1) (Version: 4.14 build 745 - Finarea S.A. Switzerland)
XnView 2.22 (HKLM\...\XnView_is1) (Version: 2.22 - Gougelet Pierre-e)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-4045813022-1567936593-3779010734-1000_Classes\CLSID\{022105BD-948A-40C9-AB42-A3300DDF097F}\localserver32 -> C:\Users\Compiuta\AppData\Local\Google\Update\GoogleUpdate.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-4045813022-1567936593-3779010734-1000_Classes\CLSID\{22181302-A8A6-4F84-A541-E5CBFC70CC43}\localserver32 -> C:\Users\Compiuta\AppData\Local\Google\Update\1.3.24.15\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-4045813022-1567936593-3779010734-1000_Classes\CLSID\{2F0E2680-9FF5-43C0-B76E-114A56E93598}\localserver32 -> C:\Users\Compiuta\AppData\Local\Google\Update\1.3.24.15\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-4045813022-1567936593-3779010734-1000_Classes\CLSID\{39125640-8D80-11DC-A2FE-C5C455D89593}\InprocServer32 -> C:\Users\Compiuta\AppData\Local\Google\Google Talk Plugin\googletalkax.dll (Google)
CustomCLSID: HKU\S-1-5-21-4045813022-1567936593-3779010734-1000_Classes\CLSID\{51F9E8EF-59D7-475B-A106-C7EA6F30C119}\localserver32 -> C:\Users\Compiuta\AppData\Local\Google\Update\1.3.24.15\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-4045813022-1567936593-3779010734-1000_Classes\CLSID\{6B148769-693E-2428-2817-00DCDC203B60}\InprocServer32 -> C:\Windows\system32\ole32.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-4045813022-1567936593-3779010734-1000_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Users\Compiuta\AppData\Local\Google\Update\1.3.24.15\psuser.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-4045813022-1567936593-3779010734-1000_Classes\CLSID\{AB9F4455-E591-4132-A386-0B91EAEDB96C}\InprocServer32 -> C:\Users\Compiuta\AppData\Local\Google\Google Talk Plugin\o1dax.dll (Google)
CustomCLSID: HKU\S-1-5-21-4045813022-1567936593-3779010734-1000_Classes\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\InprocServer32 -> C:\Users\Compiuta\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-4045813022-1567936593-3779010734-1000_Classes\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\InprocServer32 -> C:\Users\Compiuta\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-4045813022-1567936593-3779010734-1000_Classes\CLSID\{E67BE843-BBBE-4484-95FB-05271AE86750}\localserver32 -> C:\Users\Compiuta\AppData\Local\Google\Update\1.3.24.15\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-4045813022-1567936593-3779010734-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Compiuta\AppData\Local\Google\Update\1.3.24.15\psuser.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-4045813022-1567936593-3779010734-1000_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\Compiuta\AppData\Local\Google\Update\1.3.24.7\psuser.dll No File

==================== Restore Points  =========================

15-07-2014 13:52:31 Windows Update
17-07-2014 15:23:44 Installed Java 7 Update 65
03-08-2014 08:41:39 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:04 - 2009-06-10 23:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {36BF9DA8-82B6-4A1F-99EC-9DCA66BD2149} - System32\Tasks\MotoHelper Routing => C:\Program Files\Motorola\MotoHelper\MotoHelperUpdate.exe [2011-04-26] ()
Task: {5EC7BDEC-B42F-4C73-96E4-936A6FB8EBA6} - System32\Tasks\MotoHelper Update => C:\Program Files\Motorola\MotoHelper\MotoHelperUpdate.exe [2011-04-26] ()
Task: {8D8A696C-4AD5-4F11-8B4B-32055B056A69} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-09] (Adobe Systems Incorporated)
Task: {950AD6BA-35F6-4F17-A700-75738312D2C3} - System32\Tasks\MotoHelper MUM => C:\Program Files\Motorola\MotoHelper\MotoHelperUpdate.exe [2011-04-26] ()
Task: {AACF1C90-959A-4E11-96EE-E1F5B2B31584} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-4045813022-1567936593-3779010734-1000Core => C:\Users\Compiuta\AppData\Local\Google\Update\GoogleUpdate.exe [2014-05-17] (Google Inc.)
Task: {D11F31FB-2B10-48FD-84BE-737E56A6E8B9} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-4045813022-1567936593-3779010734-1000UA => C:\Users\Compiuta\AppData\Local\Google\Update\GoogleUpdate.exe [2014-05-17] (Google Inc.)
Task: {D8822A8C-86CE-4D92-AA83-274EC1461347} - System32\Tasks\{922E80DD-2C1B-4E99-8118-0EBFF0B2DEBF} => C:\Program Files\Panda Security\Panda Cloud Cleaner\PCloudCleaner.exe [2014-03-07] ()
Task: {F580DC84-6D40-4B65-9418-D31E3156F9A8} - System32\Tasks\MotoHelper Initial Update => C:\Program Files\Motorola\MotoHelper\MotoHelperUpdate.exe [2011-04-26] ()

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4045813022-1567936593-3779010734-1000Core.job => C:\Users\Compiuta\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4045813022-1567936593-3779010734-1000UA.job => C:\Users\Compiuta\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2011-04-26 22:23 - 2011-04-26 22:23 - 00223088 _____ () C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe
2014-06-01 11:08 - 2014-06-01 11:08 - 00035328 _____ () C:\Program Files\FileZilla FTP Client\fzshellext.dll
2014-05-24 18:41 - 2014-05-24 18:41 - 00091648 _____ () C:\Program Files\FileZilla FTP Client\libgcc_s_sjlj-1.dll
2014-05-24 18:41 - 2014-05-24 18:41 - 00892416 _____ () C:\Program Files\FileZilla FTP Client\libstdc++-6.dll
2011-04-26 22:22 - 2011-04-26 22:22 - 00681840 _____ () C:\Program Files\Motorola\MotoHelper\MotoHelperAgent.exe
2014-06-29 19:50 - 2014-06-29 19:50 - 00186368 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\Kies.Commonc65c5a95#\75cd8ee7e3164f7b18c76a2c7668b2d0\Kies.Common.DeviceServiceLib.Interface.ni.dll
2014-06-29 19:51 - 2014-06-29 19:51 - 14993920 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\Kies.Theme\e6f83b1e807b714f177c5cc236b100fa\Kies.Theme.ni.dll
2014-06-29 19:50 - 2014-06-29 19:50 - 01865728 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\Kies.UI\f901a89aaacd0658db1b88188f5b1df6\Kies.UI.ni.dll
2014-06-29 19:50 - 2014-06-29 19:50 - 00081920 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\Kies.MVVM\ea6f79f5bd31f9e22b4fff87d4f39050\Kies.MVVM.ni.dll
2014-05-09 17:39 - 2014-05-09 17:39 - 00236032 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\ASF_cSharpAPI\cffeb31975c17760187d713cf2d7934d\ASF_cSharpAPI.ni.dll
2014-07-31 11:12 - 2014-07-31 11:12 - 03800688 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
2014-07-09 01:59 - 2014-07-09 01:59 - 17029808 _____ () C:\Windows\system32\Macromed\Flash\NPSWF32_14_0_0_145.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


==================== Faulty Device Manager Devices =============

Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (08/03/2014 11:01:43 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/03/2014 10:57:13 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/03/2014 10:50:05 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/26/2014 06:33:08 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 30.0.0.5269, Zeitstempel: 0x53914233
Name des fehlerhaften Moduls: mozalloc.dll, Version: 30.0.0.5269, Zeitstempel: 0x53911393
Ausnahmecode: 0x80000003
Fehleroffset: 0x0000141b
ID des fehlerhaften Prozesses: 0xf4c
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3

Error: (07/24/2014 04:39:08 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/20/2014 10:02:13 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 30.0.0.5269, Zeitstempel: 0x53914233
Name des fehlerhaften Moduls: mozalloc.dll, Version: 30.0.0.5269, Zeitstempel: 0x53911393
Ausnahmecode: 0x80000003
Fehleroffset: 0x0000141b
ID des fehlerhaften Prozesses: 0x98c
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3

Error: (07/15/2014 03:01:28 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: GoogleUpdate.exe, Version: 1.3.21.103, Zeitstempel: 0x4f3c6d6c
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea91c
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00058dfb
ID des fehlerhaften Prozesses: 0x1bb8
Startzeit der fehlerhaften Anwendung: 0xGoogleUpdate.exe0
Pfad der fehlerhaften Anwendung: GoogleUpdate.exe1
Pfad des fehlerhaften Moduls: GoogleUpdate.exe2
Berichtskennung: GoogleUpdate.exe3

Error: (07/13/2014 03:26:48 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: GoogleUpdate.exe, Version: 1.3.21.103, Zeitstempel: 0x4f3c6d6c
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea91c
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00058dfb
ID des fehlerhaften Prozesses: 0x2a8
Startzeit der fehlerhaften Anwendung: 0xGoogleUpdate.exe0
Pfad der fehlerhaften Anwendung: GoogleUpdate.exe1
Pfad des fehlerhaften Moduls: GoogleUpdate.exe2
Berichtskennung: GoogleUpdate.exe3

Error: (07/10/2014 01:20:27 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/26/2014 01:07:06 AM) (Source: ESENT) (EventID: 623) (User: )
Description: wuaueng.dll (864) SUS20ClientDataStore: Der Versionsspeicher für Instanz 0 hat seine maximale Größe von 32 MB erreicht. Wahrscheinlich verhindert eine lange andauernde Transaktion die Bereinigung des Versionsspeichers und vergrößert ihn. Aktualisierungen werden zurückgewiesen, bis für die betreffende Transaktion ein vollständiger Commit- oder Rollbackvorgang durchgeführt wurde.

Mögliche lange andauernde Transaktion:

        Sitzungs-ID: 0x01040320

        Sitzungskontext: 0x00000000

        Thread-ID des Sitzungskontextes: 0x00000CBC

        Cleanup: 1


System errors:
=============
Error: (08/03/2014 01:17:51 PM) (Source: Disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.

Error: (08/03/2014 01:17:50 PM) (Source: Disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.

Error: (08/03/2014 01:17:50 PM) (Source: Disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.

Error: (08/03/2014 01:17:49 PM) (Source: Disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.

Error: (07/31/2014 10:28:25 AM) (Source: Server) (EventID: 2505) (User: )
Description: Aufgrund eines doppelten Netzwerknamens konnte zu der Transportschicht \Device\NetBT_Tcpip_{42DD7035-F2BF-43DD-BD2C-B38497880A6A} vom Serverdienst nicht gebunden werden. Der Serverdienst konnte nicht gestartet werden.

Error: (07/29/2014 05:08:17 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst TeamViewer9 erreicht.

Error: (07/28/2014 04:35:21 PM) (Source: Server) (EventID: 2505) (User: )
Description: Aufgrund eines doppelten Netzwerknamens konnte zu der Transportschicht \Device\NetBT_Tcpip_{42DD7035-F2BF-43DD-BD2C-B38497880A6A} vom Serverdienst nicht gebunden werden. Der Serverdienst konnte nicht gestartet werden.

Error: (07/28/2014 02:50:26 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst AntiVirSchedulerService erreicht.

Error: (07/21/2014 03:55:30 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst Wlansvc erreicht.

Error: (07/07/2014 04:31:31 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst Wlansvc erreicht.


Microsoft Office Sessions:
=========================
Error: (08/03/2014 11:01:43 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/03/2014 10:57:13 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/03/2014 10:50:05 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/26/2014 06:33:08 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe30.0.0.526953914233mozalloc.dll30.0.0.526953911393800000030000141bf4c01cfa87fa56174afC:\Program Files\Mozilla Firefox\plugin-container.exeC:\Program Files\Mozilla Firefox\mozalloc.dll86035f2c-14e2-11e4-8b0a-00197de848f3

Error: (07/24/2014 04:39:08 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/20/2014 10:02:13 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe30.0.0.526953914233mozalloc.dll30.0.0.526953911393800000030000141b98c01cf9bcc878614d5C:\Program Files\Mozilla Firefox\plugin-container.exeC:\Program Files\Mozilla Firefox\mozalloc.dllbcf6543a-1048-11e4-b876-00197de848f3

Error: (07/15/2014 03:01:28 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: GoogleUpdate.exe1.3.21.1034f3c6d6cntdll.dll6.1.7601.18247521ea91cc000000500058dfb1bb801cf9fc7731db24dC:\Users\Compiuta\AppData\Local\Google\Update\GoogleUpdate.exeC:\Windows\SYSTEM32\ntdll.dll8cf8495b-0bbb-11e4-b876-00197de848f3

Error: (07/13/2014 03:26:48 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: GoogleUpdate.exe1.3.21.1034f3c6d6cntdll.dll6.1.7601.18247521ea91cc000000500058dfb2a801cf9e386340bdabC:\Users\Compiuta\AppData\Local\Google\Update\GoogleUpdate.exeC:\Windows\SYSTEM32\ntdll.dllc1904e49-0a2c-11e4-b876-00197de848f3

Error: (07/10/2014 01:20:27 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/26/2014 01:07:06 AM) (Source: ESENT) (EventID: 623) (User: )
Description: wuaueng.dll864SUS20ClientDataStore: 0320x010403200x000000000x00000CBC1


==================== Memory info ===========================

Percentage of memory in use: 47%
Total physical RAM: 2550.43 MB
Available physical RAM: 1344.64 MB
Total Pagefile: 5099.15 MB
Available Pagefile: 3783.18 MB
Total Virtual: 2047.88 MB
Available Virtual: 1917.01 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:111.79 GB) (Free:23.51 GB) NTFS ==>[Drive with boot components (obtained from BCD)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 112 GB) (Disk ID: 3F673AB5)
Partition 1: (Active) - (Size=112 GB) - (Type=07 NTFS)

==================== End Of Log ============================
Und nun kopiere ich den Log von GMER. Hierbei muss ich anmerken, dass ich GMER nur aus dem abgesicherten Modus starten konnte, da das Programm im normalen Modus (bei ausgeschaltetem Avira) trotz doppelklick nicht startete bzw. sich automatisch sofort wieder beendete. Etwas ähnliches ist passiert als ich vor ein paar Tagen Malwarebytes und Adwcleaner und pandacloudcleaner laufen lassen wollte. Keines dieser Programma konnte ich im normalmodus starten (jedoch habe ich im Gegensatz zu GMER auch keines im agesicherten Modus gestartet). Hier also nun der Log von GMER aus dem abgesicherten Modus:

Code:
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-08-03 18:07:19
Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 Samsung_SSD_840_Series rev.DXT07B0Q 111,79GB
Running: Gmer-19357.exe; Driver: C:\Users\Compiuta\AppData\Local\Temp\pfryrkoc.sys


---- Kernel code sections - GMER 2.1 ----

.text  ntkrnlpa.exe!ZwRollbackEnlistment + 142D                                                        81E8DA15 1 Byte  [06]
.text  ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                                          81EC7212 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}

---- Registry - GMER 2.1 ----

Reg    HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\00197de848f3                     
Reg    HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\00197de848f3 (not active ControlSet) 

---- EOF - GMER 2.1 ----

Ich hoffe ich habe soweit alles richtig gemacht und würde mich wahnsinnig über Hilfe freuen, da ich mit meinen Computerkenntnissen an dieser Stelle nicht weiter weiß.

Im Prinzip befürchte ich, dass es die beste Lösung sein wird den Computer zu formatieren. Da jedoch Dateien von meinen USB-Sticks verschwunden sind, sehe ich beim jetzigen Zustand des Computers nicht einmal wirklich sichere Möglichkeiten wichtige Dateien zu sichern, weswegen eine Behebung des Problems vorerst ohne Formatieren sehr wichtig wäre. Zudem wäre es natürlich wichtig für mich zu wissen, welche gefahren von dem Trojaner/Virus ausgehen, so dass ich mich gegebenfalls mit meiner Bank und so weiter in Verbindung setze.

Vielen Dank schonmal!!!
LG
Fred

schrauber 03.08.2014 17:48
hi,

http://www.filepony.de/icon/panda_usb_vaccine.png Panda USB Vaccine

Bitte lade Dir von hier Panda USB Vaccine herunter.


Scan mit Combofix
WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link
  • WICHTIG: Speichere Combofix auf deinem Desktop.
  • Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
  • Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
  • Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
  • Wenn Combofix fertig ist, wird es ein Logfile erstellen.
  • Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).
Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Freiseflei 03.08.2014 19:20
Hi,

vielen, vielen Dank für die schnelle Antwort!

Ich werde mich gleich dranklemmen. Es könnte ein paar Minuten dauern, bis ich die beschriebenen Aktionen durchführen kann, da auch Panda USB Vaccine sich im Normalmodus nicht starten lässt (und ich befürchte dies wird auch für Combofix zutreffen).

Soll ich beide im abgesicherten Modus Starten?

LG
Fred

Hi,

also jetzt habe ich meinen Computer wie beschrieben mit Panda USB Vaccine geimpft und den Scan mit Combofix laufen lassen. Beide Prozesse habe ich im abgesicherten Modus laufen lassen.

Hier poste ich nun den Log von Combofix:

Code:
ComboFix 14-08-02.02 - Compiuta 03.08.2014  20:07:12.1.2 - x86 MINIMAL
Microsoft Windows 7 Professional  6.1.7601.1.1252.49.1031.18.2550.2200 [GMT 2:00]
ausgeführt von:: c:\users\Compiuta\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
SP: Avira Desktop *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Compiuta\AppData\Roaming\0a3
c:\users\Compiuta\AppData\Roaming\0a3\1c2b1.js
.
.
(((((((((((((((((((((((  Dateien erstellt von 2014-07-03 bis 2014-08-03  ))))))))))))))))))))))))))))))
.
.
2014-08-03 18:04 . 2014-08-03 18:04        --------        d-----w-        c:\programdata\Panda Security
2014-08-03 18:03 . 2014-08-03 18:03        --------        d-----w-        c:\program files\Panda USB Vaccine
2014-08-03 18:01 . 2014-08-03 18:01        46974        ----a-w-        c:\users\Compiuta\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\496a.js
2014-08-03 17:00 . 2014-08-03 17:59        46974        ----a-w-        c:\users\Compiuta\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\406.js
2014-08-03 13:55 . 2014-08-03 13:57        --------        d-----w-        C:\FRST
2014-08-03 08:57 . 2013-04-29 07:17        47632        ----a-w-        c:\windows\system32\drivers\PSKMAD.sys
2014-08-03 08:57 . 2014-08-03 08:57        --------        d-----w-        c:\program files\Panda Security
2014-08-03 08:42 . 2014-05-14 16:23        45536        ----a-w-        c:\windows\system32\wups2.dll
2014-08-03 08:42 . 2014-05-14 16:23        54240        ----a-w-        c:\windows\system32\wuauclt.exe
2014-08-03 08:42 . 2014-05-14 16:23        1973728        ----a-w-        c:\windows\system32\wuaueng.dll
2014-08-03 08:42 . 2014-05-14 16:17        2425856        ----a-w-        c:\windows\system32\wucltux.dll
2014-08-03 08:42 . 2014-05-14 16:23        36320        ----a-w-        c:\windows\system32\wups.dll
2014-08-03 08:42 . 2014-05-14 16:23        581600        ----a-w-        c:\windows\system32\wuapi.dll
2014-08-03 08:42 . 2014-05-14 16:17        92672        ----a-w-        c:\windows\system32\wudriver.dll
2014-08-03 08:41 . 2014-05-14 07:23        179656        ----a-w-        c:\windows\system32\wuwebv.dll
2014-08-03 08:41 . 2014-05-14 07:17        33792        ----a-w-        c:\windows\system32\wuapp.exe
2014-07-31 09:32 . 2009-06-22 16:58        89600        ----a-w-        c:\windows\system32\Spool\prtprocs\w32x86\HPZPPLHN.DLL
2014-07-23 23:07 . 2014-07-23 23:07        --------        d-----w-        C:\0b64
2014-07-20 02:35 . 2014-07-20 02:42        --------        d-----w-        c:\users\Compiuta\AppData\Roaming\.freeciv
2014-07-19 19:50 . 2014-07-19 19:50        --------        d-----w-        c:\program files\Freeciv-2.4.2-gtk2
2014-07-17 15:24 . 2014-07-17 15:24        --------        d-----w-        c:\program files\Common Files\Java
2014-07-17 15:24 . 2014-07-11 01:02        96680        ----a-w-        c:\windows\system32\WindowsAccessBridge.dll
2014-07-14 17:55 . 2014-07-14 18:06        --------        d-----w-        c:\users\Compiuta\AppData\Roaming\Audacity
2014-07-09 15:19 . 2014-06-03 09:29        1221632        ----a-w-        c:\program files\Windows Journal\NBDoc.DLL
2014-07-09 15:19 . 2014-06-03 09:29        969216        ----a-w-        c:\program files\Windows Journal\JNWDRV.dll
2014-07-09 15:19 . 2014-06-03 09:29        936960        ----a-w-        c:\program files\Common Files\Microsoft Shared\ink\journal.dll
2014-07-09 15:19 . 2014-06-03 09:29        989184        ----a-w-        c:\program files\Windows Journal\JNTFiltr.dll
2014-07-09 15:14 . 2014-06-05 14:26        1059840        ----a-w-        c:\windows\system32\lsasrv.dll
2014-07-09 15:02 . 2014-06-18 01:52        868864        ----a-w-        c:\program files\Common Files\Microsoft Shared\ink\tipskins.dll
2014-07-09 15:02 . 2014-06-18 01:52        399360        ----a-w-        c:\program files\Common Files\Microsoft Shared\ink\tabskb.dll
2014-07-09 15:02 . 2014-06-18 01:52        348672        ----a-w-        c:\program files\Common Files\Microsoft Shared\ink\tiptsf.dll
2014-07-09 15:02 . 2014-06-18 01:52        104448        ----a-w-        c:\program files\Common Files\Microsoft Shared\ink\TipBand.dll
2014-07-09 15:02 . 2014-06-18 01:51        181760        ----a-w-        c:\program files\Common Files\Microsoft Shared\ink\TabTip.exe
2014-07-09 15:02 . 2014-06-18 01:51        646144        ----a-w-        c:\windows\system32\osk.exe
2014-07-09 15:02 . 2014-06-18 01:50        544768        ----a-w-        c:\program files\Common Files\Microsoft Shared\ink\TipRes.dll
2014-07-09 15:02 . 2014-06-18 00:52        2350080        ----a-w-        c:\windows\system32\win32k.sys
2014-07-09 15:02 . 2014-06-06 09:44        509440        ----a-w-        c:\windows\system32\qedit.dll
2014-07-09 15:02 . 2014-05-30 06:36        338944        ----a-w-        c:\windows\system32\drivers\afd.sys
2014-07-08 12:33 . 2014-07-08 12:33        --------        d-----w-        c:\program files\MSXML 4.0
2014-07-06 21:19 . 2014-07-06 21:46        --------        d-----w-        c:\users\Compiuta\AppData\Roaming\VoipStunt
2014-07-06 21:19 . 2014-07-06 21:19        --------        d-----w-        c:\program files\VoipStunt.com
2014-07-06 17:43 . 2014-07-19 20:26        --------        d-----w-        c:\users\Compiuta\AppData\Roaming\XnView
2014-07-06 17:08 . 2014-07-06 17:08        --------        d-----w-        c:\program files\Common Files\Motorola Shared
2014-07-06 17:08 . 2014-07-06 17:08        --------        d-----w-        c:\program files\Motorola
2014-07-06 16:51 . 2014-04-11 08:39        89856        ----a-w-        c:\windows\system32\drivers\ssudbus.sys
2014-07-06 16:51 . 2014-04-11 08:39        184192        ----a-w-        c:\windows\system32\drivers\ssudmdm.sys
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-07-24 16:50 . 2014-04-21 15:30        35848        ----a-w-        c:\windows\system32\drivers\avnetflt.sys
2014-07-08 23:59 . 2014-04-29 19:30        71344        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2014-07-08 23:59 . 2014-04-29 19:30        699056        ----a-w-        c:\windows\system32\FlashPlayerApp.exe
2014-07-04 01:14 . 2014-04-21 15:20        97648        ----a-w-        c:\windows\system32\drivers\avgntflt.sys
2014-05-27 12:55 . 2014-04-21 15:20        136216        ----a-w-        c:\windows\system32\drivers\avipbb.sys
2014-05-08 09:06 . 2014-06-12 12:05        2742784        ----a-w-        c:\windows\system32\rdpcorets.dll
2014-05-08 09:06 . 2014-06-12 12:05        13824        ----a-w-        c:\windows\system32\RdpGroupPolicyExtension.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"1c2b1"="c:\users\Compiuta\AppData\Roaming\0a3\1c2b1.js" [X]
"BitTorrent Sync"="c:\program files\BitTorrent Sync\BTSync.exe" [2014-06-27 3020136]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2014-02-10 20917408]
"KiesPreload"="c:\program files\Samsung\Kies\Kies.exe" [2014-06-14 1563440]
"ABBYY Screenshot Reader Bonus"="c:\program files\ABBYY PDF Transformer 3.0\Bonus.ScreenshotReader.exe" [2014-04-23 939272]
"VoipStunt"="c:\program files\VoipStunt.com\VoipStunt\VoipStunt.exe" [2014-02-11 19768640]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2009-05-18 1314816]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-08-06 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-08-06 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-08-06 150552]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2013-04-23 2379504]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-12-21 959904]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2014-07-04 750160]
"KiesTrayAgent"="c:\program files\Samsung\Kies\KiesTrayAgent.exe" [2014-06-14 310064]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2014-07-11 256896]
.
c:\users\Compiuta\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
406.js [2014-8-3 46974]
496a.js [2014-8-3 46974]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
R1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2014-02-25 37352]
R2 ABBYY.Licensing.PDFTransformer.Classic.3.0;ABBYY PDF Transformer 3.0 Licensing Service;c:\program files\ABBYY PDF Transformer 3.0\NetworkLicenseServer.exe [2014-04-23 759048]
R2 AntiVirSchedulerService;Avira Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2014-07-04 430160]
R2 MotoHelper;MotoHelper Service;c:\program files\Motorola\MotoHelper\MotoHelperService.exe [2011-04-26 223088]
R2 TeamViewer9;TeamViewer 9;c:\program files\TeamViewer\Version9\TeamViewer_Service.exe [2014-04-02 4972864]
R3 BTCFilterService;USB Networking Driver Filter Service;c:\windows\system32\DRIVERS\motfilt.sys [2009-01-29 6016]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [2014-04-11 89856]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [2010-11-20 62464]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2014-06-18 108032]
R3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\DRIVERS\motccgp.sys [2011-04-04 20480]
R3 motccgpfl;MotCcgpFlService;c:\windows\system32\DRIVERS\motccgpfl.sys [2009-01-29 8320]
R3 Motousbnet;Motorola USB Networking Driver Service;c:\windows\system32\DRIVERS\Motousbnet.sys [2010-04-01 23424]
R3 motusbdevice;Motorola USB Dev Driver;c:\windows\system32\DRIVERS\motusbdevice.sys [2011-02-07 11008]
R3 PSKMAD;PSKMAD;c:\windows\system32\DRIVERS\PSKMAD.sys [2013-04-29 47632]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 14848]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504]
R3 ssudmdm;SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [2014-04-11 184192]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 49664]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2012-08-23 27136]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [2014-05-13 1343400]
.
.
Inhalt des "geplante Tasks" Ordners
.
2014-08-03 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-04-29 23:59]
.
2014-08-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4045813022-1567936593-3779010734-1000Core.job
- c:\users\Compiuta\AppData\Local\Google\Update\GoogleUpdate.exe [2014-05-17 14:36]
.
2014-08-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4045813022-1567936593-3779010734-1000UA.job
- c:\users\Compiuta\AppData\Local\Google\Update\GoogleUpdate.exe [2014-05-17 14:36]
.
.
------- Zusätzlicher Suchlauf -------
.
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\Compiuta\AppData\Roaming\Mozilla\Firefox\Profiles\kpvwewrm.default\
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKCU-Run-KiesAirMessage - c:\program files\Samsung\Kies\KiesAirMessage.exe
AddRemove-01_Simmental - c:\program files\Samsung\USB Drivers\01_Simmental\Uninstall.exe
AddRemove-02_Siberian - c:\program files\Samsung\USB Drivers\02_Siberian\Uninstall.exe
AddRemove-03_Swallowtail - c:\program files\Samsung\USB Drivers\03_Swallowtail\Uninstall.exe
AddRemove-04_semseyite - c:\program files\Samsung\USB Drivers\04_semseyite\Uninstall.exe
AddRemove-07_Schorl - c:\program files\Samsung\USB Drivers\07_Schorl\Uninstall.exe
AddRemove-09_Hsp - c:\program files\Samsung\USB Drivers\09_Hsp\Uninstall.exe
AddRemove-11_HSP_Plus_Default - c:\program files\Samsung\USB Drivers\11_HSP_Plus_Default\Uninstall.exe
AddRemove-16_Shrewsbury - c:\program files\Samsung\USB Drivers\16_Shrewsbury\Uninstall.exe
AddRemove-20_NXP_Driver - c:\program files\Samsung\USB Drivers\20_NXP_Driver\Uninstall.exe
AddRemove-24_flashusbdriver - c:\program files\Samsung\USB Drivers\24_flashusbdriver\Uninstall.exe
AddRemove-25_escape - c:\program files\Samsung\USB Drivers\25_escape\Uninstall.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-08-03  20:12:45
ComboFix-quarantined-files.txt  2014-08-03 18:12
.
Vor Suchlauf: 8 Verzeichnis(se), 27.937.751.040 Bytes frei
Nach Suchlauf: 13 Verzeichnis(se), 27.916.808.192 Bytes frei
.
- - End Of File - - F5307E39D37CD1CC71D01BEB17A19C29
A36C5E4F47E84449FF07ED3517B43A31
Ich warte dann auf Tipps zum weiteren Vorgehen. Danke nochmal!
LG
Fred

PS: Bitte lasst mich nach dem Ganzen wissen, ob und wie man an das Board als kleines Dankeschön spenden bzw. es sonst wie unterstützen kann.

schrauber 04.08.2014 10:24
Schau mal in meine Signatur :)


Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.


Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


und ein frisches FRST log bitte.

Freiseflei 04.08.2014 19:34
Hi Schrauber,

super, bin gerade aus der Uni zurück und habe deine Signatur gelesen und werd gern was schicken sobald ich mich wieder mit meinem Rechner auf Bank etc Seiten trauen kann. :)

Ich habe Malwarebytes im abgesicherten Modus durchgeführt, da es sich im normalen Modus weder installieren noch starten ließ. Hier nun der Log:

Code:
Malwarebytes Anti-Malware
www.malwarebytes.org

Suchlauf Datum: 04.08.2014
Suchlauf-Zeit: 19:38:05
Logdatei: mbam.txt
Administrator: Ja

Version: 2.00.2.1012
Malware Datenbank: v2014.03.04.09
Rootkit Datenbank: v2014.02.20.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Self-protection: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x86
Dateisystem: NTFS
Benutzer: Compiuta

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 239216
Verstrichene Zeit: 3 Min, 55 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristics: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registrierungsschlüssel: 0
(No malicious items detected)

Registrierungswerte: 0
(No malicious items detected)

Registrierungsdaten: 0
(No malicious items detected)

Ordner: 0
(No malicious items detected)

Dateien: 0
(No malicious items detected)

Physische Sektoren: 0
(No malicious items detected)


(end)

Nun poste ich den Adwcleaner log. Auch Adwcleaner konnte ich nur aus dem abgesicherten Modus starten.

Code:
# AdwCleaner v3.302 - Bericht erstellt am 04/08/2014 um 20:09:22
# Aktualisiert 30/07/2014 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (32 bits)
# Benutzername : Compiuta - COMPIUTA-PC
# Gestartet von : C:\Users\Compiuta\Downloads\adwcleaner_3.302.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\secman.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Schlüssel Gelöscht : HKCU\Software\Myfree Codec
Schlüssel Gelöscht : HKLM\Software\Myfree Codec

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17207


-\\ Mozilla Firefox v31.0 (x86 de)

[ Datei : C:\Users\1\AppData\Roaming\Mozilla\Firefox\Profiles\832yryei.default\prefs.js ]


[ Datei : C:\Users\Compiuta\AppData\Roaming\Mozilla\Firefox\Profiles\kpvwewrm.default\prefs.js ]


*************************

AdwCleaner[R0].txt - [1385 octets] - [04/08/2014 20:08:28]
AdwCleaner[S0].txt - [1306 octets] - [04/08/2014 20:09:22]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1366 octets] ##########
Und nun das Log von Junkware Removal Tool. Dieses konnte ich auch aus dem Normalmodus starten.

Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Professional x86
Ran by Compiuta on 04.08.2014 at 20:12:47,20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\Program Files\myfree codec"



~~~ FireFox

Emptied folder: C:\Users\Compiuta\AppData\Roaming\mozilla\firefox\profiles\kpvwewrm.default\minidumps [9 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 04.08.2014 at 20:15:44,66
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Un hier nun erneut ein FRST log (auh das konnte ich vom Normalmodus aus machen):


FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:2-08-2014
Ran by Compiuta (administrator) on COMPIUTA-PC on 04-08-2014 20:16:38
Running from C:\Users\Compiuta\Desktop
Platform: Microsoft Windows 7 Professional  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(ABBYY) C:\Program Files\ABBYY PDF Transformer 3.0\NetworkLicenseServer.exe
(Andrea Electronics Corporation) C:\Windows\System32\AEADISRV.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
() C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe
(Conexant Systems, Inc.) C:\Windows\System32\drivers\XAudio.exe
(Analog Devices, Inc.) C:\Program Files\Analog Devices\Core\smax4pnp.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
() C:\Program Files\Motorola\MotoHelper\MotoHelperAgent.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Samsung) C:\Program Files\Samsung\Kies\Kies.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
(Microsoft Corporation) C:\Windows\System32\wscript.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [BitTorrent Sync] => C:\Program Files\BitTorrent Sync\BTSync.exe [3020136 2014-06-27] (BitTorrent, Inc.)
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [20917408 2014-02-10] (Skype Technologies S.A.)
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [KiesPreload] => C:\Program Files\Samsung\Kies\Kies.exe [1563440 2014-06-14] (Samsung)
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [ABBYY Screenshot Reader Bonus] => C:\Program Files\ABBYY PDF Transformer 3.0\Bonus.ScreenshotReader.exe [939272 2014-04-23] (ABBYY)
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [VoipStunt] => C:\Program Files\VoipStunt.com\VoipStunt\VoipStunt.exe [19768640 2014-02-11] (VoipStunt)
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [1c2b1] => C:\Users\Compiuta\AppData\Roaming\0a3\1c2b1.js [46974 2014-08-04] ()
Startup: C:\Users\Compiuta\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\496a.js ()

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xECE210E7535DCF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
BHO: SwissAcademic.Citavi.Picker.IEPicker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Compiuta\AppData\Roaming\Mozilla\Firefox\Profiles\kpvwewrm.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin: @java.com/DTPlugin,version=10.65.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.65.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @talk.google.com/GoogleTalkPlugin - C:\Users\Compiuta\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin HKCU: @talk.google.com/O1DPlugin - C:\Users\Compiuta\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Compiuta\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Compiuta\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\Compiuta\AppData\Roaming\mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin ProgramFiles/Appdata: C:\Users\Compiuta\AppData\Roaming\mozilla\plugins\npo1d.dll (Google)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF HKLM\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2014-04-21]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 ABBYY.Licensing.PDFTransformer.Classic.3.0; C:\Program Files\ABBYY PDF Transformer 3.0\NetworkLicenseServer.exe [759048 2014-04-23] (ABBYY)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-07-04] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-07-04] (Avira Operations GmbH & Co. KG)
R2 MotoHelper; C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe [223088 2011-04-26] ()

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [97648 2014-07-04] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-05-27] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2014-02-25] (Avira Operations GmbH & Co. KG)
R3 e1express; C:\Windows\System32\DRIVERS\e1e6232.sys [232312 2012-10-30] (Intel Corporation)
S3 PSKMAD; C:\Windows\System32\DRIVERS\PSKMAD.sys [47632 2013-04-29] (Panda Security, S.L.)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2014-02-25] (Avira GmbH)
S3 catchme; \??\C:\Users\Compiuta\AppData\Local\Temp\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-04 20:15 - 2014-08-04 20:15 - 00000828 _____ () C:\Users\Compiuta\Desktop\JRT.txt
2014-08-04 20:12 - 2014-08-04 20:12 - 00000000 ____D () C:\Windows\ERUNT
2014-08-04 20:11 - 2014-08-04 20:11 - 00001446 _____ () C:\Users\Compiuta\Desktop\AdwCleaner[S0].txt
2014-08-04 20:07 - 2014-08-04 20:09 - 00000000 ____D () C:\AdwCleaner
2014-08-04 20:07 - 2014-08-04 20:07 - 00001161 _____ () C:\Users\Compiuta\Desktop\mbam2.txt
2014-08-04 20:06 - 2014-08-04 20:06 - 00001161 _____ () C:\Users\Compiuta\Desktop\mbam.txt
2014-08-04 20:01 - 2014-08-04 20:01 - 01361309 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.302.exe
2014-08-04 20:01 - 2014-08-04 20:01 - 01016261 _____ (Thisisu) C:\Users\Compiuta\Downloads\JRT.exe
2014-08-04 19:32 - 2014-08-04 20:03 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-04 19:32 - 2014-08-04 19:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-08-04 19:31 - 2014-08-04 19:32 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2014-08-04 19:31 - 2014-08-04 19:31 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-04 19:31 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-08-04 19:31 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-08-04 19:31 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-08-04 19:23 - 2014-08-04 19:24 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Compiuta\Downloads\mbam-setup-2.0.2.1012(1).exe
2014-08-03 20:14 - 2014-08-03 20:14 - 00000000 __SHD () C:\Users\Compiuta\AppData\Roaming\0a3
2014-08-03 20:13 - 2014-08-03 20:13 - 00013303 _____ () C:\Users\Compiuta\Desktop\combofix.txt
2014-08-03 20:12 - 2014-08-03 20:12 - 00013303 _____ () C:\ComboFix.txt
2014-08-03 20:06 - 2014-08-03 20:12 - 00000000 ____D () C:\Qoobox
2014-08-03 20:06 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-08-03 20:06 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-08-03 20:06 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-08-03 20:06 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-08-03 20:06 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-08-03 20:06 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-08-03 20:06 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-08-03 20:06 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-08-03 20:05 - 2014-08-03 20:11 - 00000000 ____D () C:\Windows\erdnt
2014-08-03 20:04 - 2014-08-03 20:04 - 00000000 ____D () C:\ProgramData\Panda Security
2014-08-03 20:03 - 2014-08-03 20:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Security
2014-08-03 20:03 - 2014-08-03 20:03 - 00000000 ____D () C:\Program Files\Panda USB Vaccine
2014-08-03 19:20 - 2014-08-03 19:20 - 05566616 ____R (Swearware) C:\Users\Compiuta\Desktop\ComboFix.exe
2014-08-03 19:19 - 2014-08-03 19:20 - 05566616 _____ (Swearware) C:\Users\Compiuta\Downloads\ComboFix.exe
2014-08-03 19:03 - 2014-08-03 19:02 - 00848856 _____ (Panda Security ) C:\Users\Compiuta\Desktop\USBVaccineSetup.exe
2014-08-03 19:01 - 2014-08-03 19:02 - 00848856 _____ (Panda Security ) C:\Users\Compiuta\Downloads\USBVaccineSetup.exe
2014-08-03 18:07 - 2014-08-03 18:07 - 00000993 _____ () C:\Users\Compiuta\Desktop\gmer.txt
2014-08-03 17:32 - 2014-08-03 17:34 - 00049106 _____ () C:\Users\Compiuta\Desktop\Antivir.odt
2014-08-03 17:28 - 2014-08-03 17:28 - 00380416 _____ () C:\Users\Compiuta\Downloads\Gmer-19357.exe
2014-08-03 17:27 - 2014-08-03 13:18 - 00000478 _____ () C:\Users\Compiuta\Desktop\defogger_disable.log
2014-08-03 17:24 - 2014-08-04 20:16 - 00008817 _____ () C:\Users\Compiuta\Desktop\FRST.txt
2014-08-03 17:24 - 2014-08-03 15:57 - 00023276 _____ () C:\Users\Compiuta\Desktop\Addition.txt
2014-08-03 15:56 - 2014-08-03 15:57 - 00023276 _____ () C:\Users\Compiuta\Downloads\Addition.txt
2014-08-03 15:55 - 2014-08-04 20:16 - 00000000 ____D () C:\FRST
2014-08-03 15:55 - 2014-08-03 15:57 - 00030941 _____ () C:\Users\Compiuta\Downloads\FRST.txt
2014-08-03 15:50 - 2014-08-03 15:50 - 01084928 _____ (Farbar) C:\Users\Compiuta\Desktop\FRST.exe
2014-08-03 13:18 - 2014-08-03 13:18 - 00000478 _____ () C:\Users\Compiuta\Downloads\defogger_disable.log
2014-08-03 13:18 - 2014-08-03 13:18 - 00000000 _____ () C:\Users\Compiuta\defogger_reenable
2014-08-03 13:04 - 2014-08-03 13:04 - 00050477 _____ () C:\Users\Compiuta\Downloads\Defogger.exe
2014-08-03 10:57 - 2014-08-03 10:57 - 00000000 ____D () C:\Program Files\Panda Security
2014-08-03 10:57 - 2013-04-29 09:17 - 00047632 _____ (Panda Security, S.L.) C:\Windows\system32\Drivers\PSKMAD.sys
2014-08-03 10:43 - 2014-08-03 10:43 - 30412088 _____ (Panda Security ) C:\Users\Compiuta\Downloads\PandaCloudCleaner.exe
2014-08-03 10:42 - 2014-05-14 18:23 - 01973728 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-08-03 10:42 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-08-03 10:42 - 2014-05-14 18:23 - 00054240 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-08-03 10:42 - 2014-05-14 18:23 - 00045536 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-08-03 10:42 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-08-03 10:42 - 2014-05-14 18:17 - 02425856 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-08-03 10:42 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-08-03 10:41 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-08-03 10:41 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-07-31 11:12 - 2014-07-31 11:12 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-07-24 15:56 - 2014-07-24 15:56 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Compiuta\Downloads\mbam-setup-2.0.2.1012.exe
2014-07-24 15:45 - 2014-07-24 15:45 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216(2).exe
2014-07-24 15:28 - 2014-07-24 15:28 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216(1).exe
2014-07-24 15:21 - 2014-07-24 15:21 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216.exe
2014-07-24 01:07 - 2014-07-24 01:07 - 00000000 __SHD () C:\0b64
2014-07-21 20:05 - 2014-07-21 20:05 - 00000000 ____D () C:\Users\Compiuta\Desktop\Neuer Ordner
2014-07-20 04:40 - 2014-07-20 04:46 - 00009008 _____ () C:\Users\Compiuta\AppData\Roaming\.freeciv-client-rc-2.4
2014-07-20 04:35 - 2014-07-20 04:42 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\.freeciv
2014-07-19 22:08 - 2014-07-19 22:26 - 00000000 ____D () C:\Users\Compiuta\Desktop\Neuer Ordner (2)
2014-07-19 22:07 - 2014-07-19 22:08 - 11861420 _____ () C:\Users\Compiuta\Downloads\Gmail(1).zip
2014-07-19 22:07 - 2014-07-19 22:08 - 11811633 _____ () C:\Users\Compiuta\Downloads\Gmail.zip
2014-07-19 21:50 - 2014-07-19 21:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Freeciv 2.4.2 (GTK+2 client)
2014-07-19 21:50 - 2014-07-19 21:50 - 00000000 ____D () C:\Program Files\Freeciv-2.4.2-gtk2
2014-07-19 20:56 - 2014-07-19 20:57 - 28215140 _____ () C:\Users\Compiuta\Downloads\Freeciv-2.4.2-win32-gtk2-setup.exe
2014-07-19 01:40 - 2014-07-24 15:57 - 00000000 ____D () C:\Users\Compiuta\Desktop\abog
2014-07-17 17:24 - 2014-07-17 17:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-07-17 17:24 - 2014-07-17 17:24 - 00000000 ____D () C:\Program Files\Common Files\Java
2014-07-17 17:24 - 2014-07-11 03:02 - 00096680 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-07-17 17:24 - 2014-07-11 02:56 - 00272808 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-07-17 17:24 - 2014-07-11 02:56 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-07-17 17:24 - 2014-07-11 02:55 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-07-14 19:55 - 2014-07-14 20:06 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\Audacity
2014-07-09 18:24 - 2014-06-20 21:39 - 00240824 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-07-09 18:24 - 2014-06-19 02:16 - 17276416 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-07-09 18:24 - 2014-06-19 01:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-07-09 18:24 - 2014-06-19 01:56 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-07-09 18:24 - 2014-06-19 01:38 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-07-09 18:24 - 2014-06-19 01:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-07-09 18:24 - 2014-06-19 01:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-07-09 18:24 - 2014-06-19 01:35 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-07-09 18:24 - 2014-06-19 01:32 - 02179072 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-07-09 18:24 - 2014-06-19 01:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-07-09 18:24 - 2014-06-19 01:28 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-07-09 18:24 - 2014-06-19 01:25 - 00442368 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-07-09 18:24 - 2014-06-19 01:23 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-07-09 18:24 - 2014-06-19 01:23 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-07-09 18:24 - 2014-06-19 01:22 - 00592896 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-07-09 18:24 - 2014-06-19 01:16 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-07-09 18:24 - 2014-06-19 01:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-07-09 18:24 - 2014-06-19 01:06 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-07-09 18:24 - 2014-06-19 01:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-07-09 18:24 - 2014-06-19 00:59 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-07-09 18:24 - 2014-06-19 00:58 - 00239616 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-07-09 18:24 - 2014-06-19 00:52 - 04254720 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-07-09 18:24 - 2014-06-19 00:52 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-07-09 18:24 - 2014-06-19 00:49 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-07-09 18:24 - 2014-06-19 00:46 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-07-09 18:24 - 2014-06-19 00:45 - 01964544 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-07-09 18:24 - 2014-06-19 00:35 - 11742208 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-07-09 18:24 - 2014-06-19 00:13 - 01791488 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-07-09 18:24 - 2014-06-19 00:09 - 01139200 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-07-09 18:24 - 2014-06-19 00:07 - 00704512 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-07-09 17:14 - 2014-06-05 16:26 - 01059840 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-07-09 17:02 - 2014-06-18 03:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2014-07-09 17:02 - 2014-06-18 02:52 - 02350080 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-07-09 17:02 - 2014-06-06 11:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-07-09 17:02 - 2014-05-30 08:36 - 00338944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-07-08 14:33 - 2014-07-08 14:33 - 00284564 _____ () C:\Windows\msxml4-KB954430-enu.LOG
2014-07-08 14:33 - 2014-07-08 14:33 - 00000000 ____D () C:\Program Files\MSXML 4.0
2014-07-08 14:32 - 2014-07-08 14:33 - 00291106 _____ () C:\Windows\msxml4-KB973688-enu.LOG
2014-07-06 23:19 - 2014-07-06 23:46 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\VoipStunt
2014-07-06 23:19 - 2014-07-06 23:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VoipStunt
2014-07-06 23:19 - 2014-07-06 23:19 - 00000000 ____D () C:\Program Files\VoipStunt.com
2014-07-06 23:17 - 2014-07-06 23:17 - 06569296 _____ (Finarea S.A. Switzerland ) C:\Users\Compiuta\Downloads\setupVoipStunt.exe
2014-07-06 19:43 - 2014-07-19 22:26 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\XnView
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_motusbdevice_01007.Wdf
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_Motousbnet_01007.Wdf
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_motmodem_01007.Wdf
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_motfilt_01007.Wdf
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_motccgpfl_01007.Wdf
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_motccgp_01007.Wdf
2014-07-06 19:08 - 2014-07-06 19:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Motorola
2014-07-06 19:08 - 2014-07-06 19:08 - 00000000 ____D () C:\Program Files\Motorola
2014-07-06 19:08 - 2014-07-06 19:08 - 00000000 ____D () C:\Program Files\Common Files\Motorola Shared
2014-07-06 18:51 - 2014-04-11 10:39 - 00184192 _____ (DEVGURU Co., LTD.(www.devguru.co.kr)) C:\Windows\system32\Drivers\ssudmdm.sys
2014-07-06 18:51 - 2014-04-11 10:39 - 00089856 _____ (DEVGURU Co., LTD.(www.devguru.co.kr)) C:\Windows\system32\Drivers\ssudbus.sys

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-04 20:16 - 2014-08-03 17:24 - 00008817 _____ () C:\Users\Compiuta\Desktop\FRST.txt
2014-08-04 20:16 - 2014-08-03 15:55 - 00000000 ____D () C:\FRST
2014-08-04 20:15 - 2014-08-04 20:15 - 00000828 _____ () C:\Users\Compiuta\Desktop\JRT.txt
2014-08-04 20:15 - 2010-11-20 23:01 - 01618320 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-08-04 20:12 - 2014-08-04 20:12 - 00000000 ____D () C:\Windows\ERUNT
2014-08-04 20:11 - 2014-08-04 20:11 - 00001446 _____ () C:\Users\Compiuta\Desktop\AdwCleaner[S0].txt
2014-08-04 20:11 - 2014-04-21 21:52 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\Skype
2014-08-04 20:11 - 2014-04-21 12:24 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\BitTorrent Sync
2014-08-04 20:10 - 2010-11-20 23:48 - 00111524 _____ () C:\Windows\PFRO.log
2014-08-04 20:10 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-04 20:10 - 2009-07-14 06:39 - 00041397 _____ () C:\Windows\setupact.log
2014-08-04 20:09 - 2014-08-04 20:07 - 00000000 ____D () C:\AdwCleaner
2014-08-04 20:07 - 2014-08-04 20:07 - 00001161 _____ () C:\Users\Compiuta\Desktop\mbam2.txt
2014-08-04 20:06 - 2014-08-04 20:06 - 00001161 _____ () C:\Users\Compiuta\Desktop\mbam.txt
2014-08-04 20:03 - 2014-08-04 19:32 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-04 20:02 - 2014-01-04 20:06 - 01202185 _____ () C:\Windows\WindowsUpdate.log
2014-08-04 20:01 - 2014-08-04 20:01 - 01361309 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.302.exe
2014-08-04 20:01 - 2014-08-04 20:01 - 01016261 _____ (Thisisu) C:\Users\Compiuta\Downloads\JRT.exe
2014-08-04 19:52 - 2009-07-14 06:34 - 00022208 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-04 19:52 - 2009-07-14 06:34 - 00022208 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-04 19:47 - 2014-05-17 16:36 - 00001132 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4045813022-1567936593-3779010734-1000UA.job
2014-08-04 19:32 - 2014-08-04 19:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-08-04 19:32 - 2014-08-04 19:31 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2014-08-04 19:31 - 2014-08-04 19:31 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-04 19:24 - 2014-08-04 19:23 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Compiuta\Downloads\mbam-setup-2.0.2.1012(1).exe
2014-08-04 19:19 - 2014-04-29 21:30 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-08-04 08:07 - 2014-05-17 16:36 - 00001080 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4045813022-1567936593-3779010734-1000Core.job
2014-08-03 20:14 - 2014-08-03 20:14 - 00000000 __SHD () C:\Users\Compiuta\AppData\Roaming\0a3
2014-08-03 20:13 - 2014-08-03 20:13 - 00013303 _____ () C:\Users\Compiuta\Desktop\combofix.txt
2014-08-03 20:12 - 2014-08-03 20:12 - 00013303 _____ () C:\ComboFix.txt
2014-08-03 20:12 - 2014-08-03 20:06 - 00000000 ____D () C:\Qoobox
2014-08-03 20:12 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public
2014-08-03 20:11 - 2014-08-03 20:05 - 00000000 ____D () C:\Windows\erdnt
2014-08-03 20:11 - 2009-07-14 04:04 - 00000215 _____ () C:\Windows\system.ini
2014-08-03 20:04 - 2014-08-03 20:04 - 00000000 ____D () C:\ProgramData\Panda Security
2014-08-03 20:03 - 2014-08-03 20:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Security
2014-08-03 20:03 - 2014-08-03 20:03 - 00000000 ____D () C:\Program Files\Panda USB Vaccine
2014-08-03 19:20 - 2014-08-03 19:20 - 05566616 ____R (Swearware) C:\Users\Compiuta\Desktop\ComboFix.exe
2014-08-03 19:20 - 2014-08-03 19:19 - 05566616 _____ (Swearware) C:\Users\Compiuta\Downloads\ComboFix.exe
2014-08-03 19:02 - 2014-08-03 19:03 - 00848856 _____ (Panda Security ) C:\Users\Compiuta\Desktop\USBVaccineSetup.exe
2014-08-03 19:02 - 2014-08-03 19:01 - 00848856 _____ (Panda Security ) C:\Users\Compiuta\Downloads\USBVaccineSetup.exe
2014-08-03 18:07 - 2014-08-03 18:07 - 00000993 _____ () C:\Users\Compiuta\Desktop\gmer.txt
2014-08-03 17:34 - 2014-08-03 17:32 - 00049106 _____ () C:\Users\Compiuta\Desktop\Antivir.odt
2014-08-03 17:28 - 2014-08-03 17:28 - 00380416 _____ () C:\Users\Compiuta\Downloads\Gmer-19357.exe
2014-08-03 15:57 - 2014-08-03 17:24 - 00023276 _____ () C:\Users\Compiuta\Desktop\Addition.txt
2014-08-03 15:57 - 2014-08-03 15:56 - 00023276 _____ () C:\Users\Compiuta\Downloads\Addition.txt
2014-08-03 15:57 - 2014-08-03 15:55 - 00030941 _____ () C:\Users\Compiuta\Downloads\FRST.txt
2014-08-03 15:50 - 2014-08-03 15:50 - 01084928 _____ (Farbar) C:\Users\Compiuta\Desktop\FRST.exe
2014-08-03 13:18 - 2014-08-03 17:27 - 00000478 _____ () C:\Users\Compiuta\Desktop\defogger_disable.log
2014-08-03 13:18 - 2014-08-03 13:18 - 00000478 _____ () C:\Users\Compiuta\Downloads\defogger_disable.log
2014-08-03 13:18 - 2014-08-03 13:18 - 00000000 _____ () C:\Users\Compiuta\defogger_reenable
2014-08-03 13:18 - 2014-01-04 20:28 - 00000000 ____D () C:\Users\Compiuta
2014-08-03 13:04 - 2014-08-03 13:04 - 00050477 _____ () C:\Users\Compiuta\Downloads\Defogger.exe
2014-08-03 10:57 - 2014-08-03 10:57 - 00000000 ____D () C:\Program Files\Panda Security
2014-08-03 10:55 - 2014-04-21 15:31 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-08-03 10:48 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-08-03 10:43 - 2014-08-03 10:43 - 30412088 _____ (Panda Security ) C:\Users\Compiuta\Downloads\PandaCloudCleaner.exe
2014-07-31 15:53 - 2014-04-23 11:00 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\vlc
2014-07-31 11:12 - 2014-07-31 11:12 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-07-24 18:50 - 2014-04-21 17:30 - 00035848 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-07-24 15:57 - 2014-07-19 01:40 - 00000000 ____D () C:\Users\Compiuta\Desktop\abog
2014-07-24 15:56 - 2014-07-24 15:56 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Compiuta\Downloads\mbam-setup-2.0.2.1012.exe
2014-07-24 15:45 - 2014-07-24 15:45 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216(2).exe
2014-07-24 15:28 - 2014-07-24 15:28 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216(1).exe
2014-07-24 15:21 - 2014-07-24 15:21 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216.exe
2014-07-24 03:33 - 2014-04-20 19:34 - 00000000 ____D () C:\BtSync
2014-07-24 01:07 - 2014-07-24 01:07 - 00000000 __SHD () C:\0b64
2014-07-23 10:52 - 2014-04-21 15:10 - 00231584 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-07-21 20:05 - 2014-07-21 20:05 - 00000000 ____D () C:\Users\Compiuta\Desktop\Neuer Ordner
2014-07-20 04:46 - 2014-07-20 04:40 - 00009008 _____ () C:\Users\Compiuta\AppData\Roaming\.freeciv-client-rc-2.4
2014-07-20 04:42 - 2014-07-20 04:35 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\.freeciv
2014-07-19 22:26 - 2014-07-19 22:08 - 00000000 ____D () C:\Users\Compiuta\Desktop\Neuer Ordner (2)
2014-07-19 22:26 - 2014-07-06 19:43 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\XnView
2014-07-19 22:13 - 2014-04-21 16:58 - 00000000 ____D () C:\Users\Compiuta\AppData\Local\Paint.NET
2014-07-19 22:09 - 2014-01-04 21:11 - 00000000 ____D () C:\Users\Compiuta\Desktop\Soundfiles
2014-07-19 22:08 - 2014-07-19 22:07 - 11861420 _____ () C:\Users\Compiuta\Downloads\Gmail(1).zip
2014-07-19 22:08 - 2014-07-19 22:07 - 11811633 _____ () C:\Users\Compiuta\Downloads\Gmail.zip
2014-07-19 21:50 - 2014-07-19 21:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Freeciv 2.4.2 (GTK+2 client)
2014-07-19 21:50 - 2014-07-19 21:50 - 00000000 ____D () C:\Program Files\Freeciv-2.4.2-gtk2
2014-07-19 20:57 - 2014-07-19 20:56 - 28215140 _____ () C:\Users\Compiuta\Downloads\Freeciv-2.4.2-win32-gtk2-setup.exe
2014-07-18 18:03 - 2014-06-13 03:24 - 00000000 ____D () C:\Users\Compiuta\AppData\Local\Adobe
2014-07-17 17:24 - 2014-07-17 17:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-07-17 17:24 - 2014-07-17 17:24 - 00000000 ____D () C:\Program Files\Common Files\Java
2014-07-17 17:24 - 2014-05-02 10:24 - 00000000 ____D () C:\ProgramData\Oracle
2014-07-17 17:24 - 2014-05-02 10:24 - 00000000 ____D () C:\Program Files\Java
2014-07-15 15:54 - 2014-04-21 21:39 - 00000000 ____D () C:\Windows\system32\MRT
2014-07-15 15:52 - 2014-04-21 21:39 - 93585272 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-07-15 02:55 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2014-07-14 22:33 - 2014-06-03 23:45 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\FileZilla
2014-07-14 20:12 - 2014-06-03 23:45 - 04996210 _____ (Tim Kosse) C:\Users\Compiuta\Downloads\FileZilla_3.8.1_win32-setup.exe
2014-07-14 20:12 - 2014-04-21 15:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client
2014-07-14 20:12 - 2014-04-21 15:41 - 00000000 ____D () C:\Program Files\FileZilla FTP Client
2014-07-14 20:06 - 2014-07-14 19:55 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\Audacity
2014-07-14 06:12 - 2014-04-27 14:19 - 00000000 ____D () C:\Users\1
2014-07-12 05:40 - 2014-01-04 20:58 - 00000000 ____D () C:\Users\Compiuta\Desktop\Flugtickets
2014-07-11 03:02 - 2014-07-17 17:24 - 00096680 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-07-11 02:56 - 2014-07-17 17:24 - 00272808 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-07-11 02:56 - 2014-07-17 17:24 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-07-11 02:55 - 2014-07-17 17:24 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-07-10 01:18 - 2010-11-21 02:55 - 00000000 ____D () C:\Program Files\Windows Journal
2014-07-10 01:18 - 2009-07-14 06:33 - 00324032 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-07-09 01:59 - 2014-04-29 21:30 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-07-09 01:59 - 2014-04-29 21:30 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-07-08 14:33 - 2014-07-08 14:33 - 00284564 _____ () C:\Windows\msxml4-KB954430-enu.LOG
2014-07-08 14:33 - 2014-07-08 14:33 - 00000000 ____D () C:\Program Files\MSXML 4.0
2014-07-08 14:33 - 2014-07-08 14:32 - 00291106 _____ () C:\Windows\msxml4-KB973688-enu.LOG
2014-07-06 23:46 - 2014-07-06 23:19 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\VoipStunt
2014-07-06 23:19 - 2014-07-06 23:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VoipStunt
2014-07-06 23:19 - 2014-07-06 23:19 - 00000000 ____D () C:\Program Files\VoipStunt.com
2014-07-06 23:17 - 2014-07-06 23:17 - 06569296 _____ (Finarea S.A. Switzerland ) C:\Users\Compiuta\Downloads\setupVoipStunt.exe
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_motusbdevice_01007.Wdf
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_Motousbnet_01007.Wdf
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_motmodem_01007.Wdf
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_motfilt_01007.Wdf
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_motccgpfl_01007.Wdf
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_motccgp_01007.Wdf
2014-07-06 19:09 - 2014-01-04 20:28 - 00000000 ____D () C:\Users\Compiuta\AppData\Local\VirtualStore
2014-07-06 19:08 - 2014-07-06 19:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Motorola
2014-07-06 19:08 - 2014-07-06 19:08 - 00000000 ____D () C:\Program Files\Motorola
2014-07-06 19:08 - 2014-07-06 19:08 - 00000000 ____D () C:\Program Files\Common Files\Motorola Shared

Some content of TEMP:
====================
C:\Users\1\AppData\Local\temp\avgnt.exe
C:\Users\Compiuta\AppData\Local\temp\avgnt.exe
C:\Users\Compiuta\AppData\Local\temp\Quarantine.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-07-15 01:40

==================== End Of Log ============================
--- --- ---


Danke fürs erneute Auswerten!
LG
Fred

schrauber 05.08.2014 12:44

ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

Freiseflei 05.08.2014 15:51
Hi Schauber,

leider konnte ich auch ESET nicht im normalen Modus installieren. Irgendwas scheint das noch zu blockieren bzw. das Installationsmenü nach dem Öffnen gleich wieder zu schließen. Deswegen habe ich den Scan im abgesicherten Modus mit Netzwerktreibern und abgeschalteter Firewall laufen lassen. Dabei hat ESET zwei Trojaner und zwei ungewünschte Toolbars gefunden. Hier nun der log:

Code:
ESETSmartInstaller@High as downloader log:
Can not open internetESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=59582790a3ceb04fab8d68e5ea925596
# engine=19509
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-08-05 02:26:31
# local_time=2014-08-05 04:26:31 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777214 100 100 29076 13931127 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 3830 158879982 0 0
# scanned=113861
# found=4
# cleaned=0
# scan_time=3153
sh=6DDD82112A07890A9BE568E2AFB6ACE830A653E9 ft=0 fh=0000000000000000 vn="JS/Kryptik.ALK Trojaner" ac=I fn="C:\Qoobox\Quarantine\C\Users\Compiuta\AppData\Roaming\0a3\1c2b1.js.vir"
sh=6DDD82112A07890A9BE568E2AFB6ACE830A653E9 ft=0 fh=0000000000000000 vn="JS/Kryptik.ALK Trojaner" ac=I fn="C:\Users\Compiuta\AppData\Roaming\0a3\1c2b1.js"
sh=503FB0F73E1F7FC3C7300A252DE32197E9C524FE ft=0 fh=0000000000000000 vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Compiuta\Desktop\Downloads\ProgrammeFriedi.zip"
sh=998E13E519B2BF4C9D714E821C7C04AE41BECC36 ft=1 fh=acaa135d3d0b8ae0 vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Compiuta\Desktop\Downloads\SICHERN\ProgrammeFriedi\Freemake Video Converter\FreemakeVideoConverter_3.0.2.9.exe"
SecurityCheck konnte ich im Normalmodus starten. Hier ist nun der log:

Code:
Results of screen317's Security Check version 0.99.86 
 Windows 7 Service Pack 1 x86 (UAC is enabled) 
 Internet Explorer 11 
``````````````Antivirus/Firewall Check:``````````````
Avira Desktop 
 Antivirus up to date!  (On Access scanning disabled!)
`````````Anti-malware/Other Utilities Check:`````````
 Java 7 Update 65 
 Adobe Flash Player        14.0.0.145 
 Adobe Reader XI 
 Mozilla Firefox (31.0)
````````Process Check: objlist.exe by Laurent```````` 
 Avira Antivir avgnt.exe
 Avira Antivir avguard.exe
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C: 
````````````````````End of Log``````````````````````
Und hier nun ein neuer FRST log:


FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:2-08-2014
Ran by Compiuta (administrator) on COMPIUTA-PC on 05-08-2014 16:43:04
Running from C:\Users\Compiuta\Desktop
Platform: Microsoft Windows 7 Professional  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(ABBYY) C:\Program Files\ABBYY PDF Transformer 3.0\NetworkLicenseServer.exe
(Andrea Electronics Corporation) C:\Windows\System32\AEADISRV.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
() C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe
(Conexant Systems, Inc.) C:\Windows\System32\drivers\XAudio.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
() C:\Program Files\Motorola\MotoHelper\MotoHelperAgent.exe
(Analog Devices, Inc.) C:\Program Files\Analog Devices\Core\smax4pnp.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(BitTorrent, Inc.) C:\Program Files\BitTorrent Sync\BTSync.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
(Samsung) C:\Program Files\Samsung\Kies\Kies.exe
(ABBYY) C:\Program Files\ABBYY PDF Transformer 3.0\Bonus.ScreenshotReader.exe
(Microsoft Corporation) C:\Windows\System32\wscript.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [BitTorrent Sync] => C:\Program Files\BitTorrent Sync\BTSync.exe [3020136 2014-06-27] (BitTorrent, Inc.)
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [20917408 2014-02-10] (Skype Technologies S.A.)
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [KiesPreload] => C:\Program Files\Samsung\Kies\Kies.exe [1563440 2014-06-14] (Samsung)
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [ABBYY Screenshot Reader Bonus] => C:\Program Files\ABBYY PDF Transformer 3.0\Bonus.ScreenshotReader.exe [939272 2014-04-23] (ABBYY)
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [VoipStunt] => C:\Program Files\VoipStunt.com\VoipStunt\VoipStunt.exe [19768640 2014-02-11] (VoipStunt)
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [1c2b1] => C:\Users\Compiuta\AppData\Roaming\0a3\1c2b1.js [46974 2014-08-05] ()
Startup: C:\Users\Compiuta\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4f694.js ()

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xECE210E7535DCF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
BHO: SwissAcademic.Citavi.Picker.IEPicker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 141.51.247.1

FireFox:
========
FF ProfilePath: C:\Users\Compiuta\AppData\Roaming\Mozilla\Firefox\Profiles\kpvwewrm.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin: @java.com/DTPlugin,version=10.65.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.65.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @talk.google.com/GoogleTalkPlugin - C:\Users\Compiuta\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin HKCU: @talk.google.com/O1DPlugin - C:\Users\Compiuta\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Compiuta\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Compiuta\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\Compiuta\AppData\Roaming\mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin ProgramFiles/Appdata: C:\Users\Compiuta\AppData\Roaming\mozilla\plugins\npo1d.dll (Google)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF HKLM\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2014-04-21]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 ABBYY.Licensing.PDFTransformer.Classic.3.0; C:\Program Files\ABBYY PDF Transformer 3.0\NetworkLicenseServer.exe [759048 2014-04-23] (ABBYY)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-07-04] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-07-04] (Avira Operations GmbH & Co. KG)
R2 MotoHelper; C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe [223088 2011-04-26] ()

