Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Avira läuft nicht - Dieses Programm wurde durch eine Gruppenrichtlinie blockiert (https://www.trojaner-board.de/157639-avira-laeuft-programm-wurde-gruppenrichtlinie-blockiert.html)

Katharina123 15.08.2014 16:49
Avira läuft nicht - Dieses Programm wurde durch eine Gruppenrichtlinie blockiert
 
Hallo,

nachdem ich gesehen habe, dass viele andere schon das gleiche Problem wie ich hatten und hier im Forum viele kompetente Helfer unterwegs sind, wende ich mich an Euch:

Auf meinem Laptop (Windows Vista) läuft seit ein paar Tagen Avira nicht mehr, es lässt sich nicht deinstallieren und es kommt der Fehlerhinweis "Dieses Programm wurde durch eine Gruppenrichtlinie blockiert".

Sensible Passwörter habe ich bereits auf einem sauberen PC geändert.

FRST habe ich mir schon heruntergeladen und einen Scan laufen lassen.


FRST:


FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:15-08-2014
Ran by Kathi (ATTENTION: The logged in user is not administrator) on KATHARINA on 15-08-2014 17:39:00
Running from c:\Users\Kathi\Downloads
Platform: Microsoft® Windows Vista™ Home Basic  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 8
Boot Mode: Normal


==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(SAMSUNG Electronics co., LTD.) C:\Program Files\Samsung\EBM\EasyBatteryMgr3.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Samsung Magic Doctor\MagicDoctorKbdHk.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(CyberLink) C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe
(CyberLink Corp.) C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
(Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
() C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
(Google Inc.) C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
() C:\Users\Kathi\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe
(Fred's Software) C:\Program Files\PrintKey2000\Printkey2000.exe
(Dropbox, Inc.) C:\Users\Kathi\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_14_0_0_145.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_14_0_0_145.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Avira <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Avira <====== ATTENTION
HKU\S-1-5-21-3121953689-2843351358-1462341086-1004\...\Run: [KiesPDLR] => C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [21392 2012-02-03] ()
HKU\S-1-5-21-3121953689-2843351358-1462341086-1004\...\Run: [swg] => C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2012-09-18] (Google Inc.)
HKU\S-1-5-21-3121953689-2843351358-1462341086-1004\...\Run: [Amazon Cloud Player] => C:\Users\Kathi\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe [3145536 2014-05-08] ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Printkey2000.lnk
ShortcutTarget: Printkey2000.lnk -> C:\Program Files\PrintKey2000\Printkey2000.exe (Fred's Software)
Startup: C:\Users\Kathi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Kathi\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Kathi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=b3b97fe1-733e-c16a-594c-aecc25092492&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=02/11/2013&type=hp1000
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=b3b97fe1-733e-c16a-594c-aecc25092492&searchtype=hp&fr=linkury-tb&installDate=02/11/2013&type=hp1000
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=smsn&bmod=smsn
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=b3b97fe1-733e-c16a-594c-aecc25092492&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=02/11/2013&type=hp1000
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=SMSN&bmod=SMSN
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=smsn&bmod=smsn
SearchScopes: HKLM - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=b3b97fe1-733e-c16a-594c-aecc25092492&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=02/11/2013&type=hp1000
SearchScopes: HKCU - DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7AURU_deDE502
SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=b3b97fe1-733e-c16a-594c-aecc25092492&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=02/11/2013&type=hp1000
SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7AURU_deDE502
BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: Yahoo Community Smartbar (by Linkury)Engine -> {31ad400d-1b06-4e33-a59a-90c2c140cba0} -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
BHO: No Name -> {41564952-412D-5637-00A7-7A786E7484D7} ->  No File
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO: Google Toolbar Notifier BHO -> {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} -> C:\Program Files\Google\GoogleToolbarNotifier\5.7.9012.1008\swg.dll (Google Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: Softonic Helper Object -> {E87806B5-E908-45FD-AF5E-957D83E58E68} -> C:\Program Files\Softonic\Softonic\1.6.7.4\bh\Softonic.dll (Softonic.com)
BHO: DVDVideoSoft IE Extension -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.)
BHO: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - Softonic Toolbar - {5018CFD2-804D-4C99-9F81-25EAEA2769DE} - C:\Program Files\Softonic\Softonic\1.6.7.4\SoftonicTlbr.dll (Softonic.com)
Toolbar: HKLM - No Name - {41564952-412D-5637-00A7-7A786E7484D7} -  No File
Toolbar: HKLM - Yahoo Community Smartbar (by Linkury) - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\system32\mscoree.dll (Microsoft Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - No Name - {41564952-412D-5637-00A7-7A786E7484D7} -  No File
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {6E718D87-6909-4FCE-92D4-EDCB2F725727} hxxp://navigram.com/engine/v1026/Navigram.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog9 01 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 02 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 03 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 04 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 05 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 06 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 07 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 08 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 19 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Kathi\AppData\Roaming\Mozilla\Firefox\Profiles\xd1mt82e.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.7.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.7.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: IE Tab 2 (FF 3.6+) - C:\Users\Kathi\AppData\Roaming\Mozilla\Firefox\Profiles\xd1mt82e.default\Extensions\{1BC9BA34-1EED-42ca-A505-6D2F1A935BBB} [2013-12-17]
FF Extension: DHL Packstation Bestellhelfer - C:\Users\Kathi\AppData\Roaming\Mozilla\Firefox\Profiles\xd1mt82e.default\Extensions\{b8cbd8e0-e642-11dd-ba2f-0800200c9a66} [2012-12-08]
FF Extension: No Name - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2012-10-23]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2011-12-28]
FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2 [2012-08-30]
FF HKLM\...\Firefox\Extensions: [{ACAA314B-EEBA-48e4-AD47-84E31C44796C}] - C:\Program Files\Common Files\DVDVideoSoft\plugins\ff
FF Extension: Download videos and MP3s from YouTube - C:\Program Files\Common Files\DVDVideoSoft\plugins\ff [2013-11-02]

Chrome:
=======
CHR HomePage: hxxp://www.google.com/
CHR RestoreOnStartup: "hxxp://www.google.com/"
CHR HKLM\...\Chrome\Extension: [aaaaacalgebmfelllfiaoknifldpngjh] - C:\ProgramData\AskPartnerNetwork\Toolbar\AVIRA-V7\CRX\ToolbarCR.crx []

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-08-15] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-08-15] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1021008 2014-08-15] (Avira Operations GmbH & Co. KG)
R2 iphlpsvc; C:\Windows\System32\svchost.exe [21504 2008-01-21] (Microsoft Corporation)
R2 lmhosts; C:\Windows\system32\svchost.exe [21504 2008-01-21] (Microsoft Corporation)
S4 MSSQLServerADHelper; C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [45272 2005-10-14] (Microsoft Corporation)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [43520 2008-02-28] (Hewlett-Packard) [File not signed]
R2 NlaSvc; C:\Windows\System32\svchost.exe [21504 2008-01-21] (Microsoft Corporation)
R2 nsi; C:\Windows\system32\svchost.exe [21504 2008-01-21] (Microsoft Corporation)
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [53248 2008-02-28] (Hewlett-Packard) [File not signed]
R2 RichVideo; C:\Program Files\CyberLink\Shared files\RichVideo.exe [247152 2008-11-25] ()
R2 Skype C2C Service; C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [3064000 2012-10-02] (Skype Technologies S.A.)
S2 APNMCP; "C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [97648 2014-07-03] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-06-05] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-26] (Avira Operations GmbH & Co. KG)
R2 KMDFMEMIO; C:\Windows\System32\DRIVERS\kmdfmemio.sys [13312 2006-11-14] (SAMSUNG ELECTRONICS CO., LTD.)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-08-05] (Avira GmbH)
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-15 17:39 - 2014-08-15 17:39 - 00016940 _____ () C:\Users\Kathi\Downloads\FRST.txt
2014-08-15 17:38 - 2014-08-15 17:39 - 00000000 ____D () C:\FRST
2014-08-15 17:37 - 2014-08-15 17:37 - 01092096 _____ (Farbar) C:\Users\Kathi\Downloads\FRST.exe
2014-08-12 20:43 - 2014-08-12 20:50 - 151513264 _____ () C:\Users\Kathi\Downloads\avira_free_antivirus06_de(1).exe
2014-08-12 20:42 - 2014-08-12 20:49 - 151513264 _____ () C:\Users\Kathi\Downloads\avira_free_antivirus06_de.exe
2014-08-04 21:09 - 2014-08-04 21:09 - 00000000 ____D () C:\Users\Kathi\AppData\Roaming\dll-files.com
2014-08-03 13:58 - 2014-08-03 13:59 - 00000000 ____D () C:\ProgramData\EtilkOdmol
2014-08-03 13:58 - 2014-08-03 13:58 - 00000000 ____D () C:\ProgramData\OxyuNhira
2014-08-03 13:43 - 2014-06-10 12:27 - 00017344 _____ (Dll-Files.com) C:\Windows\system32\roboot.exe
2014-07-30 20:35 - 2014-07-30 20:35 - 00000000 ____D () C:\Program Files\Mozilla Firefox(23)
2014-07-16 21:52 - 2014-07-16 21:52 - 00039424 _____ () C:\Users\Kathi\Desktop\Ablauf Kirche.xls

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-15 17:39 - 2014-08-15 17:39 - 00016940 _____ () C:\Users\Kathi\Downloads\FRST.txt
2014-08-15 17:39 - 2014-08-15 17:38 - 00000000 ____D () C:\FRST
2014-08-15 17:37 - 2014-08-15 17:37 - 01092096 _____ (Farbar) C:\Users\Kathi\Downloads\FRST.exe
2014-08-15 17:37 - 2009-08-11 21:16 - 00000422 ____H () C:\Windows\Tasks\User_Feed_Synchronization-{7030CE83-CC54-445E-964F-73E63606DF74}.job
2014-08-15 17:36 - 2009-07-21 20:26 - 01251946 _____ () C:\Windows\WindowsUpdate.log
2014-08-15 17:34 - 2014-04-27 21:32 - 00000000 ___RD () C:\Users\Kathi\Dropbox
2014-08-15 17:34 - 2014-04-27 21:29 - 00000000 ____D () C:\Users\Kathi\AppData\Roaming\Dropbox
2014-08-15 17:33 - 2011-12-28 18:30 - 00000000 ____D () C:\Users\Kathi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite
2014-08-15 17:32 - 2014-05-29 12:02 - 00000264 _____ () C:\Windows\Tasks\SpeedUpMyPC Startup.job
2014-08-15 17:32 - 2012-08-18 23:35 - 00001096 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-08-15 17:32 - 2006-11-02 14:58 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-15 17:32 - 2006-11-02 14:45 - 00004784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-15 17:32 - 2006-11-02 14:45 - 00004784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-15 17:31 - 2006-11-02 14:58 - 00032514 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-08-15 17:08 - 2013-06-30 22:48 - 00000422 ____H () C:\Windows\Tasks\User_Feed_Synchronization-{DC24E08D-D800-4C9D-9DE2-5FF59CBB27E4}.job
2014-08-12 23:00 - 2014-06-16 11:05 - 00015080 _____ () C:\Users\Kathi\Desktop\Hochzeitsgeschenke.xlsx
2014-08-12 23:00 - 2014-05-29 12:02 - 00000270 _____ () C:\Windows\Tasks\SpeedUpMyPC Maintenance.job
2014-08-12 21:46 - 2012-08-18 23:35 - 00001100 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-08-12 20:50 - 2014-08-12 20:43 - 151513264 _____ () C:\Users\Kathi\Downloads\avira_free_antivirus06_de(1).exe
2014-08-12 20:49 - 2014-08-12 20:42 - 151513264 _____ () C:\Users\Kathi\Downloads\avira_free_antivirus06_de.exe
2014-08-11 23:09 - 2014-06-16 23:09 - 00018357 _____ () C:\Users\Kathi\Desktop\malediven.xlsx
2014-08-11 23:06 - 2014-06-15 16:51 - 00000000 ____D () C:\Users\Kathi\Desktop\Hochzeit - Standesamt
2014-08-11 22:08 - 2014-02-16 18:46 - 00000000 ____D () C:\Users\Kathi\Desktop\Hochzeit
2014-08-10 14:08 - 2012-01-02 21:32 - 00000000 ____D () C:\Users\Kathi\Documents\Passwörter
2014-08-04 21:09 - 2014-08-04 21:09 - 00000000 ____D () C:\Users\Kathi\AppData\Roaming\dll-files.com
2014-08-04 21:06 - 2012-05-15 18:16 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-08-03 23:26 - 2011-12-28 18:30 - 00000000 ____D () C:\Users\Kathi
2014-08-03 23:26 - 2009-08-11 02:35 - 00000000 ____D () C:\Users\Wichsis
2014-08-03 23:26 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\spool
2014-08-03 23:26 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\Msdtc
2014-08-03 23:26 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\registration
2014-08-03 14:10 - 2012-10-23 18:37 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-08-03 14:10 - 2012-05-15 18:16 - 00000858 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-08-03 14:10 - 2012-05-15 18:16 - 00000846 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-08-03 13:59 - 2014-08-03 13:58 - 00000000 ____D () C:\ProgramData\EtilkOdmol
2014-08-03 13:58 - 2014-08-03 13:58 - 00000000 ____D () C:\ProgramData\OxyuNhira
2014-07-30 20:35 - 2014-07-30 20:35 - 00000000 ____D () C:\Program Files\Mozilla Firefox(23)
2014-07-23 10:52 - 2011-12-28 16:24 - 00231584 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-07-22 21:04 - 2014-04-27 21:32 - 00000919 _____ () C:\Users\Kathi\Desktop\Dropbox.lnk
2014-07-22 21:04 - 2014-04-27 21:31 - 00000000 ____D () C:\Users\Kathi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-07-18 23:55 - 2006-11-02 12:33 - 01566246 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-07-18 19:59 - 2006-11-02 14:49 - 00149220 _____ () C:\Windows\setupact.log
2014-07-18 19:54 - 2012-09-18 20:12 - 00001963 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-07-17 18:58 - 2012-03-23 19:56 - 00000000 ____D () C:\ProgramData\tmp
2014-07-17 18:17 - 2009-08-11 02:37 - 00000000 ____D () C:\Users\Wichsis\AppData\Local\Adobe
2014-07-17 18:16 - 2012-09-18 20:11 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-07-17 18:16 - 2012-02-26 00:06 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-07-17 18:01 - 2008-01-21 05:02 - 00742522 _____ () C:\Windows\PFRO.log
2014-07-16 21:52 - 2014-07-16 21:52 - 00039424 _____ () C:\Users\Kathi\Desktop\Ablauf Kirche.xls
2014-07-16 17:50 - 2013-08-16 18:35 - 00000000 ____D () C:\Windows\system32\MRT
2014-07-16 17:42 - 2006-11-02 12:24 - 93585272 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
ZeroAccess:
C:\Users\Kathi\AppData\Local\Google\Desktop\Install

Some content of TEMP:
====================
C:\Users\Kathi\AppData\Local\Temp\AskSLib.dll
C:\Users\Kathi\AppData\Local\Temp\avgnt.exe
C:\Users\Kathi\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpq754wn.dll
C:\Users\Kathi\AppData\Local\Temp\firefoxjre_exe-1.exe
C:\Users\Kathi\AppData\Local\Temp\firefoxjre_exe-2.exe
C:\Users\Kathi\AppData\Local\Temp\firefoxjre_exe.exe
C:\Users\Kathi\AppData\Local\Temp\fp_pl_pfs_installer.exe
C:\Users\Kathi\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Kathi\AppData\Local\Temp\tmp677D.exe
C:\Users\Kathi\AppData\Local\Temp\{C1500184-25BC-4E86-84ED-9B5FFBC17724}-23.0.1271.95_23.0.1271.64_chrome_updater.exe
C:\Users\Wichsis\AppData\Local\Temp\AskSLib.dll
C:\Users\Wichsis\AppData\Local\Temp\drm_dyndata_7330017.dll
C:\Users\Wichsis\AppData\Local\Temp\softonic_ggl_1.6.7.4.exe
C:\Users\Wichsis\AppData\Local\Temp\yontoo-c3.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

==================== End Of Log ============================
--- --- ---




Addition:

Code:
Additional scan result of Farbar Recovery Scan Tool (x86) Version:15-08-2014
Ran by Kathi at 2014-08-15 17:39:40
Running from c:\Users\Kathi\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