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [97648 2014-07-04] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-05-27] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2014-02-25] (Avira Operations GmbH & Co. KG)
R3 e1express; C:\Windows\System32\DRIVERS\e1e6232.sys [232312 2012-10-30] (Intel Corporation)
S3 PSKMAD; C:\Windows\System32\DRIVERS\PSKMAD.sys [47632 2013-04-29] (Panda Security, S.L.)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2014-02-25] (Avira GmbH)
S3 catchme; \??\C:\Users\Compiuta\AppData\Local\Temp\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-05 16:42 - 2014-08-05 16:42 - 00037658 _____ () C:\Users\Compiuta\Desktop\FRST3.txt
2014-08-05 16:41 - 2014-08-05 16:41 - 00000759 _____ () C:\Users\Compiuta\Desktop\checkup.txt
2014-08-05 16:35 - 2014-08-05 16:35 - 00854410 _____ () C:\Users\Compiuta\Downloads\SecurityCheck.exe
2014-08-05 15:16 - 2014-08-05 15:16 - 02347384 _____ (ESET) C:\Users\Compiuta\Downloads\esetsmartinstaller_deu.exe
2014-08-04 20:17 - 2014-08-04 20:17 - 00036633 _____ () C:\Users\Compiuta\Desktop\FRST2.txt
2014-08-04 20:15 - 2014-08-04 20:15 - 00000828 _____ () C:\Users\Compiuta\Desktop\JRT.txt
2014-08-04 20:12 - 2014-08-04 20:12 - 00000000 ____D () C:\Windows\ERUNT
2014-08-04 20:11 - 2014-08-04 20:11 - 00001446 _____ () C:\Users\Compiuta\Desktop\AdwCleaner[S0].txt
2014-08-04 20:07 - 2014-08-04 20:09 - 00000000 ____D () C:\AdwCleaner
2014-08-04 20:07 - 2014-08-04 20:07 - 00001161 _____ () C:\Users\Compiuta\Desktop\mbam2.txt
2014-08-04 20:06 - 2014-08-04 20:06 - 00001161 _____ () C:\Users\Compiuta\Desktop\mbam.txt
2014-08-04 20:01 - 2014-08-04 20:01 - 01361309 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.302.exe
2014-08-04 20:01 - 2014-08-04 20:01 - 01016261 _____ (Thisisu) C:\Users\Compiuta\Downloads\JRT.exe
2014-08-04 19:32 - 2014-08-04 20:03 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-04 19:32 - 2014-08-04 19:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-08-04 19:31 - 2014-08-04 19:32 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2014-08-04 19:31 - 2014-08-04 19:31 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-04 19:31 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-08-04 19:31 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-08-04 19:31 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-08-04 19:23 - 2014-08-04 19:24 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Compiuta\Downloads\mbam-setup-2.0.2.1012(1).exe
2014-08-03 20:14 - 2014-08-03 20:14 - 00000000 __SHD () C:\Users\Compiuta\AppData\Roaming\0a3
2014-08-03 20:13 - 2014-08-03 20:13 - 00013303 _____ () C:\Users\Compiuta\Desktop\combofix.txt
2014-08-03 20:12 - 2014-08-03 20:12 - 00013303 _____ () C:\ComboFix.txt
2014-08-03 20:06 - 2014-08-03 20:12 - 00000000 ____D () C:\Qoobox
2014-08-03 20:06 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-08-03 20:06 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-08-03 20:06 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-08-03 20:06 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-08-03 20:06 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-08-03 20:06 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-08-03 20:06 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-08-03 20:06 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-08-03 20:05 - 2014-08-03 20:11 - 00000000 ____D () C:\Windows\erdnt
2014-08-03 20:04 - 2014-08-03 20:04 - 00000000 ____D () C:\ProgramData\Panda Security
2014-08-03 20:03 - 2014-08-03 20:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Security
2014-08-03 20:03 - 2014-08-03 20:03 - 00000000 ____D () C:\Program Files\Panda USB Vaccine
2014-08-03 19:20 - 2014-08-03 19:20 - 05566616 ____R (Swearware) C:\Users\Compiuta\Desktop\ComboFix.exe
2014-08-03 19:19 - 2014-08-03 19:20 - 05566616 _____ (Swearware) C:\Users\Compiuta\Downloads\ComboFix.exe
2014-08-03 19:03 - 2014-08-03 19:02 - 00848856 _____ (Panda Security ) C:\Users\Compiuta\Desktop\USBVaccineSetup.exe
2014-08-03 19:01 - 2014-08-03 19:02 - 00848856 _____ (Panda Security ) C:\Users\Compiuta\Downloads\USBVaccineSetup.exe
2014-08-03 18:07 - 2014-08-03 18:07 - 00000993 _____ () C:\Users\Compiuta\Desktop\gmer.txt
2014-08-03 17:32 - 2014-08-04 20:25 - 00034710 _____ () C:\Users\Compiuta\Desktop\Antivir.odt
2014-08-03 17:28 - 2014-08-03 17:28 - 00380416 _____ () C:\Users\Compiuta\Downloads\Gmer-19357.exe
2014-08-03 17:27 - 2014-08-03 13:18 - 00000478 _____ () C:\Users\Compiuta\Desktop\defogger_disable.log
2014-08-03 17:24 - 2014-08-05 16:43 - 00008971 _____ () C:\Users\Compiuta\Desktop\FRST.txt
2014-08-03 17:24 - 2014-08-03 15:57 - 00023276 _____ () C:\Users\Compiuta\Desktop\Addition.txt
2014-08-03 15:56 - 2014-08-03 15:57 - 00023276 _____ () C:\Users\Compiuta\Downloads\Addition.txt
2014-08-03 15:55 - 2014-08-05 16:43 - 00000000 ____D () C:\FRST
2014-08-03 15:55 - 2014-08-03 15:57 - 00030941 _____ () C:\Users\Compiuta\Downloads\FRST.txt
2014-08-03 15:50 - 2014-08-03 15:50 - 01084928 _____ (Farbar) C:\Users\Compiuta\Desktop\FRST.exe
2014-08-03 13:18 - 2014-08-03 13:18 - 00000478 _____ () C:\Users\Compiuta\Downloads\defogger_disable.log
2014-08-03 13:18 - 2014-08-03 13:18 - 00000000 _____ () C:\Users\Compiuta\defogger_reenable
2014-08-03 13:04 - 2014-08-03 13:04 - 00050477 _____ () C:\Users\Compiuta\Downloads\Defogger.exe
2014-08-03 10:57 - 2014-08-03 10:57 - 00000000 ____D () C:\Program Files\Panda Security
2014-08-03 10:57 - 2013-04-29 09:17 - 00047632 _____ (Panda Security, S.L.) C:\Windows\system32\Drivers\PSKMAD.sys
2014-08-03 10:43 - 2014-08-03 10:43 - 30412088 _____ (Panda Security ) C:\Users\Compiuta\Downloads\PandaCloudCleaner.exe
2014-08-03 10:42 - 2014-05-14 18:23 - 01973728 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-08-03 10:42 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-08-03 10:42 - 2014-05-14 18:23 - 00054240 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-08-03 10:42 - 2014-05-14 18:23 - 00045536 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-08-03 10:42 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-08-03 10:42 - 2014-05-14 18:17 - 02425856 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-08-03 10:42 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-08-03 10:41 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-08-03 10:41 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-07-31 11:12 - 2014-07-31 11:12 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-07-24 15:56 - 2014-07-24 15:56 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Compiuta\Downloads\mbam-setup-2.0.2.1012.exe
2014-07-24 15:45 - 2014-07-24 15:45 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216(2).exe
2014-07-24 15:28 - 2014-07-24 15:28 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216(1).exe
2014-07-24 15:21 - 2014-07-24 15:21 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216.exe
2014-07-24 01:07 - 2014-07-24 01:07 - 00000000 __SHD () C:\0b64
2014-07-21 20:05 - 2014-07-21 20:05 - 00000000 ____D () C:\Users\Compiuta\Desktop\Neuer Ordner
2014-07-20 04:40 - 2014-07-20 04:46 - 00009008 _____ () C:\Users\Compiuta\AppData\Roaming\.freeciv-client-rc-2.4
2014-07-20 04:35 - 2014-07-20 04:42 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\.freeciv
2014-07-19 22:08 - 2014-07-19 22:26 - 00000000 ____D () C:\Users\Compiuta\Desktop\Neuer Ordner (2)
2014-07-19 22:07 - 2014-07-19 22:08 - 11861420 _____ () C:\Users\Compiuta\Downloads\Gmail(1).zip
2014-07-19 22:07 - 2014-07-19 22:08 - 11811633 _____ () C:\Users\Compiuta\Downloads\Gmail.zip
2014-07-19 21:50 - 2014-07-19 21:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Freeciv 2.4.2 (GTK+2 client)
2014-07-19 21:50 - 2014-07-19 21:50 - 00000000 ____D () C:\Program Files\Freeciv-2.4.2-gtk2
2014-07-19 20:56 - 2014-07-19 20:57 - 28215140 _____ () C:\Users\Compiuta\Downloads\Freeciv-2.4.2-win32-gtk2-setup.exe
2014-07-19 01:40 - 2014-07-24 15:57 - 00000000 ____D () C:\Users\Compiuta\Desktop\abog
2014-07-17 17:24 - 2014-07-17 17:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-07-17 17:24 - 2014-07-17 17:24 - 00000000 ____D () C:\Program Files\Common Files\Java
2014-07-17 17:24 - 2014-07-11 03:02 - 00096680 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-07-17 17:24 - 2014-07-11 02:56 - 00272808 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-07-17 17:24 - 2014-07-11 02:56 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-07-17 17:24 - 2014-07-11 02:55 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-07-14 19:55 - 2014-07-14 20:06 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\Audacity
2014-07-09 18:24 - 2014-06-20 21:39 - 00240824 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-07-09 18:24 - 2014-06-19 02:16 - 17276416 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-07-09 18:24 - 2014-06-19 01:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-07-09 18:24 - 2014-06-19 01:56 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-07-09 18:24 - 2014-06-19 01:38 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-07-09 18:24 - 2014-06-19 01:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-07-09 18:24 - 2014-06-19 01:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-07-09 18:24 - 2014-06-19 01:35 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-07-09 18:24 - 2014-06-19 01:32 - 02179072 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-07-09 18:24 - 2014-06-19 01:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-07-09 18:24 - 2014-06-19 01:28 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-07-09 18:24 - 2014-06-19 01:25 - 00442368 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-07-09 18:24 - 2014-06-19 01:23 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-07-09 18:24 - 2014-06-19 01:23 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-07-09 18:24 - 2014-06-19 01:22 - 00592896 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-07-09 18:24 - 2014-06-19 01:16 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-07-09 18:24 - 2014-06-19 01:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-07-09 18:24 - 2014-06-19 01:06 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-07-09 18:24 - 2014-06-19 01:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-07-09 18:24 - 2014-06-19 00:59 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-07-09 18:24 - 2014-06-19 00:58 - 00239616 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-07-09 18:24 - 2014-06-19 00:52 - 04254720 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-07-09 18:24 - 2014-06-19 00:52 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-07-09 18:24 - 2014-06-19 00:49 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-07-09 18:24 - 2014-06-19 00:46 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-07-09 18:24 - 2014-06-19 00:45 - 01964544 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-07-09 18:24 - 2014-06-19 00:35 - 11742208 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-07-09 18:24 - 2014-06-19 00:13 - 01791488 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-07-09 18:24 - 2014-06-19 00:09 - 01139200 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-07-09 18:24 - 2014-06-19 00:07 - 00704512 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-07-09 17:14 - 2014-06-05 16:26 - 01059840 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-07-09 17:02 - 2014-06-18 03:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2014-07-09 17:02 - 2014-06-18 02:52 - 02350080 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-07-09 17:02 - 2014-06-06 11:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-07-09 17:02 - 2014-05-30 08:36 - 00338944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-07-08 14:33 - 2014-07-08 14:33 - 00284564 _____ () C:\Windows\msxml4-KB954430-enu.LOG
2014-07-08 14:33 - 2014-07-08 14:33 - 00000000 ____D () C:\Program Files\MSXML 4.0
2014-07-08 14:32 - 2014-07-08 14:33 - 00291106 _____ () C:\Windows\msxml4-KB973688-enu.LOG
2014-07-06 23:19 - 2014-07-06 23:46 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\VoipStunt
2014-07-06 23:19 - 2014-07-06 23:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VoipStunt
2014-07-06 23:19 - 2014-07-06 23:19 - 00000000 ____D () C:\Program Files\VoipStunt.com
2014-07-06 23:17 - 2014-07-06 23:17 - 06569296 _____ (Finarea S.A. Switzerland ) C:\Users\Compiuta\Downloads\setupVoipStunt.exe
2014-07-06 19:43 - 2014-07-19 22:26 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\XnView
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_motusbdevice_01007.Wdf
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_Motousbnet_01007.Wdf
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_motmodem_01007.Wdf
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_motfilt_01007.Wdf
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_motccgpfl_01007.Wdf
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_motccgp_01007.Wdf
2014-07-06 19:08 - 2014-07-06 19:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Motorola
2014-07-06 19:08 - 2014-07-06 19:08 - 00000000 ____D () C:\Program Files\Motorola
2014-07-06 19:08 - 2014-07-06 19:08 - 00000000 ____D () C:\Program Files\Common Files\Motorola Shared
2014-07-06 18:51 - 2014-04-11 10:39 - 00184192 _____ (DEVGURU Co., LTD.(www.devguru.co.kr)) C:\Windows\system32\Drivers\ssudmdm.sys
2014-07-06 18:51 - 2014-04-11 10:39 - 00089856 _____ (DEVGURU Co., LTD.(www.devguru.co.kr)) C:\Windows\system32\Drivers\ssudbus.sys

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-05 16:43 - 2014-08-03 17:24 - 00008971 _____ () C:\Users\Compiuta\Desktop\FRST.txt
2014-08-05 16:43 - 2014-08-03 15:55 - 00000000 ____D () C:\FRST
2014-08-05 16:42 - 2014-08-05 16:42 - 00037658 _____ () C:\Users\Compiuta\Desktop\FRST3.txt
2014-08-05 16:41 - 2014-08-05 16:41 - 00000759 _____ () C:\Users\Compiuta\Desktop\checkup.txt
2014-08-05 16:38 - 2014-04-21 12:24 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\BitTorrent Sync
2014-08-05 16:35 - 2014-08-05 16:35 - 00854410 _____ () C:\Users\Compiuta\Downloads\SecurityCheck.exe
2014-08-05 16:35 - 2009-07-14 06:34 - 00022208 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-05 16:35 - 2009-07-14 06:34 - 00022208 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-05 16:32 - 2010-11-20 23:01 - 01618320 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-08-05 16:31 - 2014-01-04 20:06 - 01246385 _____ () C:\Windows\WindowsUpdate.log
2014-08-05 16:30 - 2014-04-21 21:52 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\Skype
2014-08-05 16:28 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-05 16:28 - 2009-07-14 06:39 - 00041621 _____ () C:\Windows\setupact.log
2014-08-05 15:16 - 2014-08-05 15:16 - 02347384 _____ (ESET) C:\Users\Compiuta\Downloads\esetsmartinstaller_deu.exe
2014-08-05 15:04 - 2014-05-17 16:36 - 00001132 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4045813022-1567936593-3779010734-1000UA.job
2014-08-05 15:03 - 2014-04-29 21:30 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-08-05 08:27 - 2014-05-17 16:36 - 00001080 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4045813022-1567936593-3779010734-1000Core.job
2014-08-04 20:25 - 2014-08-03 17:32 - 00034710 _____ () C:\Users\Compiuta\Desktop\Antivir.odt
2014-08-04 20:17 - 2014-08-04 20:17 - 00036633 _____ () C:\Users\Compiuta\Desktop\FRST2.txt
2014-08-04 20:15 - 2014-08-04 20:15 - 00000828 _____ () C:\Users\Compiuta\Desktop\JRT.txt
2014-08-04 20:12 - 2014-08-04 20:12 - 00000000 ____D () C:\Windows\ERUNT
2014-08-04 20:11 - 2014-08-04 20:11 - 00001446 _____ () C:\Users\Compiuta\Desktop\AdwCleaner[S0].txt
2014-08-04 20:10 - 2010-11-20 23:48 - 00111524 _____ () C:\Windows\PFRO.log
2014-08-04 20:09 - 2014-08-04 20:07 - 00000000 ____D () C:\AdwCleaner
2014-08-04 20:07 - 2014-08-04 20:07 - 00001161 _____ () C:\Users\Compiuta\Desktop\mbam2.txt
2014-08-04 20:06 - 2014-08-04 20:06 - 00001161 _____ () C:\Users\Compiuta\Desktop\mbam.txt
2014-08-04 20:03 - 2014-08-04 19:32 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-04 20:01 - 2014-08-04 20:01 - 01361309 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.302.exe
2014-08-04 20:01 - 2014-08-04 20:01 - 01016261 _____ (Thisisu) C:\Users\Compiuta\Downloads\JRT.exe
2014-08-04 19:32 - 2014-08-04 19:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-08-04 19:32 - 2014-08-04 19:31 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2014-08-04 19:31 - 2014-08-04 19:31 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-04 19:24 - 2014-08-04 19:23 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Compiuta\Downloads\mbam-setup-2.0.2.1012(1).exe
2014-08-03 20:14 - 2014-08-03 20:14 - 00000000 __SHD () C:\Users\Compiuta\AppData\Roaming\0a3
2014-08-03 20:13 - 2014-08-03 20:13 - 00013303 _____ () C:\Users\Compiuta\Desktop\combofix.txt
2014-08-03 20:12 - 2014-08-03 20:12 - 00013303 _____ () C:\ComboFix.txt
2014-08-03 20:12 - 2014-08-03 20:06 - 00000000 ____D () C:\Qoobox
2014-08-03 20:12 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public
2014-08-03 20:11 - 2014-08-03 20:05 - 00000000 ____D () C:\Windows\erdnt
2014-08-03 20:11 - 2009-07-14 04:04 - 00000215 _____ () C:\Windows\system.ini
2014-08-03 20:04 - 2014-08-03 20:04 - 00000000 ____D () C:\ProgramData\Panda Security
2014-08-03 20:03 - 2014-08-03 20:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Security
2014-08-03 20:03 - 2014-08-03 20:03 - 00000000 ____D () C:\Program Files\Panda USB Vaccine
2014-08-03 19:20 - 2014-08-03 19:20 - 05566616 ____R (Swearware) C:\Users\Compiuta\Desktop\ComboFix.exe
2014-08-03 19:20 - 2014-08-03 19:19 - 05566616 _____ (Swearware) C:\Users\Compiuta\Downloads\ComboFix.exe
2014-08-03 19:02 - 2014-08-03 19:03 - 00848856 _____ (Panda Security ) C:\Users\Compiuta\Desktop\USBVaccineSetup.exe
2014-08-03 19:02 - 2014-08-03 19:01 - 00848856 _____ (Panda Security ) C:\Users\Compiuta\Downloads\USBVaccineSetup.exe
2014-08-03 18:07 - 2014-08-03 18:07 - 00000993 _____ () C:\Users\Compiuta\Desktop\gmer.txt
2014-08-03 17:28 - 2014-08-03 17:28 - 00380416 _____ () C:\Users\Compiuta\Downloads\Gmer-19357.exe
2014-08-03 15:57 - 2014-08-03 17:24 - 00023276 _____ () C:\Users\Compiuta\Desktop\Addition.txt
2014-08-03 15:57 - 2014-08-03 15:56 - 00023276 _____ () C:\Users\Compiuta\Downloads\Addition.txt
2014-08-03 15:57 - 2014-08-03 15:55 - 00030941 _____ () C:\Users\Compiuta\Downloads\FRST.txt
2014-08-03 15:50 - 2014-08-03 15:50 - 01084928 _____ (Farbar) C:\Users\Compiuta\Desktop\FRST.exe
2014-08-03 13:18 - 2014-08-03 17:27 - 00000478 _____ () C:\Users\Compiuta\Desktop\defogger_disable.log
2014-08-03 13:18 - 2014-08-03 13:18 - 00000478 _____ () C:\Users\Compiuta\Downloads\defogger_disable.log
2014-08-03 13:18 - 2014-08-03 13:18 - 00000000 _____ () C:\Users\Compiuta\defogger_reenable
2014-08-03 13:18 - 2014-01-04 20:28 - 00000000 ____D () C:\Users\Compiuta
2014-08-03 13:04 - 2014-08-03 13:04 - 00050477 _____ () C:\Users\Compiuta\Downloads\Defogger.exe
2014-08-03 10:57 - 2014-08-03 10:57 - 00000000 ____D () C:\Program Files\Panda Security
2014-08-03 10:55 - 2014-04-21 15:31 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-08-03 10:48 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-08-03 10:43 - 2014-08-03 10:43 - 30412088 _____ (Panda Security ) C:\Users\Compiuta\Downloads\PandaCloudCleaner.exe
2014-07-31 15:53 - 2014-04-23 11:00 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\vlc
2014-07-31 11:12 - 2014-07-31 11:12 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-07-24 18:50 - 2014-04-21 17:30 - 00035848 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-07-24 15:57 - 2014-07-19 01:40 - 00000000 ____D () C:\Users\Compiuta\Desktop\abog
2014-07-24 15:56 - 2014-07-24 15:56 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Compiuta\Downloads\mbam-setup-2.0.2.1012.exe
2014-07-24 15:45 - 2014-07-24 15:45 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216(2).exe
2014-07-24 15:28 - 2014-07-24 15:28 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216(1).exe
2014-07-24 15:21 - 2014-07-24 15:21 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216.exe
2014-07-24 03:33 - 2014-04-20 19:34 - 00000000 ____D () C:\BtSync
2014-07-24 01:07 - 2014-07-24 01:07 - 00000000 __SHD () C:\0b64
2014-07-23 10:52 - 2014-04-21 15:10 - 00231584 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-07-21 20:05 - 2014-07-21 20:05 - 00000000 ____D () C:\Users\Compiuta\Desktop\Neuer Ordner
2014-07-20 04:46 - 2014-07-20 04:40 - 00009008 _____ () C:\Users\Compiuta\AppData\Roaming\.freeciv-client-rc-2.4
2014-07-20 04:42 - 2014-07-20 04:35 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\.freeciv
2014-07-19 22:26 - 2014-07-19 22:08 - 00000000 ____D () C:\Users\Compiuta\Desktop\Neuer Ordner (2)
2014-07-19 22:26 - 2014-07-06 19:43 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\XnView
2014-07-19 22:13 - 2014-04-21 16:58 - 00000000 ____D () C:\Users\Compiuta\AppData\Local\Paint.NET
2014-07-19 22:09 - 2014-01-04 21:11 - 00000000 ____D () C:\Users\Compiuta\Desktop\Soundfiles
2014-07-19 22:08 - 2014-07-19 22:07 - 11861420 _____ () C:\Users\Compiuta\Downloads\Gmail(1).zip
2014-07-19 22:08 - 2014-07-19 22:07 - 11811633 _____ () C:\Users\Compiuta\Downloads\Gmail.zip
2014-07-19 21:50 - 2014-07-19 21:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Freeciv 2.4.2 (GTK+2 client)
2014-07-19 21:50 - 2014-07-19 21:50 - 00000000 ____D () C:\Program Files\Freeciv-2.4.2-gtk2
2014-07-19 20:57 - 2014-07-19 20:56 - 28215140 _____ () C:\Users\Compiuta\Downloads\Freeciv-2.4.2-win32-gtk2-setup.exe
2014-07-18 18:03 - 2014-06-13 03:24 - 00000000 ____D () C:\Users\Compiuta\AppData\Local\Adobe
2014-07-17 17:24 - 2014-07-17 17:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-07-17 17:24 - 2014-07-17 17:24 - 00000000 ____D () C:\Program Files\Common Files\Java
2014-07-17 17:24 - 2014-05-02 10:24 - 00000000 ____D () C:\ProgramData\Oracle
2014-07-17 17:24 - 2014-05-02 10:24 - 00000000 ____D () C:\Program Files\Java
2014-07-15 15:54 - 2014-04-21 21:39 - 00000000 ____D () C:\Windows\system32\MRT
2014-07-15 15:52 - 2014-04-21 21:39 - 93585272 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-07-15 02:55 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2014-07-14 22:33 - 2014-06-03 23:45 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\FileZilla
2014-07-14 20:12 - 2014-06-03 23:45 - 04996210 _____ (Tim Kosse) C:\Users\Compiuta\Downloads\FileZilla_3.8.1_win32-setup.exe
2014-07-14 20:12 - 2014-04-21 15:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client
2014-07-14 20:12 - 2014-04-21 15:41 - 00000000 ____D () C:\Program Files\FileZilla FTP Client
2014-07-14 20:06 - 2014-07-14 19:55 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\Audacity
2014-07-14 06:12 - 2014-04-27 14:19 - 00000000 ____D () C:\Users\1
2014-07-12 05:40 - 2014-01-04 20:58 - 00000000 ____D () C:\Users\Compiuta\Desktop\Flugtickets
2014-07-11 03:02 - 2014-07-17 17:24 - 00096680 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-07-11 02:56 - 2014-07-17 17:24 - 00272808 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-07-11 02:56 - 2014-07-17 17:24 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-07-11 02:55 - 2014-07-17 17:24 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-07-10 01:18 - 2010-11-21 02:55 - 00000000 ____D () C:\Program Files\Windows Journal
2014-07-10 01:18 - 2009-07-14 06:33 - 00324032 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-07-09 01:59 - 2014-04-29 21:30 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-07-09 01:59 - 2014-04-29 21:30 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-07-08 14:33 - 2014-07-08 14:33 - 00284564 _____ () C:\Windows\msxml4-KB954430-enu.LOG
2014-07-08 14:33 - 2014-07-08 14:33 - 00000000 ____D () C:\Program Files\MSXML 4.0
2014-07-08 14:33 - 2014-07-08 14:32 - 00291106 _____ () C:\Windows\msxml4-KB973688-enu.LOG
2014-07-06 23:46 - 2014-07-06 23:19 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\VoipStunt
2014-07-06 23:19 - 2014-07-06 23:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VoipStunt
2014-07-06 23:19 - 2014-07-06 23:19 - 00000000 ____D () C:\Program Files\VoipStunt.com
2014-07-06 23:17 - 2014-07-06 23:17 - 06569296 _____ (Finarea S.A. Switzerland ) C:\Users\Compiuta\Downloads\setupVoipStunt.exe
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_motusbdevice_01007.Wdf
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_Motousbnet_01007.Wdf
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_motmodem_01007.Wdf
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_motfilt_01007.Wdf
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_motccgpfl_01007.Wdf
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_motccgp_01007.Wdf
2014-07-06 19:09 - 2014-01-04 20:28 - 00000000 ____D () C:\Users\Compiuta\AppData\Local\VirtualStore
2014-07-06 19:08 - 2014-07-06 19:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Motorola
2014-07-06 19:08 - 2014-07-06 19:08 - 00000000 ____D () C:\Program Files\Motorola
2014-07-06 19:08 - 2014-07-06 19:08 - 00000000 ____D () C:\Program Files\Common Files\Motorola Shared

Some content of TEMP:
====================
C:\Users\1\AppData\Local\temp\avgnt.exe
C:\Users\Compiuta\AppData\Local\temp\avgnt.exe
C:\Users\Compiuta\AppData\Local\temp\Quarantine.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-07-15 01:40

==================== End Of Log ============================
--- --- ---


Zu der Frage, ob noch Probleme bestehen: Nun ja, es kommt mir sehr komisch vor, dass ich im Normalmodus keine Anti-Virus-/Anti-Malware-Software installieren kann, da irgendwas das blockiert. Zudem Meldete ESET zwei Trojanerfunde, was ich beunruhigend finde.

!!DANKE!!
Liebe Grüße,
Fred

schrauber 05.08.2014 20:39
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
C:\Users\Compiuta\AppData\Roaming\0a3
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [1c2b1] => C:\Users\Compiuta\AppData\Roaming\0a3\1c2b1.js [46974 2014-08-05] ()
Startup: C:\Users\Compiuta\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4f694.js ()

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.




Frisches FRST log bitte.

Freiseflei 06.08.2014 08:15
Hi Schrauber,

hier nun das Fixlog von FRST:

Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version:2-08-2014
Ran by Compiuta at 2014-08-06 09:11:42 Run:1
Running from C:\Users\Compiuta\Desktop
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
C:\Users\Compiuta\AppData\Roaming\0a3
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [1c2b1] => C:\Users\Compiuta\AppData\Roaming\0a3\1c2b1.js [46974 2014-08-05] ()
Startup: C:\Users\Compiuta\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4f694.js ()
*****************

C:\Users\Compiuta\AppData\Roaming\0a3 => Moved successfully.
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\Software\Microsoft\Windows\CurrentVersion\Run\\1c2b1 => value deleted successfully.
C:\Users\Compiuta\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4f694.js not found.

==== End of Fixlog ====
Und nun ein frisches FRST Log:


FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:2-08-2014
Ran by Compiuta (administrator) on COMPIUTA-PC on 06-08-2014 09:13:48
Running from C:\Users\Compiuta\Desktop
Platform: Microsoft Windows 7 Professional  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(ABBYY) C:\Program Files\ABBYY PDF Transformer 3.0\NetworkLicenseServer.exe
(Andrea Electronics Corporation) C:\Windows\System32\AEADISRV.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
() C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe
(Conexant Systems, Inc.) C:\Windows\System32\drivers\XAudio.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
() C:\Program Files\Motorola\MotoHelper\MotoHelperAgent.exe
(Analog Devices, Inc.) C:\Program Files\Analog Devices\Core\smax4pnp.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(BitTorrent, Inc.) C:\Program Files\BitTorrent Sync\BTSync.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
(Samsung) C:\Program Files\Samsung\Kies\Kies.exe
(ABBYY) C:\Program Files\ABBYY PDF Transformer 3.0\Bonus.ScreenshotReader.exe
(Microsoft Corporation) C:\Windows\System32\wscript.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Adobe Systems Incorporated) C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe
(Adobe Systems Incorporated) C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe
(Swiss Academic Software) C:\Program Files\Citavi 3\bin\Citavi.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_14_0_0_145.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_14_0_0_145.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [BitTorrent Sync] => C:\Program Files\BitTorrent Sync\BTSync.exe [3020136 2014-06-27] (BitTorrent, Inc.)
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [20917408 2014-02-10] (Skype Technologies S.A.)
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [KiesPreload] => C:\Program Files\Samsung\Kies\Kies.exe [1563440 2014-06-14] (Samsung)
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [ABBYY Screenshot Reader Bonus] => C:\Program Files\ABBYY PDF Transformer 3.0\Bonus.ScreenshotReader.exe [939272 2014-04-23] (ABBYY)
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [VoipStunt] => C:\Program Files\VoipStunt.com\VoipStunt\VoipStunt.exe [19768640 2014-02-11] (VoipStunt)
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [1c2b1] => C:\Users\Compiuta\AppData\Roaming\0a3\1c2b1.js
Startup: C:\Users\Compiuta\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\414.js ()

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xECE210E7535DCF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
BHO: SwissAcademic.Citavi.Picker.IEPicker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Compiuta\AppData\Roaming\Mozilla\Firefox\Profiles\kpvwewrm.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin: @java.com/DTPlugin,version=10.65.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.65.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @talk.google.com/GoogleTalkPlugin - C:\Users\Compiuta\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin HKCU: @talk.google.com/O1DPlugin - C:\Users\Compiuta\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Compiuta\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Compiuta\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\Compiuta\AppData\Roaming\mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin ProgramFiles/Appdata: C:\Users\Compiuta\AppData\Roaming\mozilla\plugins\npo1d.dll (Google)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF HKLM\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2014-04-21]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 ABBYY.Licensing.PDFTransformer.Classic.3.0; C:\Program Files\ABBYY PDF Transformer 3.0\NetworkLicenseServer.exe [759048 2014-04-23] (ABBYY)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-07-04] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-07-04] (Avira Operations GmbH & Co. KG)
R2 MotoHelper; C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe [223088 2011-04-26] ()

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [97648 2014-07-04] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-05-27] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2014-02-25] (Avira Operations GmbH & Co. KG)
S3 e1express; C:\Windows\System32\DRIVERS\e1e6232.sys [232312 2012-10-30] (Intel Corporation)
S3 PSKMAD; C:\Windows\System32\DRIVERS\PSKMAD.sys [47632 2013-04-29] (Panda Security, S.L.)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2014-02-25] (Avira GmbH)
S3 catchme; \??\C:\Users\Compiuta\AppData\Local\Temp\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-06 09:11 - 2014-08-06 09:11 - 00000000 __SHD () C:\Users\Compiuta\AppData\Roaming\0a3
2014-08-05 16:42 - 2014-08-05 16:43 - 00037787 _____ () C:\Users\Compiuta\Desktop\FRST3.txt
2014-08-05 16:41 - 2014-08-05 16:41 - 00000759 _____ () C:\Users\Compiuta\Desktop\checkup.txt
2014-08-05 16:35 - 2014-08-05 16:35 - 00854410 _____ () C:\Users\Compiuta\Downloads\SecurityCheck.exe
2014-08-05 15:16 - 2014-08-05 15:16 - 02347384 _____ (ESET) C:\Users\Compiuta\Downloads\esetsmartinstaller_deu.exe
2014-08-04 20:17 - 2014-08-04 20:17 - 00036633 _____ () C:\Users\Compiuta\Desktop\FRST2.txt
2014-08-04 20:15 - 2014-08-04 20:15 - 00000828 _____ () C:\Users\Compiuta\Desktop\JRT.txt
2014-08-04 20:12 - 2014-08-04 20:12 - 00000000 ____D () C:\Windows\ERUNT
2014-08-04 20:11 - 2014-08-04 20:11 - 00001446 _____ () C:\Users\Compiuta\Desktop\AdwCleaner[S0].txt
2014-08-04 20:07 - 2014-08-04 20:09 - 00000000 ____D () C:\AdwCleaner
2014-08-04 20:07 - 2014-08-04 20:07 - 00001161 _____ () C:\Users\Compiuta\Desktop\mbam2.txt
2014-08-04 20:06 - 2014-08-04 20:06 - 00001161 _____ () C:\Users\Compiuta\Desktop\mbam.txt
2014-08-04 20:01 - 2014-08-04 20:01 - 01361309 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.302.exe
2014-08-04 20:01 - 2014-08-04 20:01 - 01016261 _____ (Thisisu) C:\Users\Compiuta\Downloads\JRT.exe
2014-08-04 19:32 - 2014-08-04 20:03 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-04 19:32 - 2014-08-04 19:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-08-04 19:31 - 2014-08-04 19:32 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2014-08-04 19:31 - 2014-08-04 19:31 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-04 19:31 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-08-04 19:31 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-08-04 19:31 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-08-04 19:23 - 2014-08-04 19:24 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Compiuta\Downloads\mbam-setup-2.0.2.1012(1).exe
2014-08-03 20:13 - 2014-08-03 20:13 - 00013303 _____ () C:\Users\Compiuta\Desktop\combofix.txt
2014-08-03 20:12 - 2014-08-03 20:12 - 00013303 _____ () C:\ComboFix.txt
2014-08-03 20:06 - 2014-08-03 20:12 - 00000000 ____D () C:\Qoobox
2014-08-03 20:06 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-08-03 20:06 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-08-03 20:06 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-08-03 20:06 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-08-03 20:06 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-08-03 20:06 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-08-03 20:06 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-08-03 20:06 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-08-03 20:05 - 2014-08-03 20:11 - 00000000 ____D () C:\Windows\erdnt
2014-08-03 20:04 - 2014-08-03 20:04 - 00000000 ____D () C:\ProgramData\Panda Security
2014-08-03 20:03 - 2014-08-03 20:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Security
2014-08-03 20:03 - 2014-08-03 20:03 - 00000000 ____D () C:\Program Files\Panda USB Vaccine