32 Bit HP CIO Components Installer (Version: 2.1.4 - Hewlett-Packard) Hidden
Adobe Flash Player 11 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 11.4.402.278 - Adobe Systems Incorporated)
Adobe Flash Player 14 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Reader 9.2 - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-A92000000001}) (Version: 9.2.0 - Adobe Systems Incorporated)
Adobe Shockwave Player 11.6 (HKLM\...\Adobe Shockwave Player) (Version: 11.6.5.635 - Adobe Systems, Inc.)
Amazon Cloud Player (HKCU\...\Amazon Amazon Cloud Player) (Version: 2.4.0.33 - Amazon Services LLC)
Atheros WLAN Client (HKLM\...\{3832FA99-2EDD-41E0-94AD-FBF9FABAFEF9}) (Version: 14.00.0000 - WLAN)
Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 14.0.6.552 - Avira)
Avira SearchFree Toolbar (HKLM\...\{41564952-412D-5637-00A7-A758B70C0600}) (Version: 12.6.0.1900 - APN, LLC)
BatteryLifeExtender (HKLM\...\{AA16A9E5-40E9-44F5-801E-6B3D3CFE79E5}) (Version: 1.0.0 - Samsung)
Business Contact Manager für Outlook 2007 SP1 (HKLM\...\Business Contact Manager) (Version: 3.0.7311.0 - Microsoft Corporation)
Business Contact Manager für Outlook 2007 SP1 (Version: 3.0.7311.0 - Microsoft Corporation) Hidden
bwin Poker 1.0.0 (HKCU\...\bwin Poker_is1) (Version: 1.0.0 - bwin)
capella 7 (HKLM\...\{7BDBF713-CB99-4B66-800B-F563BC7F0560}) (Version: 7.1.21 - capella software AG)
CyberLink DVD Suite (HKLM\...\InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 6.0.2604 - CyberLink Corp.)
CyberLink DVD Suite (Version: 6.0.2604 - CyberLink Corp.) Hidden
CyberLink LabelPrint (HKLM\...\{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.20.3605 - CyberLink Corp.)
CyberLink Power2Go (HKLM\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.0.2809 - CyberLink Corp.)
CyberLink Power2Go (Version: 6.0.2809 - CyberLink Corp.) Hidden
CyberLink PowerDirector (HKLM\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 7.0.2426 - CyberLink Corp.)
CyberLink PowerDirector (Version: 7.0.2426 - CyberLink Corp.) Hidden
CyberLink PowerDVD 8 (HKLM\...\InstallShield_{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}) (Version: 8.0.2815 - CyberLink Corp.)
CyberLink PowerDVD 8 (Version: 8.0.2815 - CyberLink Corp.) Hidden
CyberLink PowerProducer (HKLM\...\InstallShield_{B7A0CE06-068E-11D6-97FD-0050BACBF861}) (Version: 5.0.1.1410 - CyberLink Corp.)
CyberLink PowerProducer (Version: 5.0.1.1410 - CyberLink Corp.) Hidden
dm-Fotowelt (HKLM\...\dm-Fotowelt) (Version: 5.1.3 - CEWE Stiftung u Co. KGaA)
Dropbox (HKCU\...\Dropbox) (Version: 2.10.3 - Dropbox, Inc.)
Easy Battery Manager (HKLM\...\{6F730513-8688-4C3C-90A3-6B9792CE2EF3}) (Version: 3.2.1.7 - Samsung)
Easy Display Manager (HKLM\...\{17283B95-21A8-4996-97DA-547A48DB266F}) (Version: 2.3 - Samsung Electronics Co., Ltd.)
Easy Network Manager (HKLM\...\{A7581D39-EA20-4883-A480-80C21047052B}) (Version: 4.0.2 - Samsung)
Easy SpeedUp Manager (HKLM\...\{EF367AA4-070B-493C-9575-85BE59D789C9}) (Version: 2.0.2.6 - )
Free YouTube to MP3 Converter version 3.12.35.514 (HKLM\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.35.514 - DVDVideoSoft Ltd.)
Google Chrome (HKLM\...\Google Chrome) (Version: 36.0.1985.125 - Google Inc.)
Google Earth Plug-in (HKLM\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Toolbar for Internet Explorer (HKLM\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.5111.1712 - Google Inc.)
Google Toolbar for Internet Explorer (Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (Version: 1.3.24.15 - Google Inc.) Hidden
IKEA Home Planner (HKLM\...\{B3276CB1-20B6-4AF9-AAEC-E72C83816495}) (Version: 2.0.3 - IKEA IT)
imagine digital freedom - Samsung (HKLM\...\{8E106A57-A17E-431D-B48F-175E42EB9F74}) (Version: 1.0.2.2 - Samsung Electronics Co. Ltd.,)
Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version:  - Intel Corporation)
Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version:  - Intel Corporation)
Java 7 Update 7 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217007FF}) (Version: 7.0.70 - Oracle)
Java Auto Updater (Version: 2.1.9.0 - Sun Microsystems, Inc.) Hidden
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft Office 2003 Web Components (HKLM\...\{90A40407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8003.0 - Microsoft Corporation)
Microsoft Office 2007 Primary Interop Assemblies (HKLM\...\{50120000-1105-0000-0000-0000000FF1CE}) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Office Excel MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Home and Student 2007 (HKLM\...\HOMESTUDENTR) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Small Business Connectivity Components (HKLM\...\{A939D341-5A04-4E0A-BB55-3E65B386432D}) (Version: 2.0.7024.0 - Microsoft Corporation)
Microsoft Office Suite Activation Assistant (HKLM\...\{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}) (Version: 2.9 - Microsoft Corporation)
Microsoft Office Word MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft SQL Server 2005 (HKLM\...\Microsoft SQL Server 2005) (Version:  - Microsoft Corporation)
Microsoft SQL Server 2005 Express Edition (MSSMLBIZ) (Version: 9.2.3042.00 - Microsoft Corporation) Hidden
Microsoft SQL Server Native Client (HKLM\...\{1D1D8ADC-BF08-4E61-9393-5FA305B16864}) (Version: 9.00.3042.00 - Microsoft Corporation)
Microsoft SQL Server VSS Writer (HKLM\...\{5C759B74-34F4-43C6-A5D9-039CB754C5E9}) (Version: 9.00.3042.00 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 16.0.1 (x86 de) (HKCU\...\Mozilla Firefox 16.0.1 (x86 de)) (Version: 16.0.1 - Mozilla)
Mozilla Firefox 31.0 (x86 de) (HKLM\...\Mozilla Firefox 31.0 (x86 de)) (Version: 31.0 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 31.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
PCTroubleshooting (HKLM\...\{68CAE442-579C-4D84-AA5F-253852522ED5}) (Version: 2.0.0.4 - Samsung Electronics Co.,LTD.)
PrintKey2000 (HKLM\...\PrintKey2000) (Version:  - )
Realtek 8136 8168 8169 Ethernet Driver (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0004 - Realtek)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5837 - Realtek Semiconductor Corp.)
Samsung Kies (HKLM\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.2.0.12014_18 - Samsung Electronics Co., Ltd.)
Samsung Kies (Version: 2.2.0.12014_18 - Samsung Electronics Co., Ltd.) Hidden
Samsung Magic Doctor (HKLM\...\{32D6A58F-9659-446C-BBFC-E6F2B41F24DC}) (Version: 5.0 - Samsung Electronics Co., LTD)
Samsung Recovery Solution III (HKLM\...\{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}) (Version: 3.0.0.9 - Samsung)
Samsung Update Plus (HKLM\...\{D3F2FAA5-FEC4-42AA-9ABA-1F763919A2B5}) (Version: 2.0 - Samsung Electronics Co., Ltd.)
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.4.103.0 - SAMSUNG Electronics Co., Ltd.)
SimCity™ Societies (HKLM\...\{0B5154C0-8F00-4616-B0AB-6240AE80D9CE}) (Version: 1.0.0.0 - Electronic Arts)
Skype Click to Call (HKLM\...\{B6CF2967-C81E-40C0-9815-C05774FEF120}) (Version: 6.3.11079 - Skype Technologies S.A.)
Skype™ 6.3 (HKLM\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.3.105 - Skype Technologies S.A.)
SmartWebPrinting (Version: 110.0.182.000 - Hewlett-Packard) Hidden
Softonic toolbar  on IE (HKLM\...\Softonic) (Version:  - Softonic) <==== ATTENTION
SpeedUpMyPC (HKLM\...\{E55B3271-7CA8-4D0C-AE06-69A24856E996}_is1) (Version: 6.0.1.1 - Uniblue Systems Limited) <==== ATTENTION
Spelling Dictionaries Support For Adobe Reader 9 (HKLM\...\{AC76BA86-7AD7-5464-3428-900000000004}) (Version: 9.0.0 - Adobe Systems Incorporated)
swMSM (Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 11.1.3.2 - Synaptics)
Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch) (HKLM\...\{07629207-FAA0-4F1A-8092-BF5085BE511F}) (Version: 9.00.3042.00 - Microsoft Corporation)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (HKLM\...\{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB963707) (Version: 1 - Microsoft Corporation)
User Guide (HKLM\...\{BAE68339-B0F6-4D33-9554-5A3DB2DFF5DA}) (Version: 1.0 - )
VLC media player 1.1.11 (HKLM\...\VLC media player) (Version: 1.1.11 - VideoLAN)
Yahoo Community Smartbar (HKLM\...\{B5945149-A282-42E9-B43A-815E404F0580}) (Version: 1.185.66.12678 - Linkury Inc.) <==== ATTENTION

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

Could not list Restore Points. Check "winmgmt" service or repair WMI.


==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2006-11-02 12:23 - 2006-09-18 23:41 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1      localhost
::1            localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)


(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => ?
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => ?
Task: C:\Windows\Tasks\SpeedUpMyPC Maintenance.job => ? <==== ATTENTION
Task: C:\Windows\Tasks\SpeedUpMyPC Startup.job => ? <==== ATTENTION
Task: C:\Windows\Tasks\User_Feed_Synchronization-{7030CE83-CC54-445E-964F-73E63606DF74}.job => ?
Task: C:\Windows\Tasks\User_Feed_Synchronization-{DC24E08D-D800-4C9D-9DE2-5FF59CBB27E4}.job => C:\Windows\system32\msfeedssync.exe

==================== Loaded Modules (whitelisted) =============

2009-06-15 11:26 - 2006-08-12 05:48 - 00049152 _____ () C:\Program Files\Samsung\Samsung Magic Doctor\HookDllPS2.dll
2009-06-15 11:24 - 2006-08-12 05:48 - 00049152 _____ () C:\Program Files\SAMSUNG\EasySpeedUpManager\HookDllPS2.dll
2009-06-15 11:24 - 2006-08-12 05:48 - 00049152 _____ () C:\Program Files\Samsung\Easy Display Manager\HookDllPS2.dll
2008-12-24 05:29 - 2008-12-24 05:29 - 00619816 ____N () C:\Program Files\CyberLink\Power2Go\CLMediaLibrary.dll
2008-12-24 05:30 - 2008-12-24 05:30 - 00013096 ____N () C:\Program Files\CyberLink\Power2Go\CLMLSvcPS.dll
2012-02-03 18:50 - 2012-02-03 18:50 - 00021392 _____ () C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
2012-02-03 18:44 - 2012-02-03 18:44 - 00503208 _____ () C:\Program Files\Samsung\Kies\External\FirmwareUpdate\FirmwareUpdateAgent.Common.dll
2012-02-03 18:44 - 2012-02-03 18:44 - 00639912 _____ () C:\Program Files\Samsung\Kies\External\FirmwareUpdate\CommonModule.dll
2012-02-19 18:44 - 2012-02-19 18:44 - 00115137 _____ () C:\Users\Kathi\AppData\Local\Temp\08f56ff6-864d-4a92-944a-57b870198cb2\CliSecureRT.dll
2012-02-03 18:44 - 2012-02-03 18:44 - 00007168 _____ () C:\Program Files\Samsung\Kies\External\FirmwareUpdate\IPCServer.dll
2012-02-03 18:43 - 2012-02-03 18:43 - 00003584 _____ () C:\Program Files\Samsung\Kies\External\FirmwareUpdate\ISharedIPCInterface.dll
2013-12-20 23:55 - 2014-05-08 19:26 - 03145536 _____ () C:\Users\Kathi\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe
2014-08-15 17:33 - 2014-08-15 17:33 - 00043008 _____ () c:\users\kathi\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpq754wn.dll
2013-10-19 01:55 - 2013-10-19 01:55 - 25100288 _____ () C:\Users\Kathi\AppData\Roaming\Dropbox\bin\libcef.dll
2012-10-23 18:37 - 2014-07-17 07:42 - 03800688 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
2014-07-17 18:16 - 2014-07-17 18:16 - 17029808 _____ () C:\Windows\system32\Macromed\Flash\NPSWF32_14_0_0_145.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (08/15/2014 05:33:54 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/15/2014 05:04:46 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/15/2014 05:04:00 PM) (Source: MsiInstaller) (EventID: 1013) (User: NT-AUTORITÄT)
Description: Product: Skype Click to Call -- Installation cannot proceed on this operating system.

Error: (08/15/2014 05:03:50 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 11) (User: )
Description: hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabEin erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.

Error: (08/12/2014 08:06:05 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/11/2014 07:03:33 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/10/2014 07:00:28 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\KATHI\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\XD1MT82E.DEFAULT\SAFEBROWSING-TO_DELETE> in der Hash-Zuordnung kann nicht aktualisiert werden.

Kontext:  Anwendung, SystemIndex Katalog


Details:
        Ein an das System angeschlossenes Gerät funktioniert nicht.  (0x8007001f)

Error: (08/10/2014 07:00:28 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\KATHI\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\XD1MT82E.DEFAULT\SAFEBROWSING> in der Hash-Zuordnung kann nicht aktualisiert werden.

Kontext:  Anwendung, SystemIndex Katalog


Details:
        Ein an das System angeschlossenes Gerät funktioniert nicht.  (0x8007001f)

Error: (08/10/2014 07:00:28 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\KATHI\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\XD1MT82E.DEFAULT\SAFEBROWSING> in der Hash-Zuordnung kann nicht aktualisiert werden.

Kontext:  Anwendung, SystemIndex Katalog


Details:
        Ein an das System angeschlossenes Gerät funktioniert nicht.  (0x8007001f)

Error: (08/10/2014 07:00:28 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\KATHI\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\XD1MT82E.DEFAULT\SAFEBROWSING-BACKUP> in der Hash-Zuordnung kann nicht aktualisiert werden.

Kontext:  Anwendung, SystemIndex Katalog


Details:
        Ein an das System angeschlossenes Gerät funktioniert nicht.  (0x8007001f)


System errors:
=============
Error: (08/15/2014 05:35:20 PM) (Source: Microsoft-Windows-LanguagePackSetup) (EventID: 1001) (User: NT-AUTORITÄT)
Description: 0x80070032

Error: (08/15/2014 05:33:54 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Parallel port driver%%1058

Error: (08/15/2014 05:32:11 PM) (Source: HTTP) (EventID: 15016) (User: )
Description: \Device\Http\ReqQueueKerberos

Error: (08/15/2014 05:16:36 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Avira Browser-Schutz101Neustart des Diensts

Error: (08/15/2014 05:16:36 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: ScRegSetValueExWFailureActions%%5

Error: (08/15/2014 05:16:36 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: ScRegSetValueExWFailureActions%%5

Error: (08/15/2014 05:04:47 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Parallel port driver%%1058

Error: (08/15/2014 05:04:16 PM) (Source: Microsoft-Windows-LanguagePackSetup) (EventID: 1001) (User: NT-AUTORITÄT)
Description: 0x80070032

Error: (08/15/2014 05:03:07 PM) (Source: HTTP) (EventID: 15016) (User: )
Description: \Device\Http\ReqQueueKerberos

Error: (08/12/2014 11:04:07 PM) (Source: bowser) (EventID: 8003) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "ALEX-PC",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{0685C0AA-B32D-4432-9948-2DD5804032-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.


Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2014-04-26 22:52:09.820
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-04-26 22:52:09.656
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-04-26 22:52:09.480
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-04-26 22:52:09.322
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info ===========================

Processor: Intel(R) Pentium(R) Dual CPU T3400 @ 2.16GHz
Percentage of memory in use: 46%
Total physical RAM: 3031.88 MB
Available physical RAM: 1631.35 MB
Total Pagefile: 6300.17 MB
Available Pagefile: 4840.21 MB
Total Virtual: 2047.88 MB
Available Virtual: 1893.5 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:109.88 GB) (Free:3.74 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: () (Fixed) (Total:110 GB) (Free:71.21 GB) NTFS

==================== MBR & Partition Table ==================

==================== End Of Log ============================


Schon jetzt vielen Dank für Eure Hilfe!

Viele Grüße
Katharina

deeprybka 15.08.2014 17:19
:hallo:

Mein Name ist Jürgen und ich werde Dir bei Deinem Problem behilflich sein. Zusammen schaffen wir das...:abklatsch:
  • Bitte arbeite alle Schritte der Reihe nach ab.
  • Lese die Anleitungen sorgfältig durch bevor Du beginnst. Wenn es Probleme gibt oder Du etwas nicht verstehst, dann stoppe mit Deiner Ausführung und beschreibe mir das Problem.
  • Führe bitte nur Scans durch, zu denen Du von mir aufgefordert wurdest.
  • Bitte kein Crossposting (posten in mehreren Foren).
  • Installiere oder deinstalliere während der Bereinigung keine Software, außer Du wurdest dazu aufgefordert.
  • Speichere alle unsere Tools auf dem Desktop ab. Link: So ladet Ihr unsere Tools richtig
  • Poste die Logfiles direkt in Deinen Thread in Code-Tags.
  • Bedenke, dass wir hier alle während unserer Freizeit tätig sind, wenn du innerhalb von 24 Stunden nichts von mir liest, dann schreibe mir bitte eine PM.

Hinweis:
Ich kann Dir niemals eine Garantie geben, dass wir alle schädlichen Dateien finden werden.
Eine Formatierung ist meist der schnellere und immer der sicherste Weg, aber auch nur bei wirklicher Malware empfehlenswert.
Adware & Co. können wir sehr gut entfernen.
Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis Du mein clean :daumenhoc bekommst.



Los geht's:


Bitte deinstalliere folgende Programme:

Yahoo Community Smartbar
Softonic toolbar on IE
SpeedUpMyP







Schritt 1

http://filepony.de/icon/frst.pnghttp://deeprybka.trojaner-board.de/b...st/frstfix.png

Drücke bitte die http://deeprybka.trojaner-board.de/b...ne/revo/w7.png + R Taste und schreibe notepad in das Ausführen Fenster.
Klicke auf OK und kopiere nun den Text aus der Codebox in das leere Textdokument:
Code:
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Avira <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Avira <====== ATTENTION
Speichere dieses bitte als Fixlist.txt in das Verzeichnis ab, in dem sich auch die FRST-Anwendung befindet.
  • Starte FRST und drücke auf den Fix-Button.
  • Das Tool erstellt eine "Fixlog.txt" -Datei.
  • Poste mir bitte deren Inhalt.


Avira solltest Du nun wieder bedienen können und darfst es für Schritt 2 auch gleich wieder deaktivieren (Echtzeitschutz). ;)

http://www.trojaner-board.de/attachm...iten-avira.png

Schritt 2
Scan mit Combofix
WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link
  • WICHTIG: Speichere Combofix auf deinem Desktop.
  • Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
  • Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
  • Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
  • Wenn Combofix fertig ist, wird es ein Logfile erstellen.
  • Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).
Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Katharina123 15.08.2014 17:50
Hallo Jürgen,

vielen Dank für Deine Hilfe :dankeschoen:

Ich habe Softonic toolbar on IE und SpeedUpMyP deinstalliert.
Yahoo Community Smartbar konnte ich leider nicht finden.
Wenn ich das in die Suche eingebe, findest es das auch nur in der FRST- und Additionsdatei.

Soll ich nun trotzdem die weiteren Schritte ausführen?

Viele Grüße
Katharina

deeprybka 15.08.2014 17:51
Hi,
ja mach einfach mit den nächsten Schritten weiter... :)

Katharina123 15.08.2014 17:58
Ok, super.

Hier die Fixlog.txt-Datei:

Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version:15-08-2014
Ran by Kathi at 2014-08-15 18:55:49 Run:1
Running from C:\Users\Kathi\Downloads
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Avira <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Avira <====== ATTENTION
*****************

HKLM => Group Policy Restriction on software not found.
HKLM => Group Policy Restriction on software not found.
HKLM => Group Policy Restriction on software not found.

==== End of Fixlog ====
Avira kann ich leider noch nicht bedienen.
Es kommt nach wie vor die Fehlermeldung mit der Gruppenrichtlinie, wenden Sie sich an Ihren Systemadministrator.

deeprybka 15.08.2014 18:05
Hi,
Du musst alle unsere Tools als Administratror ausführen.
Code:
(ATTENTION: The logged in user is not administrator)
Zitat:
Gehen Sie folgendermaßen vor, um ein Programm mit Administratorrechten auszuführen:

Klicken Sie mit der rechten Maustaste auf das Programmsymbol, und klicken Sie danach auf Als Administrator ausführen.
Wenn Sie zur Eingabe eines Administratorkennworts bzw. zur Bestätigung aufgefordert werden, geben Sie das Administratorkennwort ein, oder klicken Sie auf Weiter.
http://support.microsoft.com/kb/922708/de


Macht aber nichts, machen wir später. Laufen ja auch keine Avira-Prozesse.
Mach jetzt bitte mit Schritt 2 weiter. Halte Dich aber genau an die Anweisungen. ;)

Katharina123 15.08.2014 18:32
Hier die Combofix-Datei. Er hat gemeckert, dass Avira Desktop aktiv wäre, was ja aber nicht der Fall war. Habe ich deshalb ignoriert.

Code:
ComboFix 14-08-15.01 - Wichsis 15.08.2014  19:13:38.1.2 - x86
Microsoft® Windows Vista™ Home Basic  6.0.6001.1.1252.49.1031.18.3032.1336 [GMT 2:00]
ausgeführt von:: c:\users\Kathi\Desktop\ComboFix.exe
AV: Avira Desktop *Enabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
SP: Avira Desktop *Enabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Kathi\AppData\Local\Google\Desktop\Install
c:\users\Kathi\AppData\Local\Google\Desktop\Install\{c7ed97b9-5c51-63b8-4ec8-f1a70c852fb6}\???\???\???\{c7ed97b9-5c51-63b8-4ec8-f1a70c852fb6}\@
c:\users\Kathi\AppData\Local\Google\Desktop\Install\{c7ed97b9-5c51-63b8-4ec8-f1a70c852fb6}\???\???\???\{c7ed97b9-5c51-63b8-4ec8-f1a70c852fb6}\U\00000001.@
c:\users\Kathi\AppData\Local\Google\Desktop\Install\{c7ed97b9-5c51-63b8-4ec8-f1a70c852fb6}\???\???\???\{c7ed97b9-5c51-63b8-4ec8-f1a70c852fb6}\U\00000002.@
c:\users\Kathi\AppData\Local\Google\Desktop\Install\{c7ed97b9-5c51-63b8-4ec8-f1a70c852fb6}\C3C1~1\01C8~1\CFFE~1\{c7ed97b9-5c51-63b8-4ec8-f1a70c852fb6}\@
c:\users\Kathi\AppData\Local\Google\Desktop\Install\{c7ed97b9-5c51-63b8-4ec8-f1a70c852fb6}\C3C1~1\01C8~1\CFFE~1\{c7ed97b9-5c51-63b8-4ec8-f1a70c852fb6}\U\00000001.@
c:\users\Kathi\AppData\Local\Google\Desktop\Install\{c7ed97b9-5c51-63b8-4ec8-f1a70c852fb6}\C3C1~1\01C8~1\CFFE~1\{c7ed97b9-5c51-63b8-4ec8-f1a70c852fb6}\U\00000002.@
D:\install.exe
.
.
(((((((((((((((((((((((  Dateien erstellt von 2014-07-15 bis 2014-08-15  ))))))))))))))))))))))))))))))
.
.
2014-08-15 17:21 . 2014-08-15 17:21        --------        d-----w-        c:\users\Default\AppData\Local\temp
2014-08-15 17:21 . 2014-08-15 17:21        --------        d-----w-        c:\users\Wichsis\AppData\Local\temp
2014-08-15 15:58 . 2014-08-15 15:58        62576        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{C633E6EE-22F1-4EA2-AD7B-977174453D10}\offreg.dll
2014-08-15 15:38 . 2014-08-15 16:55        --------        d-----w-        C:\FRST
2014-08-15 15:24 . 2014-07-02 03:11        8217224        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{C633E6EE-22F1-4EA2-AD7B-977174453D10}\mpengine.dll
2014-08-04 19:09 . 2014-08-04 19:09        --------        d-----w-        c:\users\Kathi\AppData\Roaming\dll-files.com
2014-08-03 11:58 . 2014-08-03 11:59        --------        d-----w-        c:\programdata\EtilkOdmol
2014-08-03 11:58 . 2014-08-03 11:58        --------        d-----w-        c:\programdata\OxyuNhira
2014-08-03 11:43 . 2014-08-03 11:43        --------        d-----w-        c:\programdata\Logs
2014-08-03 11:43 . 2014-06-10 10:27        17344        ----a-w-        c:\windows\system32\roboot.exe
2014-07-30 18:35 . 2014-07-30 18:35        --------        d-----w-        c:\program files\Mozilla Firefox(23)
2014-07-16 20:32 . 2014-07-17 05:42        46704        ----a-w-        c:\program files\Mozilla Firefox\browser\components\browsercomps.dll
2014-07-16 20:32 . 2014-07-17 05:42        28272        ----a-w-        c:\program files\Mozilla Firefox\plugin-hang-ui.exe
2014-07-16 20:32 . 2014-07-17 05:42        822384        ----a-w-        c:\program files\Mozilla Firefox\icuuc52.dll
2014-07-16 20:32 . 2014-07-17 05:42        1022576        ----a-w-        c:\program files\Mozilla Firefox\icuin52.dll
2014-07-16 20:32 . 2014-07-17 05:42        10594416        ----a-w-        c:\program files\Mozilla Firefox\icudt52.dll
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-07-23 08:52 . 2011-12-28 14:24        231584        ------w-        c:\windows\system32\MpSigStub.exe
2014-07-17 16:16 . 2012-09-18 18:11        699056        ----a-w-        c:\windows\system32\FlashPlayerApp.exe
2014-07-17 16:16 . 2012-02-25 22:06        71344        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2014-07-03 16:39 . 2013-08-06 20:00        97648        ----a-w-        c:\windows\system32\drivers\avgntflt.sys
2014-06-05 11:07 . 2013-08-06 20:00        136216        ----a-w-        c:\windows\system32\drivers\avipbb.sys
2007-03-12 16:59 . 2007-03-12 16:59        299008        ----a-w-        c:\program files\navigram_register.exe
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}]
2014-05-15 12:13        297128        ----a-w-        c:\program files\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920]
"KiesHelper"="c:\program files\Samsung\Kies\KiesHelper.exe" [2012-02-03 943504]
"Browser Infrastructure Helper"="c:\users\Wichsis\AppData\Local\Smartbar\Application\Smartbar.exe" [2013-10-09 20760]
"OxyuNhira"="c:\programdata\OxyuNhira\OxyuNhira.dat" [2014-08-03 254880]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-08-19 150040]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-08-19 170520]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-08-19 145944]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-04-21 7420448]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-08-28 1049896]
"UpdateLBPShortCut"="c:\program files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2008-12-03 218408]
"CLMLServer"="c:\program files\CyberLink\Power2Go\CLMLSvc.exe" [2008-12-24 103720]
"UpdateP2GoShortCut"="c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2009-02-25 218408]
"UpdatePDRShortCut"="c:\program files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" [2008-01-04 222504]
"RemoteControl8"="c:\program files\CyberLink\PowerDVD8\PDVD8Serv.exe" [2009-04-15 91432]
"PDVD8LanguageShortcut"="c:\program files\CyberLink\PowerDVD8\Language\Language.exe" [2009-04-15 50472]
"UpdatePPShortCut"="c:\program files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" [2008-12-03 218408]
"UpdatePSTShortCut"="c:\program files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" [2009-03-12 210216]
"KiesTrayAgent"="c:\program files\Samsung\Kies\KiesTrayAgent.exe" [2012-02-03 3508624]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2014-08-15 751184]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
.
c:\users\Kathi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE /tsr [2006-10-26 98632]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Printkey2000.lnk - c:\program files\PrintKey2000\Printkey2000.exe [2014-5-11 869376]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork        REG_MULTI_SZ          PLA DPS BFE mpssvc
HPZ12        REG_MULTI_SZ          Pml Driver HPZ12 Net Driver HPZ12
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-07-18 17:46        1104200        ----a-w-        c:\program files\Google\Chrome\Application\36.0.1985.125\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2014-08-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-08-18 21:35]
.
2014-08-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-08-18 21:35]
.
2014-08-15 c:\windows\Tasks\User_Feed_Synchronization-{7030CE83-CC54-445E-964F-73E63606DF74}.job
- c:\windows\system32\msfeedssync.exe [2011-12-28 04:32]
.
2014-08-15 c:\windows\Tasks\User_Feed_Synchronization-{DC24E08D-D800-4C9D-9DE2-5FF59CBB27E4}.job
- c:\windows\system32\msfeedssync.exe [2011-12-28 04:32]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=b3b97fe1-733e-c16a-594c-aecc25092492&searchtype=hp&fr=linkury-tb&installDate=02/11/2013&type=hp1000
mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=SMSN&bmod=SMSN
uSearchAssistant = hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=b3b97fe1-733e-c16a-594c-aecc25092492&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=02/11/2013&type=hp1000
IE: Free YouTube to MP3 Converter - c:\program files\Common Files\DVDVideoSoft\plugins\freeytmp3downloader.htm
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: {{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - c:\program files\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll
LSP: c:\program files\Avira\AntiVir Desktop\avsda.dll
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Wichsis\AppData\Roaming\Mozilla\Firefox\Profiles\an2mua9h.default\
FF - prefs.js: browser.startup.homepage - hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=b3b97fe1-733e-c16a-594c-aecc25092492&searchtype=hp&fr=linkury-tb&installDate={installDate}&type=hp1000
FF - prefs.js: browser.search.selectedEngine - Web Search
FF - prefs.js: keyword.URL - hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=b3b97fe1-733e-c16a-594c-aecc25092492&searchtype=ds&fr=linkury-tb&installDate={installDate}&type=hp1000&p=
FF - ExtSQL: !HIDDEN! 2012-08-30 22:12; smartwebprinting@hp.com; c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
BHO-{41564952-412D-5637-00A7-7A786E7484D7} - (no file)
Toolbar-{41564952-412D-5637-00A7-7A786E7484D7} - (no file)
ShellIconOverlayIdentifiers-{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} - (no file)
HKCU-Run-EtilkOdmol - (no file)
c:\users\Kathi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk - c:\users\Wichsis\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup
AddRemove-01_Simmental - c:\program files\Samsung\USB Drivers\01_Simmental\Uninstall.exe
AddRemove-02_Siberian - c:\program files\Samsung\USB Drivers\02_Siberian\Uninstall.exe
AddRemove-03_Swallowtail - c:\program files\Samsung\USB Drivers\03_Swallowtail\Uninstall.exe
AddRemove-04_semseyite - c:\program files\Samsung\USB Drivers\04_semseyite\Uninstall.exe
AddRemove-05_Sloan - c:\program files\Samsung\USB Drivers\05_Sloan\Uninstall.exe
AddRemove-06_Spencer - c:\program files\Samsung\USB Drivers\06_Spencer\Uninstall.exe
AddRemove-07_Schorl - c:\program files\Samsung\USB Drivers\07_Schorl\Uninstall.exe
AddRemove-08_EMPChipset - c:\program files\Samsung\USB Drivers\08_EMPChipset\Uninstall.exe
AddRemove-09_Hsp - c:\program files\Samsung\USB Drivers\09_Hsp\Uninstall.exe
AddRemove-11_HSP_Plus_Default - c:\program files\Samsung\USB Drivers\11_HSP_Plus_Default\Uninstall.exe
AddRemove-16_Shrewsbury - c:\program files\Samsung\USB Drivers\16_Shrewsbury\Uninstall.exe
AddRemove-17_EMP_Chipset2 - c:\program files\Samsung\USB Drivers\17_EMP_Chipset2\Uninstall.exe
AddRemove-18_Zinia_Serial_Driver - c:\program files\Samsung\USB Drivers\18_Zinia_Serial_Driver\Uninstall.exe
AddRemove-19_VIA_driver - c:\program files\Samsung\USB Drivers\19_VIA_driver\Uninstall.exe
AddRemove-20_NXP_Driver - c:\program files\Samsung\USB Drivers\20_NXP_Driver\Uninstall.exe
AddRemove-22_WiBro_WiMAX - c:\program files\Samsung\USB Drivers\22_WiBro_WiMAX\Uninstall.exe
AddRemove-24_flashusbdriver - c:\program files\Samsung\USB Drivers\24_flashusbdriver\Uninstall.exe
AddRemove-25_escape - c:\program files\Samsung\USB Drivers\25_escape\Uninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2014-08-15 19:21
Windows 6.0.6001 Service Pack 1 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-3121953689-2843351358-1462341086-1004_Classes\CLSID]
@DACL=(02 0000)
.
[HKEY_USERS\S-1-5-21-3121953689-2843351358-1462341086-1004_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}]
@DACL=(02 0000)
@="Dropbox Autoplay COM Server"
.
[HKEY_USERS\S-1-5-21-3121953689-2843351358-1462341086-1004_Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}]
@DACL=(02 0000)
@="Java Plug-in 10.7.2"
.
[HKEY_USERS\S-1-5-21-3121953689-2843351358-1462341086-1004_Classes\CLSID\{CAFEEFAC-0017-0000-0007-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.7.0_07"
.
[HKEY_USERS\S-1-5-21-3121953689-2843351358-1462341086-1004_Classes\CLSID\{CAFEEFAC-0017-0000-0007-ABCDEFFEDCBB}]
@DACL=(02 0000)
@="Java Plug-in 1.7.0_07"
.
[HKEY_USERS\S-1-5-21-3121953689-2843351358-1462341086-1004_Classes\CLSID\{CAFEEFAC-0017-0000-0007-ABCDEFFEDCBC}]
@DACL=(02 0000)
@="Java Plug-in 1.7.0_07"
.
[HKEY_USERS\S-1-5-21-3121953689-2843351358-1462341086-1004_Classes\CLSID\{CAFEEFAC-0017-0000-FFFF-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 1.7.0"
.
[HKEY_USERS\S-1-5-21-3121953689-2843351358-1462341086-1004_Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}]
@DACL=(02 0000)
@="Java Plug-in 10.7.2"
.
[HKEY_USERS\S-1-5-21-3121953689-2843351358-1462341086-1004_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
@DACL=(02 0000)
@="DropboxExt"
.
[HKEY_USERS\S-1-5-21-3121953689-2843351358-1462341086-1004_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
@DACL=(02 0000)
@="DropboxExt"
.
[HKEY_USERS\S-1-5-21-3121953689-2843351358-1462341086-1004_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
@DACL=(02 0000)
@="DropboxExt"
.
[HKEY_USERS\S-1-5-21-3121953689-2843351358-1462341086-1004_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
@DACL=(02 0000)
@="DropboxExt"
.
[HKEY_USERS\S-1-5-21-3121953689-2843351358-1462341086-1004_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}]
@DACL=(02 0000)
@="DropboxExt"
.
[HKEY_USERS\S-1-5-21-3121953689-2843351358-1462341086-1004_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}]
@DACL=(02 0000)
@="DropboxExt"
.
[HKEY_USERS\S-1-5-21-3121953689-2843351358-1462341086-1004_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}]
@DACL=(02 0000)
@="DropboxExt"
.
[HKEY_USERS\S-1-5-21-3121953689-2843351358-1462341086-1004_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}]
@DACL=(02 0000)
@="DropboxExt"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_278_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_278_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Zeit der Fertigstellung: 2014-08-15  19:23:51
ComboFix-quarantined-files.txt  2014-08-15 17:23
.
Vor Suchlauf: 3.493.724.160 Bytes frei
Nach Suchlauf: 6.464.237.568 Bytes frei
.
- - End Of File - - 99F5CE7D08D62FE176EC203D0E658832
61A349592C4728853F4A90FF78F7628E

deeprybka 15.08.2014 18:36
Gut...:daumenhoc

Schritt 1
Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).


Schritt 2

http://filepony.de/icon/malwarebytes_anti_malware.png Malwarebytes Antimalware
  • Download-Link
  • Installiere das Programm in den vorgegebenen Pfad.
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Sollte die Benutzeroberfläche noch in Englisch sein, klicke auf Settings und wähle bei Language Deutsch aus.
  • Unter Erkennung und Schutz setze bitte einen Haken bei "Suche nach Rootkits".
  • Klicke im Anschluss auf "Suchlauf", wähle den Bedrohungssuchlauf aus, aktualisiere die Datenbanken und klicke auf "Suchlauf jetzt starten".
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. (geht so...)
  • Poste mir den Inhalt der Logdatei (geht so...). Klicke dazu auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Suchlauf-Protokoll aus und klicke auf Ansicht. Klicke auf "In Zwischenablage kopieren" poste mir den Inhalt in Code-Tags als Antwort in den Thread.


Schritt 3

http://filepony.de/icon/frst.pnghttp://deeprybka.trojaner-board.de/b...t/frstscan.png

Bitte starte FRST erneut (mit Administrator-Rechte), und drücke auf Scan.
Bitte poste mir den Inhalt des Logs.