2014-08-03 19:20 - 2014-08-03 19:20 - 05566616 ____R (Swearware) C:\Users\Compiuta\Desktop\ComboFix.exe
2014-08-03 19:19 - 2014-08-03 19:20 - 05566616 _____ (Swearware) C:\Users\Compiuta\Downloads\ComboFix.exe
2014-08-03 19:03 - 2014-08-03 19:02 - 00848856 _____ (Panda Security ) C:\Users\Compiuta\Desktop\USBVaccineSetup.exe
2014-08-03 19:01 - 2014-08-03 19:02 - 00848856 _____ (Panda Security ) C:\Users\Compiuta\Downloads\USBVaccineSetup.exe
2014-08-03 18:07 - 2014-08-03 18:07 - 00000993 _____ () C:\Users\Compiuta\Desktop\gmer.txt
2014-08-03 17:32 - 2014-08-04 20:25 - 00034710 _____ () C:\Users\Compiuta\Desktop\Antivir.odt
2014-08-03 17:28 - 2014-08-03 17:28 - 00380416 _____ () C:\Users\Compiuta\Downloads\Gmer-19357.exe
2014-08-03 17:27 - 2014-08-03 13:18 - 00000478 _____ () C:\Users\Compiuta\Desktop\defogger_disable.log
2014-08-03 17:24 - 2014-08-06 09:13 - 00009559 _____ () C:\Users\Compiuta\Desktop\FRST.txt
2014-08-03 17:24 - 2014-08-03 15:57 - 00023276 _____ () C:\Users\Compiuta\Desktop\Addition.txt
2014-08-03 15:56 - 2014-08-03 15:57 - 00023276 _____ () C:\Users\Compiuta\Downloads\Addition.txt
2014-08-03 15:55 - 2014-08-06 09:13 - 00000000 ____D () C:\FRST
2014-08-03 15:55 - 2014-08-03 15:57 - 00030941 _____ () C:\Users\Compiuta\Downloads\FRST.txt
2014-08-03 15:50 - 2014-08-03 15:50 - 01084928 _____ (Farbar) C:\Users\Compiuta\Desktop\FRST.exe
2014-08-03 13:18 - 2014-08-03 13:18 - 00000478 _____ () C:\Users\Compiuta\Downloads\defogger_disable.log
2014-08-03 13:18 - 2014-08-03 13:18 - 00000000 _____ () C:\Users\Compiuta\defogger_reenable
2014-08-03 13:04 - 2014-08-03 13:04 - 00050477 _____ () C:\Users\Compiuta\Downloads\Defogger.exe
2014-08-03 10:57 - 2014-08-03 10:57 - 00000000 ____D () C:\Program Files\Panda Security
2014-08-03 10:57 - 2013-04-29 09:17 - 00047632 _____ (Panda Security, S.L.) C:\Windows\system32\Drivers\PSKMAD.sys
2014-08-03 10:43 - 2014-08-03 10:43 - 30412088 _____ (Panda Security ) C:\Users\Compiuta\Downloads\PandaCloudCleaner.exe
2014-08-03 10:42 - 2014-05-14 18:23 - 01973728 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-08-03 10:42 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-08-03 10:42 - 2014-05-14 18:23 - 00054240 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-08-03 10:42 - 2014-05-14 18:23 - 00045536 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-08-03 10:42 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-08-03 10:42 - 2014-05-14 18:17 - 02425856 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-08-03 10:42 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-08-03 10:41 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-08-03 10:41 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-07-31 11:12 - 2014-07-31 11:12 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-07-24 15:56 - 2014-07-24 15:56 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Compiuta\Downloads\mbam-setup-2.0.2.1012.exe
2014-07-24 15:45 - 2014-07-24 15:45 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216(2).exe
2014-07-24 15:28 - 2014-07-24 15:28 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216(1).exe
2014-07-24 15:21 - 2014-07-24 15:21 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216.exe
2014-07-24 01:07 - 2014-07-24 01:07 - 00000000 __SHD () C:\0b64
2014-07-21 20:05 - 2014-07-21 20:05 - 00000000 ____D () C:\Users\Compiuta\Desktop\Neuer Ordner
2014-07-20 04:40 - 2014-07-20 04:46 - 00009008 _____ () C:\Users\Compiuta\AppData\Roaming\.freeciv-client-rc-2.4
2014-07-20 04:35 - 2014-07-20 04:42 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\.freeciv
2014-07-19 22:08 - 2014-07-19 22:26 - 00000000 ____D () C:\Users\Compiuta\Desktop\Neuer Ordner (2)
2014-07-19 22:07 - 2014-07-19 22:08 - 11861420 _____ () C:\Users\Compiuta\Downloads\Gmail(1).zip
2014-07-19 22:07 - 2014-07-19 22:08 - 11811633 _____ () C:\Users\Compiuta\Downloads\Gmail.zip
2014-07-19 21:50 - 2014-07-19 21:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Freeciv 2.4.2 (GTK+2 client)
2014-07-19 21:50 - 2014-07-19 21:50 - 00000000 ____D () C:\Program Files\Freeciv-2.4.2-gtk2
2014-07-19 20:56 - 2014-07-19 20:57 - 28215140 _____ () C:\Users\Compiuta\Downloads\Freeciv-2.4.2-win32-gtk2-setup.exe
2014-07-19 01:40 - 2014-07-24 15:57 - 00000000 ____D () C:\Users\Compiuta\Desktop\abog
2014-07-17 17:24 - 2014-07-17 17:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-07-17 17:24 - 2014-07-17 17:24 - 00000000 ____D () C:\Program Files\Common Files\Java
2014-07-17 17:24 - 2014-07-11 03:02 - 00096680 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-07-17 17:24 - 2014-07-11 02:56 - 00272808 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-07-17 17:24 - 2014-07-11 02:56 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-07-17 17:24 - 2014-07-11 02:55 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-07-14 19:55 - 2014-07-14 20:06 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\Audacity
2014-07-09 18:24 - 2014-06-20 21:39 - 00240824 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-07-09 18:24 - 2014-06-19 02:16 - 17276416 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-07-09 18:24 - 2014-06-19 01:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-07-09 18:24 - 2014-06-19 01:56 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-07-09 18:24 - 2014-06-19 01:38 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-07-09 18:24 - 2014-06-19 01:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-07-09 18:24 - 2014-06-19 01:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-07-09 18:24 - 2014-06-19 01:35 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-07-09 18:24 - 2014-06-19 01:32 - 02179072 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-07-09 18:24 - 2014-06-19 01:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-07-09 18:24 - 2014-06-19 01:28 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-07-09 18:24 - 2014-06-19 01:25 - 00442368 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-07-09 18:24 - 2014-06-19 01:23 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-07-09 18:24 - 2014-06-19 01:23 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-07-09 18:24 - 2014-06-19 01:22 - 00592896 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-07-09 18:24 - 2014-06-19 01:16 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-07-09 18:24 - 2014-06-19 01:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-07-09 18:24 - 2014-06-19 01:06 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-07-09 18:24 - 2014-06-19 01:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-07-09 18:24 - 2014-06-19 00:59 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-07-09 18:24 - 2014-06-19 00:58 - 00239616 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-07-09 18:24 - 2014-06-19 00:52 - 04254720 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-07-09 18:24 - 2014-06-19 00:52 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-07-09 18:24 - 2014-06-19 00:49 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-07-09 18:24 - 2014-06-19 00:46 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-07-09 18:24 - 2014-06-19 00:45 - 01964544 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-07-09 18:24 - 2014-06-19 00:35 - 11742208 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-07-09 18:24 - 2014-06-19 00:13 - 01791488 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-07-09 18:24 - 2014-06-19 00:09 - 01139200 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-07-09 18:24 - 2014-06-19 00:07 - 00704512 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-07-09 17:14 - 2014-06-05 16:26 - 01059840 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-07-09 17:02 - 2014-06-18 03:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2014-07-09 17:02 - 2014-06-18 02:52 - 02350080 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-07-09 17:02 - 2014-06-06 11:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-07-09 17:02 - 2014-05-30 08:36 - 00338944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-07-08 14:33 - 2014-07-08 14:33 - 00284564 _____ () C:\Windows\msxml4-KB954430-enu.LOG
2014-07-08 14:33 - 2014-07-08 14:33 - 00000000 ____D () C:\Program Files\MSXML 4.0
2014-07-08 14:32 - 2014-07-08 14:33 - 00291106 _____ () C:\Windows\msxml4-KB973688-enu.LOG

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-06 09:14 - 2014-08-03 17:24 - 00009559 _____ () C:\Users\Compiuta\Desktop\FRST.txt
2014-08-06 09:13 - 2014-08-03 15:55 - 00000000 ____D () C:\FRST
2014-08-06 09:11 - 2014-08-06 09:11 - 00000000 __SHD () C:\Users\Compiuta\AppData\Roaming\0a3
2014-08-06 09:09 - 2010-11-20 23:01 - 01618320 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-08-06 09:07 - 2014-04-29 21:30 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-08-06 09:07 - 2014-04-21 12:24 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\BitTorrent Sync
2014-08-06 08:47 - 2014-05-17 16:36 - 00001132 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4045813022-1567936593-3779010734-1000UA.job
2014-08-06 08:34 - 2014-05-17 16:36 - 00001080 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4045813022-1567936593-3779010734-1000Core.job
2014-08-05 16:43 - 2014-08-05 16:42 - 00037787 _____ () C:\Users\Compiuta\Desktop\FRST3.txt
2014-08-05 16:41 - 2014-08-05 16:41 - 00000759 _____ () C:\Users\Compiuta\Desktop\checkup.txt
2014-08-05 16:35 - 2014-08-05 16:35 - 00854410 _____ () C:\Users\Compiuta\Downloads\SecurityCheck.exe
2014-08-05 16:35 - 2009-07-14 06:34 - 00022208 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-05 16:35 - 2009-07-14 06:34 - 00022208 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-05 16:31 - 2014-01-04 20:06 - 01266318 _____ () C:\Windows\WindowsUpdate.log
2014-08-05 16:30 - 2014-04-21 21:52 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\Skype
2014-08-05 16:28 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-05 16:28 - 2009-07-14 06:39 - 00041621 _____ () C:\Windows\setupact.log
2014-08-05 15:16 - 2014-08-05 15:16 - 02347384 _____ (ESET) C:\Users\Compiuta\Downloads\esetsmartinstaller_deu.exe
2014-08-04 20:25 - 2014-08-03 17:32 - 00034710 _____ () C:\Users\Compiuta\Desktop\Antivir.odt
2014-08-04 20:17 - 2014-08-04 20:17 - 00036633 _____ () C:\Users\Compiuta\Desktop\FRST2.txt
2014-08-04 20:15 - 2014-08-04 20:15 - 00000828 _____ () C:\Users\Compiuta\Desktop\JRT.txt
2014-08-04 20:12 - 2014-08-04 20:12 - 00000000 ____D () C:\Windows\ERUNT
2014-08-04 20:11 - 2014-08-04 20:11 - 00001446 _____ () C:\Users\Compiuta\Desktop\AdwCleaner[S0].txt
2014-08-04 20:10 - 2010-11-20 23:48 - 00111524 _____ () C:\Windows\PFRO.log
2014-08-04 20:09 - 2014-08-04 20:07 - 00000000 ____D () C:\AdwCleaner
2014-08-04 20:07 - 2014-08-04 20:07 - 00001161 _____ () C:\Users\Compiuta\Desktop\mbam2.txt
2014-08-04 20:06 - 2014-08-04 20:06 - 00001161 _____ () C:\Users\Compiuta\Desktop\mbam.txt
2014-08-04 20:03 - 2014-08-04 19:32 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-04 20:01 - 2014-08-04 20:01 - 01361309 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.302.exe
2014-08-04 20:01 - 2014-08-04 20:01 - 01016261 _____ (Thisisu) C:\Users\Compiuta\Downloads\JRT.exe
2014-08-04 19:32 - 2014-08-04 19:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-08-04 19:32 - 2014-08-04 19:31 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2014-08-04 19:31 - 2014-08-04 19:31 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-04 19:24 - 2014-08-04 19:23 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Compiuta\Downloads\mbam-setup-2.0.2.1012(1).exe
2014-08-03 20:13 - 2014-08-03 20:13 - 00013303 _____ () C:\Users\Compiuta\Desktop\combofix.txt
2014-08-03 20:12 - 2014-08-03 20:12 - 00013303 _____ () C:\ComboFix.txt
2014-08-03 20:12 - 2014-08-03 20:06 - 00000000 ____D () C:\Qoobox
2014-08-03 20:12 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public
2014-08-03 20:11 - 2014-08-03 20:05 - 00000000 ____D () C:\Windows\erdnt
2014-08-03 20:11 - 2009-07-14 04:04 - 00000215 _____ () C:\Windows\system.ini
2014-08-03 20:04 - 2014-08-03 20:04 - 00000000 ____D () C:\ProgramData\Panda Security
2014-08-03 20:03 - 2014-08-03 20:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Security
2014-08-03 20:03 - 2014-08-03 20:03 - 00000000 ____D () C:\Program Files\Panda USB Vaccine
2014-08-03 19:20 - 2014-08-03 19:20 - 05566616 ____R (Swearware) C:\Users\Compiuta\Desktop\ComboFix.exe
2014-08-03 19:20 - 2014-08-03 19:19 - 05566616 _____ (Swearware) C:\Users\Compiuta\Downloads\ComboFix.exe
2014-08-03 19:02 - 2014-08-03 19:03 - 00848856 _____ (Panda Security ) C:\Users\Compiuta\Desktop\USBVaccineSetup.exe
2014-08-03 19:02 - 2014-08-03 19:01 - 00848856 _____ (Panda Security ) C:\Users\Compiuta\Downloads\USBVaccineSetup.exe
2014-08-03 18:07 - 2014-08-03 18:07 - 00000993 _____ () C:\Users\Compiuta\Desktop\gmer.txt
2014-08-03 17:28 - 2014-08-03 17:28 - 00380416 _____ () C:\Users\Compiuta\Downloads\Gmer-19357.exe
2014-08-03 15:57 - 2014-08-03 17:24 - 00023276 _____ () C:\Users\Compiuta\Desktop\Addition.txt
2014-08-03 15:57 - 2014-08-03 15:56 - 00023276 _____ () C:\Users\Compiuta\Downloads\Addition.txt
2014-08-03 15:57 - 2014-08-03 15:55 - 00030941 _____ () C:\Users\Compiuta\Downloads\FRST.txt
2014-08-03 15:50 - 2014-08-03 15:50 - 01084928 _____ (Farbar) C:\Users\Compiuta\Desktop\FRST.exe
2014-08-03 13:18 - 2014-08-03 17:27 - 00000478 _____ () C:\Users\Compiuta\Desktop\defogger_disable.log
2014-08-03 13:18 - 2014-08-03 13:18 - 00000478 _____ () C:\Users\Compiuta\Downloads\defogger_disable.log
2014-08-03 13:18 - 2014-08-03 13:18 - 00000000 _____ () C:\Users\Compiuta\defogger_reenable
2014-08-03 13:18 - 2014-01-04 20:28 - 00000000 ____D () C:\Users\Compiuta
2014-08-03 13:04 - 2014-08-03 13:04 - 00050477 _____ () C:\Users\Compiuta\Downloads\Defogger.exe
2014-08-03 10:57 - 2014-08-03 10:57 - 00000000 ____D () C:\Program Files\Panda Security
2014-08-03 10:55 - 2014-04-21 15:31 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-08-03 10:48 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-08-03 10:43 - 2014-08-03 10:43 - 30412088 _____ (Panda Security ) C:\Users\Compiuta\Downloads\PandaCloudCleaner.exe
2014-07-31 15:53 - 2014-04-23 11:00 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\vlc
2014-07-31 11:12 - 2014-07-31 11:12 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-07-24 18:50 - 2014-04-21 17:30 - 00035848 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-07-24 15:57 - 2014-07-19 01:40 - 00000000 ____D () C:\Users\Compiuta\Desktop\abog
2014-07-24 15:56 - 2014-07-24 15:56 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Compiuta\Downloads\mbam-setup-2.0.2.1012.exe
2014-07-24 15:45 - 2014-07-24 15:45 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216(2).exe
2014-07-24 15:28 - 2014-07-24 15:28 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216(1).exe
2014-07-24 15:21 - 2014-07-24 15:21 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216.exe
2014-07-24 03:33 - 2014-04-20 19:34 - 00000000 ____D () C:\BtSync
2014-07-24 01:07 - 2014-07-24 01:07 - 00000000 __SHD () C:\0b64
2014-07-23 10:52 - 2014-04-21 15:10 - 00231584 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-07-21 20:05 - 2014-07-21 20:05 - 00000000 ____D () C:\Users\Compiuta\Desktop\Neuer Ordner
2014-07-20 04:46 - 2014-07-20 04:40 - 00009008 _____ () C:\Users\Compiuta\AppData\Roaming\.freeciv-client-rc-2.4
2014-07-20 04:42 - 2014-07-20 04:35 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\.freeciv
2014-07-19 22:26 - 2014-07-19 22:08 - 00000000 ____D () C:\Users\Compiuta\Desktop\Neuer Ordner (2)
2014-07-19 22:26 - 2014-07-06 19:43 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\XnView
2014-07-19 22:13 - 2014-04-21 16:58 - 00000000 ____D () C:\Users\Compiuta\AppData\Local\Paint.NET
2014-07-19 22:09 - 2014-01-04 21:11 - 00000000 ____D () C:\Users\Compiuta\Desktop\Soundfiles
2014-07-19 22:08 - 2014-07-19 22:07 - 11861420 _____ () C:\Users\Compiuta\Downloads\Gmail(1).zip
2014-07-19 22:08 - 2014-07-19 22:07 - 11811633 _____ () C:\Users\Compiuta\Downloads\Gmail.zip
2014-07-19 21:50 - 2014-07-19 21:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Freeciv 2.4.2 (GTK+2 client)
2014-07-19 21:50 - 2014-07-19 21:50 - 00000000 ____D () C:\Program Files\Freeciv-2.4.2-gtk2
2014-07-19 20:57 - 2014-07-19 20:56 - 28215140 _____ () C:\Users\Compiuta\Downloads\Freeciv-2.4.2-win32-gtk2-setup.exe
2014-07-18 18:03 - 2014-06-13 03:24 - 00000000 ____D () C:\Users\Compiuta\AppData\Local\Adobe
2014-07-17 17:24 - 2014-07-17 17:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-07-17 17:24 - 2014-07-17 17:24 - 00000000 ____D () C:\Program Files\Common Files\Java
2014-07-17 17:24 - 2014-05-02 10:24 - 00000000 ____D () C:\ProgramData\Oracle
2014-07-17 17:24 - 2014-05-02 10:24 - 00000000 ____D () C:\Program Files\Java
2014-07-15 15:54 - 2014-04-21 21:39 - 00000000 ____D () C:\Windows\system32\MRT
2014-07-15 15:52 - 2014-04-21 21:39 - 93585272 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-07-15 02:55 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2014-07-14 22:33 - 2014-06-03 23:45 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\FileZilla
2014-07-14 20:12 - 2014-06-03 23:45 - 04996210 _____ (Tim Kosse) C:\Users\Compiuta\Downloads\FileZilla_3.8.1_win32-setup.exe
2014-07-14 20:12 - 2014-04-21 15:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client
2014-07-14 20:12 - 2014-04-21 15:41 - 00000000 ____D () C:\Program Files\FileZilla FTP Client
2014-07-14 20:06 - 2014-07-14 19:55 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\Audacity
2014-07-14 06:12 - 2014-04-27 14:19 - 00000000 ____D () C:\Users\1
2014-07-12 05:40 - 2014-01-04 20:58 - 00000000 ____D () C:\Users\Compiuta\Desktop\Flugtickets
2014-07-11 03:02 - 2014-07-17 17:24 - 00096680 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-07-11 02:56 - 2014-07-17 17:24 - 00272808 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-07-11 02:56 - 2014-07-17 17:24 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-07-11 02:55 - 2014-07-17 17:24 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-07-10 01:18 - 2010-11-21 02:55 - 00000000 ____D () C:\Program Files\Windows Journal
2014-07-10 01:18 - 2009-07-14 06:33 - 00324032 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-07-09 01:59 - 2014-04-29 21:30 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-07-09 01:59 - 2014-04-29 21:30 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-07-08 14:33 - 2014-07-08 14:33 - 00284564 _____ () C:\Windows\msxml4-KB954430-enu.LOG
2014-07-08 14:33 - 2014-07-08 14:33 - 00000000 ____D () C:\Program Files\MSXML 4.0
2014-07-08 14:33 - 2014-07-08 14:32 - 00291106 _____ () C:\Windows\msxml4-KB973688-enu.LOG

Some content of TEMP:
====================
C:\Users\1\AppData\Local\temp\avgnt.exe
C:\Users\Compiuta\AppData\Local\temp\avgnt.exe
C:\Users\Compiuta\AppData\Local\temp\Quarantine.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-07-15 01:40

==================== End Of Log ============================
--- --- ---


Danke!
LG
Fred

schrauber 07.08.2014 09:21
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [1c2b1] => C:\Users\Compiuta\AppData\Roaming\0a3\1c2b1.js
Startup: C:\Users\Compiuta\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\414.js ()
2014-08-06 09:11 - 2014-08-06 09:11 - 00000000 __SHD () C:\Users\Compiuta\AppData\Roaming\0a3

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.



Und nochmal ein frisches FRST log bitte.

Freiseflei 07.08.2014 11:05
Hi Schrauber,

hier nun das Fixlog:

Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version:2-08-2014
Ran by Compiuta at 2014-08-07 12:00:43 Run:2
Running from C:\Users\Compiuta\Desktop
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [1c2b1] => C:\Users\Compiuta\AppData\Roaming\0a3\1c2b1.js
Startup: C:\Users\Compiuta\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\414.js ()
2014-08-06 09:11 - 2014-08-06 09:11 - 00000000 __SHD () C:\Users\Compiuta\AppData\Roaming\0a3
*****************

HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\Software\Microsoft\Windows\CurrentVersion\Run\\1c2b1 => value deleted successfully.
C:\Users\Compiuta\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\414.js not found.
C:\Users\Compiuta\AppData\Roaming\0a3 => Moved successfully.

==== End of Fixlog ====
Und hier ein frisches FRSTLOG:


FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:2-08-2014
Ran by Compiuta (administrator) on COMPIUTA-PC on 07-08-2014 12:02:31
Running from C:\Users\Compiuta\Desktop
Platform: Microsoft Windows 7 Professional  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(ABBYY) C:\Program Files\ABBYY PDF Transformer 3.0\NetworkLicenseServer.exe
(Andrea Electronics Corporation) C:\Windows\System32\AEADISRV.EXE
() C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe
(Conexant Systems, Inc.) C:\Windows\System32\drivers\XAudio.exe
() C:\Program Files\Motorola\MotoHelper\MotoHelperAgent.exe
(Analog Devices, Inc.) C:\Program Files\Analog Devices\Core\smax4pnp.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(BitTorrent, Inc.) C:\Program Files\BitTorrent Sync\BTSync.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
(Samsung) C:\Program Files\Samsung\Kies\Kies.exe
(ABBYY) C:\Program Files\ABBYY PDF Transformer 3.0\Bonus.ScreenshotReader.exe
(Microsoft Corporation) C:\Windows\System32\wscript.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Adobe Systems Incorporated) C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe
(Adobe Systems Incorporated) C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe
(Swiss Academic Software) C:\Program Files\Citavi 3\bin\Citavi.exe
(Tracker Software Products Ltd.) C:\Program Files\ABBYY PDF Transformer 3.0\PDF-XChange\pdfSaver4a.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avira_de____fm.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_14_0_0_145.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_14_0_0_145.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [BitTorrent Sync] => C:\Program Files\BitTorrent Sync\BTSync.exe [3020136 2014-06-27] (BitTorrent, Inc.)
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [20917408 2014-02-10] (Skype Technologies S.A.)
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [KiesPreload] => C:\Program Files\Samsung\Kies\Kies.exe [1563440 2014-06-14] (Samsung)
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [ABBYY Screenshot Reader Bonus] => C:\Program Files\ABBYY PDF Transformer 3.0\Bonus.ScreenshotReader.exe [939272 2014-04-23] (ABBYY)
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [VoipStunt] => C:\Program Files\VoipStunt.com\VoipStunt\VoipStunt.exe [19768640 2014-02-11] (VoipStunt)
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [1c2b1] => C:\Users\Compiuta\AppData\Roaming\0a3\1c2b1.js

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xECE210E7535DCF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
BHO: SwissAcademic.Citavi.Picker.IEPicker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Compiuta\AppData\Roaming\Mozilla\Firefox\Profiles\kpvwewrm.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin: @java.com/DTPlugin,version=10.65.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.65.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @talk.google.com/GoogleTalkPlugin - C:\Users\Compiuta\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin HKCU: @talk.google.com/O1DPlugin - C:\Users\Compiuta\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Compiuta\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Compiuta\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\Compiuta\AppData\Roaming\mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin ProgramFiles/Appdata: C:\Users\Compiuta\AppData\Roaming\mozilla\plugins\npo1d.dll (Google)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF HKLM\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2014-04-21]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 ABBYY.Licensing.PDFTransformer.Classic.3.0; C:\Program Files\ABBYY PDF Transformer 3.0\NetworkLicenseServer.exe [759048 2014-04-23] (ABBYY)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-08-07] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-08-07] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe [141392 2014-07-24] (Avira Operations GmbH & Co. KG)
R2 MotoHelper; C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe [223088 2011-04-26] ()

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [97648 2014-07-04] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-05-27] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2014-02-25] (Avira Operations GmbH & Co. KG)
R3 e1express; C:\Windows\System32\DRIVERS\e1e6232.sys [232312 2012-10-30] (Intel Corporation)
S3 PSKMAD; C:\Windows\System32\DRIVERS\PSKMAD.sys [47632 2013-04-29] (Panda Security, S.L.)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2014-02-25] (Avira GmbH)
S3 catchme; \??\C:\Users\Compiuta\AppData\Local\Temp\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-07 12:00 - 2014-08-07 12:00 - 00000000 __SHD () C:\Users\Compiuta\AppData\Roaming\0a3
2014-08-07 09:56 - 2014-08-07 10:03 - 00000000 ____D () C:\ProgramData\Package Cache
2014-08-07 09:56 - 2014-08-07 10:02 - 00001095 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-08-07 09:56 - 2014-08-07 09:56 - 00070352 _____ () C:\Users\1\AppData\Local\GDIPFONTCACHEV1.DAT
2014-08-06 09:14 - 2014-08-06 09:14 - 00035021 _____ () C:\Users\Compiuta\Desktop\FRST4.txt
2014-08-05 16:42 - 2014-08-05 16:43 - 00037787 _____ () C:\Users\Compiuta\Desktop\FRST3.txt
2014-08-05 16:41 - 2014-08-05 16:41 - 00000759 _____ () C:\Users\Compiuta\Desktop\checkup.txt
2014-08-05 16:35 - 2014-08-05 16:35 - 00854410 _____ () C:\Users\Compiuta\Downloads\SecurityCheck.exe
2014-08-05 15:16 - 2014-08-05 15:16 - 02347384 _____ (ESET) C:\Users\Compiuta\Downloads\esetsmartinstaller_deu.exe
2014-08-04 20:17 - 2014-08-04 20:17 - 00036633 _____ () C:\Users\Compiuta\Desktop\FRST2.txt
2014-08-04 20:15 - 2014-08-04 20:15 - 00000828 _____ () C:\Users\Compiuta\Desktop\JRT.txt
2014-08-04 20:12 - 2014-08-04 20:12 - 00000000 ____D () C:\Windows\ERUNT
2014-08-04 20:11 - 2014-08-04 20:11 - 00001446 _____ () C:\Users\Compiuta\Desktop\AdwCleaner[S0].txt
2014-08-04 20:07 - 2014-08-04 20:09 - 00000000 ____D () C:\AdwCleaner
2014-08-04 20:07 - 2014-08-04 20:07 - 00001161 _____ () C:\Users\Compiuta\Desktop\mbam2.txt
2014-08-04 20:06 - 2014-08-04 20:06 - 00001161 _____ () C:\Users\Compiuta\Desktop\mbam.txt
2014-08-04 20:01 - 2014-08-04 20:01 - 01361309 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.302.exe
2014-08-04 20:01 - 2014-08-04 20:01 - 01016261 _____ (Thisisu) C:\Users\Compiuta\Downloads\JRT.exe
2014-08-04 19:32 - 2014-08-04 20:03 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-04 19:32 - 2014-08-04 19:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-08-04 19:31 - 2014-08-04 19:32 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2014-08-04 19:31 - 2014-08-04 19:31 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-04 19:31 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-08-04 19:31 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-08-04 19:31 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-08-04 19:23 - 2014-08-04 19:24 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Compiuta\Downloads\mbam-setup-2.0.2.1012(1).exe
2014-08-03 20:13 - 2014-08-03 20:13 - 00013303 _____ () C:\Users\Compiuta\Desktop\combofix.txt
2014-08-03 20:12 - 2014-08-03 20:12 - 00013303 _____ () C:\ComboFix.txt
2014-08-03 20:06 - 2014-08-03 20:12 - 00000000 ____D () C:\Qoobox
2014-08-03 20:06 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-08-03 20:06 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-08-03 20:06 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-08-03 20:06 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-08-03 20:06 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-08-03 20:06 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-08-03 20:06 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-08-03 20:06 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-08-03 20:05 - 2014-08-03 20:11 - 00000000 ____D () C:\Windows\erdnt
2014-08-03 20:04 - 2014-08-03 20:04 - 00000000 ____D () C:\ProgramData\Panda Security
2014-08-03 20:03 - 2014-08-03 20:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Security
2014-08-03 20:03 - 2014-08-03 20:03 - 00000000 ____D () C:\Program Files\Panda USB Vaccine
2014-08-03 19:20 - 2014-08-03 19:20 - 05566616 ____R (Swearware) C:\Users\Compiuta\Desktop\ComboFix.exe
2014-08-03 19:19 - 2014-08-03 19:20 - 05566616 _____ (Swearware) C:\Users\Compiuta\Downloads\ComboFix.exe
2014-08-03 19:03 - 2014-08-03 19:02 - 00848856 _____ (Panda Security ) C:\Users\Compiuta\Desktop\USBVaccineSetup.exe
2014-08-03 19:01 - 2014-08-03 19:02 - 00848856 _____ (Panda Security ) C:\Users\Compiuta\Downloads\USBVaccineSetup.exe
2014-08-03 18:07 - 2014-08-03 18:07 - 00000993 _____ () C:\Users\Compiuta\Desktop\gmer.txt
2014-08-03 17:32 - 2014-08-04 20:25 - 00034710 _____ () C:\Users\Compiuta\Desktop\Antivir.odt
2014-08-03 17:28 - 2014-08-03 17:28 - 00380416 _____ () C:\Users\Compiuta\Downloads\Gmer-19357.exe
2014-08-03 17:27 - 2014-08-03 13:18 - 00000478 _____ () C:\Users\Compiuta\Desktop\defogger_disable.log
2014-08-03 17:24 - 2014-08-07 12:02 - 00009882 _____ () C:\Users\Compiuta\Desktop\FRST.txt
2014-08-03 17:24 - 2014-08-03 15:57 - 00023276 _____ () C:\Users\Compiuta\Desktop\Addition.txt
2014-08-03 15:56 - 2014-08-03 15:57 - 00023276 _____ () C:\Users\Compiuta\Downloads\Addition.txt
2014-08-03 15:55 - 2014-08-07 12:02 - 00000000 ____D () C:\FRST
2014-08-03 15:55 - 2014-08-03 15:57 - 00030941 _____ () C:\Users\Compiuta\Downloads\FRST.txt
2014-08-03 15:50 - 2014-08-03 15:50 - 01084928 _____ (Farbar) C:\Users\Compiuta\Desktop\FRST.exe
2014-08-03 13:18 - 2014-08-03 13:18 - 00000478 _____ () C:\Users\Compiuta\Downloads\defogger_disable.log
2014-08-03 13:18 - 2014-08-03 13:18 - 00000000 _____ () C:\Users\Compiuta\defogger_reenable
2014-08-03 13:04 - 2014-08-03 13:04 - 00050477 _____ () C:\Users\Compiuta\Downloads\Defogger.exe
2014-08-03 10:57 - 2014-08-03 10:57 - 00000000 ____D () C:\Program Files\Panda Security
2014-08-03 10:57 - 2013-04-29 09:17 - 00047632 _____ (Panda Security, S.L.) C:\Windows\system32\Drivers\PSKMAD.sys
2014-08-03 10:43 - 2014-08-03 10:43 - 30412088 _____ (Panda Security ) C:\Users\Compiuta\Downloads\PandaCloudCleaner.exe
2014-08-03 10:42 - 2014-05-14 18:23 - 01973728 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-08-03 10:42 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-08-03 10:42 - 2014-05-14 18:23 - 00054240 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-08-03 10:42 - 2014-05-14 18:23 - 00045536 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-08-03 10:42 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-08-03 10:42 - 2014-05-14 18:17 - 02425856 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-08-03 10:42 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-08-03 10:41 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-08-03 10:41 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-07-31 11:12 - 2014-07-31 11:12 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-07-24 15:56 - 2014-07-24 15:56 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Compiuta\Downloads\mbam-setup-2.0.2.1012.exe
2014-07-24 15:45 - 2014-07-24 15:45 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216(2).exe
2014-07-24 15:28 - 2014-07-24 15:28 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216(1).exe
2014-07-24 15:21 - 2014-07-24 15:21 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216.exe
2014-07-24 01:07 - 2014-07-24 01:07 - 00000000 __SHD () C:\0b64
2014-07-21 20:05 - 2014-07-21 20:05 - 00000000 ____D () C:\Users\Compiuta\Desktop\Neuer Ordner
2014-07-20 04:40 - 2014-07-20 04:46 - 00009008 _____ () C:\Users\Compiuta\AppData\Roaming\.freeciv-client-rc-2.4
2014-07-20 04:35 - 2014-07-20 04:42 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\.freeciv
2014-07-19 22:08 - 2014-07-19 22:26 - 00000000 ____D () C:\Users\Compiuta\Desktop\Neuer Ordner (2)
2014-07-19 22:07 - 2014-07-19 22:08 - 11861420 _____ () C:\Users\Compiuta\Downloads\Gmail(1).zip
2014-07-19 22:07 - 2014-07-19 22:08 - 11811633 _____ () C:\Users\Compiuta\Downloads\Gmail.zip
2014-07-19 21:50 - 2014-07-19 21:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Freeciv 2.4.2 (GTK+2 client)
2014-07-19 21:50 - 2014-07-19 21:50 - 00000000 ____D () C:\Program Files\Freeciv-2.4.2-gtk2
2014-07-19 20:56 - 2014-07-19 20:57 - 28215140 _____ () C:\Users\Compiuta\Downloads\Freeciv-2.4.2-win32-gtk2-setup.exe
2014-07-19 01:40 - 2014-07-24 15:57 - 00000000 ____D () C:\Users\Compiuta\Desktop\abog
2014-07-17 17:24 - 2014-07-17 17:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-07-17 17:24 - 2014-07-17 17:24 - 00000000 ____D () C:\Program Files\Common Files\Java
2014-07-17 17:24 - 2014-07-11 03:02 - 00096680 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-07-17 17:24 - 2014-07-11 02:56 - 00272808 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-07-17 17:24 - 2014-07-11 02:56 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-07-17 17:24 - 2014-07-11 02:55 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-07-14 19:55 - 2014-07-14 20:06 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\Audacity