Katharina123 15.08.2014 18:57
Hier schon mal die AdwCleaner-Datei



Code:
# AdwCleaner v3.305 - Bericht erstellt am 15/08/2014 um 19:46:03
# Aktualisiert 14/08/2014 von Xplode
# Betriebssystem : Windows Vista (TM) Home Basic Service Pack 1 (32 bits)
# Benutzername : Wichsis - KATHARINA
# Gestartet von : C:\Users\Kathi\Downloads\adwcleaner_3.305.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\Tarma Installer
Ordner Gelöscht : C:\Users\Kathi\AppData\LocalLow\Smartbar
Ordner Gelöscht : C:\Users\Kathi\AppData\LocalLow\Softonic
Ordner Gelöscht : C:\Users\Wichsis\AppData\Local\Smartbar
Ordner Gelöscht : C:\Users\Wichsis\AppData\LocalLow\Smartbar
Ordner Gelöscht : C:\Users\Wichsis\AppData\LocalLow\Softonic
Ordner Gelöscht : C:\Users\Wichsis\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gelöscht : C:\Users\Wichsis\AppData\Roaming\OpenCandy
Datei Gelöscht : C:\Windows\system32\roboot.exe

***** [ Tasks ] *****


***** [ Verknüpfungen ] *****

Verknüpfung Desinfiziert : C:\Users\Wichsis\Desktop\Search.lnk
Verknüpfung Desinfiziert : C:\Users\Wichsis\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Search.lnk

***** [ Registrierungsdatenbank ] *****

Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{ACAA314B-EEBA-48E4-AD47-84E31C44796C}]
Schlüssel Gelöscht : HKCU\Software\Google\Chrome\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp
Wert Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [Browser Infrastructure Helper]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\secman.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.bandobjectattribute
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.bho
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.dockingpanel
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.iesmartbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.iesmartbarbandobject
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.smartbardisplaystate
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.smartbarmenuform
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\speedupmypc
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{7ABBFE1C-E485-44AA-8F36-353751B4124D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{83FF80F4-8C74-4B80-B5BA-C8DDD434E5C4}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\smartbarbackup
Schlüssel Gelöscht : HKCU\Software\smartbarlog
Schlüssel Gelöscht : HKLM\Software\Uniblue
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3152E1F19977892449DC968802CE8964
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\5E8031606EB60A64C882918F8FF38DD4

***** [ Browser ] *****

-\\ Internet Explorer v8.0.6001.19088

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Search [Default_Search_URL]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Search [SearchAssistant]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls [Tabs]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\SearchUrl [Default]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchUrl [Default]

-\\ Mozilla Firefox v31.0 (x86 de)

[ Datei : C:\Users\Kathi\AppData\Roaming\Mozilla\Firefox\Profiles\xd1mt82e.default\prefs.js ]


[ Datei : C:\Users\Wichsis\AppData\Roaming\Mozilla\Firefox\Profiles\an2mua9h.default\prefs.js ]

Zeile gelöscht : user_pref("browser.newtab.url", "hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=b3b97fe1-733e-c16a-594c-aecc25092492&searchtype=nt&fr=linkury-tb&installDate={installDate}&type=[...]
Zeile gelöscht : user_pref("browser.search.selectedEngine", "Web Search");
Zeile gelöscht : user_pref("browser.startup.homepage", "hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=b3b97fe1-733e-c16a-594c-aecc25092492&searchtype=hp&fr=linkury-tb&installDate={installDate}[...]
Zeile gelöscht : user_pref("keyword.URL", "hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=b3b97fe1-733e-c16a-594c-aecc25092492&searchtype=ds&fr=linkury-tb&installDate={installDate}&type=hp1000&[...]

-\\ Google Chrome v36.0.1985.125

[ Datei : C:\Users\Kathi\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [8171 octets] - [15/08/2014 19:44:39]
AdwCleaner[S0].txt - [6714 octets] - [15/08/2014 19:46:03]

########## EOF - \AdwCleaner\AdwCleaner[S0].txt - [6774 octets] ##########

deeprybka 15.08.2014 18:58
Prima! :daumenhoc

Katharina123 15.08.2014 19:31
Malwarebytes:

Code:
Malwarebytes Anti-Malware
www.malwarebytes.org

Suchlauf Datum: 15.08.2014
Suchlauf-Zeit: 20:02:33
Logdatei:
Administrator: Ja

Version: 2.00.2.1012
Malware Datenbank: v2014.08.15.09
Rootkit Datenbank: v2014.08.04.01
Lizenz: Testversion
Malware Schutz: Aktiviert
Bösartiger Webseiten Schutz: Aktiviert
Self-protection: Deaktiviert

Betriebssystem: Windows Vista Service Pack 1
CPU: x86
Dateisystem: NTFS
Benutzer: Wichsis

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 316969
Verstrichene Zeit: 14 Min, 48 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Aktiviert
Heuristics: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registrierungsschlüssel: 8
PUP.Optional.Snapdo.T, HKU\S-1-5-21-3121953689-2843351358-1462341086-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{006ee092-9658-4fd6-bd8e-a21a348e59f5}, In Quarantäne, [5246447e86f5f14519905d4a33cf6d93],
PUP.Optional.QuickShare.A, HKU\S-1-5-21-3121953689-2843351358-1462341086-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}, In Quarantäne, [afe9b60c4338b185c2fd5c479c667c84],
PUP.Optional.QuickShare.A, HKU\S-1-5-21-3121953689-2843351358-1462341086-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}, In Quarantäne, [afe9b60c4338b185c2fd5c479c667c84],
PUP.Optional.Softonic.A, HKU\S-1-5-21-3121953689-2843351358-1462341086-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{5018CFD2-804D-4C99-9F81-25EAEA2769DE}, In Quarantäne, [acecead8ccaf82b4ac312a4328da946c],
PUP.Optional.Softonic.A, HKU\S-1-5-21-3121953689-2843351358-1462341086-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{5018CFD2-804D-4C99-9F81-25EAEA2769DE}, In Quarantäne, [acecead8ccaf82b4ac312a4328da946c],
PUP.Optional.Softonic.A, HKU\S-1-5-21-3121953689-2843351358-1462341086-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{E87806B5-E908-45FD-AF5E-957D83E58E68}, In Quarantäne, [5642447e76051e18a6380865b64c867a],
PUP.Optional.Softonic.A, HKU\S-1-5-21-3121953689-2843351358-1462341086-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{E87806B5-E908-45FD-AF5E-957D83E58E68}, In Quarantäne, [5642447e76051e18a6380865b64c867a],
PUP.Optional.Softonic.A, HKU\S-1-5-21-3121953689-2843351358-1462341086-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SOFTONIC\Softonic, In Quarantäne, [791f5b67ed8ebe787406619db949629e],

Registrierungswerte: 1
Spyware.Password, HKU\S-1-5-21-3121953689-2843351358-1462341086-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|OxyuNhira, regsvr32.exe "C:\ProgramData\OxyuNhira\OxyuNhira.dat", Löschen bei Neustart, [7226556d453674c2de95aafe2bd644bc]

Registrierungsdaten: 6
PUP.Optional.HelperBar.A, HKU\S-1-5-21-3121953689-2843351358-1462341086-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=b3b97fe1-733e-c16a-594c-aecc25092492&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=02/11/2013&type=hp1000, Gut: (www.google.com), Schlecht: (hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=b3b97fe1-733e-c16a-594c-aecc25092492&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=02/11/2013&type=hp1000),Ersetzt,[b9dfcdf5fa81df578c9c4e7a25dfe61a]
PUP.Optional.HelperBar.A, HKU\S-1-5-21-3121953689-2843351358-1462341086-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=b3b97fe1-733e-c16a-594c-aecc25092492&searchtype=hp&fr=linkury-tb&installDate=02/11/2013&type=hp1000, Gut: (www.google.com), Schlecht: (hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=b3b97fe1-733e-c16a-594c-aecc25092492&searchtype=hp&fr=linkury-tb&installDate=02/11/2013&type=hp1000),Ersetzt,[613751712b501a1ca48511b722e218e8]
PUP.Optional.HelperBar.A, HKU\S-1-5-21-3121953689-2843351358-1462341086-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Bar, hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=b3b97fe1-733e-c16a-594c-aecc25092492&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=02/11/2013&type=hp1000, Gut: (www.google.com), Schlecht: (hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=b3b97fe1-733e-c16a-594c-aecc25092492&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=02/11/2013&type=hp1000),Ersetzt,[a0f89d25512a211526017850b450e41c]
PUP.Optional.HelperBar.A, HKU\S-1-5-21-3121953689-2843351358-1462341086-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH|Default_Search_URL, hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=b3b97fe1-733e-c16a-594c-aecc25092492&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=02/11/2013&type=hp1000, Gut: (www.google.com), Schlecht: (hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=b3b97fe1-733e-c16a-594c-aecc25092492&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=02/11/2013&type=hp1000),Ersetzt,[9ff9952d8eedd85e31f96761917334cc]
PUP.Optional.HelperBar.A, HKU\S-1-5-21-3121953689-2843351358-1462341086-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH|SearchAssistant, hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=b3b97fe1-733e-c16a-594c-aecc25092492&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=02/11/2013&type=hp1000, Gut: (www.google.com), Schlecht: (hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=b3b97fe1-733e-c16a-594c-aecc25092492&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=02/11/2013&type=hp1000),Ersetzt,[6632388a0e6d023427048e3aaf5512ee]
PUP.Optional.HelperBar.A, HKU\S-1-5-21-3121953689-2843351358-1462341086-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHURL|Default, hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=b3b97fe1-733e-c16a-594c-aecc25092492&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=02/11/2013&type=hp1000, Gut: (www.google.com), Schlecht: (hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=b3b97fe1-733e-c16a-594c-aecc25092492&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=02/11/2013&type=hp1000),Ersetzt,[10889230354660d6c75f08c0887cde22]

Ordner: 0
(No malicious items detected)

Dateien: 2
Spyware.Password, C:\ProgramData\OxyuNhira\OxyuNhira.dat, In Quarantäne, [7226556d453674c2de95aafe2bd644bc],
PUP.Optional.SmartBar, C:\Windows\Installer\4a570b.msi, In Quarantäne, [c1d7d6ec265584b23d0745e98e728f71],

Physische Sektoren: 0
(No malicious items detected)


(end)
Und hier die FRST-Logdatei:


FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:15-08-2014
Ran by Wichsis (administrator) on KATHARINA on 15-08-2014 20:30:09
Running from C:\Users\Kathi\Downloads
Platform: Microsoft® Windows Vista™ Home Basic  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 8
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Microsoft Corporation) C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe
() C:\Program Files\CyberLink\Shared files\RichVideo.exe
(Skype Technologies S.A.) C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbam.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(CyberLink) C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe
(CyberLink Corp.) C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
(Adobe Systems Incorporated) C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe
(Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Fred's Software) C:\Program Files\PrintKey2000\Printkey2000.exe
(SAMSUNG Electronics co., LTD.) C:\Program Files\Samsung\EBM\EasyBatteryMgr3.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Samsung Magic Doctor\MagicDoctorKbdHk.exe
() C:\Program Files\Samsung\Samsung Update Plus\SUPBackGround.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\ielowutil.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_14_0_0_145.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_14_0_0_145.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Avira <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Avira <====== ATTENTION
HKU\S-1-5-21-3121953689-2843351358-1462341086-1000\...\Run: [KiesHelper] => C:\Program Files\Samsung\Kies\KiesHelper.exe [943504 2012-02-03] (Samsung)
HKU\S-1-5-21-3121953689-2843351358-1462341086-1000\...\RunOnce: [FlashPlayerUpdate] => C:\Windows\system32\Macromed\Flash\FlashUtil32_14_0_0_145_Plugin.exe [851632 2014-07-17] (Adobe Systems Incorporated)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Printkey2000.lnk
ShortcutTarget: Printkey2000.lnk -> C:\Program Files\PrintKey2000\Printkey2000.exe (Fred's Software)
Startup: C:\Users\Kathi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=SMSN&bmod=SMSN
BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO: Google Toolbar Notifier BHO -> {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} -> C:\Program Files\Google\GoogleToolbarNotifier\5.7.9012.1008\swg.dll (Google Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {6E718D87-6909-4FCE-92D4-EDCB2F725727} hxxp://navigram.com/engine/v1026/Navigram.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Wichsis\AppData\Roaming\Mozilla\Firefox\Profiles\an2mua9h.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.7.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.7.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2012-10-23]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2011-12-28]
FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2 [2012-08-30]
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2
FF HKCU\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files\Common Files\DVDVideoSoft\plugins\ff
FF Extension: Download videos and MP3s from YouTube - C:\Program Files\Common Files\DVDVideoSoft\plugins\ff [2013-11-02]

Chrome:
=======
CHR HKLM\...\Chrome\Extension: [aaaaacalgebmfelllfiaoknifldpngjh] - C:\ProgramData\AskPartnerNetwork\Toolbar\AVIRA-V7\CRX\ToolbarCR.crx []

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-08-15] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-08-15] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1021008 2014-08-15] (Avira Operations GmbH & Co. KG)
R2 MBAMScheduler; C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
S4 MSSQLServerADHelper; C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [45272 2005-10-14] (Microsoft Corporation)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [43520 2008-02-28] (Hewlett-Packard) [File not signed]
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [53248 2008-02-28] (Hewlett-Packard) [File not signed]
R2 RichVideo; C:\Program Files\CyberLink\Shared files\RichVideo.exe [247152 2008-11-25] ()
R2 Skype C2C Service; C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [3064000 2012-10-02] (Skype Technologies S.A.)
S2 APNMCP; "C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [97648 2014-07-03] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-06-05] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-26] (Avira Operations GmbH & Co. KG)
R2 KMDFMEMIO; C:\Windows\System32\DRIVERS\kmdfmemio.sys [13312 2006-11-14] (SAMSUNG ELECTRONICS CO., LTD.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-05-12] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [110296 2014-08-15] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-05-12] (Malwarebytes Corporation)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-08-05] (Avira GmbH)
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-21] (Microsoft Corporation)
S3 catchme; \??\C:\Users\Wichsis\AppData\Local\Temp\catchme.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-15 20:00 - 2014-08-15 20:27 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-15 19:59 - 2014-08-15 19:59 - 00000899 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-08-15 19:59 - 2014-08-15 19:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-08-15 19:59 - 2014-08-15 19:59 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-15 19:59 - 2014-08-15 19:59 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2014-08-15 19:59 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-08-15 19:59 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-08-15 19:59 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-08-15 19:58 - 2014-08-15 19:58 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Kathi\Downloads\mbam-setup-2.0.2.1012.exe
2014-08-15 19:46 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\system32\sqlite3.dll
2014-08-15 19:44 - 2014-08-15 19:46 - 00000000 ____D () C:\AdwCleaner
2014-08-15 19:42 - 2014-08-15 19:42 - 01356107 _____ () C:\Users\Kathi\Downloads\adwcleaner_3.305.exe
2014-08-15 19:23 - 2014-08-15 19:23 - 00017045 _____ () C:\ComboFix.txt
2014-08-15 19:11 - 2014-08-15 19:23 - 00000000 ____D () C:\ComboFix
2014-08-15 19:11 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-08-15 19:11 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-08-15 19:11 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-08-15 19:11 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-08-15 19:11 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-08-15 19:11 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-08-15 19:11 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-08-15 19:11 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-08-15 19:10 - 2014-08-15 19:23 - 00000000 ____D () C:\Qoobox
2014-08-15 19:10 - 2014-08-15 19:21 - 00000000 ____D () C:\Windows\erdnt
2014-08-15 19:07 - 2014-08-15 19:07 - 05571320 ____R (Swearware) C:\Users\Kathi\Desktop\ComboFix.exe
2014-08-15 17:40 - 2014-08-15 17:40 - 00025127 _____ () C:\Users\Kathi\Desktop\FRST.txt
2014-08-15 17:40 - 2014-08-15 17:40 - 00022313 _____ () C:\Users\Kathi\Desktop\Addition.txt
2014-08-15 17:39 - 2014-08-15 20:30 - 00013560 _____ () C:\Users\Kathi\Downloads\FRST.txt
2014-08-15 17:39 - 2014-08-15 17:39 - 00022313 _____ () C:\Users\Kathi\Downloads\Addition.txt
2014-08-15 17:38 - 2014-08-15 20:30 - 00000000 ____D () C:\FRST
2014-08-15 17:37 - 2014-08-15 17:37 - 01092096 _____ (Farbar) C:\Users\Kathi\Downloads\FRST.exe
2014-08-12 20:43 - 2014-08-12 20:50 - 151513264 _____ () C:\Users\Kathi\Downloads\avira_free_antivirus06_de(1).exe
2014-08-12 20:42 - 2014-08-12 20:49 - 151513264 _____ () C:\Users\Kathi\Downloads\avira_free_antivirus06_de.exe
2014-08-04 21:09 - 2014-08-04 21:09 - 00000000 ____D () C:\Users\Kathi\AppData\Roaming\dll-files.com
2014-08-03 13:58 - 2014-08-15 20:19 - 00000000 ____D () C:\ProgramData\OxyuNhira
2014-08-03 13:58 - 2014-08-03 13:59 - 00000000 ____D () C:\ProgramData\EtilkOdmol
2014-07-30 20:35 - 2014-07-30 20:35 - 00000000 ____D () C:\Program Files\Mozilla Firefox(23)
2014-07-16 21:52 - 2014-07-16 21:52 - 00039424 _____ () C:\Users\Kathi\Desktop\Ablauf Kirche.xls

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-15 20:30 - 2014-08-15 17:39 - 00013560 _____ () C:\Users\Kathi\Downloads\FRST.txt
2014-08-15 20:30 - 2014-08-15 17:38 - 00000000 ____D () C:\FRST
2014-08-15 20:28 - 2009-08-11 21:16 - 00000422 ____H () C:\Windows\Tasks\User_Feed_Synchronization-{7030CE83-CC54-445E-964F-73E63606DF74}.job
2014-08-15 20:28 - 2009-07-21 20:26 - 01284970 _____ () C:\Windows\WindowsUpdate.log
2014-08-15 20:27 - 2014-08-15 20:00 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-15 20:27 - 2012-08-18 23:35 - 00001096 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-08-15 20:27 - 2009-08-11 02:35 - 00000000 ____D () C:\Users\Wichsis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite
2014-08-15 20:21 - 2011-12-28 18:30 - 00000000 ____D () C:\Users\Kathi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite
2014-08-15 20:20 - 2008-01-21 05:02 - 00744618 _____ () C:\Windows\PFRO.log
2014-08-15 20:20 - 2006-11-02 14:58 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-15 20:20 - 2006-11-02 14:45 - 00004784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-15 20:20 - 2006-11-02 14:45 - 00004784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-15 20:19 - 2014-08-03 13:58 - 00000000 ____D () C:\ProgramData\OxyuNhira
2014-08-15 20:19 - 2006-11-02 14:58 - 00032514 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-08-15 20:19 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\Speech
2014-08-15 19:59 - 2014-08-15 19:59 - 00000899 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-08-15 19:59 - 2014-08-15 19:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-08-15 19:59 - 2014-08-15 19:59 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-15 19:59 - 2014-08-15 19:59 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2014-08-15 19:58 - 2014-08-15 19:58 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Kathi\Downloads\mbam-setup-2.0.2.1012.exe
2014-08-15 19:46 - 2014-08-15 19:44 - 00000000 ____D () C:\AdwCleaner
2014-08-15 19:46 - 2013-11-02 23:21 - 00000846 _____ () C:\Users\Wichsis\Desktop\Search.lnk
2014-08-15 19:46 - 2012-08-18 23:35 - 00001100 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-08-15 19:42 - 2014-08-15 19:42 - 01356107 _____ () C:\Users\Kathi\Downloads\adwcleaner_3.305.exe
2014-08-15 19:27 - 2014-04-27 21:32 - 00000000 ___RD () C:\Users\Kathi\Dropbox
2014-08-15 19:23 - 2014-08-15 19:23 - 00017045 _____ () C:\ComboFix.txt
2014-08-15 19:23 - 2014-08-15 19:11 - 00000000 ____D () C:\ComboFix
2014-08-15 19:23 - 2014-08-15 19:10 - 00000000 ____D () C:\Qoobox
2014-08-15 19:23 - 2009-08-11 03:13 - 00000000 ____D () C:\Users\Wichsis\AppData\Local\Google
2014-08-15 19:23 - 2006-11-02 13:18 - 00000000 __RHD () C:\Users\Default
2014-08-15 19:23 - 2006-11-02 13:18 - 00000000 ___RD () C:\Users\Public
2014-08-15 19:21 - 2014-08-15 19:10 - 00000000 ____D () C:\Windows\erdnt
2014-08-15 19:21 - 2006-11-02 12:23 - 00000215 _____ () C:\Windows\system.ini
2014-08-15 19:07 - 2014-08-15 19:07 - 05571320 ____R (Swearware) C:\Users\Kathi\Desktop\ComboFix.exe
2014-08-15 18:45 - 2009-08-11 02:42 - 00106960 _____ () C:\Users\Wichsis\AppData\Local\GDIPFONTCACHEV1.DAT
2014-08-15 17:40 - 2014-08-15 17:40 - 00025127 _____ () C:\Users\Kathi\Desktop\FRST.txt
2014-08-15 17:40 - 2014-08-15 17:40 - 00022313 _____ () C:\Users\Kathi\Desktop\Addition.txt
2014-08-15 17:39 - 2014-08-15 17:39 - 00022313 _____ () C:\Users\Kathi\Downloads\Addition.txt
2014-08-15 17:37 - 2014-08-15 17:37 - 01092096 _____ (Farbar) C:\Users\Kathi\Downloads\FRST.exe
2014-08-15 17:34 - 2014-04-27 21:29 - 00000000 ____D () C:\Users\Kathi\AppData\Roaming\Dropbox
2014-08-15 17:08 - 2013-06-30 22:48 - 00000422 ____H () C:\Windows\Tasks\User_Feed_Synchronization-{DC24E08D-D800-4C9D-9DE2-5FF59CBB27E4}.job
2014-08-12 23:00 - 2014-06-16 11:05 - 00015080 _____ () C:\Users\Kathi\Desktop\Hochzeitsgeschenke.xlsx
2014-08-12 20:50 - 2014-08-12 20:43 - 151513264 _____ () C:\Users\Kathi\Downloads\avira_free_antivirus06_de(1).exe
2014-08-12 20:49 - 2014-08-12 20:42 - 151513264 _____ () C:\Users\Kathi\Downloads\avira_free_antivirus06_de.exe
2014-08-11 23:09 - 2014-06-16 23:09 - 00018357 _____ () C:\Users\Kathi\Desktop\malediven.xlsx
2014-08-11 23:06 - 2014-06-15 16:51 - 00000000 ____D () C:\Users\Kathi\Desktop\Hochzeit - Standesamt
2014-08-11 22:08 - 2014-02-16 18:46 - 00000000 ____D () C:\Users\Kathi\Desktop\Hochzeit
2014-08-10 14:08 - 2012-01-02 21:32 - 00000000 ____D () C:\Users\Kathi\Documents\Passwörter
2014-08-04 21:09 - 2014-08-04 21:09 - 00000000 ____D () C:\Users\Kathi\AppData\Roaming\dll-files.com
2014-08-04 21:06 - 2012-05-15 18:16 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-08-03 23:26 - 2011-12-28 18:30 - 00000000 ____D () C:\Users\Kathi
2014-08-03 23:26 - 2009-08-11 02:35 - 00000000 ____D () C:\Users\Wichsis
2014-08-03 23:26 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\spool
2014-08-03 23:26 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\Msdtc
2014-08-03 23:26 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\registration
2014-08-03 23:26 - 2006-11-02 12:22 - 37748736 _____ () C:\Windows\system32\config\software_previous
2014-08-03 23:26 - 2006-11-02 12:22 - 17301504 _____ () C:\Windows\system32\config\system_previous
2014-08-03 23:23 - 2006-11-02 12:22 - 42991616 _____ () C:\Windows\system32\config\components_previous
2014-08-03 23:23 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\sam_previous
2014-08-03 14:10 - 2012-10-23 18:37 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-08-03 14:10 - 2012-05-15 18:16 - 00000858 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-08-03 14:10 - 2012-05-15 18:16 - 00000846 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-08-03 13:59 - 2014-08-03 13:58 - 00000000 ____D () C:\ProgramData\EtilkOdmol
2014-08-03 00:01 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\security_previous
2014-08-03 00:01 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\default_previous
2014-07-30 20:35 - 2014-07-30 20:35 - 00000000 ____D () C:\Program Files\Mozilla Firefox(23)
2014-07-23 10:52 - 2011-12-28 16:24 - 00231584 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-07-22 21:04 - 2014-04-27 21:32 - 00000919 _____ () C:\Users\Kathi\Desktop\Dropbox.lnk
2014-07-22 21:04 - 2014-04-27 21:31 - 00000000 ____D () C:\Users\Kathi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-07-18 23:55 - 2006-11-02 12:33 - 01566246 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-07-18 19:59 - 2006-11-02 14:49 - 00149220 _____ () C:\Windows\setupact.log
2014-07-18 19:54 - 2012-09-18 20:12 - 00001963 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-07-17 18:58 - 2012-03-23 19:56 - 00000000 ____D () C:\ProgramData\tmp
2014-07-17 18:17 - 2009-08-11 02:37 - 00000000 ____D () C:\Users\Wichsis\AppData\Local\Adobe
2014-07-17 18:16 - 2012-09-18 20:11 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-07-17 18:16 - 2012-02-26 00:06 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-07-16 21:52 - 2014-07-16 21:52 - 00039424 _____ () C:\Users\Kathi\Desktop\Ablauf Kirche.xls
2014-07-16 17:50 - 2013-08-16 18:35 - 00000000 ____D () C:\Windows\system32\MRT
2014-07-16 17:42 - 2006-11-02 12:24 - 93585272 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe

Some content of TEMP:
====================
C:\Users\Kathi\AppData\Local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpq754wn.dll
C:\Users\Wichsis\AppData\Local\temp\catchme.dll
C:\Users\Wichsis\AppData\Local\temp\Quarantine.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-08-15 20:28

==================== End Of Log ============================
--- --- ---

--- --- ---

deeprybka 15.08.2014 19:40
Gut....

Versuchen wir den Fix nochmal (als Admin) ;)

Schritt 1

http://filepony.de/icon/frst.pnghttp://deeprybka.trojaner-board.de/b...st/frstfix.png

Drücke bitte die http://deeprybka.trojaner-board.de/b...ne/revo/w7.png + R Taste und schreibe notepad in das Ausführen Fenster.
Klicke auf OK und kopiere nun den Text aus der Codebox in das leere Textdokument:
Code:
2014-08-03 13:58 - 2014-08-15 20:19 - 00000000 ____D () C:\ProgramData\OxyuNhira
2014-08-03 13:58 - 2014-08-03 13:59 - 00000000 ____D () C:\ProgramData\EtilkOdmol
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Avira <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Avira <====== ATTENTION
EmptyTemp:
Speichere dieses bitte als Fixlist.txt in das Verzeichnis ab, in dem sich auch die FRST-Anwendung befindet.
  • Starte FRST und drücke auf den Fix-Button.
  • Das Tool erstellt eine "Fixlog.txt" -Datei.
  • Poste mir bitte deren Inhalt.

Der PC startet neu und dann machste bitte gleich nochmal nen Scan mit FRST. :)

Katharina123 15.08.2014 19:55
Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version:15-08-2014
Ran by Wichsis at 2014-08-15 20:45:57 Run:2
Running from C:\Users\Wichsis\Desktop
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
2014-08-03 13:58 - 2014-08-15 20:19 - 00000000 ____D () C:\ProgramData\OxyuNhira
2014-08-03 13:58 - 2014-08-03 13:59 - 00000000 ____D () C:\ProgramData\EtilkOdmol
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Avira <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Avira <====== ATTENTION
EmptyTemp:
*****************

C:\ProgramData\OxyuNhira => Moved successfully.
C:\ProgramData\EtilkOdmol => Moved successfully.
HKLM => Group Policy Restriction on software restored successfully.
HKLM => Group Policy Restriction on software restored successfully.
HKLM => Group Policy Restriction on software restored successfully.
EmptyTemp: => Removed 357 MB temporary data.


The system needed a reboot.

==== End of Fixlog ====
Und hier das Scan-Logfile:


FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:15-08-2014
Ran by Wichsis (administrator) on KATHARINA on 15-08-2014 20:54:13
Running from C:\Users\Wichsis\Desktop
Platform: Microsoft® Windows Vista™ Home Basic  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 8
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Microsoft Corporation) C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe
() C:\Program Files\CyberLink\Shared files\RichVideo.exe
(Skype Technologies S.A.) C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbam.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(CyberLink) C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe
(CyberLink Corp.) C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Adobe Systems Incorporated) C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe
(Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Fred's Software) C:\Program Files\PrintKey2000\Printkey2000.exe
(SAMSUNG Electronics co., LTD.) C:\Program Files\Samsung\EBM\EasyBatteryMgr3.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe
() C:\Program Files\Samsung\Samsung Update Plus\SUPBackGround.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Samsung Magic Doctor\MagicDoctorKbdHk.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avira_de____fm.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKU\S-1-5-21-3121953689-2843351358-1462341086-1000\...\Run: [KiesHelper] => C:\Program Files\Samsung\Kies\KiesHelper.exe [943504 2012-02-03] (Samsung)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Printkey2000.lnk
ShortcutTarget: Printkey2000.lnk -> C:\Program Files\PrintKey2000\Printkey2000.exe (Fred's Software)
Startup: C:\Users\Kathi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=SMSN&bmod=SMSN
BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO: Google Toolbar Notifier BHO -> {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} -> C:\Program Files\Google\GoogleToolbarNotifier\5.7.9012.1008\swg.dll (Google Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {6E718D87-6909-4FCE-92D4-EDCB2F725727} hxxp://navigram.com/engine/v1026/Navigram.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Wichsis\AppData\Roaming\Mozilla\Firefox\Profiles\an2mua9h.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.7.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.7.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2012-10-23]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2011-12-28]
FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2 [2012-08-30]
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2
FF HKCU\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files\Common Files\DVDVideoSoft\plugins\ff
FF Extension: Download videos and MP3s from YouTube - C:\Program Files\Common Files\DVDVideoSoft\plugins\ff [2013-11-02]

Chrome:
=======
CHR HKLM\...\Chrome\Extension: [aaaaacalgebmfelllfiaoknifldpngjh] - C:\ProgramData\AskPartnerNetwork\Toolbar\AVIRA-V7\CRX\ToolbarCR.crx []

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-08-15] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-08-15] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1021008 2014-08-15] (Avira Operations GmbH & Co. KG)
R2 MBAMScheduler; C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
S4 MSSQLServerADHelper; C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [45272 2005-10-14] (Microsoft Corporation)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [43520 2008-02-28] (Hewlett-Packard) [File not signed]
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [53248 2008-02-28] (Hewlett-Packard) [File not signed]
R2 RichVideo; C:\Program Files\CyberLink\Shared files\RichVideo.exe [247152 2008-11-25] ()
R2 Skype C2C Service; C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [3064000 2012-10-02] (Skype Technologies S.A.)
S2 APNMCP; "C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [97648 2014-07-03] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-06-05] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-26] (Avira Operations GmbH & Co. KG)
R2 KMDFMEMIO; C:\Windows\System32\DRIVERS\kmdfmemio.sys [13312 2006-11-14] (SAMSUNG ELECTRONICS CO., LTD.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-05-12] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [110296 2014-08-15] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-05-12] (Malwarebytes Corporation)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-08-05] (Avira GmbH)
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-21] (Microsoft Corporation)
S3 catchme; \??\C:\Users\Wichsis\AppData\Local\Temp\catchme.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-15 20:54 - 2014-08-15 20:54 - 00012926 _____ () C:\Users\Wichsis\Desktop\FRST.txt
2014-08-15 20:00 - 2014-08-15 20:51 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-15 19:59 - 2014-08-15 19:59 - 00000899 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-08-15 19:59 - 2014-08-15 19:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-08-15 19:59 - 2014-08-15 19:59 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-15 19:59 - 2014-08-15 19:59 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2014-08-15 19:59 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-08-15 19:59 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-08-15 19:59 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-08-15 19:58 - 2014-08-15 19:58 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Kathi\Downloads\mbam-setup-2.0.2.1012.exe
2014-08-15 19:46 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\system32\sqlite3.dll
2014-08-15 19:44 - 2014-08-15 19:46 - 00000000 ____D () C:\AdwCleaner
2014-08-15 19:42 - 2014-08-15 19:42 - 01356107 _____ () C:\Users\Kathi\Downloads\adwcleaner_3.305.exe
2014-08-15 19:23 - 2014-08-15 19:23 - 00017045 _____ () C:\ComboFix.txt
2014-08-15 19:11 - 2014-08-15 19:23 - 00000000 ____D () C:\ComboFix
2014-08-15 19:11 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-08-15 19:11 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-08-15 19:11 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-08-15 19:11 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-08-15 19:11 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-08-15 19:11 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-08-15 19:11 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-08-15 19:11 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-08-15 19:10 - 2014-08-15 19:23 - 00000000 ____D () C:\Qoobox
2014-08-15 19:10 - 2014-08-15 19:21 - 00000000 ____D () C:\Windows\erdnt
2014-08-15 19:07 - 2014-08-15 19:07 - 05571320 ____R (Swearware) C:\Users\Kathi\Desktop\ComboFix.exe
2014-08-15 17:40 - 2014-08-15 17:40 - 00025127 _____ () C:\Users\Kathi\Desktop\FRST.txt
2014-08-15 17:40 - 2014-08-15 17:40 - 00022313 _____ () C:\Users\Kathi\Desktop\Addition.txt
2014-08-15 17:39 - 2014-08-15 20:30 - 00026282 _____ () C:\Users\Kathi\Downloads\FRST.txt
2014-08-15 17:39 - 2014-08-15 17:39 - 00022313 _____ () C:\Users\Kathi\Downloads\Addition.txt
2014-08-15 17:38 - 2014-08-15 20:54 - 00000000 ____D () C:\FRST
2014-08-15 17:37 - 2014-08-15 17:37 - 01092096 _____ (Farbar) C:\Users\Wichsis\Desktop\FRST.exe
2014-08-12 20:43 - 2014-08-12 20:50 - 151513264 _____ () C:\Users\Kathi\Downloads\avira_free_antivirus06_de(1).exe
2014-08-12 20:42 - 2014-08-12 20:49 - 151513264 _____ () C:\Users\Kathi\Downloads\avira_free_antivirus06_de.exe
2014-08-04 21:09 - 2014-08-04 21:09 - 00000000 ____D () C:\Users\Kathi\AppData\Roaming\dll-files.com
2014-07-30 20:35 - 2014-07-30 20:35 - 00000000 ____D () C:\Program Files\Mozilla Firefox(23)
2014-07-16 21:52 - 2014-07-16 21:52 - 00039424 _____ () C:\Users\Kathi\Desktop\Ablauf Kirche.xls