2014-07-09 18:24 - 2014-06-20 21:39 - 00240824 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-07-09 18:24 - 2014-06-19 02:16 - 17276416 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-07-09 18:24 - 2014-06-19 01:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-07-09 18:24 - 2014-06-19 01:56 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-07-09 18:24 - 2014-06-19 01:38 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-07-09 18:24 - 2014-06-19 01:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-07-09 18:24 - 2014-06-19 01:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-07-09 18:24 - 2014-06-19 01:35 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-07-09 18:24 - 2014-06-19 01:32 - 02179072 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-07-09 18:24 - 2014-06-19 01:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-07-09 18:24 - 2014-06-19 01:28 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-07-09 18:24 - 2014-06-19 01:25 - 00442368 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-07-09 18:24 - 2014-06-19 01:23 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-07-09 18:24 - 2014-06-19 01:23 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-07-09 18:24 - 2014-06-19 01:22 - 00592896 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-07-09 18:24 - 2014-06-19 01:16 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-07-09 18:24 - 2014-06-19 01:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-07-09 18:24 - 2014-06-19 01:06 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-07-09 18:24 - 2014-06-19 01:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-07-09 18:24 - 2014-06-19 00:59 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-07-09 18:24 - 2014-06-19 00:58 - 00239616 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-07-09 18:24 - 2014-06-19 00:52 - 04254720 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-07-09 18:24 - 2014-06-19 00:52 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-07-09 18:24 - 2014-06-19 00:49 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-07-09 18:24 - 2014-06-19 00:46 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-07-09 18:24 - 2014-06-19 00:45 - 01964544 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-07-09 18:24 - 2014-06-19 00:35 - 11742208 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-07-09 18:24 - 2014-06-19 00:13 - 01791488 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-07-09 18:24 - 2014-06-19 00:09 - 01139200 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-07-09 18:24 - 2014-06-19 00:07 - 00704512 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-07-09 17:14 - 2014-06-05 16:26 - 01059840 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-07-09 17:02 - 2014-06-18 03:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2014-07-09 17:02 - 2014-06-18 02:52 - 02350080 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-07-09 17:02 - 2014-06-06 11:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-07-09 17:02 - 2014-05-30 08:36 - 00338944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-07-08 14:33 - 2014-07-08 14:33 - 00284564 _____ () C:\Windows\msxml4-KB954430-enu.LOG
2014-07-08 14:33 - 2014-07-08 14:33 - 00000000 ____D () C:\Program Files\MSXML 4.0
2014-07-08 14:32 - 2014-07-08 14:33 - 00291106 _____ () C:\Windows\msxml4-KB973688-enu.LOG

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-07 12:03 - 2014-04-29 21:30 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-08-07 12:02 - 2014-08-03 17:24 - 00009882 _____ () C:\Users\Compiuta\Desktop\FRST.txt
2014-08-07 12:02 - 2014-08-03 15:55 - 00000000 ____D () C:\FRST
2014-08-07 12:00 - 2014-08-07 12:00 - 00000000 __SHD () C:\Users\Compiuta\AppData\Roaming\0a3
2014-08-07 11:55 - 2014-04-21 12:24 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\BitTorrent Sync
2014-08-07 11:47 - 2014-05-17 16:36 - 00001132 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4045813022-1567936593-3779010734-1000UA.job
2014-08-07 10:03 - 2014-08-07 09:56 - 00000000 ____D () C:\ProgramData\Package Cache
2014-08-07 10:02 - 2014-08-07 09:56 - 00001095 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-08-07 10:02 - 2014-04-21 17:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-08-07 10:02 - 2014-04-21 17:20 - 00000000 ____D () C:\Program Files\Avira
2014-08-07 10:02 - 2014-01-04 20:06 - 01298252 _____ () C:\Windows\WindowsUpdate.log
2014-08-07 09:56 - 2014-08-07 09:56 - 00070352 _____ () C:\Users\1\AppData\Local\GDIPFONTCACHEV1.DAT
2014-08-07 09:56 - 2014-04-21 17:20 - 00000000 ____D () C:\ProgramData\Avira
2014-08-07 09:47 - 2014-05-17 16:36 - 00001080 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4045813022-1567936593-3779010734-1000Core.job
2014-08-06 09:14 - 2014-08-06 09:14 - 00035021 _____ () C:\Users\Compiuta\Desktop\FRST4.txt
2014-08-06 09:09 - 2010-11-20 23:01 - 01618320 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-08-05 16:43 - 2014-08-05 16:42 - 00037787 _____ () C:\Users\Compiuta\Desktop\FRST3.txt
2014-08-05 16:41 - 2014-08-05 16:41 - 00000759 _____ () C:\Users\Compiuta\Desktop\checkup.txt
2014-08-05 16:35 - 2014-08-05 16:35 - 00854410 _____ () C:\Users\Compiuta\Downloads\SecurityCheck.exe
2014-08-05 16:35 - 2009-07-14 06:34 - 00022208 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-05 16:35 - 2009-07-14 06:34 - 00022208 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-05 16:30 - 2014-04-21 21:52 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\Skype
2014-08-05 16:28 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-05 16:28 - 2009-07-14 06:39 - 00041621 _____ () C:\Windows\setupact.log
2014-08-05 15:16 - 2014-08-05 15:16 - 02347384 _____ (ESET) C:\Users\Compiuta\Downloads\esetsmartinstaller_deu.exe
2014-08-04 20:25 - 2014-08-03 17:32 - 00034710 _____ () C:\Users\Compiuta\Desktop\Antivir.odt
2014-08-04 20:17 - 2014-08-04 20:17 - 00036633 _____ () C:\Users\Compiuta\Desktop\FRST2.txt
2014-08-04 20:15 - 2014-08-04 20:15 - 00000828 _____ () C:\Users\Compiuta\Desktop\JRT.txt
2014-08-04 20:12 - 2014-08-04 20:12 - 00000000 ____D () C:\Windows\ERUNT
2014-08-04 20:11 - 2014-08-04 20:11 - 00001446 _____ () C:\Users\Compiuta\Desktop\AdwCleaner[S0].txt
2014-08-04 20:10 - 2010-11-20 23:48 - 00111524 _____ () C:\Windows\PFRO.log
2014-08-04 20:09 - 2014-08-04 20:07 - 00000000 ____D () C:\AdwCleaner
2014-08-04 20:07 - 2014-08-04 20:07 - 00001161 _____ () C:\Users\Compiuta\Desktop\mbam2.txt
2014-08-04 20:06 - 2014-08-04 20:06 - 00001161 _____ () C:\Users\Compiuta\Desktop\mbam.txt
2014-08-04 20:03 - 2014-08-04 19:32 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-04 20:01 - 2014-08-04 20:01 - 01361309 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.302.exe
2014-08-04 20:01 - 2014-08-04 20:01 - 01016261 _____ (Thisisu) C:\Users\Compiuta\Downloads\JRT.exe
2014-08-04 19:32 - 2014-08-04 19:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-08-04 19:32 - 2014-08-04 19:31 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2014-08-04 19:31 - 2014-08-04 19:31 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-04 19:24 - 2014-08-04 19:23 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Compiuta\Downloads\mbam-setup-2.0.2.1012(1).exe
2014-08-03 20:13 - 2014-08-03 20:13 - 00013303 _____ () C:\Users\Compiuta\Desktop\combofix.txt
2014-08-03 20:12 - 2014-08-03 20:12 - 00013303 _____ () C:\ComboFix.txt
2014-08-03 20:12 - 2014-08-03 20:06 - 00000000 ____D () C:\Qoobox
2014-08-03 20:12 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public
2014-08-03 20:11 - 2014-08-03 20:05 - 00000000 ____D () C:\Windows\erdnt
2014-08-03 20:11 - 2009-07-14 04:04 - 00000215 _____ () C:\Windows\system.ini
2014-08-03 20:04 - 2014-08-03 20:04 - 00000000 ____D () C:\ProgramData\Panda Security
2014-08-03 20:03 - 2014-08-03 20:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Security
2014-08-03 20:03 - 2014-08-03 20:03 - 00000000 ____D () C:\Program Files\Panda USB Vaccine
2014-08-03 19:20 - 2014-08-03 19:20 - 05566616 ____R (Swearware) C:\Users\Compiuta\Desktop\ComboFix.exe
2014-08-03 19:20 - 2014-08-03 19:19 - 05566616 _____ (Swearware) C:\Users\Compiuta\Downloads\ComboFix.exe
2014-08-03 19:02 - 2014-08-03 19:03 - 00848856 _____ (Panda Security ) C:\Users\Compiuta\Desktop\USBVaccineSetup.exe
2014-08-03 19:02 - 2014-08-03 19:01 - 00848856 _____ (Panda Security ) C:\Users\Compiuta\Downloads\USBVaccineSetup.exe
2014-08-03 18:07 - 2014-08-03 18:07 - 00000993 _____ () C:\Users\Compiuta\Desktop\gmer.txt
2014-08-03 17:28 - 2014-08-03 17:28 - 00380416 _____ () C:\Users\Compiuta\Downloads\Gmer-19357.exe
2014-08-03 15:57 - 2014-08-03 17:24 - 00023276 _____ () C:\Users\Compiuta\Desktop\Addition.txt
2014-08-03 15:57 - 2014-08-03 15:56 - 00023276 _____ () C:\Users\Compiuta\Downloads\Addition.txt
2014-08-03 15:57 - 2014-08-03 15:55 - 00030941 _____ () C:\Users\Compiuta\Downloads\FRST.txt
2014-08-03 15:50 - 2014-08-03 15:50 - 01084928 _____ (Farbar) C:\Users\Compiuta\Desktop\FRST.exe
2014-08-03 13:18 - 2014-08-03 17:27 - 00000478 _____ () C:\Users\Compiuta\Desktop\defogger_disable.log
2014-08-03 13:18 - 2014-08-03 13:18 - 00000478 _____ () C:\Users\Compiuta\Downloads\defogger_disable.log
2014-08-03 13:18 - 2014-08-03 13:18 - 00000000 _____ () C:\Users\Compiuta\defogger_reenable
2014-08-03 13:18 - 2014-01-04 20:28 - 00000000 ____D () C:\Users\Compiuta
2014-08-03 13:04 - 2014-08-03 13:04 - 00050477 _____ () C:\Users\Compiuta\Downloads\Defogger.exe
2014-08-03 10:57 - 2014-08-03 10:57 - 00000000 ____D () C:\Program Files\Panda Security
2014-08-03 10:55 - 2014-04-21 15:31 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-08-03 10:48 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-08-03 10:43 - 2014-08-03 10:43 - 30412088 _____ (Panda Security ) C:\Users\Compiuta\Downloads\PandaCloudCleaner.exe
2014-07-31 15:53 - 2014-04-23 11:00 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\vlc
2014-07-31 11:12 - 2014-07-31 11:12 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-07-24 18:50 - 2014-04-21 17:30 - 00035848 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-07-24 15:57 - 2014-07-19 01:40 - 00000000 ____D () C:\Users\Compiuta\Desktop\abog
2014-07-24 15:56 - 2014-07-24 15:56 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Compiuta\Downloads\mbam-setup-2.0.2.1012.exe
2014-07-24 15:45 - 2014-07-24 15:45 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216(2).exe
2014-07-24 15:28 - 2014-07-24 15:28 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216(1).exe
2014-07-24 15:21 - 2014-07-24 15:21 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216.exe
2014-07-24 03:33 - 2014-04-20 19:34 - 00000000 ____D () C:\BtSync
2014-07-24 01:07 - 2014-07-24 01:07 - 00000000 __SHD () C:\0b64
2014-07-23 10:52 - 2014-04-21 15:10 - 00231584 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-07-21 20:05 - 2014-07-21 20:05 - 00000000 ____D () C:\Users\Compiuta\Desktop\Neuer Ordner
2014-07-20 04:46 - 2014-07-20 04:40 - 00009008 _____ () C:\Users\Compiuta\AppData\Roaming\.freeciv-client-rc-2.4
2014-07-20 04:42 - 2014-07-20 04:35 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\.freeciv
2014-07-19 22:26 - 2014-07-19 22:08 - 00000000 ____D () C:\Users\Compiuta\Desktop\Neuer Ordner (2)
2014-07-19 22:26 - 2014-07-06 19:43 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\XnView
2014-07-19 22:13 - 2014-04-21 16:58 - 00000000 ____D () C:\Users\Compiuta\AppData\Local\Paint.NET
2014-07-19 22:09 - 2014-01-04 21:11 - 00000000 ____D () C:\Users\Compiuta\Desktop\Soundfiles
2014-07-19 22:08 - 2014-07-19 22:07 - 11861420 _____ () C:\Users\Compiuta\Downloads\Gmail(1).zip
2014-07-19 22:08 - 2014-07-19 22:07 - 11811633 _____ () C:\Users\Compiuta\Downloads\Gmail.zip
2014-07-19 21:50 - 2014-07-19 21:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Freeciv 2.4.2 (GTK+2 client)
2014-07-19 21:50 - 2014-07-19 21:50 - 00000000 ____D () C:\Program Files\Freeciv-2.4.2-gtk2
2014-07-19 20:57 - 2014-07-19 20:56 - 28215140 _____ () C:\Users\Compiuta\Downloads\Freeciv-2.4.2-win32-gtk2-setup.exe
2014-07-18 18:03 - 2014-06-13 03:24 - 00000000 ____D () C:\Users\Compiuta\AppData\Local\Adobe
2014-07-17 17:24 - 2014-07-17 17:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-07-17 17:24 - 2014-07-17 17:24 - 00000000 ____D () C:\Program Files\Common Files\Java
2014-07-17 17:24 - 2014-05-02 10:24 - 00000000 ____D () C:\ProgramData\Oracle
2014-07-17 17:24 - 2014-05-02 10:24 - 00000000 ____D () C:\Program Files\Java
2014-07-15 15:54 - 2014-04-21 21:39 - 00000000 ____D () C:\Windows\system32\MRT
2014-07-15 15:52 - 2014-04-21 21:39 - 93585272 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-07-15 02:55 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2014-07-14 22:33 - 2014-06-03 23:45 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\FileZilla
2014-07-14 20:12 - 2014-06-03 23:45 - 04996210 _____ (Tim Kosse) C:\Users\Compiuta\Downloads\FileZilla_3.8.1_win32-setup.exe
2014-07-14 20:12 - 2014-04-21 15:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client
2014-07-14 20:12 - 2014-04-21 15:41 - 00000000 ____D () C:\Program Files\FileZilla FTP Client
2014-07-14 20:06 - 2014-07-14 19:55 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\Audacity
2014-07-14 06:12 - 2014-04-27 14:19 - 00000000 ____D () C:\Users\1
2014-07-12 05:40 - 2014-01-04 20:58 - 00000000 ____D () C:\Users\Compiuta\Desktop\Flugtickets
2014-07-11 03:02 - 2014-07-17 17:24 - 00096680 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-07-11 02:56 - 2014-07-17 17:24 - 00272808 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-07-11 02:56 - 2014-07-17 17:24 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-07-11 02:55 - 2014-07-17 17:24 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-07-10 01:18 - 2010-11-21 02:55 - 00000000 ____D () C:\Program Files\Windows Journal
2014-07-10 01:18 - 2009-07-14 06:33 - 00324032 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-07-09 01:59 - 2014-04-29 21:30 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-07-09 01:59 - 2014-04-29 21:30 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-07-08 14:33 - 2014-07-08 14:33 - 00284564 _____ () C:\Windows\msxml4-KB954430-enu.LOG
2014-07-08 14:33 - 2014-07-08 14:33 - 00000000 ____D () C:\Program Files\MSXML 4.0
2014-07-08 14:33 - 2014-07-08 14:32 - 00291106 _____ () C:\Windows\msxml4-KB973688-enu.LOG

Some content of TEMP:
====================
C:\Users\1\AppData\Local\temp\avgnt.exe
C:\Users\Compiuta\AppData\Local\temp\avgnt.exe
C:\Users\Compiuta\AppData\Local\temp\Quarantine.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-07-15 01:40

==================== End Of Log ============================
--- --- ---


Dnake!
LG
Fred

schrauber 08.08.2014 06:10
jetzt nervt das Ding :)

Downloade dir bitte TDSSKiller TDSSKiller.exe und speichere diese Datei auf dem Desktop
  • Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
  • Drücke Start Scan
  • Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
    TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
    Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt
Poste den Inhalt bitte in jedem Fall hier in deinen Thread.

Freiseflei 08.08.2014 10:19
Hi Schrauber,

na, da scheint echt ein hartnäckiges Virus zu sein.

Hier nun der TDSSKiller Log:

Code:
11:10:08.0664 0x4378  TDSS rootkit removing tool 3.0.0.40 Jul 10 2014 12:37:58
11:10:28.0402 0x4378  ============================================================
11:10:28.0402 0x4378  Current date / time: 2014/08/08 11:10:28.0402
11:10:28.0402 0x4378  SystemInfo:
11:10:28.0402 0x4378 
11:10:28.0402 0x4378  OS Version: 6.1.7601 ServicePack: 1.0
11:10:28.0402 0x4378  Product type: Workstation
11:10:28.0403 0x4378  ComputerName: COMPIUTA-PC
11:10:28.0403 0x4378  UserName: Compiuta
11:10:28.0403 0x4378  Windows directory: C:\Windows
11:10:28.0403 0x4378  System windows directory: C:\Windows
11:10:28.0403 0x4378  Processor architecture: Intel x86
11:10:28.0403 0x4378  Number of processors: 2
11:10:28.0403 0x4378  Page size: 0x1000
11:10:28.0403 0x4378  Boot type: Normal boot
11:10:28.0403 0x4378  ============================================================
11:10:28.0796 0x4378  KLMD registered as C:\Windows\system32\drivers\11932214.sys
11:10:28.0985 0x4378  System UUID: {A6F79280-F829-45D6-3E27-A6502803D32A}
11:10:29.0659 0x4378  Drive \Device\Harddisk0\DR0 - Size: 0x1BF2976000 ( 111.79 Gb ), SectorSize: 0x200, Cylinders: 0x3C91, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xF0, Type 'K0', Flags 0x00000050
11:10:29.0662 0x4378  ============================================================
11:10:29.0662 0x4378  \Device\Harddisk0\DR0:
11:10:29.0662 0x4378  MBR partitions:
11:10:29.0662 0x4378  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0xDF93800
11:10:29.0662 0x4378  ============================================================
11:10:29.0663 0x4378  C: <-> \Device\Harddisk0\DR0\Partition1
11:10:29.0664 0x4378  ============================================================
11:10:29.0664 0x4378  Initialize success
11:10:29.0664 0x4378  ============================================================
11:12:33.0506 0x3c24  ============================================================
11:12:33.0506 0x3c24  Scan started
11:12:33.0506 0x3c24  Mode: Manual; SigCheck; TDLFS;
11:12:33.0506 0x3c24  ============================================================
11:12:33.0506 0x3c24  KSN ping started
11:12:47.0044 0x3c24  KSN ping finished: true
11:12:47.0316 0x3c24  ================ Scan system memory ========================
11:12:47.0316 0x3c24  System memory - ok
11:12:47.0317 0x3c24  ================ Scan services =============================
11:12:47.0386 0x3c24  [ 1B133875B8AA8AC48969BD3458AFE9F5, 01753BDD47F3F9BC0E0D23A069B9C56D4AE6A6B6295BC19B95AE245D25B12744 ] 1394ohci        C:\Windows\system32\drivers\1394ohci.sys
11:12:47.0479 0x3c24  1394ohci - ok
11:12:47.0534 0x3c24  [ B33CF4DE909A5B30F526D82053A63C8E, ABF5BB962C038E545C18B96E686E072D780C907096C7BB341297AF31D3703ABD ] ABBYY.Licensing.PDFTransformer.Classic.3.0 C:\Program Files\ABBYY PDF Transformer 3.0\NetworkLicenseServer.exe
11:12:47.0584 0x3c24  ABBYY.Licensing.PDFTransformer.Classic.3.0 - ok
11:12:47.0605 0x3c24  [ CEA80C80BED809AA0DA6FEBC04733349, AE69C142DC2210A4AE657C23CEA4A6E7CB32C4F4EBA039414123CAC52157509B ] ACPI            C:\Windows\system32\drivers\ACPI.sys
11:12:47.0633 0x3c24  ACPI - ok
11:12:47.0641 0x3c24  [ 1EFBC664ABFF416D1D07DB115DCB264F, BF94D069D692140B792DBF4FD3CB0127D27C26CC5BFB6B0C28A8B6346767EE58 ] AcpiPmi        C:\Windows\system32\drivers\acpipmi.sys
11:12:47.0677 0x3c24  AcpiPmi - ok
11:12:47.0702 0x3c24  [ 6C61BCEB60C2C187E6F96001FD69493E, AB8752E7DCCE134CA63D2E660D3E2688086426167B9E8E2C24E0D45B87497774 ] ADIHdAudAddService C:\Windows\system32\drivers\ADIHdAud.sys
11:12:47.0752 0x3c24  ADIHdAudAddService - ok
11:12:47.0762 0x3c24  [ B362181ED3771DC03B4141927C80F801, 69514E5177A0AEA89C27C2234712F9F82E8D8F99E1FD4273898C9324C6FF7472 ] AdobeARMservice C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
11:12:47.0781 0x3c24  AdobeARMservice - ok
11:12:47.0799 0x3c24  [ A6B6AB9502B63F43A9A56AE6AFB22078, DD1F0BA3D8F3333F52A71EAE3719A001F6EF844D647FFABF0E4C56C6C764ACA7 ] AdobeFlashPlayerUpdateSvc C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
11:12:47.0823 0x3c24  AdobeFlashPlayerUpdateSvc - ok
11:12:47.0849 0x3c24  [ 21E785EBD7DC90A06391141AAC7892FB, A2D3D764C5E6DC0AD5AAF48485FFB8B121D2A40DC08ECF2D2CB92278A1002B25 ] adp94xx        C:\Windows\system32\drivers\adp94xx.sys
11:12:47.0901 0x3c24  adp94xx - ok
11:12:47.0923 0x3c24  [ 0C676BC278D5B59FF5ABD57BBE9123F2, 339E8A433D186BAAB6FCB44C82CC9FB6FCD63C87981449494CBEB2072CB6B7BB ] adpahci        C:\Windows\system32\drivers\adpahci.sys
11:12:47.0966 0x3c24  adpahci - ok
11:12:47.0980 0x3c24  [ 7C7B5EE4B7B822EC85321FE23A27DB33, A934AFB71D439555E6376DA9B34F82E8D39A300A4547BE9AC9311F6A3C36270C ] adpu320        C:\Windows\system32\drivers\adpu320.sys
11:12:48.0013 0x3c24  adpu320 - ok
11:12:48.0027 0x3c24  [ 4DC6B0772D1698F04FC79053A21C8260, 010D4660DB9F7BC49C72691B5D9936EAB6F4A0799374B4019B97343B517D86F4 ] AEADIFilters    C:\Windows\system32\AEADISRV.EXE
11:12:48.0048 0x3c24  AEADIFilters - ok
11:12:48.0057 0x3c24  [ 8B5EEFEEC1E6D1A72A06C526628AD161, 026CDF4C96F4D493E7BABF79A14C4B0B5ADCCEF0B081FFFA2E3B243B2414167F ] AeLookupSvc    C:\Windows\System32\aelupsvc.dll
11:12:48.0123 0x3c24  AeLookupSvc - ok
11:12:48.0144 0x3c24  [ D0B388DA1D111A34366E04EB4A5DD156, 60D226F027F4025CC032CAFF73A80FAFB5FA75445654FDCF80CA8C0419C6E938 ] AFD            C:\Windows\system32\drivers\afd.sys
11:12:48.0180 0x3c24  AFD - ok
11:12:48.0190 0x3c24  [ 507812C3054C21CEF746B6EE3D04DD6E, D7E59350AC338AD229E3D10C76E32AE16D120311B263714A9CD94AB538633B0E ] agp440          C:\Windows\system32\drivers\agp440.sys
11:12:48.0218 0x3c24  agp440 - ok
11:12:48.0228 0x3c24  [ 8B30250D573A8F6B4BD23195160D8707, 64EC289AFCD63D84EAFD9D81C50D0A77BCC79A1EFF32C50B2776BB0C0151757D ] aic78xx        C:\Windows\system32\drivers\djsvs.sys
11:12:48.0260 0x3c24  aic78xx - ok
11:12:48.0269 0x3c24  [ 18A54E132947CD98FEA9ACCC57F98F13, 9D39AF972785E49F0DD12C4BAEF39A79CD69F098886BF152AF1B7CCE2E902115 ] ALG            C:\Windows\System32\alg.exe
11:12:48.0310 0x3c24  ALG - ok
11:12:48.0318 0x3c24  [ 0D40BCF52EA90FC7DF2AEAB6503DEA44, 1D1AA8F50935D976C29DE7A84708CADBBBDD936F0DD2C059E820F0D21367B3B6 ] aliide          C:\Windows\system32\drivers\aliide.sys
11:12:48.0344 0x3c24  aliide - ok
11:12:48.0353 0x3c24  [ 3C6600A0696E90A463771C7422E23AB5, 370B33DC1C25B981628A318BAE434A78A5F0A0DA93C2896DC7A3D7B87AE1A5E7 ] amdagp          C:\Windows\system32\drivers\amdagp.sys
11:12:48.0384 0x3c24  amdagp - ok
11:12:48.0392 0x3c24  [ CD5914170297126B6266860198D1D4F0, 2239FCBD1A7EC27CE4F10DA36AE6BD6CCB87E5128C82CA71B84BFE5AF5602A60 ] amdide          C:\Windows\system32\drivers\amdide.sys
11:12:48.0417 0x3c24  amdide - ok
11:12:48.0426 0x3c24  [ 00DDA200D71BAC534BF56A9DB5DFD666, CA316B1FFD85BA1CF8664B3229DA1F238A5341E016059F7ED89702324CFD124B ] AmdK8          C:\Windows\system32\drivers\amdk8.sys
11:12:48.0461 0x3c24  AmdK8 - ok
11:12:48.0470 0x3c24  [ 3CBF30F5370FDA40DD3E87DF38EA53B6, 7EACF1743367BE805357B6FD10F8F99E9B1C301FE3782D77719347B13DFA65EC ] AmdPPM          C:\Windows\system32\drivers\amdppm.sys
11:12:48.0501 0x3c24  AmdPPM - ok
11:12:48.0511 0x3c24  [ E7F4D42D8076EC60E21715CD11743A0D, 91AC020A70964F8783C999BDE8AB8391A3FA3AFC1CD4BC52A43625A2010A53E7 ] amdsata        C:\Windows\system32\drivers\amdsata.sys
11:12:48.0542 0x3c24  amdsata - ok
11:12:48.0556 0x3c24  [ EA43AF0C423FF267355F74E7A53BDABA, 3F1335909AB0281A2FBDD7AD90E18309E091656CD32B48894B992789D8C61DB4 ] amdsbs          C:\Windows\system32\drivers\amdsbs.sys
11:12:48.0605 0x3c24  amdsbs - ok
11:12:48.0613 0x3c24  [ 146459D2B08BFDCBFA856D9947043C81, AC7F2069717601F949B0968EA651899D497170A93B84281B66D3CE5C382DDECB ] amdxata        C:\Windows\system32\drivers\amdxata.sys
11:12:48.0639 0x3c24  amdxata - ok
11:12:48.0671 0x3c24  [ 0327A6CE0934C324E3E82920E9EC0EE4, B4A1E6A77032F7DF97FED3C01E76E2BD3270A3FFC500C7C9A118C0E2EB675D75 ] AntiVirSchedulerService C:\Program Files\Avira\AntiVir Desktop\sched.exe
11:12:48.0701 0x3c24  AntiVirSchedulerService - ok
11:12:48.0726 0x3c24  [ 0327A6CE0934C324E3E82920E9EC0EE4, B4A1E6A77032F7DF97FED3C01E76E2BD3270A3FFC500C7C9A118C0E2EB675D75 ] AntiVirService  C:\Program Files\Avira\AntiVir Desktop\avguard.exe
11:12:48.0753 0x3c24  AntiVirService - ok
11:12:48.0765 0x3c24  [ AEA177F783E20150ACE5383EE368DA19, 8FA9EE27AA1F22E8B8FE33A21028CA1E0062BAA95CB132C20D55B98C03B4254F ] AppID          C:\Windows\system32\drivers\appid.sys
11:12:48.0829 0x3c24  AppID - ok
11:12:48.0840 0x3c24  [ 62A9C86CB6085E20DB4823E4E97826F5, E0F840B49710022C4FB437002AD06F64B0F6B5D628B32D00F2B66765E6B97E4B ] AppIDSvc        C:\Windows\System32\appidsvc.dll
11:12:48.0888 0x3c24  AppIDSvc - ok
11:12:48.0896 0x3c24  [ EACFDF31921F51C097629F1F3C9129B4, 24138755D823E69760579ECBD672421192457CDC9941B2BC499C2D34D83E86C3 ] Appinfo        C:\Windows\System32\appinfo.dll
11:12:48.0932 0x3c24  Appinfo - ok
11:12:48.0948 0x3c24  [ A45D184DF6A8803DA13A0B329517A64A, C1D16B60A6D69689AE951DC3D6884ED2E233D144B3FC0B86BC1C50AAAAA01ED2 ] AppMgmt        C:\Windows\System32\appmgmts.dll
11:12:48.0986 0x3c24  AppMgmt - ok
11:12:48.0996 0x3c24  [ 2932004F49677BD84DBC72EDB754FFB3, 73F84582244AC53994A2F4499A119B4A84A6BF7FD3046C29A8080C763DE540B8 ] arc            C:\Windows\system32\drivers\arc.sys
11:12:49.0027 0x3c24  arc - ok
11:12:49.0038 0x3c24  [ 5D6F36C46FD283AE1B57BD2E9FEB0BC7, F7C9C3B4F2C816F57A43B2921672858C291054220BADE291044343778216F6BA ] arcsas          C:\Windows\system32\drivers\arcsas.sys
11:12:49.0070 0x3c24  arcsas - ok
11:12:49.0094 0x3c24  [ 9D768C43FEF254DD50B1DBF8AD5C4C0B, A50854EA5C08605133B8BB4DFDC6090357C5665314AA72E0BFA1E07D4E451F09 ] aspnet_state    C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
11:12:49.0128 0x3c24  aspnet_state - ok
11:12:49.0135 0x3c24  [ ADD2ADE1C2B285AB8378D2DAAF991481, 7965A705F37924C0EC7A934E64E89C5DF4069816E2EEA3509E0AC90F78910519 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys
11:12:49.0205 0x3c24  AsyncMac - ok
11:12:49.0212 0x3c24  [ 338C86357871C167A96AB976519BF59E, F28CC534523D1701B0552F5D7E18E88369C4218BDB1F69110C3E31D395884AD6 ] atapi          C:\Windows\system32\drivers\atapi.sys
11:12:49.0230 0x3c24  atapi - ok
11:12:49.0284 0x3c24  [ 614A60AEE03A6151FDCBAC295854A9CB, 0453BD59AEF21F2EFD6E1E39F1CF691E694BC778073843111AE5FA2BB1DEF31B ] athr            C:\Windows\system32\DRIVERS\athr.sys
11:12:49.0358 0x3c24  athr - ok
11:12:49.0390 0x3c24  [ CE3B4E731638D2EF62FCB419BE0D39F0, 3B98179CB0101778D9E7810D2CD46D9C0D7120E141BA11471666E7D9EB3C93CC ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
11:12:49.0470 0x3c24  AudioEndpointBuilder - ok
11:12:49.0498 0x3c24  [ CE3B4E731638D2EF62FCB419BE0D39F0, 3B98179CB0101778D9E7810D2CD46D9C0D7120E141BA11471666E7D9EB3C93CC ] Audiosrv        C:\Windows\System32\Audiosrv.dll
11:12:49.0556 0x3c24  Audiosrv - ok
11:12:49.0568 0x3c24  [ B0A63DD71CB0CB597D8BD5C364E73F7C, 572B31F3FC962F50110D42A08CDD0614323E18C213575710CEEFA35EE7CAE8C5 ] avgntflt        C:\Windows\system32\DRIVERS\avgntflt.sys
11:12:49.0608 0x3c24  avgntflt - ok
11:12:49.0621 0x3c24  [ 05AF7CBF0BDA1571BBADC36703EB9CA4, 3925AD58053769D317D3CF0DDDF7371B010F2F4C839CF7B44F327AE9D0AB5442 ] avipbb          C:\Windows\system32\DRIVERS\avipbb.sys
11:12:49.0656 0x3c24  avipbb - ok
11:12:49.0665 0x3c24  [ D8C712305F73CD34D1B344810E522728, 49A474FF6CA44E8427D7A8290B47395125B0148AF384CF2B3B1FA495A4718CBA ] avkmgr          C:\Windows\system32\DRIVERS\avkmgr.sys
11:12:49.0694 0x3c24  avkmgr - ok
11:12:49.0704 0x3c24  [ 6E30D02AAC9CAC84F421622E3A2F6178, 229DC527C1D6C778BCA2C855A2A6F6D2C4B0F4F6DE56C886B3AAD26E3347952C ] AxInstSV        C:\Windows\System32\AxInstSV.dll
11:12:49.0750 0x3c24  AxInstSV - ok
11:12:49.0774 0x3c24  [ 1A231ABEC60FD316EC54C66715543CEC, 09E2897BA80737997A286EA5408C03DD3CC0EBACD24CB391C2455B6D4BE7D67E ] b06bdrv        C:\Windows\system32\drivers\bxvbdx.sys
11:12:49.0836 0x3c24  b06bdrv - ok
11:12:49.0853 0x3c24  [ BD8869EB9CDE6BBE4508D869929869EE, F4363A12EBFDBB89C69FD59B22F9EE05BADA07D477A1DF2DE01F59D6EE496543 ] b57nd60x        C:\Windows\system32\DRIVERS\b57nd60x.sys
11:12:49.0894 0x3c24  b57nd60x - ok
11:12:49.0908 0x3c24  [ EE1E9C3BB8228AE423DD38DB69128E71, ED54FD9795F3A4D32F02BED6052AD9404409A05644CDBEBFF19C662D104DA95A ] BDESVC          C:\Windows\System32\bdesvc.dll
11:12:49.0943 0x3c24  BDESVC - ok
11:12:49.0950 0x3c24  [ 505506526A9D467307B3C393DEDAF858, 8AD6F1492E357F57CF42261497BA29122045D4FC0DCC9669AA5AC9B2A4BABFA4 ] Beep            C:\Windows\system32\drivers\Beep.sys
11:12:49.0998 0x3c24  Beep - ok
11:12:50.0025 0x3c24  [ 1E2BAC209D184BB851E1A187D8A29136, 53933C938DA5126986FFF2918C1F522ABE93ABAB460AE32E4453161C2F7B68DF ] BFE            C:\Windows\System32\bfe.dll
11:12:50.0086 0x3c24  BFE - ok
11:12:50.0119 0x3c24  [ E585445D5021971FAE10393F0F1C3961, 178C008A9A0A6BFDA65EB0B98C510271360AD4474F22F13594F5EB60AA4E1CF5 ] BITS            C:\Windows\system32\qmgr.dll
11:12:50.0189 0x3c24  BITS - ok
11:12:50.0200 0x3c24  [ 2287078ED48FCFC477B05B20CF38F36F, 55BCA6174E6034A8D61CBE4126B2F1989F6052BFA624BEA9C0A0A664AEC74521 ] blbdrive        C:\Windows\system32\DRIVERS\blbdrive.sys
11:12:50.0229 0x3c24  blbdrive - ok
11:12:50.0239 0x3c24  [ 8F2DA3028D5FCBD1A060A3DE64CD6506, E234672E9CFE1A95AD2E78E306E41E010B870221E6EBBC0E2B0BE2FA5CE0CD76 ] bowser          C:\Windows\system32\DRIVERS\bowser.sys
11:12:50.0271 0x3c24  bowser - ok
11:12:50.0279 0x3c24  [ 9F9ACC7F7CCDE8A15C282D3F88B43309, A9131334BD9CF8FD60BA9D54AA054E2DF2BE1219FB650DF1464F2787BDEAE98F ] BrFiltLo        C:\Windows\system32\drivers\BrFiltLo.sys
11:12:50.0317 0x3c24  BrFiltLo - ok
11:12:50.0324 0x3c24  [ 56801AD62213A41F6497F96DEE83755A, 0DEB8318FB47DF6473C171C795C735E26A73FA12232876C6856549EA16F33361 ] BrFiltUp        C:\Windows\system32\drivers\BrFiltUp.sys
11:12:50.0354 0x3c24  BrFiltUp - ok
11:12:50.0364 0x3c24  [ 77361D72A04F18809D0EFB6CCEB74D4B, 55E7DB65BB29FF421F138CDFF05E5ECFFC7C8862FAA68F6179A3BA9D6B69AE64 ] BridgeMP        C:\Windows\system32\DRIVERS\bridge.sys
11:12:50.0425 0x3c24  BridgeMP - ok
11:12:50.0436 0x3c24  [ 3DAA727B5B0A45039B0E1C9A211B8400, 903B51E75F0C503A0E255120F53BF51B047B219FEC1E15F2F1D02DDD562FC73B ] Browser        C:\Windows\System32\browser.dll
11:12:50.0474 0x3c24  Browser - ok
11:12:50.0492 0x3c24  [ 845B8CE732E67F3B4133164868C666EA, 9309B094CD9B5EBC46295A5EB806BED472C3CEDE3B5F6F497EBDABA496A2A27F ] Brserid        C:\Windows\System32\Drivers\Brserid.sys
11:12:50.0540 0x3c24  Brserid - ok
11:12:50.0550 0x3c24  [ 203F0B1E73ADADBBB7B7B1FABD901F6B, 782FA7B26940FE479C49C9BAA2EB582CDAAAD607013E9BCFC85E6FBBB7D49A6D ] BrSerWdm        C:\Windows\System32\Drivers\BrSerWdm.sys
11:12:50.0583 0x3c24  BrSerWdm - ok
11:12:50.0591 0x3c24  [ BD456606156BA17E60A04E18016AE54B, DFBDC9DA6A3EA40BACFF204BC6C55C2C122B5885D2CBF6D45054DE43EE15EC4D ] BrUsbMdm        C:\Windows\System32\Drivers\BrUsbMdm.sys
11:12:50.0620 0x3c24  BrUsbMdm - ok
11:12:50.0628 0x3c24  [ AF72ED54503F717A43268B3CC5FAEC2E, 4A638669B0C30B1BDED242A8BF2015A37749570FF4D67D190BACC8D7E0C44468 ] BrUsbSer        C:\Windows\System32\Drivers\BrUsbSer.sys
11:12:50.0659 0x3c24  BrUsbSer - ok
11:12:50.0666 0x3c24  [ 4813DF77EDE536A52E3737971F910BAA, 31BC0DEB6B4C0F3F54A651F0AA848E502A7D259448C823A4DB019F4FBB13C9E5 ] BTCFilterService C:\Windows\system32\DRIVERS\motfilt.sys
11:12:50.0701 0x3c24  BTCFilterService - ok
11:12:50.0709 0x3c24  [ 2865A5C8E98C70C605F417908CEBB3A4, B1C5AC228BD7072AF8668C009C6CDC13EE9FCB9481F57524300F37C40BF1E935 ] BthEnum        C:\Windows\system32\drivers\BthEnum.sys
11:12:50.0739 0x3c24  BthEnum - ok
11:12:50.0748 0x3c24  [ ED3DF7C56CE0084EB2034432FC56565A, B5B75E002E7BC0209582C635CCCA26DB569BDB23C33A126634E00C6434BF941B ] BTHMODEM        C:\Windows\system32\drivers\bthmodem.sys
11:12:50.0780 0x3c24  BTHMODEM - ok
11:12:50.0791 0x3c24  [ AD1872E5829E8A2C3B5B4B641C3EAB0E, 8C2DBCAC08DDB41E2B44E257C55FA2D0272959B308EFF9EAF5FF9AE1E4A0AA39 ] BthPan          C:\Windows\system32\DRIVERS\bthpan.sys
11:12:50.0819 0x3c24  BthPan - ok
11:12:50.0843 0x3c24  [ C2FBF6D271D9A94D839C416BF186EAD9, 492F8344BD2E354C3525E1E535A1BAAAC17A38EE01868B986AC112E33B3B2A66 ] BTHPORT        C:\Windows\System32\Drivers\BTHport.sys
11:12:50.0899 0x3c24  BTHPORT - ok
11:12:50.0909 0x3c24  [ 1DF19C96EEF6C29D1C3E1A8678E07190, 1F4BB161FF3A1C5B1465BB52F3520FEDB7ACB1FAA132466F07D16DB8E394AEA5 ] bthserv        C:\Windows\system32\bthserv.dll
11:12:50.0962 0x3c24  bthserv - ok
11:12:50.0974 0x3c24  [ C81E9413A25A439F436B1D4B6A0CF9E9, A4C290163207AED22C70C7F90B28F6FC24892889643D60D915059405AC5A4A72 ] BTHUSB          C:\Windows\System32\Drivers\BTHUSB.sys
11:12:51.0007 0x3c24  BTHUSB - ok
11:12:51.0015 0x3c24  catchme - ok
11:12:51.0025 0x3c24  [ 77EA11B065E0A8AB902D78145CA51E10, 160EB3BBE9E5F3CC4A02584E6F2576A812C7565B940D74838B983F1EE51FA73A ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys
11:12:51.0077 0x3c24  cdfs - ok
11:12:51.0089 0x3c24  [ BE167ED0FDB9C1FA1133953C18D5A6C9, E26A851CA13E7300F977E5B20FA5D25FD0E1442AB6AD5DB58BBDB2DAAD87027C ] cdrom          C:\Windows\system32\DRIVERS\cdrom.sys
11:12:51.0126 0x3c24  cdrom - ok
11:12:51.0135 0x3c24  [ 319C6B309773D063541D01DF8AC6F55F, 182F392FE839499D159A30A3CD04B5D0C87219930BFB1A7456880B7DA75B9820 ] CertPropSvc    C:\Windows\System32\certprop.dll
11:12:51.0186 0x3c24  CertPropSvc - ok
11:12:51.0196 0x3c24  [ 3FE3FE94A34DF6FB06E6418D0F6A0060, 6B3A2A26609A75B690D4C0B3059E40822F3B3DB08943F58EC496BABDA7D0A735 ] circlass        C:\Windows\system32\drivers\circlass.sys
11:12:51.0233 0x3c24  circlass - ok
11:12:51.0250 0x3c24  [ 635181E0E9BBF16871BF5380D71DB02D, 58D5150C6F3B9F1730FFDF3A8A2ABF5FF207F9785BD66C0C1E03A0F1C223A26A ] CLFS            C:\Windows\system32\CLFS.sys
11:12:51.0277 0x3c24  CLFS - ok
11:12:51.0289 0x3c24  [ D88040F816FDA31C3B466F0FA0918F29, 39D3630E623DA25B8444B6D3AAAB16B98E7E289C5619E19A85D47B74C71449F3 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
11:12:51.0319 0x3c24  clr_optimization_v2.0.50727_32 - ok
11:12:51.0329 0x3c24  [ E87213F37A13E2B54391E40934F071D0, 7EB221127EFB5BF158FB03D18EFDA2C55FB6CE3D1A1FE69C01D70DBED02C87E5 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
11:12:51.0366 0x3c24  clr_optimization_v4.0.30319_32 - ok
11:12:51.0374 0x3c24  [ DEA805815E587DAD1DD2C502220B5616, 2D6A7668C95352B818F5EC59FF462894935833D34190257DA9CAC7E67FD3631C ] CmBatt          C:\Windows\system32\DRIVERS\CmBatt.sys
11:12:51.0401 0x3c24  CmBatt - ok
11:12:51.0409 0x3c24  [ C537B1DB64D495B9B4717B4D6D9EDBF2, 400EEFE662DE117C9CC956E4CBD5E98F28F962E7447CD93E8A78FDD8CA39EB4B ] cmdide          C:\Windows\system32\drivers\cmdide.sys
11:12:51.0434 0x3c24  cmdide - ok
11:12:51.0457 0x3c24  [ 85449EEBE8F8EBD6481EFBF0F352B4EB, E6FF04970C5A5BFDE7297A86C1C7B9BFE2E0F976A1A1AFB874CEB488DC6151CC ] CNG            C:\Windows\system32\Drivers\cng.sys
11:12:51.0515 0x3c24  CNG - ok
11:12:51.0525 0x3c24  [ A6023D3823C37043986713F118A89BEE, FAC239A7FA6251C7EDFFA34B4BAE3910B8BC0BD4A3574B6DB6931A8D691E207B ] Compbatt        C:\Windows\system32\DRIVERS\compbatt.sys
11:12:51.0551 0x3c24  Compbatt - ok
11:12:51.0564 0x3c24  [ CBE8C58A8579CFE5FCCF809E6F114E89, AC083A1C649EBA18C59FCC1772D0784B10E2B8C63094E3C14388E147DBC3F6DF ] CompositeBus    C:\Windows\system32\DRIVERS\CompositeBus.sys
11:12:51.0594 0x3c24  CompositeBus - ok
11:12:51.0601 0x3c24  COMSysApp - ok
11:12:51.0611 0x3c24  [ 2C4EBCFC84A9B44F209DFF6C6E6C61D1, 6FC323217D82EF661BA0E3F949B61B05BB5235D1A69C81D24876C2153FAECEF6 ] crcdisk        C:\Windows\system32\drivers\crcdisk.sys
11:12:51.0638 0x3c24  crcdisk - ok
11:12:51.0655 0x3c24  [ 7CA1BECEA5DE2643ADDAD32670E7A4C9, E3AB4CC52A97E3855D7EAB87363F807FDD2162ED8C76A036CD71549ED64E7797 ] CryptSvc        C:\Windows\system32\cryptsvc.dll
11:12:51.0694 0x3c24  CryptSvc - ok
11:12:51.0718 0x3c24  [ 3C2177A897B4CA2788C6FB0C3FD81D4B, 98575CBD0664586E6211D02E71BDD52CBAA149A1658573550E29E74E5F7B1553 ] CSC            C:\Windows\system32\drivers\csc.sys
11:12:51.0774 0x3c24  CSC - ok
11:12:51.0804 0x3c24  [ 15F93B37F6801943360D9EB42485D5D3, DD6838C6496CB15F8BB57A6596F6A64ADD9C36B09F062295699131232712B558 ] CscService      C:\Windows\System32\cscsvc.dll
11:12:51.0852 0x3c24  CscService - ok
11:12:51.0880 0x3c24  [ 7660F01D3B38ACA1747E397D21D790AF, 04611B43705C064C2A8331F6D3F8E4530295694AE2C3E3EC3F62CFF4A5EFA88D ] DcomLaunch      C:\Windows\system32\rpcss.dll
11:12:51.0939 0x3c24  DcomLaunch - ok
11:12:51.0956 0x3c24  [ 8D6E10A2D9A5EED59562D9B82CF804E1, 888F9650F4E872BA8F4E0C27E38A6672A561042B17EBA40E306A22357965B0AD ] defragsvc      C:\Windows\System32\defragsvc.dll
11:12:52.0021 0x3c24  defragsvc - ok
11:12:52.0031 0x3c24  [ F024449C97EC1E464AAFFDA18593DB88, 7EF1E241892E098A472BCA14C724DFF1AACCF190954AF1C4A38B6D542CC74BD2 ] DfsC            C:\Windows\system32\Drivers\dfsc.sys
11:12:52.0082 0x3c24  DfsC - ok