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-15 20:54 - 2014-08-15 20:54 - 00012926 _____ () C:\Users\Wichsis\Desktop\FRST.txt
2014-08-15 20:54 - 2014-08-15 17:38 - 00000000 ____D () C:\FRST
2014-08-15 20:53 - 2009-08-11 21:16 - 00000422 ____H () C:\Windows\Tasks\User_Feed_Synchronization-{7030CE83-CC54-445E-964F-73E63606DF74}.job
2014-08-15 20:53 - 2009-07-21 20:26 - 01294441 _____ () C:\Windows\WindowsUpdate.log
2014-08-15 20:51 - 2014-08-15 20:00 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-15 20:51 - 2012-08-18 23:35 - 00001096 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-08-15 20:51 - 2009-08-11 02:35 - 00000000 ____D () C:\Users\Wichsis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite
2014-08-15 20:49 - 2011-12-28 18:30 - 00000000 ____D () C:\Users\Kathi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite
2014-08-15 20:48 - 2008-01-21 05:02 - 00745920 _____ () C:\Windows\PFRO.log
2014-08-15 20:48 - 2006-11-02 14:58 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-15 20:48 - 2006-11-02 14:45 - 00004784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-15 20:48 - 2006-11-02 14:45 - 00004784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-15 20:47 - 2006-11-02 14:58 - 00032514 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-08-15 20:46 - 2012-08-18 23:35 - 00001100 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-08-15 20:30 - 2014-08-15 17:39 - 00026282 _____ () C:\Users\Kathi\Downloads\FRST.txt
2014-08-15 20:19 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\Speech
2014-08-15 19:59 - 2014-08-15 19:59 - 00000899 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-08-15 19:59 - 2014-08-15 19:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-08-15 19:59 - 2014-08-15 19:59 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-15 19:59 - 2014-08-15 19:59 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2014-08-15 19:58 - 2014-08-15 19:58 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Kathi\Downloads\mbam-setup-2.0.2.1012.exe
2014-08-15 19:46 - 2014-08-15 19:44 - 00000000 ____D () C:\AdwCleaner
2014-08-15 19:46 - 2013-11-02 23:21 - 00000846 _____ () C:\Users\Wichsis\Desktop\Search.lnk
2014-08-15 19:42 - 2014-08-15 19:42 - 01356107 _____ () C:\Users\Kathi\Downloads\adwcleaner_3.305.exe
2014-08-15 19:27 - 2014-04-27 21:32 - 00000000 ___RD () C:\Users\Kathi\Dropbox
2014-08-15 19:23 - 2014-08-15 19:23 - 00017045 _____ () C:\ComboFix.txt
2014-08-15 19:23 - 2014-08-15 19:11 - 00000000 ____D () C:\ComboFix
2014-08-15 19:23 - 2014-08-15 19:10 - 00000000 ____D () C:\Qoobox
2014-08-15 19:23 - 2009-08-11 03:13 - 00000000 ____D () C:\Users\Wichsis\AppData\Local\Google
2014-08-15 19:23 - 2006-11-02 13:18 - 00000000 __RHD () C:\Users\Default
2014-08-15 19:23 - 2006-11-02 13:18 - 00000000 ___RD () C:\Users\Public
2014-08-15 19:21 - 2014-08-15 19:10 - 00000000 ____D () C:\Windows\erdnt
2014-08-15 19:21 - 2006-11-02 12:23 - 00000215 _____ () C:\Windows\system.ini
2014-08-15 19:07 - 2014-08-15 19:07 - 05571320 ____R (Swearware) C:\Users\Kathi\Desktop\ComboFix.exe
2014-08-15 18:45 - 2009-08-11 02:42 - 00106960 _____ () C:\Users\Wichsis\AppData\Local\GDIPFONTCACHEV1.DAT
2014-08-15 17:40 - 2014-08-15 17:40 - 00025127 _____ () C:\Users\Kathi\Desktop\FRST.txt
2014-08-15 17:40 - 2014-08-15 17:40 - 00022313 _____ () C:\Users\Kathi\Desktop\Addition.txt
2014-08-15 17:39 - 2014-08-15 17:39 - 00022313 _____ () C:\Users\Kathi\Downloads\Addition.txt
2014-08-15 17:37 - 2014-08-15 17:37 - 01092096 _____ (Farbar) C:\Users\Wichsis\Desktop\FRST.exe
2014-08-15 17:34 - 2014-04-27 21:29 - 00000000 ____D () C:\Users\Kathi\AppData\Roaming\Dropbox
2014-08-15 17:08 - 2013-06-30 22:48 - 00000422 ____H () C:\Windows\Tasks\User_Feed_Synchronization-{DC24E08D-D800-4C9D-9DE2-5FF59CBB27E4}.job
2014-08-12 23:00 - 2014-06-16 11:05 - 00015080 _____ () C:\Users\Kathi\Desktop\Hochzeitsgeschenke.xlsx
2014-08-12 20:50 - 2014-08-12 20:43 - 151513264 _____ () C:\Users\Kathi\Downloads\avira_free_antivirus06_de(1).exe
2014-08-12 20:49 - 2014-08-12 20:42 - 151513264 _____ () C:\Users\Kathi\Downloads\avira_free_antivirus06_de.exe
2014-08-11 23:09 - 2014-06-16 23:09 - 00018357 _____ () C:\Users\Kathi\Desktop\malediven.xlsx
2014-08-11 23:06 - 2014-06-15 16:51 - 00000000 ____D () C:\Users\Kathi\Desktop\Hochzeit - Standesamt
2014-08-11 22:08 - 2014-02-16 18:46 - 00000000 ____D () C:\Users\Kathi\Desktop\Hochzeit
2014-08-10 14:08 - 2012-01-02 21:32 - 00000000 ____D () C:\Users\Kathi\Documents\Passwörter
2014-08-04 21:09 - 2014-08-04 21:09 - 00000000 ____D () C:\Users\Kathi\AppData\Roaming\dll-files.com
2014-08-04 21:06 - 2012-05-15 18:16 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-08-03 23:26 - 2011-12-28 18:30 - 00000000 ____D () C:\Users\Kathi
2014-08-03 23:26 - 2009-08-11 02:35 - 00000000 ____D () C:\Users\Wichsis
2014-08-03 23:26 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\spool
2014-08-03 23:26 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\Msdtc
2014-08-03 23:26 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\registration
2014-08-03 23:26 - 2006-11-02 12:22 - 37748736 _____ () C:\Windows\system32\config\software_previous
2014-08-03 23:26 - 2006-11-02 12:22 - 17301504 _____ () C:\Windows\system32\config\system_previous
2014-08-03 23:23 - 2006-11-02 12:22 - 42991616 _____ () C:\Windows\system32\config\components_previous
2014-08-03 23:23 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\sam_previous
2014-08-03 14:10 - 2012-10-23 18:37 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-08-03 14:10 - 2012-05-15 18:16 - 00000858 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-08-03 14:10 - 2012-05-15 18:16 - 00000846 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-08-03 00:01 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\security_previous
2014-08-03 00:01 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\default_previous
2014-07-30 20:35 - 2014-07-30 20:35 - 00000000 ____D () C:\Program Files\Mozilla Firefox(23)
2014-07-23 10:52 - 2011-12-28 16:24 - 00231584 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-07-22 21:04 - 2014-04-27 21:32 - 00000919 _____ () C:\Users\Kathi\Desktop\Dropbox.lnk
2014-07-22 21:04 - 2014-04-27 21:31 - 00000000 ____D () C:\Users\Kathi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-07-18 23:55 - 2006-11-02 12:33 - 01566246 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-07-18 19:59 - 2006-11-02 14:49 - 00149220 _____ () C:\Windows\setupact.log
2014-07-18 19:54 - 2012-09-18 20:12 - 00001963 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-07-17 18:58 - 2012-03-23 19:56 - 00000000 ____D () C:\ProgramData\tmp
2014-07-17 18:17 - 2009-08-11 02:37 - 00000000 ____D () C:\Users\Wichsis\AppData\Local\Adobe
2014-07-17 18:16 - 2012-09-18 20:11 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-07-17 18:16 - 2012-02-26 00:06 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-07-16 21:52 - 2014-07-16 21:52 - 00039424 _____ () C:\Users\Kathi\Desktop\Ablauf Kirche.xls
2014-07-16 17:50 - 2013-08-16 18:35 - 00000000 ____D () C:\Windows\system32\MRT
2014-07-16 17:42 - 2006-11-02 12:24 - 93585272 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe

Some content of TEMP:
====================
C:\Users\Wichsis\AppData\Local\temp\avgnt.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-08-15 20:28

==================== End Of Log ============================
--- --- ---

--- --- ---

deeprybka 15.08.2014 19:59
Ja, ja das hast mich vorhin mit dem Benutzerkonto reingelegt was... ;)

So, jetzt noch etwas was den Abend versüßt... :D

(Der Scan dauert laaaang!)



Schritt 1

ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset



Schritt 2
Downloade dir bitte Farbar Service Scanner Farbar Service Scanner
  • Starte das Tool mit Doppelklick auf die FSS.exe
  • Gehe sicher, dass folgende Optionen angehakt sind.
    • Internet Services
    • Windows Firewall
    • System Restore
    • Security Center/Action Center
    • Windows Update
    • Windows Defender
    • Other Services
  • Klicke auf Scan.
  • Wenn das Tool fertig ist, wird es eine FSS.txt in dem Verzeichnis erstellen, wo das Tool gelaufen ist.

Poste bitte den Inhalt hier.



Katharina123 15.08.2014 21:07
Ich habe gerade gemerkt, dass ich vergessen hatte, Avira und die Firewall zu deaktivieren.
Das habe ich jetzt nachgeholt. Bislang sind 37 % gescannt und es wurden auch schon 77 infizierte Dateien gefunden :-(

Soll ich das jetzt weiterlaufen lassen oder nochmal von vorne, da die ganze Zeit Avira und Firewall aktiv waren?

deeprybka 15.08.2014 21:12
Nö, lass einfach laufen und warten wir das Endergebnis ab. :)

Katharina123 15.08.2014 22:39
So, Scan ist endlich fertig:

Code:
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=9e1c24079a9ee24e8c4b7e07821718b5
# engine=19682
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-08-15 09:35:07
# local_time=2014-08-15 11:35:07 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.0.6001 NT Service Pack 1
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777213 100 100 22623 152690685 0 0
# compatibility_mode_1=''
# compatibility_mode=5892 16776574 100 100 14856 245671279 0 0
# scanned=197943
# found=80
# cleaned=0
# scan_time=8560
sh=39727BCF2543BE1E1B7F66A26AD88991B5E87A9E ft=1 fh=411585b0142f5330 vn="Variante von MSIL/Toolbar.Linkury.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\BrowserHelper.exe.vir"
sh=178B194FF8430AEA92A740632C0CAF21D62BC6F0 ft=1 fh=60abfaf896ba0cc6 vn="Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\Interop.SHDocVw.dll.vir"
sh=22C537EC97EDD0452B9CA913361B93D32D136B2A ft=1 fh=c7ccef8b3e1535b6 vn="Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\MACTrackBarLib.dll.vir"
sh=ECD92EE75EB0DBE303A9616919D6BA78532345D7 ft=1 fh=c76944c94b8e8b12 vn="Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\NDde.dll.vir"
sh=B1BDCD934E1205D38F86B410E55BF844F6CB2B6E ft=1 fh=6cbfa12425a91bba vn="Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\Newtonsoft.Json.dll.vir"
sh=B290F6BFC300317A636DF735DCCE0F5B47F0E06B ft=1 fh=c19b82ebeeb1cdc5 vn="Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\sgml.dll.vir"
sh=F35805044835A3E1DE6944BB17DBD16B652177E3 ft=1 fh=1f283a283cbd8560 vn="Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\sidb.dll.vir"
sh=82182D5DE08E6AC6C13289261BE653FE4E851702 ft=1 fh=46468c4ac5af0536 vn="Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\siem.dll.vir"
sh=32531A43D401E017E6EF63407BBDB1EC4F4FC365 ft=1 fh=e07bd36d680eda20 vn="Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\sipb.dll.vir"
sh=6DF917718FE1071EC8BBFC4C92A3FEE4E3A3A7CA ft=1 fh=60b6e7071c52c932 vn="Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\sismlp.dll.vir"
sh=4173757B5AD0AE078DDF9FA5EE625388539ECE8C ft=1 fh=b1a7f49b5e1dc8de vn="Variante von Win32/Toolbar.Linkury.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\Smartbar.exe.vir"
sh=421177018DC508910FD25232D75588AAAA6160C0 ft=1 fh=222544237f99f476 vn="Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\Smartbar.GUI.Controls.dll.vir"
sh=F35452FECE5F75D805DA85D418F56445C7D8AB97 ft=1 fh=ec608d50e1da1f4e vn="Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\Smartbar.GUI.Docking.dll.vir"
sh=0C1CCE5A2086396F8B8FEB6D65CF3826BFB22C62 ft=1 fh=c665906c5f48e919 vn="Variante von Win32/Toolbar.Linkury.F evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\Smartbar.GUI.MainClient.dll.vir"
sh=FA509CB75784F32961516AF5041553E50FA95099 ft=1 fh=a90ff93b978b0e39 vn="Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.BusinessEntities.dll.vir"
sh=D827791B1958BC575AFDDF7A17051443AFD16520 ft=1 fh=ac96aebe5cdf07f2 vn="Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Core.dll.vir"
sh=1FAB1254447A648316ECD5B37ED4F3A8C44A415D ft=1 fh=aead5c34f367dfe2 vn="Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Plugins.ChromeLocalPlugin.dll.vir"
sh=A91782F092DAEDEAE6112BEFD2A3BECA4E8A0900 ft=1 fh=a861f7b9c1c3e6d7 vn="Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Plugins.FireFoxLocalPlugin.dll.vir"
sh=68D88B3FA4D17934683A782746E4193EF4C9A546 ft=1 fh=8d55866a6ceb2390 vn="Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Plugins.InternetExplorerLocalPlugin.dll.vir"
sh=B4E92970F1DB77AF8409EB37392A541E1EDB7793 ft=1 fh=ebbc87e2b6c0f8e6 vn="Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Utilities.dll.vir"
sh=6F1707B81E212A4A3CAA6407760560C9D1CFCB26 ft=1 fh=835ab5d1fe2341ed vn="Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\Smartbar.Personalization.Common.dll.vir"
sh=5D7F1488E6431B4BCDB1ED19085D5D3E16AAE572 ft=1 fh=f0ca28abe7a9bd56 vn="Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\Smartbar.Resources.HistoryAndStatsWrapper.dll.vir"
sh=30920D9A63D5C575259E5479D0935292D4334CB2 ft=1 fh=9996e5bcf9fafe69 vn="Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\Smartbar.Resources.LanguageSettings.dll.vir"
sh=8AD6314A382AC53DF589443B1BFC3AF0595E5CCD ft=1 fh=912365ab03627dd6 vn="Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\Smartbar.Resources.SocialNetsSharer.dll.vir"
sh=CCC70802F87515492D23F5085A252F223D0C01BE ft=1 fh=8769520ae760c4b6 vn="Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\Smartbar.Resources.SocialNetsSharer.XmlSerializers.dll.vir"
sh=748425711102D7B6636D099A675E6500FE5D6E40 ft=1 fh=d644c2cb2e98a284 vn="Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\Smartbar.Resources.Translations.dll.vir"
sh=ED2E4711DE0C60F69862EEAA2300400611BDEA31 ft=1 fh=cae2c9b4172869cb vn="Variante von MSIL/Toolbar.Linkury.E evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\SmartbarInternetExplorerBHO.dll.vir"
sh=ED2E4711DE0C60F69862EEAA2300400611BDEA31 ft=1 fh=cae2c9b4172869cb vn="Variante von MSIL/Toolbar.Linkury.E evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\SmartbarInternetExplorerBHO2.dll.vir"
sh=F2C7700FDE071C3EC01BFB8969A1134C7874072A ft=1 fh=bbd2deaf5deda993 vn="Variante von MSIL/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\SmartbarInternetExplorerExtension.dll.vir"
sh=F2C7700FDE071C3EC01BFB8969A1134C7874072A ft=1 fh=bbd2deaf5deda993 vn="Variante von MSIL/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\SmartbarInternetExplorerExtension2.dll.vir"
sh=44E10326ECCAEA9AD009E82120FF034EF8C77F12 ft=1 fh=93946633b3131719 vn="Variante von MSIL/Toolbar.Linkury.E evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\SmartbarVersionsHelper.exe.vir"
sh=3CFC911F176C10929E3C7C88B7513A1461F1F5F5 ft=1 fh=d6f0f22ae006d3c1 vn="Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\spbe.dll.vir"
sh=C883089E0ABA41D817653DB5EED4D9229AD3A8B3 ft=1 fh=2053d7cbaf8433c2 vn="Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\spbl.dll.vir"
sh=72AE44754322D5A535B43163E4ECD1BF7E109E27 ft=1 fh=b29c4c37c0d68050 vn="Variante von MSIL/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\sppsm.dll.vir"
sh=532EF8421E35C6E269653265516276CC81295245 ft=1 fh=5643b33af54b8c22 vn="Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\spsm.dll.vir"
sh=136C16076EA03EAD9C78E08C19B55F61EDA74E19 ft=1 fh=bab1424d43ff780b vn="Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\spusm.dll.vir"
sh=7A13EC73E546D993600EB9F3B6FD87E9384415DD ft=1 fh=92fef06e16fd3c15 vn="Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\srau.dll.vir"
sh=6A79985AB2F1EC937BEC900AFEF7E0CA4FFACA71 ft=1 fh=ddda115a96222bf8 vn="Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\srbhu.dll.vir"
sh=D652D132A9A85CC1CFA002FF66935A772A3329C6 ft=1 fh=8d4647e31ce873a6 vn="Variante von MSIL/Toolbar.Linkury.C evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\srbs.dll.vir"
sh=1426CB9C92905EC6E1C5F15A456F2FBB2892BCE9 ft=1 fh=6cbe46cd78372847 vn="Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\srgu.dll.vir"
sh=18ABC9D2A3168BF03FE01CD47655B3FDF469937A ft=1 fh=1df00fd2d193a4ac vn="Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\srns.dll.vir"
sh=8A8BA71C825B3B3D90225AEA26187D994CCCDADB ft=1 fh=f8e9be590da8a9a1 vn="Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\srpdm.dll.vir"
sh=E5B3BE3A74C512458E1E50DC801450C4C15338BA ft=1 fh=2e41ec69aaa76999 vn="Variante von MSIL/Toolbar.Linkury.F evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\srprl.dll.vir"
sh=2A9EEE08DB86A5282EA2CCA2B29263D2956EF5A3 ft=1 fh=7d32b7fbd64cf212 vn="Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\srpu.dll.vir"
sh=9340CF96ADC8B14CE05B0D2CB6AACC1289573403 ft=1 fh=dc848053d71a874d vn="Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\srsbs.dll.vir"
sh=76A60601FEF95544FECDCD7C6BB2E5F5F292664C ft=1 fh=7cb664700f2fcbdb vn="Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\srsbsau.dll.vir"
sh=2C94D0D44301170FA3A2C13E33F969B30B1E1A3F ft=1 fh=a016ca3775f977f3 vn="Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\srsl.dll.vir"
sh=D07A834F60CB3204DA4FFA4FE97A32BC5DDFE431 ft=1 fh=234665e1bd1d7f33 vn="Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\sruhs.dll.vir"
sh=2962DDFC7FEC53BD6415A4B6EB93E8172B5D40DE ft=1 fh=11594c6570341dc1 vn="Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\srus.dll.vir"
sh=C49DBA6C49DEE0CD679A557D2307E9FE9E71C74C ft=1 fh=c8c7e0272019bbbf vn="Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\srut.dll.vir"
sh=1A63D5D4F7D46FBBC9E6011C2CB03BDC3E5FE331 ft=1 fh=1b3cecf6924a8b70 vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\amfclgbdpgndipgoegfpkkgobahigbcl\GoogleChromeRemotePlugin.dll.vir"
sh=C993CF7F4BC36C7C19CCE1BF1D86D91F82B6372C ft=1 fh=517d2939207d7e1d vn="Variante von MSIL/Toolbar.Linkury.E evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\ar\Smartbar.Resources.LanguageSettings.resources.dll.vir"
sh=9E06E8B8D08B1C853672CC55743238CA4E963E7A ft=1 fh=a2229e8447c2427c vn="Variante von MSIL/Toolbar.Linkury.E evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\de\Smartbar.Resources.LanguageSettings.resources.dll.vir"
sh=B520137D0FC3FD7DD27B34F89C0506C9A79E15B1 ft=1 fh=aaab7aae3301a073 vn="Variante von MSIL/Toolbar.Linkury.E evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\es\Smartbar.Resources.LanguageSettings.resources.dll.vir"
sh=8A88D0B028B11CF4602FA97B2280CDB7B585C903 ft=1 fh=e8a3b21a476355c0 vn="Variante von MSIL/Toolbar.Linkury.E evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\fr\Smartbar.Resources.LanguageSettings.resources.dll.vir"
sh=847AA4FEECD8AD829B6BC9909F5FFD3C449B040F ft=1 fh=4605ab81e68636fb vn="Variante von MSIL/Toolbar.Linkury.E evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\he\Smartbar.Resources.LanguageSettings.resources.dll.vir"
sh=C7E054C7BA58AE2D703DB29C52346A3ED84FEF57 ft=1 fh=53532950b9749a4f vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_20.dll.vir"
sh=C546BA3CA78F93EB65DCCEA191BC40B9F940E2EA ft=1 fh=6fd80785d353cf5d vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_21.dll.vir"
sh=7C15DA5A80F24F0383C992CFB03CF68E95A464B1 ft=1 fh=be427aaf403ae2ff vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_22.dll.vir"
sh=95544372D9D68E8AFAE5E9DA8B07C14CE5406ABB ft=1 fh=dd489ec711c15129 vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_23.dll.vir"
sh=BA8871127FB23B24A8963B6A5992DED58259E590 ft=1 fh=65df87dcc97c6ea8 vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_24.dll.vir"
sh=6AEDDB65A3AD9C611CE4C7146EFDA4E328063FE8 ft=1 fh=9800be3f58c07b56 vn="Variante von MSIL/Toolbar.Linkury.E evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\it\Smartbar.Resources.LanguageSettings.resources.dll.vir"
sh=89D4CEB9035E109B5DE308DDED95F3027021115C ft=1 fh=aa49b718abecd5d5 vn="Variante von MSIL/Toolbar.Linkury.E evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\nl\Smartbar.Resources.LanguageSettings.resources.dll.vir"
sh=50C22509DAF877DEC72B6A3B4A3FA684CA94AB09 ft=1 fh=e38f9687bbf0fcca vn="Variante von MSIL/Toolbar.Linkury.E evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\pt\Smartbar.Resources.LanguageSettings.resources.dll.vir"
sh=4777730E7C0D80EC73D29DAED237361F37072F34 ft=1 fh=562c36f4d6d43d36 vn="Variante von MSIL/Toolbar.Linkury.E evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\ru\Smartbar.Resources.LanguageSettings.resources.dll.vir"
sh=B81312E3760DCF165D60DC5CCEBC9F15BA94853E ft=1 fh=0c27864f980eaf85 vn="Variante von MSIL/Toolbar.Linkury.E evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Application\tr\Smartbar.Resources.LanguageSettings.resources.dll.vir"
sh=57B78F03D8CF46E5335DBE56139F3205C706F54B ft=1 fh=685593c0a7537a92 vn="Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Common\ServicesPlugins\Smartbar.Personalization.ServicesPlugins.DMP.dll.vir"
sh=92E33636D6B7CC58AE96552F2C7237C4FE469A3A ft=1 fh=c3fffdd6ecda1569 vn="Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Common\ServicesPlugins\Smartbar.Personalization.ServicesPlugins.MessengerPlugin.dll.vir"
sh=8C2B527B23FE522346FD91424ADFF664E7D298CA ft=1 fh=026a1cd1f9e48cf4 vn="Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Common\ServicesPlugins\Smartbar.Personalization.ServicesPlugins.NotepadPlugin.dll.vir"
sh=E6A71F458899B102A18A3E7F15789936F60FDC0E ft=1 fh=ca834528842c9f9b vn="Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Common\ServicesPlugins\Smartbar.Personalization.ServicesPlugins.ScreenCapturePlugin.dll.vir"
sh=0CD4706D601AA5FBCCE9D5D4BDB4592F1E74AE9B ft=1 fh=bbf30ebdcfbdbe18 vn="Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Common\ServicesPlugins\Smartbar.Personalization.ServicesPlugins.WeatherPlugin.dll.vir"
sh=E811F3F39F9E1E1DFC06F050B9B60238D4ECAAC6 ft=1 fh=85499a6d347f9321 vn="Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Common\ServicesPlugins\Smartbar.Personalization.ServicesPlugins.WordPlugin.dll.vir"
sh=86A4E2B12D4B3D5C33ABEA625226F1B1EEF516BE ft=1 fh=88b22f79132772dd vn="Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Common\ServicesPlugins\Smartbar.Personalization.ServicesPlugins.YoutubeDownloadPlugin.dll.vir"
sh=8F2A6FA742389FB96C1DB38991164BE1928F837C ft=1 fh=6d2ea6c08c28b012 vn="Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Local\Smartbar\Common\ServicesPlugins\spup.dll.vir"
sh=98FCF260C8C676E33DA77173AB222BA6B0142116 ft=1 fh=e0b1efaf129489ac vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Roaming\OpenCandy\29D33B1BBA8049B9A1DA853010FBA063\zafwSetupWeb_131_211_000.exe.vir"
sh=29E42A61A6BE387A24C035693D509D873C02D916 ft=1 fh=b326822ef8b4edbf vn="Win32/SpeedUpMyPC.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Roaming\OpenCandy\74D64134126A45C685E1C9732F30B803\speedupmypcDE.exe.vir"
sh=47E8773722C91DD2792ED05E79910C87DA832874 ft=1 fh=24f1ec3461bda9be vn="Variante von Win32/Toolbar.Linkury.E evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Wichsis\AppData\Roaming\OpenCandy\CDF933C9E6B74BC8B9D13D983F1C7447\Installer.exe.vir"
sh=ED705943E61D07143E332403421E303B72496029 ft=1 fh=02a6bc1dbd5b0b8e vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Kathi\Desktop\FreeYouTubeToMP3Converter_3.11.20.exe"
sh=25467DF975CC3DDEC27DE2E53399DB01CA5F05CE ft=1 fh=859963bf416007ff vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Kathi\Downloads\PrintKey 2000 - CHIP-Downloader.exe"
sh=178B194FF8430AEA92A740632C0CAF21D62BC6F0 ft=1 fh=60abfaf896ba0cc6 vn="Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\assembly\GAC_MSIL\Interop.SHDocVw\1.1.0.0__84542ff99aed6a4d\Interop.SHDocVw.dll"