11:12:52.0093 0x3c24  [ 1D93C52AF82D68CFF028B51AA8E024C6, D68DBA930EF89FD3A6D7FF889722EE458D52550411FA399CF20F3BA62AAB9FBA ] dg_ssudbus      C:\Windows\system32\DRIVERS\ssudbus.sys
11:12:52.0122 0x3c24  dg_ssudbus - ok
11:12:52.0139 0x3c24  [ E9E01EB683C132F7FA27CD607B8A2B63, 4D9037B458C522874619143A4176BCED42472C68933E6E83D37B67242706F3C4 ] Dhcp            C:\Windows\system32\dhcpcore.dll
11:12:52.0186 0x3c24  Dhcp - ok
11:12:52.0195 0x3c24  [ 1A050B0274BFB3890703D490F330C0DA, 79D74F4679A2EE040FAAF4D0392A9311239A10A5F8A5CCB48656C6F89B6D62FB ] discache        C:\Windows\system32\drivers\discache.sys
11:12:52.0236 0x3c24  discache - ok
11:12:52.0245 0x3c24  [ 565003F326F99802E68CA78F2A68E9FF, ABC42B24DBA4FFC411120E09278EF26AF56CCAB463B69B4BD6C530B4A07063D2 ] Disk            C:\Windows\system32\drivers\disk.sys
11:12:52.0274 0x3c24  Disk - ok
11:12:52.0284 0x3c24  [ 2A958EF85DB1B61FFCA65044FA4BCE9E, C83511685EE1CE85A5ADF9B5BE96C375A521601F66024BDC3EE044C0B6E85D69 ] dmvsc          C:\Windows\system32\drivers\dmvsc.sys
11:12:52.0317 0x3c24  dmvsc - ok
11:12:52.0330 0x3c24  [ 33EF4861F19A0736B11314AAD9AE28D0, 4C4B84365D85758E3263B88F157D8B086B392C6F1EA5F0F3DB6BF87EF90248EC ] Dnscache        C:\Windows\System32\dnsrslvr.dll
11:12:52.0368 0x3c24  Dnscache - ok
11:12:52.0386 0x3c24  [ 366BA8FB4B7BB7435E3B9EACB3843F67, 65B7C61ACF34F1F0149045AA9E09A3F917A927963237A385A914D0B80551DC31 ] dot3svc        C:\Windows\System32\dot3svc.dll
11:12:52.0454 0x3c24  dot3svc - ok
11:12:52.0468 0x3c24  [ 8EC04CA86F1D68DA9E11952EB85973D6, 2E3FBC2D683D1274E8BC45EEEA87D43B77EDDCAAF0D453296D9FDA6B9D717071 ] DPS            C:\Windows\system32\dps.dll
11:12:52.0513 0x3c24  DPS - ok
11:12:52.0520 0x3c24  [ B918E7C5F9BF77202F89E1A9539F2EB4, C589A37DE50BBEF22E2DAA9682EA43147F614AA1AF7DAAA942BA5FC192313A0B ] drmkaud        C:\Windows\system32\drivers\drmkaud.sys
11:12:52.0546 0x3c24  drmkaud - ok
11:12:52.0585 0x3c24  [ 71BC35067CABC02C9453AEAA42B2E43E, 713B19F2C08EA5E4C087F7A74A8856932CF33E19D63384823DD4E02ED8798619 ] DXGKrnl        C:\Windows\System32\drivers\dxgkrnl.sys
11:12:52.0654 0x3c24  DXGKrnl - ok
11:12:52.0676 0x3c24  [ 377AD53E4154477339290B4212E69D53, CFB201699CBB9416963973DB2E45810760BEBABAE684EC06E35495601A8A10AF ] e1express      C:\Windows\system32\DRIVERS\e1e6232.sys
11:12:52.0711 0x3c24  e1express - ok
11:12:52.0722 0x3c24  [ 8600142FA91C1B96367D3300AD0F3F3A, 5713625E27DF11FAAFDA7AC79899A6AD813166E167088FA990EC5DE87DBE83DF ] EapHost        C:\Windows\System32\eapsvc.dll
11:12:52.0778 0x3c24  EapHost - ok
11:12:52.0918 0x3c24  [ 024E1B5CAC09731E4D868E64DBFB4AB0, AB0826A74BBEE5B7A1B035861B665C79BC98305CFC7D82BEF420558FBD3EE994 ] ebdrv          C:\Windows\system32\drivers\evbdx.sys
11:12:53.0123 0x3c24  ebdrv - ok
11:12:53.0141 0x3c24  [ DD17E1573651293D4ED31053795B3471, 94F7D1BB1C3B0C1FAAEED07375DB0F3BC995394FB5C26983548D946C8D229D54 ] EFS            C:\Windows\System32\lsass.exe
11:12:53.0163 0x3c24  EFS - ok
11:12:53.0193 0x3c24  [ A8C362018EFC87BEB013EE28F29C0863, 07971C681FBD391C0BA0172618AF8AD77520182207F1C57F134B34D6A113857F ] ehRecvr        C:\Windows\ehome\ehRecvr.exe
11:12:53.0263 0x3c24  ehRecvr - ok
11:12:53.0275 0x3c24  [ D389BFF34F80CAEDE417BF9D1507996A, 12859B9925D7A4631DE61A820922F43F56ED23C2AF014CBF36322685E5CF641E ] ehSched        C:\Windows\ehome\ehsched.exe
11:12:53.0311 0x3c24  ehSched - ok
11:12:53.0338 0x3c24  [ 0ED67910C8C326796FAA00B2BF6D9D3C, 97FAA7627A162B0AEC15545E0165D13355D535B4157604BB87F8EEB72ECD24A8 ] elxstor        C:\Windows\system32\drivers\elxstor.sys
11:12:53.0387 0x3c24  elxstor - ok
11:12:53.0396 0x3c24  [ 8FC3208352DD3912C94367A206AB3F11, 69B65C12BDADD4B730508674B1B77C5496612B4ACCC447DB9AFE49ADEA8CBF02 ] ErrDev          C:\Windows\system32\drivers\errdev.sys
11:12:53.0426 0x3c24  ErrDev - ok
11:12:53.0451 0x3c24  [ F6916EFC29D9953D5D0DF06882AE8E16, ED41893960018D5EC2F7829B1DE4B6967D9FD074D60B11B9EB854E3E0948EC24 ] EventSystem    C:\Windows\system32\es.dll
11:12:53.0504 0x3c24  EventSystem - ok
11:12:53.0517 0x3c24  [ 2DC9108D74081149CC8B651D3A26207F, 75CB47923A867DDAC512701CE71DFCFC340FC3A2E27F4255D0836A1FBC463176 ] exfat          C:\Windows\system32\drivers\exfat.sys
11:12:53.0574 0x3c24  exfat - ok
11:12:53.0587 0x3c24  [ 7E0AB74553476622FB6AE36F73D97D35, 41463A255FDA1D550B3385EC7C73ABC343B1BBBE9CEE4DF9F2A8B3E7338C4947 ] fastfat        C:\Windows\system32\drivers\fastfat.sys
11:12:53.0644 0x3c24  fastfat - ok
11:12:53.0672 0x3c24  [ 967EA5B213E9984CBE270205DF37755B, 43153E23210B03FAE16897D62D55B8742F834EDC695F8401EAB5DE307F62602D ] Fax            C:\Windows\system32\fxssvc.exe
11:12:53.0736 0x3c24  Fax - ok
11:12:53.0746 0x3c24  [ E817A017F82DF2A1F8CFDBDA29388B29, 4CC9320A21E6FEA2D16C48D6BEA14391B695BD541A3C5FDDAEEE086A414FC837 ] fdc            C:\Windows\system32\drivers\fdc.sys
11:12:53.0773 0x3c24  fdc - ok
11:12:53.0781 0x3c24  [ F3222C893BD2F5821A0179E5C71E88FB, A85B947249DBB986358CCD4B158DD58A9301F074F3C6CCCDEF2D01F432E59D1B ] fdPHost        C:\Windows\system32\fdPHost.dll
11:12:53.0829 0x3c24  fdPHost - ok
11:12:53.0837 0x3c24  [ 7DBE8CBFE79EFBDEB98C9FB08D3A9A5B, 0E76C29D2A974A3F2FBFCB63D066D4136B78E02F6B1F579B1865CA7A76193987 ] FDResPub        C:\Windows\system32\fdrespub.dll
11:12:53.0888 0x3c24  FDResPub - ok
11:12:53.0897 0x3c24  [ 6CF00369C97F3CF563BE99BE983D13D8, F65F35324A2FB9DFB533B1C4D089D990CC242218FE83414329D07B786D8EFF33 ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys
11:12:53.0926 0x3c24  FileInfo - ok
11:12:53.0934 0x3c24  [ 42C51DC94C91DA21CB9196EB64C45DB9, 388C68D12ECC8FFE3116FEAAF4DB7B80CF4A3F97E935788DD21C6ADE2369F635 ] Filetrace      C:\Windows\system32\drivers\filetrace.sys
11:12:53.0982 0x3c24  Filetrace - ok
11:12:53.0991 0x3c24  [ 87907AA70CB3C56600F1C2FB8841579B, CA1CD82A1CD453617CE5EA431A1836997F14E3580554E8A516D9FE1E9926D979 ] flpydisk        C:\Windows\system32\drivers\flpydisk.sys
11:12:54.0018 0x3c24  flpydisk - ok
11:12:54.0033 0x3c24  [ 7520EC808E0C35E0EE6F841294316653, 6EC65511B4838A7172A8F89E35C2F9DF4F0BFCE3BE12EDA790F3EB567102FF67 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys
11:12:54.0073 0x3c24  FltMgr - ok
11:12:54.0131 0x3c24  [ E12C4928B32ACE04610259647F072635, B71B9C2DF45F33C4DAC88435129B08B0BCDBBE82E8C3AD0A95F00137CC8B619F ] FontCache      C:\Windows\system32\FntCache.dll
11:12:54.0215 0x3c24  FontCache - ok
11:12:54.0227 0x3c24  [ E56F39F6B7FDA0AC77A79B0FD3DE1A2F, DBED26852B99B362152DA9CD4F31A1883EF6F9B496F3CF3772A197BA72DB61DA ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
11:12:54.0251 0x3c24  FontCache3.0.0.0 - ok
11:12:54.0261 0x3c24  [ 1A16B57943853E598CFF37FE2B8CBF1D, 87609F46F3B8123552141FD70866E895220B1BBD92BC2B580CAF49201AA0197E ] FsDepends      C:\Windows\system32\drivers\FsDepends.sys
11:12:54.0289 0x3c24  FsDepends - ok
11:12:54.0297 0x3c24  [ 7DAE5EBCC80E45D3253F4923DC424D05, 8A2C4D5591509B0B0A44583520617A9AE34F32BB6E68A012A7D7870ED24F703A ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys
11:12:54.0324 0x3c24  Fs_Rec - ok
11:12:54.0339 0x3c24  [ E306A24D9694C724FA2491278BF50FDB, 1D246B9C28550640EACBF8CF9DC980FD75106B92832D392FEBEF0C7012353091 ] fvevol          C:\Windows\system32\DRIVERS\fvevol.sys
11:12:54.0368 0x3c24  fvevol - ok
11:12:54.0378 0x3c24  [ 65EE0C7A58B65E74AE05637418153938, 0E1A398ADD8411AF4CCC3344D67BE1B261320C58328BD5C5855A357476FAEBEF ] gagp30kx        C:\Windows\system32\drivers\gagp30kx.sys
11:12:54.0407 0x3c24  gagp30kx - ok
11:12:54.0439 0x3c24  [ E897EAF5ED6BA41E081060C9B447A673, A428DC68516F19C6C53A8B62E4BDB2587E70FB751B9D77700B6B147D347DA157 ] gpsvc          C:\Windows\System32\gpsvc.dll
11:12:54.0509 0x3c24  gpsvc - ok
11:12:54.0519 0x3c24  [ C44E3C2BAB6837DB337DDEE7544736DB, 88A24FF7D2FECCEAFFD421B2039A0FB623DA47A6B220B80EF1E52DD26D9E222D ] hcw85cir        C:\Windows\system32\drivers\hcw85cir.sys
11:12:54.0548 0x3c24  hcw85cir - ok
11:12:54.0568 0x3c24  [ A5EF29D5315111C80A5C1ABAD14C8972, A181DA72E946F121C3F4A19438C547B0BFD15138AB1DB5465945EC89DF1F6B0A ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
11:12:54.0619 0x3c24  HdAudAddService - ok
11:12:54.0631 0x3c24  [ 9036377B8A6C15DC2EEC53E489D159B5, 1E56D2ACFE92E6DF96D755B05C63D580EED82C210F075C8623E138BEE6BCD41B ] HDAudBus        C:\Windows\system32\DRIVERS\HDAudBus.sys
11:12:54.0657 0x3c24  HDAudBus - ok
11:12:54.0665 0x3c24  [ 1D58A7F3E11A9731D0EAAAA8405ACC36, 7056FA18B86FBD52C4A6092D80476C02553EA053D6A0BEDB01A2FA5E152D5215 ] HidBatt        C:\Windows\system32\drivers\HidBatt.sys
11:12:54.0692 0x3c24  HidBatt - ok
11:12:54.0706 0x3c24  [ 89448F40E6DF260C206A193A4683BA78, 71E0FCC32AE6FF8DFF420DB0383D6A200E1EAE14BD2E32453F92CE18B31C1F3C ] HidBth          C:\Windows\system32\drivers\hidbth.sys
11:12:54.0752 0x3c24  HidBth - ok
11:12:54.0762 0x3c24  [ CF50B4CF4A4F229B9F3C08351F99CA5E, B97843620AF80FF0EC8F2C438255C0A42A756C6314FAF3DEF415DE16E14C108F ] HidIr          C:\Windows\system32\drivers\hidir.sys
11:12:54.0793 0x3c24  HidIr - ok
11:12:54.0802 0x3c24  [ 2BC6F6A1992B3A77F5F41432CA6B3B6B, 2AF3312F1C8C8923C0A29AA5DAE57CE269417E53DEA2F0CCCC8DB57029698FE1 ] hidserv        C:\Windows\System32\hidserv.dll
11:12:54.0857 0x3c24  hidserv - ok
11:12:54.0866 0x3c24  [ 10C19F8290891AF023EAEC0832E1EB4D, E208553029488A6EE2F5216CC9FE5F93E9931A94C0D0625253BB159E30642853 ] HidUsb          C:\Windows\system32\DRIVERS\hidusb.sys
11:12:54.0897 0x3c24  HidUsb - ok
11:12:54.0906 0x3c24  [ 196B4E3F4CCCC24AF836CE58FACBB699, 7A2E1F603A073421FA0987EFB96647F1F0F2D4E0C82AA62EBC041585DA811DAF ] hkmsvc          C:\Windows\system32\kmsvc.dll
11:12:54.0958 0x3c24  hkmsvc - ok
11:12:54.0973 0x3c24  [ 6658F4404DE03D75FE3BA09F7ABA6A30, E51D9C1580A283EB862F09B73AAE1B647DD683A53F3DD99834222F12DD15E40F ] HomeGroupListener C:\Windows\system32\ListSvc.dll
11:12:55.0025 0x3c24  HomeGroupListener - ok
11:12:55.0040 0x3c24  [ DBC02D918FFF1CAD628ACBE0C0EAA8E8, 02121800D9062692C102475876AE8143EBE46D855E8328B8CDCFE6A2F0D19696 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
11:12:55.0084 0x3c24  HomeGroupProvider - ok
11:12:55.0094 0x3c24  [ 295FDC419039090EB8B49FFDBB374549, 670E8015FD374640C6570F56F7FE8DE4D8F92E7A8072F5D1B2B95D0BD699CEF7 ] HpSAMD          C:\Windows\system32\drivers\HpSAMD.sys
11:12:55.0125 0x3c24  HpSAMD - ok
11:12:55.0175 0x3c24  [ 7BC42C65B5C6281777C1A7605B253BA8, 71885EB4E8625450ECA4623466FB3D5437DAABE739A5DC3B5F4CF982A65F8A86 ] HSF_DPV        C:\Windows\system32\DRIVERS\HSX_DPV.sys
11:12:55.0263 0x3c24  HSF_DPV - ok
11:12:55.0282 0x3c24  [ 9EBF2D102CCBB6BCDFBF1B7922F8BA2E, A11CE324DD8E8BDFFDF513429C32D3C16EC79DC9A7517048587759B26BF38583 ] HSXHWAZL        C:\Windows\system32\DRIVERS\HSXHWAZL.sys
11:12:55.0322 0x3c24  HSXHWAZL - ok
11:12:55.0351 0x3c24  [ 871917B07A141BFF43D76D8844D48106, 30C702008D0EE57D63F74864967DD19A55A268E77E42B5B3CC73037AD51D2987 ] HTTP            C:\Windows\system32\drivers\HTTP.sys
11:12:55.0414 0x3c24  HTTP - ok
11:12:55.0425 0x3c24  [ 0C4E035C7F105F1299258C90886C64C5, CFB4FBE7B28058E6D3E6E508CF3C1645F6AAE0AFEB4C5364835B9C42311DF0D4 ] hwpolicy        C:\Windows\system32\drivers\hwpolicy.sys
11:12:55.0445 0x3c24  hwpolicy - ok
11:12:55.0455 0x3c24  [ F151F0BDC47F4A28B1B20A0818EA36D6, 84B24B5796D9F70A8C37773F5484A4606CC7908370CCD942627ACBEDC4952D79 ] i8042prt        C:\Windows\system32\DRIVERS\i8042prt.sys
11:12:55.0488 0x3c24  i8042prt - ok
11:12:55.0513 0x3c24  [ A3CAE5D281DB4CFF7CFF8233507EE5AD, 2666107220B9F301193F2CF85A3D6B09E6E42CC150152D10A8886E47A3FD9B0D ] iaStorV        C:\Windows\system32\drivers\iaStorV.sys
11:12:55.0561 0x3c24  iaStorV - ok
11:12:55.0605 0x3c24  [ C521D7EB6497BB1AF6AFA89E322FB43C, BDDCFCBB5B76A9295669B5AC9F732D6127199ED5C300770B554C4E4794F66BB7 ] idsvc          C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
11:12:55.0688 0x3c24  idsvc - ok
11:12:55.0703 0x3c24  IEEtwCollectorService - ok
11:12:55.0919 0x3c24  [ 1F50623259DF354776DF04C56504A2D7, AC9D7A588638C00091C2CB7A257182DB72AF9C924BDEA20BAF10CC556896BA75 ] igfx            C:\Windows\system32\DRIVERS\igdkmd32.sys
11:12:56.0212 0x3c24  igfx - ok
11:12:56.0235 0x3c24  [ 4173FF5708F3236CF25195FECD742915, 0A9C0701DF6EAC6602BE342FC13C7950EF04BB5BDF7D96C2C5DABBD2A29AA55D ] iirsp          C:\Windows\system32\drivers\iirsp.sys
11:12:56.0263 0x3c24  iirsp - ok
11:12:56.0298 0x3c24  [ B9C54120F46392100478F58F374E5709, A28EE8B0988F580D5984E815FC78DF41B169260814234AA0E453375542D0957B ] IKEEXT          C:\Windows\System32\ikeext.dll
11:12:56.0372 0x3c24  IKEEXT - ok
11:12:56.0386 0x3c24  [ A0F12F2C9BA6C72F3987CE780E77C130, 5F53DF8BE1621AA7DFB655CFD9C95E0AFA1AD3CE2E290E19D7B7FB3C6E380034 ] intelide        C:\Windows\system32\drivers\intelide.sys
11:12:56.0411 0x3c24  intelide - ok
11:12:56.0420 0x3c24  [ 3B514D27BFC4ACCB4037BC6685F766E0, F12D7AC62F8550E6F33B28AD751D8413AB7FFEF963242D99FFA76CE8A48B027A ] intelppm        C:\Windows\system32\DRIVERS\intelppm.sys
11:12:56.0441 0x3c24  intelppm - ok
11:12:56.0452 0x3c24  [ ACB364B9075A45C0736E5C47BE5CAE19, 202F77C659103D2D0E787B8CB0A23BE32EA5AA2E6B3B0A0F0A8DFA906AB3C0C0 ] IPBusEnum      C:\Windows\system32\ipbusenum.dll
11:12:56.0508 0x3c24  IPBusEnum - ok
11:12:56.0518 0x3c24  [ 709D1761D3B19A932FF0238EA6D50200, 0A9D2C3A6E91CA45540555B40CB4E2DF3EBE98C1D164C4EECEE20C86782F5823 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys
11:12:56.0570 0x3c24  IpFilterDriver - ok
11:12:56.0596 0x3c24  [ 58F67245D041FBE7AF88F4EAF79DF0FA, 67468D6A46FF4D87AD321BFEA42F2FC843D09AA292A119C76D4D795D06028F96 ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll
11:12:56.0642 0x3c24  iphlpsvc - ok
11:12:56.0653 0x3c24  [ 4BD7134618C1D2A27466A099062547BF, 20284ABEF4433A59E2981F4143CAEC67DC990864FE0B9E3DC70EE0B88539E964 ] IPMIDRV        C:\Windows\system32\drivers\IPMIDrv.sys
11:12:56.0684 0x3c24  IPMIDRV - ok
11:12:56.0695 0x3c24  [ A5FA468D67ABCDAA36264E463A7BB0CD, EDB828D596E43372F97DAE1AADA46428C4C45FB80646DDC64FAD5F25C826CF63 ] IPNAT          C:\Windows\system32\drivers\ipnat.sys
11:12:56.0750 0x3c24  IPNAT - ok
11:12:56.0761 0x3c24  [ 9F7E491FB0BA0F9E370163834FC1FE31, 313D81BEBEC8C3F370FD1C9CC49931F0F178E6BA0581E6594EE1C64275FC157D ] irda            C:\Windows\system32\DRIVERS\irda.sys
11:12:56.0798 0x3c24  irda - ok
11:12:56.0806 0x3c24  [ 42996CFF20A3084A56017B7902307E9F, 688176DAB91BE569280E4822E4C5BDE755794D293591C53F8047AD59C441751D ] IRENUM          C:\Windows\system32\drivers\irenum.sys
11:12:56.0838 0x3c24  IRENUM - ok
11:12:56.0846 0x3c24  [ 4220D2F03D5C4226D0A1AA4B84025E45, 9002F4CB026CB0D71FFF4CC420C0F3573DA9F70B574A18AE7EF84D5B0A64D472 ] Irmon          C:\Windows\System32\irmon.dll
11:12:56.0879 0x3c24  Irmon - ok
11:12:56.0888 0x3c24  [ 1F32BB6B38F62F7DF1A7AB7292638A35, 86522358680FBB1CEBC56B4D139290689BB0F71A3EC78CE883E4D75D0B37586F ] isapnp          C:\Windows\system32\drivers\isapnp.sys
11:12:56.0917 0x3c24  isapnp - ok
11:12:56.0933 0x3c24  [ CB7A9ABB12B8415BCE5D74994C7BA3AE, 464BFF3F5EEE985BE075E23E1813F5CB82A9A0771A92C6D889B13B867BCDF647 ] iScsiPrt        C:\Windows\system32\drivers\msiscsi.sys
11:12:56.0975 0x3c24  iScsiPrt - ok
11:12:56.0985 0x3c24  [ ADEF52CA1AEAE82B50DF86B56413107E, A3AE1E96B04AC81665ABBD3CB267DFB3F78376DAE18FB0DBD447908DDAAA22D2 ] kbdclass        C:\Windows\system32\DRIVERS\kbdclass.sys
11:12:57.0014 0x3c24  kbdclass - ok
11:12:57.0022 0x3c24  [ 9E3CED91863E6EE98C24794D05E27A71, 90CF59F20E14E4A5A793266805E82BF7AE1F0CF4C7BAB1FD2EEF3B53C5DF770F ] kbdhid          C:\Windows\system32\drivers\kbdhid.sys
11:12:57.0050 0x3c24  kbdhid - ok
11:12:57.0057 0x3c24  [ DD17E1573651293D4ED31053795B3471, 94F7D1BB1C3B0C1FAAEED07375DB0F3BC995394FB5C26983548D946C8D229D54 ] KeyIso          C:\Windows\system32\lsass.exe
11:12:57.0078 0x3c24  KeyIso - ok
11:12:57.0088 0x3c24  [ 4120DA10AA42A9996F4575DB9E3E6E6E, 1C6E790772EA327ACB885D731A030408160534997DD56FEE4D6CEE6929873BB8 ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys
11:12:57.0117 0x3c24  KSecDD - ok
11:12:57.0131 0x3c24  [ D3964885F0A11ACF51DA3AAA776973B2, 417ED5A3201FC50FBC0D646F8F2114A1E8A91E7919A62508DCBC156C0BFB2FBA ] KSecPkg        C:\Windows\system32\Drivers\ksecpkg.sys
11:12:57.0165 0x3c24  KSecPkg - ok
11:12:57.0185 0x3c24  [ 89A7B9CC98D0D80C6F31B91C0A310FCD, 4583CAEEE0D50C0C7CE955E533FDA063CDC37B69033D41EF22EF1BA242E4C747 ] KtmRm          C:\Windows\system32\msdtckrm.dll
11:12:57.0254 0x3c24  KtmRm - ok
11:12:57.0269 0x3c24  [ D64AF876D53ECA3668BB97B51B4E70AB, D5C07C019BFEAFBEDC29AB5060356A3B07449712B21B50E03378BEF04AF180F9 ] LanmanServer    C:\Windows\System32\srvsvc.dll
11:12:57.0330 0x3c24  LanmanServer - ok
11:12:57.0341 0x3c24  [ 58405E4F68BA8E4057C6E914F326ABA2, C3E6519A1A38F1B3597D4391E42ABFE8F1F5E86256C4B3BD876CDAD9BB68B0A6 ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
11:12:57.0396 0x3c24  LanmanWorkstation - ok
11:12:57.0408 0x3c24  [ F7611EC07349979DA9B0AE1F18CCC7A6, 879AA7A391966F00761CA039C25EBC62F6712DD5461694911EEC673E12DE103E ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys
11:12:57.0459 0x3c24  lltdio - ok
11:12:57.0476 0x3c24  [ 5700673E13A2117FA3B9020C852C01E2, 6684A2905EE8C438F2A64BE47E51A54D287B08DEFB8E0AE7FC2809D845EE3C5F ] lltdsvc        C:\Windows\System32\lltdsvc.dll
11:12:57.0537 0x3c24  lltdsvc - ok
11:12:57.0545 0x3c24  [ 55CA01BA19D0006C8F2639B6C045E08B, 4DBBDC820C514DB18CC13F8EE178F8C4E39C295C6E3C255416C235553CE7BDC1 ] lmhosts        C:\Windows\System32\lmhsvc.dll
11:12:57.0592 0x3c24  lmhosts - ok
11:12:57.0607 0x3c24  [ EB119A53CCF2ACC000AC71B065B78FEF, 1FD60735C4945AE565C223F0B47EAF9602D8777E3D15600914C1A9D761215AF9 ] LSI_FC          C:\Windows\system32\drivers\lsi_fc.sys
11:12:57.0637 0x3c24  LSI_FC - ok
11:12:57.0648 0x3c24  [ 8ADE1C877256A22E49B75D1CC9161F9C, 3D64F233DC866537E50549A7C1A2B40A954055B22F0BDA39825B04C38C607CB7 ] LSI_SAS        C:\Windows\system32\drivers\lsi_sas.sys
11:12:57.0679 0x3c24  LSI_SAS - ok
11:12:57.0688 0x3c24  [ DC9DC3D3DAA0E276FD2EC262E38B11E9, A264990857CBC74036799E17A087130626C0A09BE19879019BAF2D761C62AECC ] LSI_SAS2        C:\Windows\system32\drivers\lsi_sas2.sys
11:12:57.0716 0x3c24  LSI_SAS2 - ok
11:12:57.0727 0x3c24  [ 0A036C7D7CAB643A7F07135AC47E0524, 2F662D07FCB74B8D493156DB555EAA90A47E93CF14C7B30039D2FE47EB8682B8 ] LSI_SCSI        C:\Windows\system32\drivers\lsi_scsi.sys
11:12:57.0758 0x3c24  LSI_SCSI - ok
11:12:57.0770 0x3c24  [ 6703E366CC18D3B6E534F5CF7DF39CEE, 7396B9AF938284D99EC51206A7B2FA4A0DC10A493DCE6707818B03A7473782C4 ] luafv          C:\Windows\system32\drivers\luafv.sys
11:12:57.0824 0x3c24  luafv - ok
11:12:57.0836 0x3c24  [ BFB9EE8EE977EFE85D1A3105ABEF6DD1, D2A84EBF0C0B7A14AD432FD2EF43CC12300027AEA3FA4075659FB088AB62B588 ] Mcx2Svc        C:\Windows\system32\Mcx2Svc.dll
11:12:57.0871 0x3c24  Mcx2Svc - ok
11:12:57.0879 0x3c24  [ 0CEA2D0D3FA284B85ED5B68365114F76, E6FF0EC98FDC3F628438B613C356C237E68686E3B5B17A58A60C16F4B9A2B968 ] mdmxsdk        C:\Windows\system32\DRIVERS\mdmxsdk.sys
11:12:57.0901 0x3c24  mdmxsdk - ok
11:12:57.0910 0x3c24  [ 0FFF5B045293002AB38EB1FD1FC2FB74, 49071B565FD5B2DE43EC00D8518C3BE70843F38919E82F13104B8C1FAFB20374 ] megasas        C:\Windows\system32\drivers\megasas.sys
11:12:57.0937 0x3c24  megasas - ok
11:12:57.0954 0x3c24  [ DCBAB2920C75F390CAF1D29F675D03D6, 85C3A7A010BEA5E3C6179161B295F2CB900A6A214833A5F87A4327392880E2BB ] MegaSR          C:\Windows\system32\drivers\MegaSR.sys
11:12:57.0995 0x3c24  MegaSR - ok
11:12:58.0004 0x3c24  [ 146B6F43A673379A3C670E86D89BE5EA, C4412DCF80DE6B55466F399413271364F14BC0819C224AA161EDDC31A9775440 ] MMCSS          C:\Windows\system32\mmcss.dll
11:12:58.0047 0x3c24  MMCSS - ok
11:12:58.0056 0x3c24  [ F001861E5700EE84E2D4E52C712F4964, F4DC5AEED6F34D76CCEF360862CC47EF71097BE0813C8CE04EE5F0DB387DFFAE ] Modem          C:\Windows\system32\drivers\modem.sys
11:12:58.0100 0x3c24  Modem - ok
11:12:58.0108 0x3c24  [ 79D10964DE86B292320E9DFE02282A23, 52714827B7EEDACA55326A4E4F6158D4942DFAA3BACDE303A2F569BF3F4FAA72 ] monitor        C:\Windows\system32\DRIVERS\monitor.sys
11:12:58.0131 0x3c24  monitor - ok
11:12:58.0139 0x3c24  [ F4EA1193A52C8FE4B8A135E210ABE546, B7370190A3B11A4A458F8B94118971F6C2448562645DAA05A79A93FCE6407B93 ] motccgp        C:\Windows\system32\DRIVERS\motccgp.sys
11:12:58.0175 0x3c24  motccgp - ok
11:12:58.0182 0x3c24  [ B812DA6605CAF02641312F1F65C75419, 5001E21AFE5FFC6F0333FE7F1C19DE882348A4BB0881B2E483EF59BC38351239 ] motccgpfl      C:\Windows\system32\DRIVERS\motccgpfl.sys
11:12:58.0215 0x3c24  motccgpfl - ok
11:12:58.0223 0x3c24  [ 69814ACD50A9D6D28296050EF6215D46, B8D4F6D7A6922CF146B053BAD6254A20B9FD77DA7425C7E04C4BB21F0561956E ] motmodem        C:\Windows\system32\DRIVERS\motmodem.sys
11:12:58.0260 0x3c24  motmodem - ok
11:12:58.0275 0x3c24  [ 3BBC6C2402242401F791548AAEBF3D39, DF0CBD6713D863C1A686367ACFB152C9E75741656E4F0DF3826B8A53EF7BDE57 ] MotoHelper      C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe
11:12:58.0297 0x3c24  MotoHelper - ok
11:12:58.0304 0x3c24  [ FD8C2CEF7AD8B23C6714103D621FAC1F, E008F2727E15DA513D21F0CA6A5872C089631523B511769857AF35D819D6EA47 ] MotoSwitchService C:\Windows\system32\DRIVERS\motswch.sys
11:12:58.0336 0x3c24  MotoSwitchService - ok
11:12:58.0345 0x3c24  [ DDC489D40B49F443787E7FFA75373522, A2144E20883A5D6502F763879023FA984244985469AE5AABC5AE0E85A32E831C ] Motousbnet      C:\Windows\system32\DRIVERS\Motousbnet.sys
11:12:58.0381 0x3c24  Motousbnet - ok
11:12:58.0389 0x3c24  [ F18898D418F43E74A93EDC57E1F28BC9, BFD5C6631F6F9E4E7337ED7470FA0384CE1FDB51E3FC9AC75E661F04036BF2D0 ] motusbdevice    C:\Windows\system32\DRIVERS\motusbdevice.sys
11:12:58.0425 0x3c24  motusbdevice - ok
11:12:58.0433 0x3c24  [ FB18CC1D4C2E716B6B903B0AC0CC0609, F10CCA63493782B16DE6B96B94A27078DBE68AECEF34FDF840CFF86D2C6E3C5E ] mouclass        C:\Windows\system32\DRIVERS\mouclass.sys
11:12:58.0461 0x3c24  mouclass - ok
11:12:58.0470 0x3c24  [ 2C388D2CD01C9042596CF3C8F3C7B24D, B2FB72272BB01AEDA4047B57C943B7E9BD8A6497854F8CC34672AAA592D0A703 ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys
11:12:58.0502 0x3c24  mouhid - ok
11:12:58.0512 0x3c24  [ FC8771F45ECCCFD89684E38842539B9B, 806DDF2B4830CA866582FE74A521BB7DF26CA0E19013DAF584D3677FB48CC77A ] mountmgr        C:\Windows\system32\drivers\mountmgr.sys
11:12:58.0532 0x3c24  mountmgr - ok
11:12:58.0543 0x3c24  [ 4E9D8041D352A33332FD6F59A3A78B03, D4E6229B07EF9866993EEE4F6223DC7F1FF1108273FE14A3DC74E65C181DE56A ] MozillaMaintenance C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
11:12:58.0578 0x3c24  MozillaMaintenance - ok
11:12:58.0591 0x3c24  [ 2D699FB6E89CE0D8DA14ECC03B3EDFE0, D3D903EEA465D77345AAC9B9F02CDEADF4831212EA2DE4FCA33BEE26EBB47420 ] mpio            C:\Windows\system32\drivers\mpio.sys
11:12:58.0627 0x3c24  mpio - ok
11:12:58.0637 0x3c24  [ AD2723A7B53DD1AACAE6AD8C0BFBF4D0, 1D6DCFA0E56C3E55B6AED819176E751502F863BA0FCF4F0B3253A81D208141A2 ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys
11:12:58.0685 0x3c24  mpsdrv - ok
11:12:58.0715 0x3c24  [ 9835584E999D25004E1EE8E5F3E3B881, 71798B0CBE9AE69F1F29B845319019C69EC7F415CBABB3B87DDE92C360675021 ] MpsSvc          C:\Windows\system32\mpssvc.dll
11:12:58.0785 0x3c24  MpsSvc - ok
11:12:58.0798 0x3c24  [ 21F4B24ACFC79A483515BD986DD9043F, 22681907E02E0B723ABE2CEF0602D36C8EF862E7E2B62A9B40A5EF582E58D7BA ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys
11:12:58.0835 0x3c24  MRxDAV - ok
11:12:58.0847 0x3c24  [ 5D16C921E3671636C0EBA3BBAAC5FD25, 5BC107B95CAFC88F51FBB9F657B99944B20627A2B618F263093D7045E4FFD65C ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys
11:12:58.0884 0x3c24  mrxsmb - ok
11:12:58.0902 0x3c24  [ 6D17A4791ACA19328C685D256349FEFC, 012AA3D84EEAAF53780D06D2D11B9727DFC3441F3FAD75BC9E751FB814403668 ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys
11:12:58.0945 0x3c24  mrxsmb10 - ok
11:12:58.0957 0x3c24  [ B81F204D146000BE76651A50670A5E9E, 78193D0F967BE9829E53F9B500342934B4B1E1F4CEFC444382959E2061BC3B17 ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys
11:12:58.0989 0x3c24  mrxsmb20 - ok
11:12:58.0997 0x3c24  [ 012C5F4E9349E711E11E0F19A8589F0A, 208B92DFCF7AD43202660FBBC9FF5E03AEDBEE38178FF3628EB74CB6CD37C584 ] msahci          C:\Windows\system32\drivers\msahci.sys
11:12:59.0023 0x3c24  msahci - ok
11:12:59.0036 0x3c24  [ 55055F8AD8BE27A64C831322A780A228, C2C9FD1F61302997117B1CD0835E8234405BB80084065ED05363B77868397304 ] msdsm          C:\Windows\system32\drivers\msdsm.sys
11:12:59.0069 0x3c24  msdsm - ok
11:12:59.0082 0x3c24  [ E1BCE74A3BD9902B72599C0192A07E27, 5162EB623FE64E9DFEAC6CA2410EFA1314E62EC13207FFBFED2D61AA887603C4 ] MSDTC          C:\Windows\System32\msdtc.exe
11:12:59.0123 0x3c24  MSDTC - ok
11:12:59.0159 0x3c24  [ DAEFB28E3AF5A76ABCC2C3078C07327F, 6EB558532400B489763BAE7203538DE5F196282A8CB46A1B31D59120FC5AFCEF ] Msfs            C:\Windows\system32\drivers\Msfs.sys
11:12:59.0223 0x3c24  Msfs - ok
11:12:59.0234 0x3c24  [ 3E1E5767043C5AF9367F0056295E9F84, B2EDFECD3C14E4FE1BA87D9A86334043A9BD696A554EBD186DA7EAEB2EBD4F70 ] mshidkmdf      C:\Windows\System32\drivers\mshidkmdf.sys
11:12:59.0279 0x3c24  mshidkmdf - ok
11:12:59.0287 0x3c24  [ 0A4E5757AE09FA9622E3158CC1AEF114, ED574E420E57374E328C7C526504ECA569C164287966F06019EC207CB17F2C54 ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys
11:12:59.0313 0x3c24  msisadrv - ok
11:12:59.0324 0x3c24  [ 90F7D9E6B6F27E1A707D4A297F077828, BEFC220EAA7307849600748842ACB9254A6A91158812D9B23EFAF912C498BA7F ] MSiSCSI        C:\Windows\system32\iscsiexe.dll
11:12:59.0379 0x3c24  MSiSCSI - ok
11:12:59.0387 0x3c24  msiserver - ok
11:12:59.0397 0x3c24  [ 8C0860D6366AAFFB6C5BB9DF9448E631, 949C5A14E57F2D7385543C17C3485E7ADE36EA2016F6E0A1866571D2EDE90A77 ] MSKSSRV        C:\Windows\system32\drivers\MSKSSRV.sys
11:12:59.0443 0x3c24  MSKSSRV - ok
11:12:59.0450 0x3c24  [ 3EA8B949F963562CEDBB549EAC0C11CE, 1B0B2F16A1790282504F3C548D47C3281EFB440D5D9711A1EF76D6371B768D2D ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys
11:12:59.0496 0x3c24  MSPCLOCK - ok
11:12:59.0504 0x3c24  [ F456E973590D663B1073E9C463B40932, 48BA6D5580EE7B6A4C06E04772FD35B51779553FC0DD6C5C30DD8B5DEEB25B11 ] MSPQM          C:\Windows\system32\drivers\MSPQM.sys
11:12:59.0549 0x3c24  MSPQM - ok
11:12:59.0562 0x3c24  [ 0E008FC4819D238C51D7C93E7B41E560, 141FCEBDD05874407EAEC35A9DCD3BB16F2A428F23E55487D6A5DBFCADBF10D2 ] MsRPC          C:\Windows\system32\drivers\MsRPC.sys
11:12:59.0597 0x3c24  MsRPC - ok
11:12:59.0609 0x3c24  [ FC6B9FF600CC585EA38B12589BD4E246, F05DB01AE1955D2468CE6B51E51998B111CA3B0BDEED090EE6B99B625CBA564A ] mssmbios        C:\Windows\system32\DRIVERS\mssmbios.sys
11:12:59.0628 0x3c24  mssmbios - ok
11:12:59.0636 0x3c24  [ B42C6B921F61A6E55159B8BE6CD54A36, 6BB0A7BE005B8F281E551D1B8046CE4202372BC7AE0161881C858BFAC675FE1C ] MSTEE          C:\Windows\system32\drivers\MSTEE.sys
11:12:59.0682 0x3c24  MSTEE - ok
11:12:59.0689 0x3c24  [ 33599130F44E1F34631CEA241DE8AC84, E15B31D1AFDC8DC6D2B21D4215796A99ECC69EEDBB06CEED01AECC3C99A44C8B ] MTConfig        C:\Windows\system32\drivers\MTConfig.sys
11:12:59.0716 0x3c24  MTConfig - ok
11:12:59.0725 0x3c24  [ 159FAD02F64E6381758C990F753BCC80, E55AB01DCFA95ECAB24A2A9656E28FF9D064BA08B3D82DC8AA42F5991BA09598 ] Mup            C:\Windows\system32\Drivers\mup.sys
11:12:59.0753 0x3c24  Mup - ok
11:12:59.0775 0x3c24  [ 61D57A5D7C6D9AFE10E77DAE6E1B445E, D252248532142E9E2332DA693BC51B795102CA938B568FF04981E98B19BFBC5C ] napagent        C:\Windows\system32\qagentRT.dll
11:12:59.0844 0x3c24  napagent - ok
11:12:59.0864 0x3c24  [ 26384429FCD85D83746F63E798AB1480, 957C115C263A4B4DC854558B43ECE632D8E2BCCB744E23A01EBA7476BA2E7FFB ] NativeWifiP    C:\Windows\system32\DRIVERS\nwifi.sys
11:12:59.0916 0x3c24  NativeWifiP - ok
11:12:59.0952 0x3c24  [ 8C9C922D71F1CD4DEF73F186416B7896, 15FF43CD90C7913F83B35F2E7986561584588E8A45196EBD965C3A355836A9C7 ] NDIS            C:\Windows\system32\drivers\ndis.sys
11:12:59.0999 0x3c24  NDIS - ok
11:13:00.0011 0x3c24  [ 0E1787AA6C9191D3D319E8BAFE86F80C, F535022747355B2C66424BDA892D7DCB820C2EB8EE05BAE5BC6D1B1D65186278 ] NdisCap        C:\Windows\system32\DRIVERS\ndiscap.sys
11:13:00.0060 0x3c24  NdisCap - ok
11:13:00.0067 0x3c24  [ E4A8AEC125A2E43A9E32AFEEA7C9C888, 6EA181117126FC70B3C1DD1AC73CC26D1603A2CF49E47F66623E2C9489C49B55 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys
11:13:00.0112 0x3c24  NdisTapi - ok
11:13:00.0121 0x3c24  [ D8A65DAFB3EB41CBB622745676FCD072, 874D3C3D247C4A309DA813DB1D2EDB0037D3C489824BD5FE95B0C20699764EF7 ] Ndisuio        C:\Windows\system32\DRIVERS\ndisuio.sys
11:13:00.0171 0x3c24  Ndisuio - ok
11:13:00.0183 0x3c24  [ 38FBE267E7E6983311179230FACB1017, CFD1CBCA59650795C030DB30E5795B37C11C736E14003AE1DAB081BA5C0C9B14 ] NdisWan        C:\Windows\system32\DRIVERS\ndiswan.sys
11:13:00.0235 0x3c24  NdisWan - ok
11:13:00.0244 0x3c24  [ A4BDC541E69674FBFF1A8FF00BE913F2, 18CCFD063E9870B8B6958715BC0414C4D920AE63528EA1E9D7E30F7138918FFA ] NDProxy        C:\Windows\system32\drivers\NDProxy.sys
11:13:00.0291 0x3c24  NDProxy - ok
11:13:00.0299 0x3c24  [ 80B275B1CE3B0E79909DB7B39AF74D51, 75B406B0D9D28239D4EB2A298419A5F78A58237D88C5FD688EF1DFFAFACCF796 ] NetBIOS        C:\Windows\system32\DRIVERS\netbios.sys
11:13:00.0348 0x3c24  NetBIOS - ok
11:13:00.0365 0x3c24  [ 280122DDCF04B378EDD1AD54D71C1E54, F98B2ADE34F7E67C7C06C1D0FFB80ECBC353D044D4B4784CD952910345DC2ED0 ] NetBT          C:\Windows\system32\DRIVERS\netbt.sys
11:13:00.0411 0x3c24  NetBT - ok
11:13:00.0419 0x3c24  [ DD17E1573651293D4ED31053795B3471, 94F7D1BB1C3B0C1FAAEED07375DB0F3BC995394FB5C26983548D946C8D229D54 ] Netlogon        C:\Windows\system32\lsass.exe
11:13:00.0439 0x3c24  Netlogon - ok
11:13:00.0458 0x3c24  [ 7CCCFCA7510684768DA22092D1FA4DB2, BB9E4F8FABBF596D888E6D303CB54A336D9DFF95B36AEA9369D2ED787DDC4B5D ] Netman          C:\Windows\System32\netman.dll
11:13:00.0529 0x3c24  Netman - ok
11:13:00.0545 0x3c24  [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
11:13:00.0585 0x3c24  NetMsmqActivator - ok
11:13:00.0596 0x3c24  [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetPipeActivator C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
11:13:00.0621 0x3c24  NetPipeActivator - ok
11:13:00.0643 0x3c24  [ 8C338238C16777A802D6A9211EB2BA50, 0D08A47CD403EDA5E8CAD7409BBBBCDC29A9861D2DC41D42B68B22B1AA1EBDD6 ] netprofm        C:\Windows\System32\netprofm.dll
11:13:00.0703 0x3c24  netprofm - ok
11:13:00.0715 0x3c24  [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetTcpActivator C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
11:13:00.0740 0x3c24  NetTcpActivator - ok
11:13:00.0751 0x3c24  [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
11:13:00.0776 0x3c24  NetTcpPortSharing - ok
11:13:00.0785 0x3c24  [ 1D85C4B390B0EE09C7A46B91EFB2C097, 6A8850B151E88EE371F3CC543A946302DDF9494908D684B8B0C706A42CC54348 ] nfrd960        C:\Windows\system32\drivers\nfrd960.sys
11:13:00.0813 0x3c24  nfrd960 - ok
11:13:00.0830 0x3c24  [ 374071043F9E4231EE43BE2BB48DD36D, C4FA3FC40CC49DBBB91901D14210A55D3831FAC9F9B3FF45FCA7F5CF242C9E92 ] NlaSvc          C:\Windows\System32\nlasvc.dll
11:13:00.0876 0x3c24  NlaSvc - ok
11:13:00.0885 0x3c24  [ 1DB262A9F8C087E8153D89BEF3D2235F, A51EE5D5AD3CD76B74BEA9C66C462608BF3B50C53DAA4110A75DB10495A8C101 ] Npfs            C:\Windows\system32\drivers\Npfs.sys
11:13:00.0934 0x3c24  Npfs - ok
11:13:00.0942 0x3c24  [ 6D8D2E5652FC2442C810C5D8BE784148, 013FF4FA03CA2E066B1946CC09889616B243068BA0FB2E58D4C1435BF66FBC87 ] NSCIRDA        C:\Windows\system32\DRIVERS\nscirda.sys
11:13:00.0968 0x3c24  NSCIRDA - ok
11:13:00.0976 0x3c24  [ BA387E955E890C8A88306D9B8D06BF17, 3477BD9686C5777A93251C154512671AAA7533B18C536DF51F7B1D6D28E7F8A5 ] nsi            C:\Windows\system32\nsisvc.dll
11:13:01.0026 0x3c24  nsi - ok
11:13:01.0034 0x3c24  [ E9A0A4D07E53D8FEA2BB8387A3293C58, 690CAD6C4E35ECC1172A2E1FD3933DF73158B3BF42CB21244269612A53DE4D7A ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys
11:13:01.0075 0x3c24  nsiproxy - ok
11:13:01.0135 0x3c24  [ 5E43D2B0EE64123D4880DFA6626DEFDE, 164413A22DE58B19EA2B4120034B46D6BE1F424B80C3421E10BE5C81153D049F ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys
11:13:01.0231 0x3c24  Ntfs - ok
11:13:01.0242 0x3c24  [ F9756A98D69098DCA8945D62858A812C, 572ADBFCFDE2030B34A013AADC14DBC144EB3F34D06991E2464A3EA9605BC045 ] Null            C:\Windows\system32\drivers\Null.sys
11:13:01.0288 0x3c24  Null - ok
11:13:01.0299 0x3c24  [ AF2EEC9580C1D32FB7EAF105D9784061, 6DAAE3BCA048ACD7FFD26A65C793C461933179070F03855FE3DC3C01F968163A ] nvraid          C:\Windows\system32\drivers\nvraid.sys
11:13:01.0332 0x3c24  nvraid - ok
11:13:01.0345 0x3c24  [ 9283C58EBAA2618F93482EB5DABCEC82, 0BC119D4EAFDEA879E4C1CFBA5402499DBD1970EDF963C6D2034D4867C34D15E ] nvstor          C:\Windows\system32\drivers\nvstor.sys
11:13:01.0379 0x3c24  nvstor - ok
11:13:01.0390 0x3c24  [ 5A0983915F02BAE73267CC2A041F717D, D83461D74597BF2BE042FEFCC27FCD18BF63CB8135B0666D731D50951C3468A8 ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys
11:13:01.0423 0x3c24  nv_agp - ok
11:13:01.0433 0x3c24  [ 08A70A1F2CDDE9BB49B885CB817A66EB, 0BB98123B544124B144F3E95D77E01E973D060B8B2302503FF24ABBBE803EB63 ] ohci1394        C:\Windows\system32\drivers\ohci1394.sys
11:13:01.0465 0x3c24  ohci1394 - ok
11:13:01.0483 0x3c24  [ 82A8521DDC60710C3D3D3E7325209BEC, C4E34571EDD57C7FBB3D736B5FE8BD154624705B5C8EA2EC898F19F75B9A5942 ] p2pimsvc        C:\Windows\system32\pnrpsvc.dll
11:13:01.0518 0x3c24  p2pimsvc - ok
11:13:01.0538 0x3c24  [ 59C3DDD501E39E006DAC31BF55150D91, E02B63AB7F34CF6FF3F644AF354D10004E6F50014E03172D80BD78934EF71EF1 ] p2psvc          C:\Windows\system32\p2psvc.dll
11:13:01.0591 0x3c24  p2psvc - ok
11:13:01.0602 0x3c24  [ 2EA877ED5DD9713C5AC74E8EA7348D14, 14BA3722CE5F8FF07F2D97DCDD6558EB49C9B02E5E6FAD6D9F18D354733EFECE ] Parport        C:\Windows\system32\drivers\parport.sys
11:13:01.0634 0x3c24  Parport - ok
11:13:01.0643 0x3c24  [ 3F34A1B4C5F6475F320C275E63AFCE9B, 31295D5121C0C3F2085E0EEBA260EEE4CA003993C026E2F81986D19158036E6B ] partmgr        C:\Windows\system32\drivers\partmgr.sys
11:13:01.0673 0x3c24  partmgr - ok
11:13:01.0680 0x3c24  [ EB0A59F29C19B86479D36B35983DAADC, AC09AFE7F13BE4079D01383BAC44091997E1AAF6512C9673A42B9E3780EB08A8 ] Parvdm          C:\Windows\system32\drivers\parvdm.sys
11:13:01.0705 0x3c24  Parvdm - ok
11:13:01.0718 0x3c24  [ 358AB7956D3160000726574083DFC8A6, 6CAFD4D1B8AB8C1D167ADC018985DDAB5AC2CBFFB3434FE6390F14AF50C19025 ] PcaSvc          C:\Windows\System32\pcasvc.dll
11:13:01.0764 0x3c24  PcaSvc - ok
11:13:01.0778 0x3c24  [ 673E55C3498EB970088E812EA820AA8F, 1F81315664B8CBFDD569416C0ECCE4C6251F34577313A0858AB46609781303B5 ] pci            C:\Windows\system32\drivers\pci.sys
11:13:01.0816 0x3c24  pci - ok
11:13:01.0824 0x3c24  [ AFE86F419014DB4E5593F69FFE26CE0A, CAF36E61BE7B511D3A03A65FF5A3017CEE4D2F53005B410F2D4A2AAE9FED4C00 ] pciide          C:\Windows\system32\drivers\pciide.sys
11:13:01.0849 0x3c24  pciide - ok
11:13:01.0864 0x3c24  [ F396431B31693E71E8A80687EF523506, BC614FC21E029E2497F1CCE3131BBD295B827F2310762B47D5BBC7703D80554B ] pcmcia          C:\Windows\system32\DRIVERS\pcmcia.sys
11:13:01.0903 0x3c24  pcmcia - ok
11:13:01.0912 0x3c24  [ 250F6B43D2B613172035C6747AEEB19F, A91F15B133F2619912CF750E6F3662E011CD0FA4B9477CE532CE3196D23307D9 ] pcw            C:\Windows\system32\drivers\pcw.sys
11:13:01.0940 0x3c24  pcw - ok
11:13:01.0971 0x3c24  [ 9E0104BA49F4E6973749A02BF41344ED, B32F39F38DB48D77FBA884DEE34112BAB81CCEF5DD2EAAA12D9589D73D2BB116 ] PEAUTH          C:\Windows\system32\drivers\peauth.sys
11:13:02.0061 0x3c24  PEAUTH - ok
11:13:02.0112 0x3c24  [ AF4D64D2A57B9772CF3801950B8058A6, C9C493A3775E6E1660CE5DF75DA574D0C04245FB88CF41B96217A725359C350D ] PeerDistSvc    C:\Windows\system32\peerdistsvc.dll
11:13:02.0186 0x3c24  PeerDistSvc - ok
11:13:02.0274 0x3c24  [ 414BBA67A3DED1D28437EB66AEB8A720, D6DF254E2615FA402044824DCD9004F579FC0DF74B90E44C99D5F0253CF8AD88 ] pla            C:\Windows\system32\pla.dll
11:13:02.0413 0x3c24  pla - ok
11:13:02.0437 0x3c24  [ EC7BC28D207DA09E79B3E9FAF8B232CA, A42F8F69C3CD753D787A5D558659DEA2CC306C896D75B8C82549219CF654504F ] PlugPlay        C:\Windows\system32\umpnpmgr.dll
11:13:02.0473 0x3c24  PlugPlay - ok
11:13:02.0481 0x3c24  [ 63FF8572611249931EB16BB8EED6AFC8, 9732CCBCB93A7A4BEC88812B952C20244479E9BD781240C195E57F09E619EA33 ] PNRPAutoReg    C:\Windows\system32\pnrpauto.dll
11:13:02.0510 0x3c24  PNRPAutoReg - ok
11:13:02.0528 0x3c24  [ 82A8521DDC60710C3D3D3E7325209BEC, C4E34571EDD57C7FBB3D736B5FE8BD154624705B5C8EA2EC898F19F75B9A5942 ] PNRPsvc        C:\Windows\system32\pnrpsvc.dll
11:13:02.0559 0x3c24  PNRPsvc - ok
11:13:02.0581 0x3c24  [ 53946B69BA0836BD95B03759530C81EC, 7F14A34635354CCA0F5342C8D9DF5A6AA1B94F6A508BD8834029E9BACF252920 ] PolicyAgent    C:\Windows\System32\ipsecsvc.dll
11:13:02.0649 0x3c24  PolicyAgent - ok
11:13:02.0669 0x3c24  [ F87D30E72E03D579A5199CCB3831D6EA, B09328E89954584F97908FA5946376BA990B8C650DABCBF3CA3B08719937C694 ] Power          C:\Windows\system32\umpo.dll
11:13:02.0714 0x3c24  Power - ok
11:13:02.0724 0x3c24  [ 631E3E205AD6D86F2AED6A4A8E69F2DB, 1D3BF0CFC37D91A3A56246920B9CF1084E78A055D56E85A773417809C58C8065 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys
11:13:02.0766 0x3c24  PptpMiniport - ok
11:13:02.0775 0x3c24  [ 85B1E3A0C7585BC4AAE6899EC6FCF011, 1E067113C146D6842D7FB04007F363D6FB7783C6BC7C9AB6614E44075C4F86C3 ] Processor      C:\Windows\system32\drivers\processr.sys
11:13:02.0807 0x3c24  Processor - ok
11:13:02.0821 0x3c24  [ CADEFAC453040E370A1BDFF3973BE00D, 2E3DD8DA702468D8AB0F3CE27188B1991D4CB015FB36BAE4C6E7996B61CF49B8 ] ProfSvc        C:\Windows\system32\profsvc.dll
11:13:02.0864 0x3c24  ProfSvc - ok
11:13:02.0871 0x3c24  [ DD17E1573651293D4ED31053795B3471, 94F7D1BB1C3B0C1FAAEED07375DB0F3BC995394FB5C26983548D946C8D229D54 ] ProtectedStorage C:\Windows\system32\lsass.exe
11:13:02.0892 0x3c24  ProtectedStorage - ok
11:13:02.0904 0x3c24  [ 6270CCAE2A86DE6D146529FE55B3246A, 463209CBAF1B0E269DC8FC6FBDEE5BB7E5ADB5D3F024930BFD0B97E0A9678883 ] Psched          C:\Windows\system32\DRIVERS\pacer.sys
11:13:02.0949 0x3c24  Psched - ok
11:13:02.0958 0x3c24  [ 05A0C2744CEAC6F1B723EC469B650EF0, D9F2E0E4431217C6A7CDE38D36362CD5A06E93B9F45F92638120EF151089B370 ] PSKMAD          C:\Windows\system32\DRIVERS\PSKMAD.sys
11:13:02.0985 0x3c24  PSKMAD - ok
11:13:03.0049 0x3c24  [ AB95ECF1F6659A60DDC166D8315B0751, 0ED6D3460D28978BADF31B930DBB3298A6A10EFF8883763EABA0E36A21A0E83D ] ql2300          C:\Windows\system32\drivers\ql2300.sys
11:13:03.0145 0x3c24  ql2300 - ok
11:13:03.0161 0x3c24  [ B4DD51DD25182244B86737DC51AF2270, 7E62B04F054A6330B7F9968222523BDE8F3EE47A11D17E6C0E2D5ACDC07B9E6B ] ql40xx          C:\Windows\system32\drivers\ql40xx.sys
11:13:03.0194 0x3c24  ql40xx - ok
11:13:03.0209 0x3c24  [ 31AC809E7707EB580B2BDB760390765A, A8481FD19A0F778F5591B7676F591F664ADC68B6867E663C0F9564173F4AC909 ] QWAVE          C:\Windows\system32\qwave.dll
11:13:03.0259 0x3c24  QWAVE - ok
11:13:03.0267 0x3c24  [ 584078CA1B95CA72DF2A27C336F9719D, 836F115C92D343463C14A9DE39648C1EFA7C7EE4720F5C692EE0F68B84830121 ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys
11:13:03.0300 0x3c24  QWAVEdrv - ok
11:13:03.0307 0x3c24  [ 30A81B53C766D0133BB86D234E5556AB, 726C6B83B5ACAA84CAB1689B6DD6DDAE3199D61A57B5D7B5B5A0F62FCF838090 ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys
11:13:03.0353 0x3c24  RasAcd - ok
11:13:03.0361 0x3c24  [ 57EC4AEF73660166074D8F7F31C0D4FD, C66B425EC4DB5E7FD289AE631C9B019EB16717C55E80FAE964BB22203E4AACEF ] RasAgileVpn    C:\Windows\system32\DRIVERS\AgileVpn.sys
11:13:03.0401 0x3c24  RasAgileVpn - ok
11:13:03.0411 0x3c24  [ A60F1839849C0C00739787FD5EC03F13, B210DFA5A843CF1DA73635F168E2EA5052CBED15C664F8523CDFB34CA165D0E0 ] RasAuto        C:\Windows\System32\rasauto.dll
11:13:03.0467 0x3c24  RasAuto - ok
11:13:03.0477 0x3c24  [ D9F91EAFEC2815365CBE6D167E4E332A, 8350457A39D141C13807E7DB5A8D4113197C4016F7744B9993391F4AEA0C4A5C ] Rasl2tp        C:\Windows\system32\DRIVERS\rasl2tp.sys
11:13:03.0530 0x3c24  Rasl2tp - ok
11:13:03.0549 0x3c24  [ CB9E04DC05EACF5B9A36CA276D475006, 4D8C0AEF1D4F84F375AD2BAF786C9F6C52316A3E655B913449E71AD7C0FCA56E ] RasMan          C:\Windows\System32\rasmans.dll
11:13:03.0618 0x3c24  RasMan - ok
11:13:03.0629 0x3c24  [ 0FE8B15916307A6AC12BFB6A63E45507, 64119474DE7499E6E8B82E78BBD50074B3AA70B3E8329089FAE9B7F29919004E ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys
11:13:03.0672 0x3c24  RasPppoe - ok
11:13:03.0682 0x3c24  [ 44101F495A83EA6401D886E7FD70096B, 56A0CE5C89870752B9B2AB795C1A248CA28209E049B2F20CCA0308CBE2488A0A ] RasSstp        C:\Windows\system32\DRIVERS\rassstp.sys
11:13:03.0723 0x3c24  RasSstp - ok
11:13:03.0739 0x3c24  [ D528BC58A489409BA40334EBF96A311B, C71E9A4B101DB6C3183B9F97B9098D73D6FE1B12C05C2EB3CE8A8041BEE6BA61 ] rdbss          C:\Windows\system32\DRIVERS\rdbss.sys
11:13:03.0802 0x3c24  rdbss - ok
11:13:03.0811 0x3c24  [ 0D8F05481CB76E70E1DA06EE9F0DA9DF, 2AFCBE3237D27AFBF095F91F1FCCA63E6890F34A9E4F00E5C34C92394CDA89FB ] rdpbus          C:\Windows\system32\DRIVERS\rdpbus.sys
11:13:03.0840 0x3c24  rdpbus - ok
11:13:03.0847 0x3c24  [ 23DAE03F29D253AE74C44F99E515F9A1, 8FED93D10B2062F0526FE3508101F8FCF8F72DEB90AFB472EB7CBAE83A0EC430 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys
11:13:03.0885 0x3c24  RDPCDD - ok
11:13:03.0901 0x3c24  [ B973FCFC50DC1434E1970A146F7E3885, BE797E5F5AE34D37F8DA1134CE94DD14DBE36D2BC405B97E992E2257848B7CA9 ] RDPDR          C:\Windows\system32\drivers\rdpdr.sys
11:13:03.0938 0x3c24  RDPDR - ok
11:13:03.0946 0x3c24  [ 5A53CA1598DD4156D44196D200C94B8A, 8112FE14FEC94C67B1C5BDE4171E37584F1D0098D2C557C9E4BDD3E0291E25E4 ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys
11:13:03.0984 0x3c24  RDPENCDD - ok
11:13:03.0995 0x3c24  [ 44B0A53CD4F27D50ED461DAE0C0B4E1F, CDA80B08E67AD034081C0C920CD66147689F1844403CBC552F65005E7C011A91 ] RDPREFMP        C:\Windows\system32\drivers\rdprefmp.sys
11:13:04.0034 0x3c24  RDPREFMP - ok
11:13:04.0045 0x3c24  [ 65375DF758CA1872AB7EBBBA457FD5E6, 8AC7681F51277E799C22FF95FA0B833E9E260D37C0416319FF05B66FB3948005 ] RdpVideoMiniport C:\Windows\system32\drivers\rdpvideominiport.sys
11:13:04.0072 0x3c24  RdpVideoMiniport - ok
11:13:04.0087 0x3c24  [ F031683E6D1FEA157ABB2FF260B51E61, 83B552819A5964152882C527E1421DBCEAACC74DEB897E3C4B53F52F1467FED3 ] RDPWD          C:\Windows\system32\drivers\RDPWD.sys
11:13:04.0126 0x3c24  RDPWD - ok
11:13:04.0140 0x3c24  [ 518395321DC96FE2C9F0E96AC743B656, 5F6A0880B4F3EE7196259EA362DA9554B0687B0236F9A8E5CF7A4A77F01F1776 ] rdyboost        C:\Windows\system32\drivers\rdyboost.sys
11:13:04.0179 0x3c24  rdyboost - ok
11:13:04.0189 0x3c24  [ 7B5E1419717FAC363A31CC302895217A, 048B96B127CC20833948DAE53C59886D5C725ECA7A744424A01339447D2DDC32 ] RemoteAccess    C:\Windows\System32\mprdim.dll
11:13:04.0240 0x3c24  RemoteAccess - ok
11:13:04.0251 0x3c24  [ CB9A8683F4EF2BF99E123D79950D7935, B9FA3E7E91E76D975CF40BFA37909E50F29CC13AB1399007884710651827E9AA ] RemoteRegistry  C:\Windows\system32\regsvc.dll
11:13:04.0309 0x3c24  RemoteRegistry - ok
11:13:04.0322 0x3c24  [ CB928D9E6DAF51879DD6BA8D02F01321, DFD263B67DDF98AE09AF6D6986CBC7BE3206BCE8403AAC51BCF9459E78233D12 ] RFCOMM          C:\Windows\system32\DRIVERS\rfcomm.sys
11:13:04.0391 0x3c24  RFCOMM - ok
11:13:04.0400 0x3c24  [ 78D072F35BC45D9E4E1B61895C152234, 80C924EE1156B4E3172E83DCB9C60817E87885FB9377647E0BF90153E415B1CA ] RpcEptMapper    C:\Windows\System32\RpcEpMap.dll
11:13:04.0454 0x3c24  RpcEptMapper - ok
11:13:04.0461 0x3c24  [ 94D36C0E44677DD26981D2BFEEF2A29D, D77A93AC60536F3706E8A0154C0C2199E888B7748C84DB7437254FF175F4DF55 ] RpcLocator      C:\Windows\system32\locator.exe
11:13:04.0488 0x3c24  RpcLocator - ok
11:13:04.0509 0x3c24  [ 7660F01D3B38ACA1747E397D21D790AF, 04611B43705C064C2A8331F6D3F8E4530295694AE2C3E3EC3F62CFF4A5EFA88D ] RpcSs          C:\Windows\system32\rpcss.dll
11:13:04.0565 0x3c24  RpcSs - ok
11:13:04.0575 0x3c24  [ 032B0D36AD92B582D869879F5AF5B928, 0F8F18A6A0A689957B886D9368015889091094EDA18BE532093F06A70A7CE184 ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys
11:13:04.0626 0x3c24  rspndr - ok
11:13:04.0633 0x3c24  [ 7FA7F2E249A5DCBB7970630E15E1F482, 9633B193F3FDA67BC551C6DCA4788AB83E9F45F77763EE579D02FE5D6B80DEDF ] s3cap          C:\Windows\system32\drivers\vms3cap.sys
11:13:04.0657 0x3c24  s3cap - ok
11:13:04.0665 0x3c24  [ DD17E1573651293D4ED31053795B3471, 94F7D1BB1C3B0C1FAAEED07375DB0F3BC995394FB5C26983548D946C8D229D54 ] SamSs          C:\Windows\system32\lsass.exe
11:13:04.0686 0x3c24  SamSs - ok
11:13:04.0696 0x3c24  [ 05D860DA1040F111503AC416CCEF2BCA, DAE2F37D09A5A42F945BC8E27E4EA2303521081783A80CEE7FEE7C5A1C2CFC5E ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys
11:13:04.0727 0x3c24  sbp2port - ok
11:13:04.0740 0x3c24  [ 8FC518FFE9519C2631D37515A68009C4, 21E10585470CF9FC3BD1977F8A426686CD2FA6BD2094B9E3594B21C7C4541D25 ] SCardSvr        C:\Windows\System32\SCardSvr.dll
11:13:04.0795 0x3c24  SCardSvr - ok
11:13:04.0804 0x3c24  [ 0693B5EC673E34DC147E195779A4DCF6, AF1B56FBF3ADABF94CD9DBA67586B8746DE135151F6B3D1B0EE315BC1E2DB670 ] scfilter        C:\Windows\system32\DRIVERS\scfilter.sys
11:13:04.0850 0x3c24  scfilter - ok
11:13:04.0889 0x3c24  [ A04BB13F8A72F8B6E8B4071723E4E336, E63287FF71C39CBF64C3347C455324C8437F9CF398153E269543588B65389502 ] Schedule        C:\Windows\system32\schedsvc.dll
11:13:04.0987 0x3c24  Schedule - ok
11:13:04.0999 0x3c24  [ 319C6B309773D063541D01DF8AC6F55F, 182F392FE839499D159A30A3CD04B5D0C87219930BFB1A7456880B7DA75B9820 ] SCPolicySvc    C:\Windows\System32\certprop.dll
11:13:05.0040 0x3c24  SCPolicySvc - ok
11:13:05.0055 0x3c24  [ 08236C4BCE5EDD0A0318A438AF28E0F7, 77727F963F63C4CEC11E7AAD5FB3836179701D512CA9436C3170B9E6A4E5F888 ] SDRSVC          C:\Windows\System32\SDRSVC.dll
11:13:05.0094 0x3c24  SDRSVC - ok
11:13:05.0102 0x3c24  [ 90A3935D05B494A5A39D37E71F09A677, F72733A69BC6E1A2BB91D7632FF3463C12563F60FDCC00A2CDD67FF20D479952 ] secdrv          C:\Windows\system32\drivers\secdrv.sys
11:13:05.0149 0x3c24  secdrv - ok
11:13:05.0157 0x3c24  [ A59B3A4442C52060CC7A85293AA3546F, 1776D6DEE51991149265AAF39E17065E301C5FA1FF4068653DC0010B9B27185D ] seclogon        C:\Windows\system32\seclogon.dll
11:13:05.0209 0x3c24  seclogon - ok
11:13:05.0218 0x3c24  [ DCB7FCDCC97F87360F75D77425B81737, F8289AF2C458C167038EEFE613EE5E3D6D5B3308B8784168374BC81C47891CE5 ] SENS            C:\Windows\system32\sens.dll
11:13:05.0263 0x3c24  SENS - ok
11:13:05.0271 0x3c24  [ 50087FE1EE447009C9CC2997B90DE53F, B5E6CF1D991F87C29C5E28198E0962E31FFB499A46C3BD43FC20391693389959 ] SensrSvc        C:\Windows\system32\sensrsvc.dll
11:13:05.0302 0x3c24  SensrSvc - ok
11:13:05.0310 0x3c24  [ 9AD8B8B515E3DF6ACD4212EF465DE2D1, E2F019BCD1446236D078D46065DD151DD068778F33BE2F1E8A0CC1EA2F954E86 ] Serenum        C:\Windows\system32\drivers\serenum.sys
11:13:05.0350 0x3c24  Serenum - ok
11:13:05.0360 0x3c24  [ 5FB7FCEA0490D821F26F39CC5EA3D1E2, A26DB2EB9F3E2509B4EBA949DB97595CC32332D9321DF68283BFC102E66D766F ] Serial          C:\Windows\system32\drivers\serial.sys
11:13:05.0398 0x3c24  Serial - ok
11:13:05.0406 0x3c24  [ 79BFFB520327FF916A582DFEA17AA813, 7A2A9D69BE02228591186A9F4453D4B5FD98837CA422C873C48040170E8BD18C ] sermouse        C:\Windows\system32\drivers\sermouse.sys
11:13:05.0440 0x3c24  sermouse - ok
11:13:05.0464 0x3c24  [ 4AE380F39A0032EAB7DD953030B26D28, C8F5F2DD59574E966FDF3057867BB959A554BAB6FD5DC6F1427094A6BC2B2809 ] SessionEnv      C:\Windows\system32\sessenv.dll
11:13:05.0527 0x3c24  SessionEnv - ok
11:13:05.0534 0x3c24  [ 9F976E1EB233DF46FCE808D9DEA3EB9C, 6A5C53F27F8BCA85CE206EE7D196176F67EC6FFA5D4830373A20792C149B5E75 ] sffdisk        C:\Windows\system32\drivers\sffdisk.sys
11:13:05.0563 0x3c24  sffdisk - ok
11:13:05.0570 0x3c24  [ 932A68EE27833CFD57C1639D375F2731, 11D6B98FBEEE2B9C7B06EF7091857BBD3B349077997D6261D66280668FD1B5C3 ] sffp_mmc        C:\Windows\system32\drivers\sffp_mmc.sys
11:13:05.0599 0x3c24  sffp_mmc - ok
11:13:05.0607 0x3c24  [ 6D4CCAEDC018F1CF52866BBBAA235982, AAC41F5C97B3FE5A3DC0838457EB8CC9BB71FCA16D3EDBB67D603F0A9D46C131 ] sffp_sd        C:\Windows\system32\drivers\sffp_sd.sys
11:13:05.0637 0x3c24  sffp_sd - ok
11:13:05.0644 0x3c24  [ DB96666CC8312EBC45032F30B007A547, C3AE60FC65A36E96E0D2CC6E184481D70F91A19DC3E2E17E2873DD670A592DD7 ] sfloppy        C:\Windows\system32\drivers\sfloppy.sys
11:13:05.0671 0x3c24  sfloppy - ok
11:13:05.0691 0x3c24  [ D1A079A0DE2EA524513B6930C24527A2, E2BC16DBCF38841EECD49C6FA1A9AC89C17F332F12606CA826F058E995E1B83D ] SharedAccess    C:\Windows\System32\ipnathlp.dll
11:13:05.0762 0x3c24  SharedAccess - ok
11:13:05.0784 0x3c24  [ 414DA952A35BF5D50192E28263B40577, 9C9BAFB9880DA6CC728506A142BE124E186219610DCC3460657A3CA93C865DF1 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
11:13:05.0891 0x3c24  ShellHWDetection - ok
11:13:05.0902 0x3c24  [ 2565CAC0DC9FE0371BDCE60832582B2E, 1A775214E86B83C2F1799F12D71077D81C89AD32734A248BA88787B7F104B79D ] sisagp          C:\Windows\system32\drivers\sisagp.sys
11:13:05.0949 0x3c24  sisagp - ok
11:13:05.0967 0x3c24  [ A9F0486851BECB6DDA1D89D381E71055, 7E909538AB758C18AC2CCBFFEE17BA36FA6ED2E674AA70924AA87AC61375FF35 ] SiSRaid2        C:\Windows\system32\drivers\SiSRaid2.sys
11:13:05.0997 0x3c24  SiSRaid2 - ok
11:13:06.0012 0x3c24  [ 3727097B55738E2F554972C3BE5BC1AA, 75D52A596A298C33EC79A3B0B80F25492C08A182ABC679401502DA9597687566 ] SiSRaid4        C:\Windows\system32\drivers\sisraid4.sys
11:13:06.0044 0x3c24  SiSRaid4 - ok
11:13:06.0054 0x3c24  [ 3E21C083B8A01CB70BA1F09303010FCE, 803F8F91299C387110F34A49340E7136AAE91B418E2977A36285EA8F432FF197 ] Smb            C:\Windows\system32\DRIVERS\smb.sys
11:13:06.0111 0x3c24  Smb - ok
11:13:06.0132 0x3c24  [ 6A984831644ECA1A33FFEAE4126F4F37, 753E23D2B33D47C52C05D892B052CFD96D93B97FB6E9FCB58EF1E4C4A125BF78 ] SNMPTRAP        C:\Windows\System32\snmptrap.exe
11:13:06.0164 0x3c24  SNMPTRAP - ok
11:13:06.0174 0x3c24  [ 95CF1AE7527FB70F7816563CBC09D942, CE8BACB91A5A86CBCE82619C6C1873B4D7593B00CED3B522E41B8F7F6258CC65 ] spldr          C:\Windows\system32\drivers\spldr.sys
11:13:06.0200 0x3c24  spldr - ok
11:13:06.0219 0x3c24  [ 866A43013535DC8587C258E43579C764, B2BE846B5167A2ECD1E30C69A81385FCC6EAE6033394D08458A5583D311C4D82 ] Spooler        C:\Windows\System32\spoolsv.exe
11:13:06.0293 0x3c24  Spooler - ok
11:13:06.0432 0x3c24  [ CF87A1DE791347E75B98885214CED2B8, 7AF4E03D751C951A4E5FBA28200DABFE6B3BF055490163EEEEA84EBA4D0F368A ] sppsvc          C:\Windows\system32\sppsvc.exe
11:13:06.0666 0x3c24  sppsvc - ok
11:13:06.0685 0x3c24  [ B0180B20B065D89232A78A40FE56EAA6, 4D045B23AD58A8822BE9F20119744A8D47455469D54494745CEB099951DA60FF ] sppuinotify    C:\Windows\system32\sppuinotify.dll
11:13:06.0738 0x3c24  sppuinotify - ok
11:13:06.0757 0x3c24  [ E4C2764065D66EA1D2D3EBC28FE99C46, 043AEF06A23069DD17675955C834690A5FD8F1948A05B3969F977E823C4E25F5 ] srv            C:\Windows\system32\DRIVERS\srv.sys
11:13:06.0815 0x3c24  srv - ok
11:13:06.0836 0x3c24  [ 03F0545BD8D4C77FA0AE1CEEDFCC71AB, 4DF31206DF8F33C2975E23C7257ED930C4EDA8BC4E246D8FDA130BB583083ED0 ] srv2            C:\Windows\system32\DRIVERS\srv2.sys
11:13:06.0888 0x3c24  srv2 - ok
11:13:06.0904 0x3c24  [ E00FDFAFF025E94F9821153750C35A6D, 6ECDC5F314A29B859B0DCB7FF114CACE0718612556299B16412C21F9539DC9B5 ] SrvHsfHDA      C:\Windows\system32\DRIVERS\VSTAZL3.SYS
11:13:06.0947 0x3c24  SrvHsfHDA - ok
11:13:06.0995 0x3c24  [ CEB4E3B6890E1E42DCA6694D9E59E1A0, 00D841690A88F1051A238F67AACCE905E8A59C86070F215A8D31FA3E68C6BF35 ] SrvHsfV92      C:\Windows\system32\DRIVERS\VSTDPV3.SYS
11:13:07.0083 0x3c24  SrvHsfV92 - ok
11:13:07.0120 0x3c24  [ BC0C7EA89194C299F051C24119000E17, F5FB21F7AD7370F3D5DF7C23F33118ECF19865B995AF12E9A8A8D893E7E6264F ] SrvHsfWinac    C:\Windows\system32\DRIVERS\VSTCNXT3.SYS
11:13:07.0194 0x3c24  SrvHsfWinac - ok
11:13:07.0208 0x3c24  [ BE6BD660CAA6F291AE06A718A4FA8ABC, CD38939CFBA80B882D38099194FC1EBAE15A9D27A4D941DD03C55EC745E52E59 ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys
11:13:07.0245 0x3c24  srvnet - ok
11:13:07.0261 0x3c24  [ D887C9FD02AC9FA880F6E5027A43E118, F38BAD90EC791368C37C21090302708D2DFB83ECE9096609AD9AA667B2E5592E ] SSDPSRV        C:\Windows\System32\ssdpsrv.dll
11:13:07.0336 0x3c24  SSDPSRV - ok
11:13:07.0346 0x3c24  [ A36EE93698802CD899F98BFD553D8185, 224CFED921EA230FF8025D259E34968FD2C0FD34BB3A918FB4B9B8BA42BEA5D3 ] ssmdrv          C:\Windows\system32\DRIVERS\ssmdrv.sys
11:13:07.0369 0x3c24  ssmdrv - ok
11:13:07.0380 0x3c24  [ D318F23BE45D5E3A107469EB64815B50, D74355E6FF215AA8CE53BC9DF16AF2740F2FC2FD754939478A3608BDA8C6DDA0 ] SstpSvc        C:\Windows\system32\sstpsvc.dll
11:13:07.0427 0x3c24  SstpSvc - ok
11:13:07.0443 0x3c24  [ 2C71F7AFB1DA599E87F3C4FF15188EBE, 1B9DC278674AB8663A2D92CC66ECF233DC101844B0F9D8D8CD5BD4825460B469 ] ssudmdm        C:\Windows\system32\DRIVERS\ssudmdm.sys
11:13:07.0481 0x3c24  ssudmdm - ok
11:13:07.0489 0x3c24  [ DB32D325C192B801DF274BFD12A7E72B, F089DBA719E22BC269720A6B840B873A4AF5639745DB0C3DBC8BD2F2839A1ABA ] stexstor        C:\Windows\system32\drivers\stexstor.sys
11:13:07.0516 0x3c24  stexstor - ok
11:13:07.0542 0x3c24  [ E1FB3706030FB4578A0D72C2FC3689E4, A62EC9AA4514CAF2A10C0A3AEF7A36F593A7E7DA370A3F130C24E1B612E19427 ] StiSvc          C:\Windows\System32\wiaservc.dll
11:13:07.0607 0x3c24  StiSvc - ok
11:13:07.0617 0x3c24  [ 472AF0311073DCECEAA8FA18BA2BDF89, 089414057EB2047E42C96C1ACE79D509967461DC5A4D2836F63C04268637A3FC ] storflt        C:\Windows\system32\drivers\vmstorfl.sys
11:13:07.0645 0x3c24  storflt - ok
11:13:07.0653 0x3c24  [ 0BF669F0A910BEDA4A32258D363AF2A5, 83EEBACDE4F69A2866B69CAA633F5C8B3CB01D88CEDB01B6EA5988E0A25CEE47 ] StorSvc        C:\Windows\system32\storsvc.dll
11:13:07.0684 0x3c24  StorSvc - ok
11:13:07.0691 0x3c24  [ DCAFFD62259E0BDB433DD67B5BB37619, CBD12FF9BBF33D18B0F3D322B12EC62E7DF3BF45C6AD43D2E91FF4C4762E05D0 ] storvsc        C:\Windows\system32\drivers\storvsc.sys
11:13:07.0718 0x3c24  storvsc - ok
11:13:07.0725 0x3c24  [ E58C78A848ADD9610A4DB6D214AF5224, 1575A90EB22A4FB066459BDA00C6CAC10198C3C8C74493721EC6D34B51F50426 ] swenum          C:\Windows\system32\DRIVERS\swenum.sys
11:13:07.0751 0x3c24  swenum - ok
11:13:07.0770 0x3c24  [ A28BD92DF340E57B024BA433165D34D7, 889CC7FF143C3549982128473FF927CD80CF36485A347EF399C1271C8CE12CE4 ] swprv          C:\Windows\System32\swprv.dll
11:13:07.0827 0x3c24  swprv - ok
11:13:07.0849 0x3c24  [ FFFA898575A8A16665429AFAE3D55302, 4241268D45E86D797250A996C014F7F4F701DF023A64669217C1EBE2555836BE ] SynTP          C:\Windows\system32\DRIVERS\SynTP.sys
11:13:07.0892 0x3c24  SynTP - ok
11:13:07.0947 0x3c24  [ 36650D618CA34C9D357DFD3D89B2C56F, 7C3774E53DCF32CB3A4B3504E32D2A651E18467FA0A6AC4C7993C696741B704B ] SysMain        C:\Windows\system32\sysmain.dll
11:13:08.0053 0x3c24  SysMain - ok
11:13:08.0067 0x3c24  [ 763FECDC3D30C815FE72DD57936C6CD1, 1A62C7E63E426D56894F4121C75D9C60FC9A14469ADBD0D6F0B94B8DE48CDA3E ] TabletInputService C:\Windows\System32\TabSvc.dll
11:13:08.0108 0x3c24  TabletInputService - ok
11:13:08.0125 0x3c24  [ 613BF4820361543956909043A265C6AC, FCFF02E466D2501630B452627FB218C01E5245A0921EE3D2117E7FD63AC7E98E ] TapiSrv        C:\Windows\System32\tapisrv.dll
11:13:08.0191 0x3c24  TapiSrv - ok
11:13:08.0201 0x3c24  [ B799D9FDB26111737F58288D8DC172D9, 409A60819A4305699E2E492A6190637FAAEBD19E745A5DB2A5D6977106C86591 ] TBS            C:\Windows\System32\tbssvc.dll
11:13:08.0245 0x3c24  TBS - ok
11:13:08.0305 0x3c24  [ 5579DD18546999F5D0EC39D018726C6B, 82432BACEE75C34F21222D9CC1607223C2940947118A63DB239777A4B1442AD3 ] Tcpip          C:\Windows\system32\drivers\tcpip.sys
11:13:08.0406 0x3c24  Tcpip - ok
11:13:08.0472 0x3c24  [ 5579DD18546999F5D0EC39D018726C6B, 82432BACEE75C34F21222D9CC1607223C2940947118A63DB239777A4B1442AD3 ] TCPIP6          C:\Windows\system32\DRIVERS\tcpip.sys
11:13:08.0541 0x3c24  TCPIP6 - ok
11:13:08.0559 0x3c24  [ 3EEBD3BD93DA46A26E89893C7AB2FF3B, 2C7204DCD2BCBC6A250FF0F6477616F327AF41FDB7CABE69E5C357361009FB4E ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys
11:13:08.0589 0x3c24  tcpipreg - ok
11:13:08.0601 0x3c24  [ 1CB91B2BD8F6DD367DFC2EF26FD751B2, 879E2827354BB21573AC6A7CCEB746D44214540687E6882FFCB4089546FBD954 ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys
11:13:08.0635 0x3c24  TDPIPE - ok
11:13:08.0643 0x3c24  [ 2C2C5AFE7EE4F620D69C23C0617651A8, E828D974C3F9D7004A030C3AD448096C736FDB4C4C1707D043E567D08C845103 ] TDTCP          C:\Windows\system32\drivers\tdtcp.sys
11:13:08.0672 0x3c24  TDTCP - ok
11:13:08.0684 0x3c24  [ B459575348C20E8121D6039DA063C704, 1B4328A9EA39FF5A57F258E02254D04B73455F1DF7C997C13702A8B2F12D0347 ] tdx            C:\Windows\system32\DRIVERS\tdx.sys
11:13:08.0751 0x3c24  tdx - ok
11:13:08.0968 0x3c24  [ CC907C2FB839D3F92690A25FF8E463BE, 3CEE9BEA1ACB1086389AA4817D996431716EFEB4432EC4D59EEF1BA710C15B8C ] TeamViewer9    C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe
11:13:09.0230 0x3c24  TeamViewer9 - ok
11:13:09.0255 0x3c24  [ 04DBF4B01EA4BF25A9A3E84AFFAC9B20, 0D81B427720637882077C5024D738191F858FC734ED040697872D906351EF663 ] TermDD          C:\Windows\system32\DRIVERS\termdd.sys
11:13:09.0283 0x3c24  TermDD - ok
11:13:09.0311 0x3c24  [ 382C804C92811BE57829D8E550A900E2, 5F52C2E7902024CF1C9CC0069F411C3F19CCA3DB209F437FA0F3932D4898EB50 ] TermService    C:\Windows\System32\termsrv.dll
11:13:09.0394 0x3c24  TermService - ok
11:13:09.0404 0x3c24  [ 42FB6AFD6B79D9FE07381609172E7CA4, B57C85091209A2FAD19ED490B8FA7FC98F12911F9C9CACE9AF1E540780CE6700 ] Themes          C:\Windows\system32\themeservice.dll
11:13:09.0471 0x3c24  Themes - ok
11:13:09.0479 0x3c24  [ 146B6F43A673379A3C670E86D89BE5EA, C4412DCF80DE6B55466F399413271364F14BC0819C224AA161EDDC31A9775440 ] THREADORDER    C:\Windows\system32\mmcss.dll
11:13:09.0522 0x3c24  THREADORDER - ok
11:13:09.0530 0x3c24  [ 5AD05191DC8B444A7BA4D79B76C42A30, 6166E939A5A240388EBA5AF7FF335DC413F2BBCF74C2E1D310F4BE2A5454A610 ] TPM            C:\Windows\system32\drivers\tpm.sys
11:13:09.0559 0x3c24  TPM - ok
11:13:09.0569 0x3c24  [ 4792C0378DB99A9BC2AE2DE6CFFF0C3A, 532A3A812578B2DFD83001DE66FC73689D79EC729409EB572E07E6D65B281712 ] TrkWks          C:\Windows\System32\trkwks.dll
11:13:09.0625 0x3c24  TrkWks - ok
11:13:09.0639 0x3c24  [ 2C49B175AEE1D4364B91B531417FE583, 6C7995E18F84E465C376D1D5F153C15ACB66CDEA86EE5BF186677F572E7E129B ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
11:13:09.0686 0x3c24  TrustedInstaller - ok
11:13:09.0698 0x3c24  [ B37B08F2E5EEB1A37E448E09BACE1101, 32CC9E06B88BAB6FAB4696B744548DFCE9199A7FD2BA8B019F269CA75895852C ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys
11:13:09.0727 0x3c24  tssecsrv - ok
11:13:09.0736 0x3c24  [ 9CE253214ACAA5A7D323327D2055EFAA, 15E7DB578EDF36DD2FD5BA960C3941B2353037323B6B96702CDCDC07588EA724 ] TsUsbFlt        C:\Windows\system32\drivers\tsusbflt.sys
11:13:09.0767 0x3c24  TsUsbFlt - ok
11:13:09.0775 0x3c24  [ 57C527AF84748B5C2F5178C499C0B81F, 2FF1F25BA16F8984E9F2CE4DE663F261BAF267EDF10D466A52BB211C567F763C ] TsUsbGD        C:\Windows\system32\drivers\TsUsbGD.sys
11:13:09.0802 0x3c24  TsUsbGD - ok
11:13:09.0813 0x3c24  [ B2FA25D9B17A68BB93D58B0556E8C90D, 0146931B733CAB1CD87F94C35F97E110D6ED6C55EAFF03345400A29AEDE99BDE ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys
11:13:09.0867 0x3c24  tunnel - ok
11:13:09.0876 0x3c24  [ 750FBCB269F4D7DD2E420C56B795DB6D, E1A95C59148FE463539C34336FD0E74B31A33B8AB2B8E34AA10349C3347471D7 ] uagp35          C:\Windows\system32\drivers\uagp35.sys
11:13:09.0905 0x3c24  uagp35 - ok
11:13:09.0922 0x3c24  [ EE43346C7E4B5E63E54F927BABBB32FF, BAD6FC3BEE45E644D5A6A0A31428F5B2AEC72A0AA0C74EF8177B1FE23EEF3AA9 ] udfs            C:\Windows\system32\DRIVERS\udfs.sys
11:13:10.0007 0x3c24  udfs - ok
11:13:10.0031 0x3c24  [ 8344FD4FCE927880AA1AA7681D4927E5, 1B54EFA60A221E2B9FFE59BB41C7E7D8B5AC6826F1C5577456D81371D464255A ] UI0Detect      C:\Windows\system32\UI0Detect.exe
11:13:10.0065 0x3c24  UI0Detect - ok
11:13:10.0074 0x3c24  [ 44E8048ACE47BEFBFDC2E9BE4CBC8880, 5D96D90FDF68AE470CC92CA9DF9DA2C05A53EF455A5A109DBBF7C96F3238257C ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys
11:13:10.0104 0x3c24  uliagpkx - ok
11:13:10.0113 0x3c24  [ D295BED4B898F0FD999FCFA9B32B071B, D4130DB4AE76EE6DC0B8E7A4FEF5CB8B26EBD822C21021F6FA78FD29C1E211C2 ] umbus          C:\Windows\system32\DRIVERS\umbus.sys
11:13:10.0149 0x3c24  umbus - ok
11:13:10.0156 0x3c24  [ 7550AD0C6998BA1CB4843E920EE0FEAC, 24C001E422C3B3B920CDCF6003A3179CE464DE4284775403DD5122EF9780460D ] UmPass          C:\Windows\system32\drivers\umpass.sys
11:13:10.0186 0x3c24  UmPass - ok
11:13:10.0201 0x3c24  [ 409994A8EACEEE4E328749C0353527A0, FFC57B647147DE2957A7DE4B330CC534DE7AC892A2FCE3BB164F7A516CAB1B56 ] UmRdpService    C:\Windows\System32\umrdp.dll
11:13:10.0247 0x3c24  UmRdpService - ok
11:13:10.0266 0x3c24  [ 833FBB672460EFCE8011D262175FAD33, C0C3067A305993CBF056C229771CB0593DD60C9C7AC5130FF1CA610BCA812AB5 ] upnphost        C:\Windows\System32\upnphost.dll
11:13:10.0334 0x3c24  upnphost - ok
11:13:10.0344 0x3c24  [ 0803FBA9FE829D61AE26EC0BCC910C46, 30D00E2C7DFC630C99C1599587D4F9C272BC30D444E07C961AA05BF84587806B ] usbccgp        C:\Windows\system32\DRIVERS\usbccgp.sys
11:13:10.0375 0x3c24  usbccgp - ok
11:13:10.0386 0x3c24  [ 2352AB5F9F8F097BF9D41D5A4718A041, 25BC7828C625B9B2A5110C25B230C5828CEC18EC97ECF9EC4745E8930CBF472C ] usbcir          C:\Windows\system32\drivers\usbcir.sys
11:13:10.0421 0x3c24  usbcir - ok
11:13:10.0430 0x3c24  [ D40855F89B69305140BBD7E9A3BA2DA6, 745DC6D770666F6B19C2B6AA89C21D1A314732E291453BFA2367F9AF86F97C3C ] usbehci        C:\Windows\system32\DRIVERS\usbehci.sys
11:13:10.0460 0x3c24  usbehci - ok
11:13:10.0478 0x3c24  [ EDF2DF71C4F1E13A6AC75F5224DE655A, 1764D155C6B99201774B57195349304259232A12868ECFC2069CA49443EBDC2C ] usbhub          C:\Windows\system32\DRIVERS\usbhub.sys
11:13:10.0523 0x3c24  usbhub - ok
11:13:10.0531 0x3c24  [ 9828C8D14CC2676421778F0DE638CF97, 479A28211FFB85190A01FAB0283B927588805D2C0CDB03F85F8F814B88E4F453 ] usbohci        C:\Windows\system32\drivers\usbohci.sys
11:13:10.0557 0x3c24  usbohci - ok
11:13:10.0565 0x3c24  [ 797D862FE0875E75C7CC4C1AD7B30252, 1BBE745E4C85F8911076F6032ACD7A35FAC048D3CB1500C64E08D8B2C70A1069 ] usbprint        C:\Windows\system32\drivers\usbprint.sys
11:13:10.0595 0x3c24  usbprint - ok
11:13:10.0605 0x3c24  [ BF63EBFC6979FEFB2BC03DF7989A0C1A, AFEF764A3E5D52CDBB5074F0E87F2B5EBCDF8D9B6E8F88EE235602B80145BE31 ] USBSTOR        C:\Windows\system32\DRIVERS\USBSTOR.SYS
11:13:10.0637 0x3c24  USBSTOR - ok
11:13:10.0645 0x3c24  [ 800AABFD625EEFF899F7E5496BDE37AB, 3EB7ED07760CB348FCA9A06C2B838EF79B51A83C5F70A9C9EAAEAE54480067E2 ] usbuhci        C:\Windows\system32\DRIVERS\usbuhci.sys
11:13:10.0672 0x3c24  usbuhci - ok
11:13:10.0681 0x3c24  [ 081E6E1C91AEC36758902A9F727CD23C, 9FDAA17A3B99067E035E5D76305427F15FFDBC5D304B2BB78AFC6463EDDE1A75 ] UxSms          C:\Windows\System32\uxsms.dll
11:13:10.0732 0x3c24  UxSms - ok
11:13:10.0739 0x3c24  [ DD17E1573651293D4ED31053795B3471, 94F7D1BB1C3B0C1FAAEED07375DB0F3BC995394FB5C26983548D946C8D229D54 ] VaultSvc        C:\Windows\system32\lsass.exe
11:13:10.0759 0x3c24  VaultSvc - ok
11:13:10.0769 0x3c24  [ A059C4C3EDB09E07D21A8E5C0AABD3CB, BDD3729B49DF2E2FC72FFEF9D10235B481A671DE5A721B6B9A80873B7A343F07 ] vdrvroot        C:\Windows\system32\drivers\vdrvroot.sys
11:13:10.0796 0x3c24  vdrvroot - ok
11:13:10.0822 0x3c24  [ C3CD30495687C2A2F66A65CA6FD89BE9, 582E4706C1D6A151020D14B26C7BF166F4E42BDD6E410F30EC452469270C5E9B ] vds            C:\Windows\System32\vds.exe
11:13:10.0902 0x3c24  vds - ok
11:13:10.0912 0x3c24  [ 17C408214EA61696CEC9C66E388B14F3, 829C0416672E2B2DFABCFE641E7F281F41E8DBB3C0EF11C7784CB9BB94F87E97 ] vga            C:\Windows\system32\DRIVERS\vgapnp.sys
11:13:10.0943 0x3c24  vga - ok
11:13:10.0951 0x3c24  [ 8E38096AD5C8570A6F1570A61E251561, 4DBA3C1397A2203548F45F006E66D99F837903F601ABBCE2304754F783CA8A39 ] VgaSave        C:\Windows\System32\drivers\vga.sys
11:13:10.0999 0x3c24  VgaSave - ok
11:13:11.0012 0x3c24  [ 5461686CCA2FDA57B024547733AB42E3, 2721D0659AA890172FCAD4EC4D926B58ACD0EE4887DA51545DC7237420D5BF84 ] vhdmp          C:\Windows\system32\drivers\vhdmp.sys
11:13:11.0049 0x3c24  vhdmp - ok
11:13:11.0058 0x3c24  [ C829317A37B4BEA8F39735D4B076E923, 55D1796AE750071E1E05BD7702B6C355CCFFE27B4C00E93E7044C3184732B497 ] viaagp          C:\Windows\system32\drivers\viaagp.sys
11:13:11.0086 0x3c24  viaagp - ok
11:13:11.0095 0x3c24  [ E02F079A6AA107F06B16549C6E5C7B74, B530DCE3EE4F285B3D5F69F7148D17E016D54F04E6F93706B829A34567748788 ] ViaC7          C:\Windows\system32\drivers\viac7.sys
11:13:11.0126 0x3c24  ViaC7 - ok
11:13:11.0134 0x3c24  [ E43574F6A56A0EE11809B48C09E4FD3C, 3687BF638E21C00E62ABFED70D728B91ADA08F7164CA898E654F31DA196589E9 ] viaide          C:\Windows\system32\drivers\viaide.sys
11:13:11.0161 0x3c24  viaide - ok
11:13:11.0175 0x3c24  [ C2F2911156FDC7817C52829C86DA494E, FE499F189B5016FCE0018AA3DE3970B72275B7B15F3D4D608117F6DDEC6B90DC ] vmbus          C:\Windows\system32\drivers\vmbus.sys
11:13:11.0214 0x3c24  vmbus - ok
11:13:11.0222 0x3c24  [ D4D77455211E204F370D08F4963063CE, 2018B2A84C73E0834200A594C02A9D28C74906F126DAD3CCDDFC9CD9A61669E2 ] VMBusHID        C:\Windows\system32\drivers\VMBusHID.sys
11:13:11.0248 0x3c24  VMBusHID - ok
11:13:11.0256 0x3c24  [ 4C63E00F2F4B5F86AB48A58CD990F212, 9796BD4B9CFEEEAF57C5E332A732EFC2770B21F9B35301A5D202F5FC52C1E035 ] volmgr          C:\Windows\system32\drivers\volmgr.sys
11:13:11.0286 0x3c24  volmgr - ok
11:13:11.0305 0x3c24  [ B5BB72067DDDDBBFB04B2F89FF8C3C87, 65B9AD55F43940A5FDD88B6EC5034A7E375DF8E6F5F1AE6519A4BD6B7E992EBC ] volmgrx        C:\Windows\system32\drivers\volmgrx.sys
11:13:11.0335 0x3c24  volmgrx - ok
11:13:11.0353 0x3c24  [ F497F67932C6FA693D7DE2780631CFE7, DAE544ED99D2CF570DA31343BD87D2F856D0D13529656D38E1BF854C77F017F6 ] volsnap        C:\Windows\system32\drivers\volsnap.sys
11:13:11.0399 0x3c24  volsnap - ok
11:13:11.0412 0x3c24  [ 9DFA0CC2F8855A04816729651175B631, 37FD9E43A2A3F125E94A315FB4CD8A1B5499A5FD74806EB2D1E5DA88C070D3A3 ] vsmraid        C:\Windows\system32\drivers\vsmraid.sys
11:13:11.0448 0x3c24  vsmraid - ok
11:13:11.0502 0x3c24  [ 209A3B1901B83AEB8527ED211CCE9E4C, 1A431F6409F8E0531F600F8F988ECECECB902DA26BBAAF1DE74A5CAC29A7CB44 ] VSS            C:\Windows\system32\vssvc.exe
11:13:11.0598 0x3c24  VSS - ok
11:13:11.0612 0x3c24  [ 90567B1E658001E79D7C8BBD3DDE5AA6, EFC23BEEA7F54A2DC56CB523DAD1AF0358D904C5278BF08873910E2DB3F13557 ] vwifibus        C:\Windows\system32\DRIVERS\vwifibus.sys
11:13:11.0643 0x3c24  vwifibus - ok
11:13:11.0652 0x3c24  [ 7090D3436EEB4E7DA3373090A23448F7, 3A130B28F2BFA7DCEC8596C4CE4E187B019F5ECF1AAC8DD1BBDE9CBD2428FEC2 ] vwififlt        C:\Windows\system32\DRIVERS\vwififlt.sys
11:13:11.0688 0x3c24  vwififlt - ok
11:13:11.0695 0x3c24  [ A3F04CBEA6C2A10E6CB01F8B47611882, 32AFE18B07FECA30BC95831A5DC94C784E543784DF16165334A777DC84E91EF3 ] vwifimp        C:\Windows\system32\DRIVERS\vwifimp.sys
11:13:11.0726 0x3c24  vwifimp - ok
11:13:11.0746 0x3c24  [ 55187FD710E27D5095D10A472C8BAF1C, AE298E2D3BA366BCBDC092C717214C181E8843FA564A6DFB07FC3238A5A68DC3 ] W32Time        C:\Windows\system32\w32time.dll
11:13:11.0818 0x3c24  W32Time - ok
11:13:11.0830 0x3c24  [ DE3721E89C653AA281428C8A69745D90, 501C78056ED4295625D8A5412025FD2F0CA24077044D3A5800BA79DF3D946516 ] WacomPen        C:\Windows\system32\drivers\wacompen.sys
11:13:11.0859 0x3c24  WacomPen - ok
11:13:11.0868 0x3c24  [ 3C3C78515F5AB448B022BDF5B8FFDD2E, 35284174A42039C3C1FF8A3C8BC187A5E067C7782FC62D19749C2CB28C4E36C7 ] WANARP          C:\Windows\system32\DRIVERS\wanarp.sys
11:13:11.0916 0x3c24  WANARP - ok
11:13:11.0924 0x3c24  [ 3C3C78515F5AB448B022BDF5B8FFDD2E, 35284174A42039C3C1FF8A3C8BC187A5E067C7782FC62D19749C2CB28C4E36C7 ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys
11:13:11.0965 0x3c24  Wanarpv6 - ok
11:13:12.0028 0x3c24  [ 353A04C273EC58475D8633E75CCD5604, FFAE53B6B53AEFC9E8A10BF27480E072D74430276BEB532FE1D473E9616D8CE0 ] WatAdminSvc    C:\Windows\system32\Wat\WatAdminSvc.exe
11:13:12.0152 0x3c24  WatAdminSvc - ok
11:13:12.0216 0x3c24  [ 691E3285E53DCA558E1A84667F13E15A, 12EDB66EF8FC100402BEA221F354D3BD5542F6DDF715B6E7D873D6BAE7E3D329 ] wbengine        C:\Windows\system32\wbengine.exe
11:13:12.0319 0x3c24  wbengine - ok
11:13:12.0335 0x3c24  [ 9614B5D29DC76AC3C29F6D2D3AA70E67, A2FFB92F0030B4CD771E862DA575ECCF2F3A5B4B85858C1241A0C59262C0EC88 ] WbioSrvc        C:\Windows\System32\wbiosrvc.dll
11:13:12.0379 0x3c24  WbioSrvc - ok
11:13:12.0398 0x3c24  [ 34EEE0DFAADB4F691D6D5308A51315DC, A040A03E25A0C78B9E26F86C2DF95BCAF8E7EC90183CEB295615D3265350EBEE ] wcncsvc        C:\Windows\System32\wcncsvc.dll
11:13:12.0450 0x3c24  wcncsvc - ok
11:13:12.0459 0x3c24  [ 5D930B6357A6D2AF4D7653BDABBF352F, 677FF2ED14EE0B0CAA710DA81556CC16D5971DAB10E7C7432D167A87CA6F0EAA ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
11:13:12.0493 0x3c24  WcsPlugInService - ok
11:13:12.0501 0x3c24  [ 1112A9BADACB47B7C0BB0392E3158DFF, 1AE2AFA125973571F91E6945FE8A735F63D76EBB250A0075D98C580167FD9ED4 ] Wd              C:\Windows\system32\drivers\wd.sys
11:13:12.0529 0x3c24  Wd - ok
11:13:12.0558 0x3c24  [ 25944D2CC49E0A6C581D02A74B7D6645, AF8FFAFEC07F1A6A3D4008E609E8E1D705A8DFCC7995C766E3946887203F7BEE ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys
11:13:12.0618 0x3c24  Wdf01000 - ok
11:13:12.0630 0x3c24  [ 46EF9DC96265FD0B423DB72E7C38C2A5, 43801A51FB0E45CFFC73DF6441B54A75FC2FEAF5E0424DFE7AB04FC26CF6CD16 ] WdiServiceHost  C:\Windows\system32\wdi.dll
11:13:12.0679 0x3c24  WdiServiceHost - ok
11:13:12.0687 0x3c24  [ 46EF9DC96265FD0B423DB72E7C38C2A5, 43801A51FB0E45CFFC73DF6441B54A75FC2FEAF5E0424DFE7AB04FC26CF6CD16 ] WdiSystemHost  C:\Windows\system32\wdi.dll
11:13:12.0718 0x3c24  WdiSystemHost - ok
11:13:12.0734 0x3c24  [ 75E8EBD7040CE238684333F97014762A, 2CA0B267FBAEB303D1F8B639D733DC0DE17BA1276CC9096035B4F2BBBED3EF7F ] WebClient      C:\Windows\System32\webclnt.dll