deeprybka 15.08.2014 22:42
Sehr gut...und das Service-Scanner-Log noch bitte.... :)

Katharina123 15.08.2014 22:43
Code:
Farbar Service Scanner Version: 21-07-2014
Ran by Wichsis (administrator) on 15-08-2014 at 23:42:43
Running from "c:\Users\Wichsis\Downloads"
Microsoft® Windows Vista™ Home Basic  Service Pack 1 (X86)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Attempt to access Google IP returned error. Google IP is unreachable
Google.com is accessible.
Attempt to access Yahoo.com returned error: Yahoo.com is unreachable


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Disabled Policy:
========================


Security Center:
============


Windows Update:
============

Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is set to Demand. The default start type is Auto.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.


Other Services:
==============


File Check:
========
C:\Windows\system32\nsisvc.dll => File is digitally signed
C:\Windows\system32\Drivers\nsiproxy.sys => File is digitally signed
C:\Windows\system32\dhcpcsvc.dll => File is digitally signed
C:\Windows\system32\Drivers\afd.sys => File is digitally signed
C:\Windows\system32\Drivers\tdx.sys => File is digitally signed
C:\Windows\system32\Drivers\tcpip.sys => File is digitally signed
C:\Windows\system32\dnsrslvr.dll => File is digitally signed
C:\Windows\system32\mpssvc.dll => File is digitally signed
C:\Windows\system32\bfe.dll => File is digitally signed
C:\Windows\system32\Drivers\mpsdrv.sys => File is digitally signed
C:\Windows\system32\SDRSVC.dll => File is digitally signed
C:\Windows\system32\vssvc.exe => File is digitally signed
C:\Windows\system32\wscsvc.dll => File is digitally signed
C:\Windows\system32\wbem\WMIsvc.dll => File is digitally signed
C:\Windows\system32\wuaueng.dll => File is digitally signed
C:\Windows\system32\qmgr.dll => File is digitally signed
C:\Windows\system32\es.dll => File is digitally signed
C:\Windows\system32\cryptsvc.dll => File is digitally signed
C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed
C:\Windows\system32\ipnathlp.dll => File is digitally signed
C:\Windows\system32\iphlpsvc.dll => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed


**** End of log ****

deeprybka 15.08.2014 22:51
Jo, das schaut auch gut aus.
Dann machen wir uns mal an die Updates:

Code:
Java 7 Update 7
Das bitte mal deinstallieren.


Das installieren:
Download Windows Server 2008 Service Pack 2 und Windows Vista Service Pack 2 - Five Language Standalone (KB948465) from Official Microsoft Download Center

Danach das machen (also alles an Updates saugen was geht)
Windows Vista aktualisieren - Teil 4: Manuelle Updateinstallation

Und wenn alles erledigt hast: :)

Schritt 1

http://filepony.de/icon/frst.pnghttp://deeprybka.trojaner-board.de/b...t/frstscan.png

Bitte starte FRST erneut, markiere auch die checkbox http://deeprybka.trojaner-board.de/b...t/addition.pngund drücke auf Scan.
Bitte poste mir den Inhalt der beiden Logs die erstellt werden.

Katharina123 15.08.2014 22:58
Java habe ich deinstalliert.

Die Windows-Service-exe lässt sich leider nicht ausführen.
Es kommt die Fehlermeldung "Windows6.0-KB948465-X86.exe ist keine zulässige Win32-Anwendung.

deeprybka 15.08.2014 22:59
Schritt 1

http://filepony.de/icon/frst.pnghttp://deeprybka.trojaner-board.de/b...t/frstscan.png

Bitte starte FRST erneut, und drücke auf Scan.
Bitte poste mir den Inhalt des Logs.

Katharina123 15.08.2014 23:01

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:15-08-2014
Ran by Wichsis (administrator) on KATHARINA on 16-08-2014 00:00:17
Running from c:\Users\Wichsis\Desktop
Platform: Microsoft® Windows Vista™ Home Basic  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 8
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Microsoft Corporation) C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe
() C:\Program Files\CyberLink\Shared files\RichVideo.exe
(Skype Technologies S.A.) C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbam.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(CyberLink) C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe
(CyberLink Corp.) C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Fred's Software) C:\Program Files\PrintKey2000\Printkey2000.exe
(SAMSUNG Electronics co., LTD.) C:\Program Files\Samsung\EBM\EasyBatteryMgr3.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Samsung Magic Doctor\MagicDoctorKbdHk.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_14_0_0_145.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_14_0_0_145.exe
() C:\Program Files\Samsung\Samsung Update Plus\SUPNotifier.exe
(Microsoft Corporation) C:\Windows\System32\msiexec.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKU\S-1-5-21-3121953689-2843351358-1462341086-1000\...\Run: [KiesHelper] => C:\Program Files\Samsung\Kies\KiesHelper.exe [943504 2012-02-03] (Samsung)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Printkey2000.lnk
ShortcutTarget: Printkey2000.lnk -> C:\Program Files\PrintKey2000\Printkey2000.exe (Fred's Software)
Startup: C:\Users\Kathi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=SMSN&bmod=SMSN
BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO: Google Toolbar Notifier BHO -> {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} -> C:\Program Files\Google\GoogleToolbarNotifier\5.7.9012.1008\swg.dll (Google Inc.)
BHO: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {6E718D87-6909-4FCE-92D4-EDCB2F725727} hxxp://navigram.com/engine/v1026/Navigram.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Wichsis\AppData\Roaming\Mozilla\Firefox\Profiles\an2mua9h.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.7.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2012-10-23]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2011-12-28]
FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2 [2012-08-30]
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2
FF HKCU\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files\Common Files\DVDVideoSoft\plugins\ff
FF Extension: Download videos and MP3s from YouTube - C:\Program Files\Common Files\DVDVideoSoft\plugins\ff [2013-11-02]

Chrome:
=======
CHR HKLM\...\Chrome\Extension: [aaaaacalgebmfelllfiaoknifldpngjh] - C:\ProgramData\AskPartnerNetwork\Toolbar\AVIRA-V7\CRX\ToolbarCR.crx []

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-08-15] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-08-15] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1021008 2014-08-15] (Avira Operations GmbH & Co. KG)
R2 MBAMScheduler; C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
S4 MSSQLServerADHelper; C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [45272 2005-10-14] (Microsoft Corporation)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [43520 2008-02-28] (Hewlett-Packard) [File not signed]
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [53248 2008-02-28] (Hewlett-Packard) [File not signed]
R2 RichVideo; C:\Program Files\CyberLink\Shared files\RichVideo.exe [247152 2008-11-25] ()
R2 Skype C2C Service; C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [3064000 2012-10-02] (Skype Technologies S.A.)
S2 APNMCP; "C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [97648 2014-07-03] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-06-05] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-26] (Avira Operations GmbH & Co. KG)
R2 KMDFMEMIO; C:\Windows\System32\DRIVERS\kmdfmemio.sys [13312 2006-11-14] (SAMSUNG ELECTRONICS CO., LTD.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-05-12] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [110296 2014-08-15] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-05-12] (Malwarebytes Corporation)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-08-05] (Avira GmbH)
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-21] (Microsoft Corporation)
S3 catchme; \??\C:\Users\Wichsis\AppData\Local\Temp\catchme.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-15 23:53 - 2014-08-15 23:53 - 313822110 _____ () C:\Users\Wichsis\Downloads\Windows6.0-KB948465-X86.exe.part
2014-08-15 23:53 - 2014-08-15 23:53 - 00000000 _____ () C:\Users\Wichsis\Downloads\Windows6.0-KB948465-X86.exe
2014-08-15 23:42 - 2014-08-15 23:42 - 00002701 _____ () C:\Windows\system32\FSS.txt
2014-08-15 23:41 - 2014-08-15 23:41 - 00415232 _____ (Farbar) C:\Users\Wichsis\Downloads\FSS.exe
2014-08-15 21:09 - 2014-08-15 21:09 - 00000000 ____D () C:\Program Files\ESET
2014-08-15 21:08 - 2014-08-15 21:09 - 02347384 _____ (ESET) C:\Users\Wichsis\Downloads\esetsmartinstaller_deu.exe
2014-08-15 20:57 - 2014-08-15 20:57 - 00000000 ____D () C:\Users\Wichsis\AppData\Roaming\Avira
2014-08-15 20:54 - 2014-08-16 00:00 - 00012715 _____ () C:\Users\Wichsis\Desktop\FRST.txt
2014-08-15 20:00 - 2014-08-15 23:43 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-15 19:59 - 2014-08-15 19:59 - 00000899 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-08-15 19:59 - 2014-08-15 19:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-08-15 19:59 - 2014-08-15 19:59 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-15 19:59 - 2014-08-15 19:59 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2014-08-15 19:59 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-08-15 19:59 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-08-15 19:59 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-08-15 19:58 - 2014-08-15 19:58 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Kathi\Downloads\mbam-setup-2.0.2.1012.exe
2014-08-15 19:46 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\system32\sqlite3.dll
2014-08-15 19:44 - 2014-08-15 19:46 - 00000000 ____D () C:\AdwCleaner
2014-08-15 19:42 - 2014-08-15 19:42 - 01356107 _____ () C:\Users\Kathi\Downloads\adwcleaner_3.305.exe
2014-08-15 19:23 - 2014-08-15 19:23 - 00017045 _____ () C:\ComboFix.txt
2014-08-15 19:11 - 2014-08-15 19:23 - 00000000 ____D () C:\ComboFix
2014-08-15 19:11 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-08-15 19:11 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-08-15 19:11 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-08-15 19:11 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-08-15 19:11 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-08-15 19:11 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-08-15 19:11 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-08-15 19:11 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-08-15 19:10 - 2014-08-15 19:23 - 00000000 ____D () C:\Qoobox
2014-08-15 19:10 - 2014-08-15 19:21 - 00000000 ____D () C:\Windows\erdnt
2014-08-15 19:07 - 2014-08-15 19:07 - 05571320 ____R (Swearware) C:\Users\Kathi\Desktop\ComboFix.exe
2014-08-15 17:40 - 2014-08-15 17:40 - 00025127 _____ () C:\Users\Kathi\Desktop\FRST.txt
2014-08-15 17:40 - 2014-08-15 17:40 - 00022313 _____ () C:\Users\Kathi\Desktop\Addition.txt
2014-08-15 17:39 - 2014-08-15 20:30 - 00026282 _____ () C:\Users\Kathi\Downloads\FRST.txt
2014-08-15 17:39 - 2014-08-15 17:39 - 00022313 _____ () C:\Users\Kathi\Downloads\Addition.txt
2014-08-15 17:38 - 2014-08-16 00:00 - 00000000 ____D () C:\FRST
2014-08-15 17:37 - 2014-08-15 17:37 - 01092096 _____ (Farbar) C:\Users\Wichsis\Desktop\FRST.exe
2014-08-12 20:43 - 2014-08-12 20:50 - 151513264 _____ () C:\Users\Kathi\Downloads\avira_free_antivirus06_de(1).exe
2014-08-12 20:42 - 2014-08-12 20:49 - 151513264 _____ () C:\Users\Kathi\Downloads\avira_free_antivirus06_de.exe
2014-08-04 21:09 - 2014-08-04 21:09 - 00000000 ____D () C:\Users\Kathi\AppData\Roaming\dll-files.com
2014-07-30 20:35 - 2014-07-30 20:35 - 00000000 ____D () C:\Program Files\Mozilla Firefox(23)