11:13:12.0782 0x3c24  WebClient - ok
11:13:12.0795 0x3c24  [ 760F0AFE937A77CFF27153206534F275, A53940BA28854486FF18F16B98A3314B36322B0B6EFB54D08B921315BEB0ADD5 ] Wecsvc          C:\Windows\system32\wecsvc.dll
11:13:12.0859 0x3c24  Wecsvc - ok
11:13:12.0869 0x3c24  [ AC804569BB2364FB6017370258A4091B, 1856F354146A5946F3E7D0DD09726FC8A3502B0F0776FEADDF10669C81CC28E2 ] wercplsupport  C:\Windows\System32\wercplsupport.dll
11:13:12.0923 0x3c24  wercplsupport - ok
11:13:12.0933 0x3c24  [ 08E420D873E4FD85241EE2421B02C4A4, E1E9436EB096FF7DE9A76DA6217035257EF9FC7565DDB9016DCA3859E7F1EF0F ] WerSvc          C:\Windows\System32\WerSvc.dll
11:13:12.0991 0x3c24  WerSvc - ok
11:13:12.0999 0x3c24  [ 8B9A943F3B53861F2BFAF6C186168F79, 88E2F79F32AFBA17CB8377A508B83A1EC2315E9F3A365F591C87FE4525AA6713 ] WfpLwf          C:\Windows\system32\DRIVERS\wfplwf.sys
11:13:13.0045 0x3c24  WfpLwf - ok
11:13:13.0053 0x3c24  [ 5CF95B35E59E2A38023836FFF31BE64C, CEA21302B3E855EE592810D4E0DE10E47A47A393064C435463CD54598735CD8D ] WIMMount        C:\Windows\system32\drivers\wimmount.sys
11:13:13.0079 0x3c24  WIMMount - ok
11:13:13.0112 0x3c24  [ 5A77AC34A0FFB70CE8B35B524FEDE9BA, 711DD957AF98F1B835ECE0FEBCCF8FCC7763F1DAA232F1C9E80DE6DA123C7F33 ] winachsf        C:\Windows\system32\DRIVERS\HSX_CNXT.sys
11:13:13.0180 0x3c24  winachsf - ok
11:13:13.0216 0x3c24  [ 082CF481F659FAE0DE51AD060881EB47, BB67D2AF0BB9192D4CCF66C23D80CE5A1B38715556D94E2561DBF8F805FA30A5 ] WinDefend      C:\Program Files\Windows Defender\mpsvc.dll
11:13:13.0288 0x3c24  WinDefend - ok
11:13:13.0302 0x3c24  WinHttpAutoProxySvc - ok
11:13:13.0324 0x3c24  [ F62E510B6AD4C21EB9FE8668ED251826, FA3E5CAC3E67E49377320CFBE4646585E6B62168292768FEA81E4623F9166890 ] Winmgmt        C:\Windows\system32\wbem\WMIsvc.dll
11:13:13.0383 0x3c24  Winmgmt - ok
11:13:13.0439 0x3c24  [ 1B91CD34EA3A90AB6A4EF0550174F4CC, 5B6618615EBFBA594C945AD35F5C68DA8C6053892B6D12D626BB6120910D80DC ] WinRM          C:\Windows\system32\WsmSvc.dll
11:13:13.0558 0x3c24  WinRM - ok
11:13:13.0577 0x3c24  [ A67E5F9A400F3BD1BE3D80613B45F708, E170A8BD31A779403DC9C43ED6483DA8E186512D3EE700B87F6BA292E284E367 ] WinUsb          C:\Windows\system32\DRIVERS\WinUsb.sys
11:13:13.0610 0x3c24  WinUsb - ok
11:13:13.0651 0x3c24  [ 16935C98FF639D185086A3529B1F2067, E9C6B73A572A04FCE9B1B0E6815F941B10332D9A6D55B92927C2B1275F119091 ] Wlansvc        C:\Windows\System32\wlansvc.dll
11:13:13.0733 0x3c24  Wlansvc - ok
11:13:13.0744 0x3c24  [ 0217679B8FCA58714C3BF2726D2CA84E, 4494984B922DCF24D37BCD0E6831CEBD07D1CA49235D04E821D17ED3DF84ED2A ] WmiAcpi        C:\Windows\system32\drivers\wmiacpi.sys
11:13:13.0772 0x3c24  WmiAcpi - ok
11:13:13.0789 0x3c24  [ 6EB6B66517B048D87DC1856DDF1F4C3F, EBB534C4829477C70062ADBB5626236B02FE563A544C53FA255E79F3CA170FE8 ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe
11:13:13.0828 0x3c24  wmiApSrv - ok
11:13:13.0883 0x3c24  [ 3B40D3A61AA8C21B88AE57C58AB3122E, 6C67DCB007C3CDF2EB0BBF5FD89C32CD7800C20F7166872F8C387BE262C5CD21 ] WMPNetworkSvc  C:\Program Files\Windows Media Player\wmpnetwk.exe
11:13:13.0982 0x3c24  WMPNetworkSvc - ok
11:13:13.0994 0x3c24  [ A2F0EC770A92F2B3F9DE6D518E11409C, 6838F2148B11285E00DC449D51F8AD85AAE57694E89BA2C607B87AC1C650D845 ] WPCSvc          C:\Windows\System32\wpcsvc.dll
11:13:14.0023 0x3c24  WPCSvc - ok
11:13:14.0033 0x3c24  [ AA53356D60AF47EACC85BC617A4F3F66, 155CB8112AA382D841C1891750FF29EF4F1BF716CD9CDF0F2243209E2CCCAC98 ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll
11:13:14.0075 0x3c24  WPDBusEnum - ok
11:13:14.0083 0x3c24  [ 6DB3276587B853BF886B69528FDB048C, 9972FF6DF0DF6F86D1E9BCEF4C29064748B217DA196B0633C30D3D580144951C ] ws2ifsl        C:\Windows\system32\drivers\ws2ifsl.sys
11:13:14.0125 0x3c24  ws2ifsl - ok
11:13:14.0135 0x3c24  [ 6F5D49EFE0E7164E03AE773A3FE25340, 15B6AFF7455538189A96F8863CC995A271E02C6FBDAC15B037D44DDA65E61339 ] wscsvc          C:\Windows\system32\wscsvc.dll
11:13:14.0182 0x3c24  wscsvc - ok
11:13:14.0188 0x3c24  WSearch - ok
11:13:14.0288 0x3c24  [ D9B0134913E5EF007AF82A418C503322, 7418DD28C8E968674382F8352AAFFC4DE77887E2B71B8844D615F19432B4C55A ] wuauserv        C:\Windows\system32\wuaueng.dll
11:13:14.0403 0x3c24  wuauserv - ok
11:13:14.0419 0x3c24  [ 06E6F32C8D0A3F66D956F57B43A2E070, 9A6BD96A28294B0372F16E13D652FD603308F64B74A56E41E0C68C5E8011F943 ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys
11:13:14.0441 0x3c24  WudfPf - ok
11:13:14.0455 0x3c24  [ 867C301E8B790040AE9CF6486E8041DF, D867D6498C987944D99508B2FAD6D6B749FA1EDFE8124B0863D4A642352F0855 ] WUDFRd          C:\Windows\system32\DRIVERS\WUDFRd.sys
11:13:14.0492 0x3c24  WUDFRd - ok
11:13:14.0502 0x3c24  [ FE47B7BC8EA320C2D9B5E5BF6E303765, 34518DBD1E9EA6E5DA62273B18613761E1D9C6B4E074A93C6D639FBAF02222EA ] wudfsvc        C:\Windows\System32\WUDFSvc.dll
11:13:14.0537 0x3c24  wudfsvc - ok
11:13:14.0551 0x3c24  [ 3C5E51C05BE9B56EAFF4E388C3AB25E4, 10D9FDEDAB1FB2E76D54661AFA5C1A6B1B0980525F38F5D061537077841C6AEE ] WwanSvc        C:\Windows\System32\wwansvc.dll
11:13:14.0615 0x3c24  WwanSvc - ok
11:13:14.0623 0x3c24  [ 88AF537264F2B818DA15479CEEAF5D7C, E0F95D6448FFB77351BB63ED444238F891B16748FD09F8BCCA23BEC4E341A96B ] XAudio          C:\Windows\system32\DRIVERS\xaudio.sys
11:13:14.0645 0x3c24  XAudio - ok
11:13:14.0667 0x3c24  [ 15A317674A08DF26BE65164D959E9203, 6EEE0D1711F37936D157651E265A65137BCBFBDA17F066C844BAA0D53558F86A ] XAudioService  C:\Windows\system32\DRIVERS\xaudio.exe
11:13:14.0702 0x3c24  XAudioService - ok
11:13:14.0726 0x3c24  ================ Scan global ===============================
11:13:14.0735 0x3c24  [ DAB748AE0439955ED2FA22357533DDDB, 73EDD402C7479DDCE1998D0C7E99E1EC2974F64EFC33A851439CC85D09EDCDF9 ] C:\Windows\system32\basesrv.dll
11:13:14.0759 0x3c24  [ 51BB04243DF6196C06E125898127E397, E1B6C83FC6E455F6806185027C5B56F8BA9ECDF1CD69E97301EC0291F0D3466E ] C:\Windows\system32\winsrv.dll
11:13:14.0792 0x3c24  [ 51BB04243DF6196C06E125898127E397, E1B6C83FC6E455F6806185027C5B56F8BA9ECDF1CD69E97301EC0291F0D3466E ] C:\Windows\system32\winsrv.dll
11:13:14.0806 0x3c24  [ 364455805E64882844EE9ACB72522830, 906561DBBB33F744844CF27E456226044C85DF0FCFD26DE1FD11E09E2CFA6F8F ] C:\Windows\system32\sxssrv.dll
11:13:14.0832 0x3c24  [ 5F1B6A9C35D3D5CA72D6D6FDEF9747D6, D7BC4ED605B32274B45328FD9914FB0E7B90D869A38F0E6F94FB1BF4E9E2B407 ] C:\Windows\system32\services.exe
11:13:14.0846 0x3c24  [ Global ] - ok
11:13:14.0847 0x3c24  ================ Scan MBR ==================================
11:13:14.0851 0x3c24  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
11:13:14.0952 0x3c24  \Device\Harddisk0\DR0 - ok
11:13:14.0952 0x3c24  ================ Scan VBR ==================================
11:13:14.0958 0x3c24  [ 55D6350D9E9B209F39352897E6C3C499 ] \Device\Harddisk0\DR0\Partition1
11:13:14.0960 0x3c24  \Device\Harddisk0\DR0\Partition1 - ok
11:13:14.0960 0x3c24  ================ Scan generic autorun ======================
11:13:15.0018 0x3c24  [ AFD15F701B550037FFDDE6B18171479D, 38C049529611653832944B9A624BA9E336E0AFE668CEDD95BDAF550A9605ADF5 ] C:\Program Files\Analog Devices\Core\smax4pnp.exe
11:13:15.0096 0x3c24  SoundMAXPnP - ok
11:13:15.0110 0x3c24  [ BC60F7192CCBF9864EF55E4FA2F42079, 4B5DE5F9B67CB4BA06C7385F55D675F806E44145D3CE1DC6B94FFEE685C27A1D ] C:\Windows\system32\igfxtray.exe
11:13:15.0130 0x3c24  IgfxTray - ok
11:13:15.0143 0x3c24  [ 1B63F8FFFFFFDA1E03AED970C7383FFE, EC7C55827137105F6FF56163114ED530A1C8E273939A4A3B067185D106625B28 ] C:\Windows\system32\hkcmd.exe
11:13:15.0164 0x3c24  HotKeysCmds - ok
11:13:15.0175 0x3c24  [ A2636716C37ABD1EE9B4C6F56B685BB2, 50B36ADE106C9CAAA1F3A2B1BEDE35E75E48CE257F688486FB39A2D68AADCFE5 ] C:\Windows\system32\igfxpers.exe
11:13:15.0196 0x3c24  Persistence - ok
11:13:15.0299 0x3c24  [ C963F1BA9DAFE0C07A27E14557AA8B3E, 4ADD6C088FDF706229E13FCF1644F1F3A02F3FCABB7FF63AE4E5EA0E5A98E353 ] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
11:13:15.0413 0x3c24  SynTPEnh - ok
11:13:15.0496 0x3c24  [ 048EA4B978851788E9F5E8E4F081DF7A, EB62719AC0DCC18FF056F2CD84438BF14B61E38F0619617C81961C6257BDFCEC ] C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
11:13:15.0555 0x3c24  Adobe ARM - ok
11:13:15.0600 0x3c24  [ 2AA5DD75EA1281432C40D22B5FD87D3A, 9868D4176C8F08EB72B0B992D3E2A480C587930CA025B4FDF3212F99B79C3017 ] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
11:13:15.0640 0x3c24  avgnt - ok
11:13:15.0660 0x3c24  [ EB1B7B961090A4AF33FC297516B88FAE, 2E49D704C33EE2CA57DAE16137157F595F9811CB617A88C958EFC21BB4297CE7 ] C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
11:13:15.0684 0x3c24  KiesTrayAgent - ok
11:13:15.0701 0x3c24  [ 1DE859B82E381A645C44284A5044BC33, 305AE678D3163D57C8E027F94BC553FDFDE7F9A14599EAEC370B0867DE4A9EC2 ] C:\Program Files\Common Files\Java\Java Update\jusched.exe
11:13:15.0724 0x3c24  SunJavaUpdateSched - ok
11:13:15.0856 0x3c24  [ 9A2FE54A34315F38C1D79E16081EB775, 1B966FCE15814F67D800E807C6FE7BEDDEB1D3F499622C76D7629DF959A1B59C ] C:\Program Files\BitTorrent Sync\BTSync.exe
11:13:16.0007 0x3c24  BitTorrent Sync - ok
11:13:16.0901 0x3c24  [ 4C41287B6AEF44D9F4233403F1614671, 469D37DBAA082AF52273E1E89C1D321B9365EC16EDBBD04E3E018389217CCFE3 ] C:\Program Files\Skype\Phone\Skype.exe
11:13:19.0216 0x3c24  Skype - ok
11:13:19.0344 0x3c24  [ D3F78E38C39AB0E7358735717FB52EAE, 43C6DF27A0E0BB2C83F9D936454C41501B1908851795250BBA95B9BF55C8026D ] C:\Program Files\Samsung\Kies\Kies.exe
11:13:19.0423 0x3c24  KiesPreload - ok
11:13:19.0476 0x3c24  [ 7737E1471FD1437B82A2C12575443CAE, 81FEEDF91111E996DE2569C8EDCD1C2AC0291B2BE401C448497171D958EFDC35 ] C:\Program Files\ABBYY PDF Transformer 3.0\Bonus.ScreenshotReader.exe
11:13:19.0545 0x3c24  ABBYY Screenshot Reader Bonus - detected UnsignedFile.Multi.Generic ( 1 )
11:13:22.0346 0x3c24  Detect skipped due to KSN trusted
11:13:22.0346 0x3c24  ABBYY Screenshot Reader Bonus - ok
11:13:23.0187 0x3c24  [ 401F53AA84F3E42F1EE3AA86C1247747, B067D0AEF3135E9AEAD0A70CA440466E28ADCB880D472D269215475C46D406F9 ] C:\Program Files\VoipStunt.com\VoipStunt\VoipStunt.exe
11:13:24.0328 0x3c24  VoipStunt - ok
11:13:24.0391 0x3c24  1c2b1 - ok
11:13:24.0392 0x3c24  Waiting for KSN requests completion. In queue: 1
11:13:25.0392 0x3c24  Waiting for KSN requests completion. In queue: 1
11:13:26.0392 0x3c24  Waiting for KSN requests completion. In queue: 1
11:13:27.0491 0x3c24  AV detected via SS2: Avira Desktop, C:\Program Files\Avira\AntiVir Desktop\wsctool.exe ( 14.0.6.548 ), 0x40000 ( disabled : updated )
11:13:27.0509 0x3c24  Win FW state via NFP2: enabled
11:13:29.0963 0x3c24  ============================================================
11:13:29.0963 0x3c24  Scan finished
11:13:29.0963 0x3c24  ============================================================
11:13:29.0982 0x0f9c  Detected object count: 0
11:13:29.0982 0x0f9c  Actual detected object count: 0
Danke für Deine Geduld!
LG
Fred

schrauber 09.08.2014 09:48
hi,

Scan mit Farbar's Recovery Scan Tool (Recovery Mode - Windows Vista, 7, 8)
Hinweise für Windows 8-Nutzer: Anleitung 1 (FRST-Variante) und Anleitung 2 (zweiter Teil)
  • Downloade dir bitte die passende Version des Tools (im Zweifel beide) und speichere diese auf einen USB Stick: FRST Download FRST 32-Bit | FRST 64-Bit
  • Schließe den USB Stick an das infizierte System an und boote das System in die System Reparatur Option.
  • Scanne jetzt nach der bebilderten Anleitung oder verwende die folgende Kurzanleitung:
Über den Boot Manager:
  • Starte den Rechner neu.
  • Während dem Hochfahren drücke mehrmals die F8 Taste
  • Wähle nun Computer reparieren.
  • Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".
Mit Windows CD/DVD (auch bei Windows 8 möglich):
  • Lege die Windows CD in dein Laufwerk.
  • Starte den Rechner neu und starte von der CD.
  • Wähle die Spracheinstellungen und klicke "Weiter".
  • Klicke auf Computerreparaturoptionen !
  • Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".
Wähle in den Reparaturoptionen: Eingabeaufforderung
  • Gib nun bitte notepad ein und drücke Enter.
  • Im öffnenden Textdokument: Datei > Speichern unter... und wähle Computer.
    Hier wird dir der Laufwerksbuchstabe deines USB Sticks angezeigt, merke ihn dir.
  • Schließe Notepad wieder
  • Gib nun bitte folgenden Befehl ein.
    e:\frst.exe bzw. e:\frst64.exe
    Hinweis: e steht für den Laufwerksbuchstaben deines USB Sticks, den du dir gemerkt hast. Gegebenfalls anpassen.
  • Akzeptiere den Disclaimer mit Ja und klicke Untersuchen
Das Tool erstellt eine FRST.txt auf deinem USB Stick. Poste den Inhalt bitte hier nach Möglichkeit in Code-Tags (Anleitung).


Freiseflei 09.08.2014 13:03
Hi Schrauber,

hier nun das FRSTLog vom USB Stick aus:


FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:9-08-2014
Ran by SYSTEM on MININT-LF7BNT7 on 09-08-2014 12:47:32
Running from E:\
Platform: Windows 7 Professional Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST must be run from normal or Safe mode to create a complete log.




==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKU\Compiuta\...\Run: [BitTorrent Sync] => C:\Program Files\BitTorrent Sync\BTSync.exe [3020136 2014-06-27] (BitTorrent, Inc.)
HKU\Compiuta\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [20917408 2014-02-10] (Skype Technologies S.A.)
HKU\Compiuta\...\Run: [KiesPreload] => C:\Program Files\Samsung\Kies\Kies.exe [1563440 2014-06-14] (Samsung)
HKU\Compiuta\...\Run: [ABBYY Screenshot Reader Bonus] => C:\Program Files\ABBYY PDF Transformer 3.0\Bonus.ScreenshotReader.exe [939272 2014-04-23] (ABBYY)
HKU\Compiuta\...\Run: [VoipStunt] => C:\Program Files\VoipStunt.com\VoipStunt\VoipStunt.exe [19768640 2014-02-11] (VoipStunt)
HKU\Compiuta\...\Run: [1c2b1] => C:\Users\Compiuta\AppData\Roaming\0a3\1c2b1.js

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 ABBYY.Licensing.PDFTransformer.Classic.3.0; C:\Program Files\ABBYY PDF Transformer 3.0\NetworkLicenseServer.exe [759048 2014-04-23] (ABBYY)
S2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-08-07] (Avira Operations GmbH & Co. KG)
S2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-08-07] (Avira Operations GmbH & Co. KG)
S2 MotoHelper; C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe [223088 2011-04-26] ()

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [97648 2014-07-04] (Avira Operations GmbH & Co. KG)
S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-05-27] (Avira Operations GmbH & Co. KG)
S1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2014-02-25] (Avira Operations GmbH & Co. KG)
S3 e1express; C:\Windows\System32\DRIVERS\e1e6232.sys [232312 2012-10-30] (Intel Corporation)
S3 PSKMAD; C:\Windows\System32\DRIVERS\PSKMAD.sys [47632 2013-04-29] (Panda Security, S.L.)
S1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2014-02-25] (Avira GmbH)
S3 catchme; \??\C:\Users\Compiuta\AppData\Local\Temp\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-08 10:06 - 2014-08-08 10:06 - 04181856 _____ (Kaspersky Lab ZAO) C:\Users\Compiuta\Downloads\tdsskiller.exe
2014-08-07 11:04 - 2014-08-07 11:04 - 00036362 _____ () C:\Users\Compiuta\Desktop\FRST5.txt
2014-08-07 11:00 - 2014-08-07 11:00 - 00000000 __SHD () C:\Users\Compiuta\AppData\Roaming\0a3
2014-08-07 08:56 - 2014-08-07 11:06 - 00000000 ____D () C:\ProgramData\Package Cache
2014-08-07 08:56 - 2014-08-07 08:56 - 00070352 _____ () C:\Users\1\AppData\Local\GDIPFONTCACHEV1.DAT
2014-08-06 08:14 - 2014-08-06 08:14 - 00035021 _____ () C:\Users\Compiuta\Desktop\FRST4.txt
2014-08-05 15:42 - 2014-08-05 15:43 - 00037787 _____ () C:\Users\Compiuta\Desktop\FRST3.txt
2014-08-05 15:41 - 2014-08-05 15:41 - 00000759 _____ () C:\Users\Compiuta\Desktop\checkup.txt
2014-08-05 15:35 - 2014-08-05 15:35 - 00854410 _____ () C:\Users\Compiuta\Downloads\SecurityCheck.exe
2014-08-05 14:16 - 2014-08-05 14:16 - 02347384 _____ (ESET) C:\Users\Compiuta\Downloads\esetsmartinstaller_deu.exe
2014-08-04 19:17 - 2014-08-04 19:17 - 00036633 _____ () C:\Users\Compiuta\Desktop\FRST2.txt
2014-08-04 19:15 - 2014-08-04 19:15 - 00000828 _____ () C:\Users\Compiuta\Desktop\JRT.txt
2014-08-04 19:12 - 2014-08-04 19:12 - 00000000 ____D () C:\Windows\ERUNT
2014-08-04 19:11 - 2014-08-04 19:11 - 00001446 _____ () C:\Users\Compiuta\Desktop\AdwCleaner[S0].txt
2014-08-04 19:07 - 2014-08-04 19:09 - 00000000 ____D () C:\AdwCleaner
2014-08-04 19:07 - 2014-08-04 19:07 - 00001161 _____ () C:\Users\Compiuta\Desktop\mbam2.txt
2014-08-04 19:06 - 2014-08-04 19:06 - 00001161 _____ () C:\Users\Compiuta\Desktop\mbam.txt
2014-08-04 19:01 - 2014-08-04 19:01 - 01361309 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.302.exe
2014-08-04 19:01 - 2014-08-04 19:01 - 01016261 _____ (Thisisu) C:\Users\Compiuta\Downloads\JRT.exe
2014-08-04 18:32 - 2014-08-04 19:03 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\MBAMSwissArmy.sys
2014-08-04 18:31 - 2014-08-04 18:32 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2014-08-04 18:31 - 2014-08-04 18:31 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-04 18:31 - 2014-05-12 06:26 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\mwac.sys
2014-08-04 18:31 - 2014-05-12 06:25 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbamchameleon.sys
2014-08-04 18:31 - 2014-05-12 06:25 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2014-08-04 18:23 - 2014-08-04 18:24 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Compiuta\Downloads\mbam-setup-2.0.2.1012(1).exe
2014-08-03 19:13 - 2014-08-03 19:13 - 00013303 _____ () C:\Users\Compiuta\Desktop\combofix.txt
2014-08-03 19:12 - 2014-08-03 19:12 - 00013303 _____ () C:\ComboFix.txt
2014-08-03 19:06 - 2014-08-03 19:12 - 00000000 ____D () C:\Qoobox
2014-08-03 19:06 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-08-03 19:06 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-08-03 19:06 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-08-03 19:06 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-08-03 19:06 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-08-03 19:06 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2014-08-03 19:06 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2014-08-03 19:06 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2014-08-03 19:05 - 2014-08-03 19:11 - 00000000 ____D () C:\Windows\erdnt
2014-08-03 19:04 - 2014-08-03 19:04 - 00000000 ____D () C:\ProgramData\Panda Security
2014-08-03 19:03 - 2014-08-03 19:03 - 00000000 ____D () C:\Program Files\Panda USB Vaccine
2014-08-03 18:20 - 2014-08-03 18:20 - 05566616 ____R (Swearware) C:\Users\Compiuta\Desktop\ComboFix.exe
2014-08-03 18:19 - 2014-08-03 18:20 - 05566616 _____ (Swearware) C:\Users\Compiuta\Downloads\ComboFix.exe
2014-08-03 18:03 - 2014-08-03 18:02 - 00848856 _____ (Panda Security ) C:\Users\Compiuta\Desktop\USBVaccineSetup.exe
2014-08-03 18:01 - 2014-08-03 18:02 - 00848856 _____ (Panda Security ) C:\Users\Compiuta\Downloads\USBVaccineSetup.exe
2014-08-03 17:07 - 2014-08-03 17:07 - 00000993 _____ () C:\Users\Compiuta\Desktop\gmer.txt
2014-08-03 16:32 - 2014-08-04 19:25 - 00034710 _____ () C:\Users\Compiuta\Desktop\Antivir.odt
2014-08-03 16:28 - 2014-08-03 16:28 - 00380416 _____ () C:\Users\Compiuta\Downloads\Gmer-19357.exe
2014-08-03 16:27 - 2014-08-03 12:18 - 00000478 _____ () C:\Users\Compiuta\Desktop\defogger_disable.log
2014-08-03 16:24 - 2014-08-07 11:03 - 00036362 _____ () C:\Users\Compiuta\Desktop\FRST.txt
2014-08-03 16:24 - 2014-08-03 14:57 - 00023276 _____ () C:\Users\Compiuta\Desktop\Addition.txt
2014-08-03 14:56 - 2014-08-03 14:57 - 00023276 _____ () C:\Users\Compiuta\Downloads\Addition.txt
2014-08-03 14:55 - 2014-08-09 12:47 - 00000000 ____D () C:\FRST
2014-08-03 14:55 - 2014-08-03 14:57 - 00030941 _____ () C:\Users\Compiuta\Downloads\FRST.txt
2014-08-03 14:50 - 2014-08-03 14:50 - 01084928 _____ (Farbar) C:\Users\Compiuta\Desktop\FRST.exe
2014-08-03 12:18 - 2014-08-03 12:18 - 00000478 _____ () C:\Users\Compiuta\Downloads\defogger_disable.log
2014-08-03 12:18 - 2014-08-03 12:18 - 00000000 _____ () C:\Users\Compiuta\defogger_reenable
2014-08-03 12:04 - 2014-08-03 12:04 - 00050477 _____ () C:\Users\Compiuta\Downloads\Defogger.exe
2014-08-03 09:57 - 2014-08-03 09:57 - 00000000 ____D () C:\Program Files\Panda Security
2014-08-03 09:57 - 2013-04-29 08:17 - 00047632 _____ (Panda Security, S.L.) C:\Windows\System32\Drivers\PSKMAD.sys
2014-08-03 09:43 - 2014-08-03 09:43 - 30412088 _____ (Panda Security ) C:\Users\Compiuta\Downloads\PandaCloudCleaner.exe
2014-08-03 09:42 - 2014-05-14 17:23 - 01973728 _____ (Microsoft Corporation) C:\Windows\System32\wuaueng.dll
2014-08-03 09:42 - 2014-05-14 17:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\System32\wuapi.dll
2014-08-03 09:42 - 2014-05-14 17:23 - 00054240 _____ (Microsoft Corporation) C:\Windows\System32\wuauclt.exe
2014-08-03 09:42 - 2014-05-14 17:23 - 00045536 _____ (Microsoft Corporation) C:\Windows\System32\wups2.dll
2014-08-03 09:42 - 2014-05-14 17:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\System32\wups.dll
2014-08-03 09:42 - 2014-05-14 17:17 - 02425856 _____ (Microsoft Corporation) C:\Windows\System32\wucltux.dll
2014-08-03 09:42 - 2014-05-14 17:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\System32\wudriver.dll
2014-08-03 09:41 - 2014-05-14 08:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\System32\wuwebv.dll
2014-08-03 09:41 - 2014-05-14 08:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\System32\wuapp.exe
2014-07-31 10:12 - 2014-07-31 10:12 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-07-24 14:56 - 2014-07-24 14:56 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Compiuta\Downloads\mbam-setup-2.0.2.1012.exe
2014-07-24 14:45 - 2014-07-24 14:45 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216(2).exe
2014-07-24 14:28 - 2014-07-24 14:28 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216(1).exe
2014-07-24 14:21 - 2014-07-24 14:21 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216.exe
2014-07-24 00:07 - 2014-07-24 00:07 - 00000000 __SHD () C:\0b64
2014-07-21 19:05 - 2014-07-21 19:05 - 00000000 ____D () C:\Users\Compiuta\Desktop\Neuer Ordner
2014-07-20 03:40 - 2014-07-20 03:46 - 00009008 _____ () C:\Users\Compiuta\AppData\Roaming\.freeciv-client-rc-2.4
2014-07-20 03:35 - 2014-07-20 03:42 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\.freeciv
2014-07-19 21:08 - 2014-07-19 21:26 - 00000000 ____D () C:\Users\Compiuta\Desktop\Neuer Ordner (2)
2014-07-19 21:07 - 2014-07-19 21:08 - 11861420 _____ () C:\Users\Compiuta\Downloads\Gmail(1).zip
2014-07-19 21:07 - 2014-07-19 21:08 - 11811633 _____ () C:\Users\Compiuta\Downloads\Gmail.zip
2014-07-19 20:50 - 2014-07-19 20:50 - 00000000 ____D () C:\Program Files\Freeciv-2.4.2-gtk2
2014-07-19 19:56 - 2014-07-19 19:57 - 28215140 _____ () C:\Users\Compiuta\Downloads\Freeciv-2.4.2-win32-gtk2-setup.exe
2014-07-19 00:40 - 2014-07-24 14:57 - 00000000 ____D () C:\Users\Compiuta\Desktop\abog
2014-07-17 16:24 - 2014-07-17 16:24 - 00000000 ____D () C:\Program Files\Common Files\Java
2014-07-17 16:24 - 2014-07-11 02:02 - 00096680 _____ (Oracle Corporation) C:\Windows\System32\WindowsAccessBridge.dll
2014-07-17 16:24 - 2014-07-11 01:56 - 00272808 _____ (Oracle Corporation) C:\Windows\System32\javaws.exe
2014-07-17 16:24 - 2014-07-11 01:56 - 00175528 _____ (Oracle Corporation) C:\Windows\System32\javaw.exe
2014-07-17 16:24 - 2014-07-11 01:55 - 00175528 _____ (Oracle Corporation) C:\Windows\System32\java.exe
2014-07-14 18:55 - 2014-07-14 19:06 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\Audacity

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-09 12:47 - 2014-08-03 14:55 - 00000000 ____D () C:\FRST
2014-08-09 11:45 - 2014-04-21 11:24 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\BitTorrent Sync
2014-08-09 11:45 - 2014-01-04 19:06 - 01362569 _____ () C:\Windows\WindowsUpdate.log
2014-08-08 10:06 - 2014-08-08 10:06 - 04181856 _____ (Kaspersky Lab ZAO) C:\Users\Compiuta\Downloads\tdsskiller.exe
2014-08-08 09:43 - 2010-11-20 22:01 - 01618320 _____ () C:\Windows\System32\PerfStringBackup.INI
2014-08-07 11:06 - 2014-08-07 08:56 - 00000000 ____D () C:\ProgramData\Package Cache
2014-08-07 11:06 - 2014-04-21 16:20 - 00000000 ____D () C:\Program Files\Avira
2014-08-07 11:04 - 2014-08-07 11:04 - 00036362 _____ () C:\Users\Compiuta\Desktop\FRST5.txt
2014-08-07 11:03 - 2014-08-03 16:24 - 00036362 _____ () C:\Users\Compiuta\Desktop\FRST.txt
2014-08-07 11:00 - 2014-08-07 11:00 - 00000000 __SHD () C:\Users\Compiuta\AppData\Roaming\0a3
2014-08-07 08:56 - 2014-08-07 08:56 - 00070352 _____ () C:\Users\1\AppData\Local\GDIPFONTCACHEV1.DAT
2014-08-07 08:56 - 2014-04-21 16:20 - 00000000 ____D () C:\ProgramData\Avira
2014-08-06 08:14 - 2014-08-06 08:14 - 00035021 _____ () C:\Users\Compiuta\Desktop\FRST4.txt
2014-08-05 15:43 - 2014-08-05 15:42 - 00037787 _____ () C:\Users\Compiuta\Desktop\FRST3.txt
2014-08-05 15:41 - 2014-08-05 15:41 - 00000759 _____ () C:\Users\Compiuta\Desktop\checkup.txt
2014-08-05 15:35 - 2014-08-05 15:35 - 00854410 _____ () C:\Users\Compiuta\Downloads\SecurityCheck.exe
2014-08-05 15:35 - 2009-07-14 05:34 - 00022208 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-05 15:35 - 2009-07-14 05:34 - 00022208 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-05 15:30 - 2014-04-21 20:52 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\Skype
2014-08-05 15:28 - 2009-07-14 05:39 - 00041621 _____ () C:\Windows\setupact.log
2014-08-05 14:16 - 2014-08-05 14:16 - 02347384 _____ (ESET) C:\Users\Compiuta\Downloads\esetsmartinstaller_deu.exe
2014-08-04 19:25 - 2014-08-03 16:32 - 00034710 _____ () C:\Users\Compiuta\Desktop\Antivir.odt
2014-08-04 19:17 - 2014-08-04 19:17 - 00036633 _____ () C:\Users\Compiuta\Desktop\FRST2.txt
2014-08-04 19:15 - 2014-08-04 19:15 - 00000828 _____ () C:\Users\Compiuta\Desktop\JRT.txt
2014-08-04 19:12 - 2014-08-04 19:12 - 00000000 ____D () C:\Windows\ERUNT
2014-08-04 19:11 - 2014-08-04 19:11 - 00001446 _____ () C:\Users\Compiuta\Desktop\AdwCleaner[S0].txt
2014-08-04 19:10 - 2010-11-20 22:48 - 00111524 _____ () C:\Windows\PFRO.log
2014-08-04 19:09 - 2014-08-04 19:07 - 00000000 ____D () C:\AdwCleaner
2014-08-04 19:07 - 2014-08-04 19:07 - 00001161 _____ () C:\Users\Compiuta\Desktop\mbam2.txt
2014-08-04 19:06 - 2014-08-04 19:06 - 00001161 _____ () C:\Users\Compiuta\Desktop\mbam.txt
2014-08-04 19:03 - 2014-08-04 18:32 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\MBAMSwissArmy.sys
2014-08-04 19:01 - 2014-08-04 19:01 - 01361309 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.302.exe
2014-08-04 19:01 - 2014-08-04 19:01 - 01016261 _____ (Thisisu) C:\Users\Compiuta\Downloads\JRT.exe
2014-08-04 18:32 - 2014-08-04 18:31 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2014-08-04 18:31 - 2014-08-04 18:31 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-04 18:24 - 2014-08-04 18:23 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Compiuta\Downloads\mbam-setup-2.0.2.1012(1).exe
2014-08-03 19:13 - 2014-08-03 19:13 - 00013303 _____ () C:\Users\Compiuta\Desktop\combofix.txt
2014-08-03 19:12 - 2014-08-03 19:12 - 00013303 _____ () C:\ComboFix.txt
2014-08-03 19:12 - 2014-08-03 19:06 - 00000000 ____D () C:\Qoobox
2014-08-03 19:12 - 2009-07-14 03:37 - 00000000 ___RD () C:\users\Public
2014-08-03 19:11 - 2014-08-03 19:05 - 00000000 ____D () C:\Windows\erdnt
2014-08-03 19:11 - 2009-07-14 03:04 - 00000215 _____ () C:\Windows\system.ini
2014-08-03 19:04 - 2014-08-03 19:04 - 00000000 ____D () C:\ProgramData\Panda Security
2014-08-03 19:03 - 2014-08-03 19:03 - 00000000 ____D () C:\Program Files\Panda USB Vaccine
2014-08-03 18:20 - 2014-08-03 18:20 - 05566616 ____R (Swearware) C:\Users\Compiuta\Desktop\ComboFix.exe
2014-08-03 18:20 - 2014-08-03 18:19 - 05566616 _____ (Swearware) C:\Users\Compiuta\Downloads\ComboFix.exe
2014-08-03 18:02 - 2014-08-03 18:03 - 00848856 _____ (Panda Security ) C:\Users\Compiuta\Desktop\USBVaccineSetup.exe
2014-08-03 18:02 - 2014-08-03 18:01 - 00848856 _____ (Panda Security ) C:\Users\Compiuta\Downloads\USBVaccineSetup.exe
2014-08-03 17:07 - 2014-08-03 17:07 - 00000993 _____ () C:\Users\Compiuta\Desktop\gmer.txt
2014-08-03 16:28 - 2014-08-03 16:28 - 00380416 _____ () C:\Users\Compiuta\Downloads\Gmer-19357.exe
2014-08-03 14:57 - 2014-08-03 16:24 - 00023276 _____ () C:\Users\Compiuta\Desktop\Addition.txt
2014-08-03 14:57 - 2014-08-03 14:56 - 00023276 _____ () C:\Users\Compiuta\Downloads\Addition.txt
2014-08-03 14:57 - 2014-08-03 14:55 - 00030941 _____ () C:\Users\Compiuta\Downloads\FRST.txt
2014-08-03 14:50 - 2014-08-03 14:50 - 01084928 _____ (Farbar) C:\Users\Compiuta\Desktop\FRST.exe
2014-08-03 12:18 - 2014-08-03 16:27 - 00000478 _____ () C:\Users\Compiuta\Desktop\defogger_disable.log
2014-08-03 12:18 - 2014-08-03 12:18 - 00000478 _____ () C:\Users\Compiuta\Downloads\defogger_disable.log
2014-08-03 12:18 - 2014-08-03 12:18 - 00000000 _____ () C:\Users\Compiuta\defogger_reenable
2014-08-03 12:18 - 2014-01-04 19:28 - 00000000 ____D () C:\users\Compiuta
2014-08-03 12:04 - 2014-08-03 12:04 - 00050477 _____ () C:\Users\Compiuta\Downloads\Defogger.exe
2014-08-03 09:57 - 2014-08-03 09:57 - 00000000 ____D () C:\Program Files\Panda Security
2014-08-03 09:55 - 2014-04-21 14:31 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-08-03 09:48 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\System32\de-DE
2014-08-03 09:43 - 2014-08-03 09:43 - 30412088 _____ (Panda Security ) C:\Users\Compiuta\Downloads\PandaCloudCleaner.exe
2014-07-31 14:53 - 2014-04-23 10:00 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\vlc
2014-07-31 10:12 - 2014-07-31 10:12 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-07-24 17:50 - 2014-04-21 16:30 - 00035848 _____ (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avnetflt.sys
2014-07-24 14:57 - 2014-07-19 00:40 - 00000000 ____D () C:\Users\Compiuta\Desktop\abog
2014-07-24 14:56 - 2014-07-24 14:56 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Compiuta\Downloads\mbam-setup-2.0.2.1012.exe
2014-07-24 14:45 - 2014-07-24 14:45 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216(2).exe
2014-07-24 14:28 - 2014-07-24 14:28 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216(1).exe
2014-07-24 14:21 - 2014-07-24 14:21 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216.exe
2014-07-24 02:33 - 2014-04-20 18:34 - 00000000 ____D () C:\BtSync
2014-07-24 00:07 - 2014-07-24 00:07 - 00000000 __SHD () C:\0b64
2014-07-23 09:52 - 2014-04-21 14:10 - 00231584 ____N (Microsoft Corporation) C:\Windows\System32\MpSigStub.exe
2014-07-21 19:05 - 2014-07-21 19:05 - 00000000 ____D () C:\Users\Compiuta\Desktop\Neuer Ordner
2014-07-20 03:46 - 2014-07-20 03:40 - 00009008 _____ () C:\Users\Compiuta\AppData\Roaming\.freeciv-client-rc-2.4
2014-07-20 03:42 - 2014-07-20 03:35 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\.freeciv
2014-07-19 21:26 - 2014-07-19 21:08 - 00000000 ____D () C:\Users\Compiuta\Desktop\Neuer Ordner (2)
2014-07-19 21:26 - 2014-07-06 18:43 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\XnView
2014-07-19 21:13 - 2014-04-21 15:58 - 00000000 ____D () C:\Users\Compiuta\AppData\Local\Paint.NET
2014-07-19 21:09 - 2014-01-04 20:11 - 00000000 ____D () C:\Users\Compiuta\Desktop\Soundfiles
2014-07-19 21:08 - 2014-07-19 21:07 - 11861420 _____ () C:\Users\Compiuta\Downloads\Gmail(1).zip
2014-07-19 21:08 - 2014-07-19 21:07 - 11811633 _____ () C:\Users\Compiuta\Downloads\Gmail.zip
2014-07-19 20:50 - 2014-07-19 20:50 - 00000000 ____D () C:\Program Files\Freeciv-2.4.2-gtk2
2014-07-19 19:57 - 2014-07-19 19:56 - 28215140 _____ () C:\Users\Compiuta\Downloads\Freeciv-2.4.2-win32-gtk2-setup.exe
2014-07-18 17:03 - 2014-06-13 02:24 - 00000000 ____D () C:\Users\Compiuta\AppData\Local\Adobe
2014-07-17 16:24 - 2014-07-17 16:24 - 00000000 ____D () C:\Program Files\Common Files\Java
2014-07-17 16:24 - 2014-05-02 09:24 - 00000000 ____D () C:\ProgramData\Oracle
2014-07-17 16:24 - 2014-05-02 09:24 - 00000000 ____D () C:\Program Files\Java
2014-07-15 14:54 - 2014-04-21 20:39 - 00000000 ____D () C:\Windows\System32\MRT
2014-07-15 14:52 - 2014-04-21 20:39 - 93585272 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
2014-07-15 01:55 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\rescache
2014-07-14 21:33 - 2014-06-03 22:45 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\FileZilla
2014-07-14 19:12 - 2014-06-03 22:45 - 04996210 _____ (Tim Kosse) C:\Users\Compiuta\Downloads\FileZilla_3.8.1_win32-setup.exe
2014-07-14 19:12 - 2014-04-21 14:41 - 00000000 ____D () C:\Program Files\FileZilla FTP Client
2014-07-14 19:06 - 2014-07-14 18:55 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\Audacity
2014-07-14 05:12 - 2014-04-27 13:19 - 00000000 ____D () C:\users\1
2014-07-12 04:40 - 2014-01-04 19:58 - 00000000 ____D () C:\Users\Compiuta\Desktop\Flugtickets
2014-07-11 02:02 - 2014-07-17 16:24 - 00096680 _____ (Oracle Corporation) C:\Windows\System32\WindowsAccessBridge.dll
2014-07-11 01:56 - 2014-07-17 16:24 - 00272808 _____ (Oracle Corporation) C:\Windows\System32\javaws.exe
2014-07-11 01:56 - 2014-07-17 16:24 - 00175528 _____ (Oracle Corporation) C:\Windows\System32\javaw.exe
2014-07-11 01:55 - 2014-07-17 16:24 - 00175528 _____ (Oracle Corporation) C:\Windows\System32\java.exe
2014-07-10 00:18 - 2010-11-21 01:55 - 00000000 ____D () C:\Program Files\Windows Journal
2014-07-10 00:18 - 2009-07-14 05:33 - 00324032 _____ () C:\Windows\System32\FNTCACHE.DAT

Some content of TEMP:
====================
C:\Users\1\AppData\Local\Temp\avgnt.exe
C:\Users\Compiuta\AppData\Local\Temp\avgnt.exe
C:\Users\Compiuta\AppData\Local\Temp\Quarantine.exe


==================== Known DLLs (Whitelisted) ============


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== Restore Points  =========================

Restore point made on: 2014-08-03 09:41:49
Restore point made on: 2014-08-04 08:59:55
Restore point made on: 2014-08-08 09:44:26

==================== Memory info ===========================

Percentage of memory in use: 15%
Total physical RAM: 2550.43 MB
Available physical RAM: 2158.23 MB
Total Pagefile: 2548.71 MB
Available Pagefile: 2155.4 MB
Total Virtual: 2047.88 MB
Available Virtual: 1966.2 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:111.79 GB) (Free:26.45 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive e: () (Removable) (Total:3.75 GB) (Free:3.75 GB) FAT
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 112 GB) (Disk ID: 3F673AB5)
Partition 1: (Active) - (Size=112 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 4 GB) (Disk ID: 018F9277)
Partition 1: (Active) - (Size=4 GB) - (Type=06)


LastRegBack: 2014-07-15 00:40

==================== End Of Log ============================
--- --- ---


Danke und schoenen Samstag!
LG
Fred


Alle Zeitangaben in WEZ +1. Es ist jetzt 20:36 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131