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-16 00:00 - 2014-08-15 20:54 - 00012715 _____ () C:\Users\Wichsis\Desktop\FRST.txt
2014-08-16 00:00 - 2014-08-15 17:38 - 00000000 ____D () C:\FRST
2014-08-15 23:58 - 2009-08-11 21:16 - 00000422 ____H () C:\Windows\Tasks\User_Feed_Synchronization-{7030CE83-CC54-445E-964F-73E63606DF74}.job
2014-08-15 23:53 - 2014-08-15 23:53 - 313822110 _____ () C:\Users\Wichsis\Downloads\Windows6.0-KB948465-X86.exe.part
2014-08-15 23:53 - 2014-08-15 23:53 - 00000000 _____ () C:\Users\Wichsis\Downloads\Windows6.0-KB948465-X86.exe
2014-08-15 23:46 - 2012-08-18 23:35 - 00001100 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-08-15 23:43 - 2014-08-15 20:00 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-15 23:42 - 2014-08-15 23:42 - 00002701 _____ () C:\Windows\system32\FSS.txt
2014-08-15 23:41 - 2014-08-15 23:41 - 00415232 _____ (Farbar) C:\Users\Wichsis\Downloads\FSS.exe
2014-08-15 23:38 - 2012-09-18 20:12 - 00001963 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-08-15 22:48 - 2006-11-02 14:45 - 00004784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-15 22:48 - 2006-11-02 14:45 - 00004784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-15 21:09 - 2014-08-15 21:09 - 00000000 ____D () C:\Program Files\ESET
2014-08-15 21:09 - 2014-08-15 21:08 - 02347384 _____ (ESET) C:\Users\Wichsis\Downloads\esetsmartinstaller_deu.exe
2014-08-15 20:57 - 2014-08-15 20:57 - 00000000 ____D () C:\Users\Wichsis\AppData\Roaming\Avira
2014-08-15 20:53 - 2009-07-21 20:26 - 01294441 _____ () C:\Windows\WindowsUpdate.log
2014-08-15 20:51 - 2012-08-18 23:35 - 00001096 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-08-15 20:51 - 2009-08-11 02:35 - 00000000 ____D () C:\Users\Wichsis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite
2014-08-15 20:49 - 2011-12-28 18:30 - 00000000 ____D () C:\Users\Kathi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite
2014-08-15 20:48 - 2008-01-21 05:02 - 00745920 _____ () C:\Windows\PFRO.log
2014-08-15 20:48 - 2006-11-02 14:58 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-15 20:47 - 2006-11-02 14:58 - 00032514 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-08-15 20:30 - 2014-08-15 17:39 - 00026282 _____ () C:\Users\Kathi\Downloads\FRST.txt
2014-08-15 20:19 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\Speech
2014-08-15 19:59 - 2014-08-15 19:59 - 00000899 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-08-15 19:59 - 2014-08-15 19:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-08-15 19:59 - 2014-08-15 19:59 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-15 19:59 - 2014-08-15 19:59 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2014-08-15 19:58 - 2014-08-15 19:58 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Kathi\Downloads\mbam-setup-2.0.2.1012.exe
2014-08-15 19:46 - 2014-08-15 19:44 - 00000000 ____D () C:\AdwCleaner
2014-08-15 19:46 - 2013-11-02 23:21 - 00000846 _____ () C:\Users\Wichsis\Desktop\Search.lnk
2014-08-15 19:42 - 2014-08-15 19:42 - 01356107 _____ () C:\Users\Kathi\Downloads\adwcleaner_3.305.exe
2014-08-15 19:27 - 2014-04-27 21:32 - 00000000 ___RD () C:\Users\Kathi\Dropbox
2014-08-15 19:23 - 2014-08-15 19:23 - 00017045 _____ () C:\ComboFix.txt
2014-08-15 19:23 - 2014-08-15 19:11 - 00000000 ____D () C:\ComboFix
2014-08-15 19:23 - 2014-08-15 19:10 - 00000000 ____D () C:\Qoobox
2014-08-15 19:23 - 2009-08-11 03:13 - 00000000 ____D () C:\Users\Wichsis\AppData\Local\Google
2014-08-15 19:23 - 2006-11-02 13:18 - 00000000 __RHD () C:\Users\Default
2014-08-15 19:23 - 2006-11-02 13:18 - 00000000 ___RD () C:\Users\Public
2014-08-15 19:21 - 2014-08-15 19:10 - 00000000 ____D () C:\Windows\erdnt
2014-08-15 19:21 - 2006-11-02 12:23 - 00000215 _____ () C:\Windows\system.ini
2014-08-15 19:07 - 2014-08-15 19:07 - 05571320 ____R (Swearware) C:\Users\Kathi\Desktop\ComboFix.exe
2014-08-15 18:45 - 2009-08-11 02:42 - 00106960 _____ () C:\Users\Wichsis\AppData\Local\GDIPFONTCACHEV1.DAT
2014-08-15 17:40 - 2014-08-15 17:40 - 00025127 _____ () C:\Users\Kathi\Desktop\FRST.txt
2014-08-15 17:40 - 2014-08-15 17:40 - 00022313 _____ () C:\Users\Kathi\Desktop\Addition.txt
2014-08-15 17:39 - 2014-08-15 17:39 - 00022313 _____ () C:\Users\Kathi\Downloads\Addition.txt
2014-08-15 17:37 - 2014-08-15 17:37 - 01092096 _____ (Farbar) C:\Users\Wichsis\Desktop\FRST.exe
2014-08-15 17:34 - 2014-04-27 21:29 - 00000000 ____D () C:\Users\Kathi\AppData\Roaming\Dropbox
2014-08-15 17:08 - 2013-06-30 22:48 - 00000422 ____H () C:\Windows\Tasks\User_Feed_Synchronization-{DC24E08D-D800-4C9D-9DE2-5FF59CBB27E4}.job
2014-08-12 23:00 - 2014-06-16 11:05 - 00015080 _____ () C:\Users\Kathi\Desktop\Hochzeitsgeschenke.xlsx
2014-08-12 20:50 - 2014-08-12 20:43 - 151513264 _____ () C:\Users\Kathi\Downloads\avira_free_antivirus06_de(1).exe
2014-08-12 20:49 - 2014-08-12 20:42 - 151513264 _____ () C:\Users\Kathi\Downloads\avira_free_antivirus06_de.exe
2014-08-11 23:09 - 2014-06-16 23:09 - 00018357 _____ () C:\Users\Kathi\Desktop\malediven.xlsx
2014-08-11 23:06 - 2014-06-15 16:51 - 00000000 ____D () C:\Users\Kathi\Desktop\Hochzeit - Standesamt
2014-08-11 22:08 - 2014-02-16 18:46 - 00000000 ____D () C:\Users\Kathi\Desktop\Hochzeit
2014-08-10 14:08 - 2012-01-02 21:32 - 00000000 ____D () C:\Users\Kathi\Documents\Passwörter
2014-08-04 21:09 - 2014-08-04 21:09 - 00000000 ____D () C:\Users\Kathi\AppData\Roaming\dll-files.com
2014-08-04 21:06 - 2012-05-15 18:16 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-08-03 23:26 - 2011-12-28 18:30 - 00000000 ____D () C:\Users\Kathi
2014-08-03 23:26 - 2009-08-11 02:35 - 00000000 ____D () C:\Users\Wichsis
2014-08-03 23:26 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\spool
2014-08-03 23:26 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\Msdtc
2014-08-03 23:26 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\registration
2014-08-03 23:26 - 2006-11-02 12:22 - 37748736 _____ () C:\Windows\system32\config\software_previous
2014-08-03 23:26 - 2006-11-02 12:22 - 17301504 _____ () C:\Windows\system32\config\system_previous
2014-08-03 23:23 - 2006-11-02 12:22 - 42991616 _____ () C:\Windows\system32\config\components_previous
2014-08-03 23:23 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\sam_previous
2014-08-03 14:10 - 2012-10-23 18:37 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-08-03 14:10 - 2012-05-15 18:16 - 00000858 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-08-03 14:10 - 2012-05-15 18:16 - 00000846 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-08-03 00:01 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\security_previous
2014-08-03 00:01 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\default_previous
2014-07-30 20:35 - 2014-07-30 20:35 - 00000000 ____D () C:\Program Files\Mozilla Firefox(23)
2014-07-23 10:52 - 2011-12-28 16:24 - 00231584 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-07-22 21:04 - 2014-04-27 21:32 - 00000919 _____ () C:\Users\Kathi\Desktop\Dropbox.lnk
2014-07-22 21:04 - 2014-04-27 21:31 - 00000000 ____D () C:\Users\Kathi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-07-18 23:55 - 2006-11-02 12:33 - 01566246 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-07-18 19:59 - 2006-11-02 14:49 - 00149220 _____ () C:\Windows\setupact.log
2014-07-17 18:58 - 2012-03-23 19:56 - 00000000 ____D () C:\ProgramData\tmp
2014-07-17 18:17 - 2009-08-11 02:37 - 00000000 ____D () C:\Users\Wichsis\AppData\Local\Adobe
2014-07-17 18:16 - 2012-09-18 20:11 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-07-17 18:16 - 2012-02-26 00:06 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl

Some content of TEMP:
====================
C:\Users\Wichsis\AppData\Local\temp\avgnt.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-08-15 20:56

==================== End Of Log ============================
--- --- ---

deeprybka 15.08.2014 23:03
Code:
2014-08-15 23:53 - 2014-08-15 23:53 - 313822110 _____ () C:\Users\Wichsis\Downloads\Windows6.0-KB948465-X86.exe.part
2014-08-15 23:53 - 2014-08-15 23:53 - 00000000 _____ () C:\Users\Wichsis\Downloads\Windows6.0-KB948465-X86.exe
Datei bitte ganz runterladen... ;)

Katharina123 16.08.2014 10:35
So, Updates sind installiert.
Hier das FRST-Logfile:


FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:16-08-2014 02
Ran by Wichsis (administrator) on KATHARINA on 16-08-2014 11:33:18
Running from C:\Users\Wichsis\Desktop
Platform: Microsoft® Windows Vista™ Home Basic  Service Pack 2 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 8
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Microsoft Corporation) C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe
() C:\Program Files\CyberLink\Shared files\RichVideo.exe
(Skype Technologies S.A.) C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbam.exe
(SAMSUNG Electronics co., LTD.) C:\Program Files\Samsung\EBM\EasyBatteryMgr3.exe
() C:\Program Files\Samsung\Samsung Update Plus\SUPBackGround.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Samsung Magic Doctor\MagicDoctorKbdHk.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(CyberLink) C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe
(CyberLink Corp.) C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Adobe Systems Incorporated) C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe
(Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Fred's Software) C:\Program Files\PrintKey2000\Printkey2000.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_14_0_0_145.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_14_0_0_145.exe
(Microsoft Corporation) C:\Windows\System32\msfeedssync.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKU\S-1-5-21-3121953689-2843351358-1462341086-1000\...\Run: [KiesHelper] => C:\Program Files\Samsung\Kies\KiesHelper.exe [943504 2012-02-03] (Samsung)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Printkey2000.lnk
ShortcutTarget: Printkey2000.lnk -> C:\Program Files\PrintKey2000\Printkey2000.exe (Fred's Software)
Startup: C:\Users\Kathi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=SMSN&bmod=SMSN
BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO: Google Toolbar Notifier BHO -> {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} -> C:\Program Files\Google\GoogleToolbarNotifier\5.7.9012.1008\swg.dll (Google Inc.)
BHO: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {6E718D87-6909-4FCE-92D4-EDCB2F725727} hxxp://navigram.com/engine/v1026/Navigram.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Wichsis\AppData\Roaming\Mozilla\Firefox\Profiles\an2mua9h.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.7.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2012-10-23]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2011-12-28]
FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2 [2012-08-30]
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2
FF HKCU\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files\Common Files\DVDVideoSoft\plugins\ff
FF Extension: Download videos and MP3s from YouTube - C:\Program Files\Common Files\DVDVideoSoft\plugins\ff [2013-11-02]

Chrome:
=======
CHR HKLM\...\Chrome\Extension: [aaaaacalgebmfelllfiaoknifldpngjh] - C:\ProgramData\AskPartnerNetwork\Toolbar\AVIRA-V7\CRX\ToolbarCR.crx []

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-08-15] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-08-15] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1021008 2014-08-15] (Avira Operations GmbH & Co. KG)
R2 MBAMScheduler; C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
S4 MSSQLServerADHelper; C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [45272 2005-10-14] (Microsoft Corporation)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [43520 2008-02-28] (Hewlett-Packard) [File not signed]
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [53248 2008-02-28] (Hewlett-Packard) [File not signed]
R2 RichVideo; C:\Program Files\CyberLink\Shared files\RichVideo.exe [247152 2008-11-25] ()
R2 Skype C2C Service; C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [3064000 2012-10-02] (Skype Technologies S.A.)
S2 APNMCP; "C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [97648 2014-07-03] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-06-05] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-26] (Avira Operations GmbH & Co. KG)
R2 KMDFMEMIO; C:\Windows\System32\DRIVERS\kmdfmemio.sys [13312 2006-11-14] (SAMSUNG ELECTRONICS CO., LTD.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-05-12] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [110296 2014-08-16] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-05-12] (Malwarebytes Corporation)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-08-05] (Avira GmbH)
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-21] (Microsoft Corporation)
S3 catchme; \??\C:\Users\Wichsis\AppData\Local\Temp\catchme.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-16 11:33 - 2014-08-16 11:33 - 00000000 ____D () C:\Users\Wichsis\Desktop\FRST-OlderVersion
2014-08-16 11:25 - 2014-08-16 11:25 - 00000000 ____D () C:\Users\Wichsis\AppData\Local\WindowsUpdate
2014-08-16 11:08 - 2014-08-16 11:08 - 00000000 ____D () C:\Windows\system32\WindowsPowerShell
2014-08-16 10:52 - 2014-08-16 10:52 - 00000000 ____D () C:\Windows\system32\x64
2014-08-16 10:49 - 2009-10-09 23:56 - 01181696 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll
2014-08-16 10:49 - 2009-10-09 23:56 - 00246272 _____ (Microsoft Corporation) C:\Windows\system32\WSManHTTPConfig.exe
2014-08-16 10:49 - 2009-10-09 23:56 - 00241152 _____ (Microsoft Corporation) C:\Windows\system32\winrscmd.dll
2014-08-16 10:49 - 2009-10-09 23:56 - 00214016 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll
2014-08-16 10:49 - 2009-10-09 23:56 - 00145408 _____ (Microsoft Corporation) C:\Windows\system32\WsmAuto.dll
2014-08-16 10:49 - 2009-10-09 23:56 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\pwrshplugin.dll
2014-08-16 10:49 - 2009-10-09 23:56 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\winrs.exe
2014-08-16 10:49 - 2009-10-09 23:56 - 00020480 _____ (Microsoft Corporation) C:\Windows\system32\winrshost.exe
2014-08-16 10:49 - 2009-10-09 23:56 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\wsmprovhost.exe
2014-08-16 10:49 - 2009-10-09 23:56 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\wsmplpxy.dll
2014-08-16 10:49 - 2009-10-09 23:56 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\winrssrv.dll
2014-08-16 10:49 - 2009-10-09 23:56 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\winrsmgr.dll
2014-08-16 10:49 - 2009-10-09 23:55 - 00252416 _____ (Microsoft Corporation) C:\Windows\system32\WSManMigrationPlugin.dll
2014-08-16 10:49 - 2009-10-09 23:55 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\wecsvc.dll
2014-08-16 10:49 - 2009-10-09 23:55 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\wevtfwd.dll
2014-08-16 10:49 - 2009-10-09 23:55 - 00079872 _____ (Microsoft Corporation) C:\Windows\system32\wecutil.exe
2014-08-16 10:49 - 2009-10-09 23:55 - 00056320 _____ (Microsoft Corporation) C:\Windows\system32\wecapi.dll
2014-08-16 10:49 - 2009-10-09 23:55 - 00054272 _____ (Microsoft Corporation) C:\Windows\system32\WsmRes.dll
2014-08-16 10:49 - 2009-08-01 08:27 - 00201184 _____ () C:\Windows\system32\winrm.vbs
2014-08-16 10:49 - 2009-07-16 19:30 - 00004675 _____ () C:\Windows\system32\wsmanconfig_schema.xml
2014-08-16 10:49 - 2009-07-16 19:30 - 00002426 _____ () C:\Windows\system32\WsmTxt.xsl
2014-08-16 10:46 - 2011-04-12 18:07 - 00892416 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-08-16 10:46 - 2011-03-03 17:40 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\Apphlpdm.dll
2014-08-16 10:46 - 2011-03-03 15:35 - 04240384 _____ (Microsoft) C:\Windows\system32\GameUXLegacyGDFs.dll
2014-08-16 10:46 - 2010-08-26 18:34 - 01696256 _____ (Microsoft Corporation) C:\Windows\system32\gameux.dll
2014-08-16 10:46 - 2010-01-25 14:00 - 00471552 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll
2014-08-16 10:46 - 2010-01-25 14:00 - 00471552 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll
2014-08-16 10:46 - 2010-01-25 14:00 - 00152576 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll
2014-08-16 10:46 - 2010-01-25 14:00 - 00152064 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll
2014-08-16 10:46 - 2010-01-25 13:58 - 00332288 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll
2014-08-16 10:46 - 2010-01-25 10:21 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe
2014-08-16 10:46 - 2010-01-25 10:21 - 00518144 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe
2014-08-16 10:46 - 2010-01-25 10:21 - 00347136 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe
2014-08-16 10:46 - 2010-01-25 10:21 - 00346624 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe
2014-08-16 10:46 - 2009-10-23 19:10 - 00714240 _____ (Microsoft Corporation) C:\Windows\system32\timedate.cpl
2014-08-16 10:46 - 2009-09-10 16:58 - 00310784 _____ (Microsoft Corporation) C:\Windows\system32\unregmp2.exe
2014-08-16 00:45 - 2014-08-16 00:46 - 00000000 ____D () C:\Windows\system32\vi-VN
2014-08-16 00:45 - 2014-08-16 00:46 - 00000000 ____D () C:\Windows\system32\eu-ES
2014-08-16 00:45 - 2014-08-16 00:46 - 00000000 ____D () C:\Windows\system32\ca-ES
2014-08-16 00:42 - 2014-08-16 00:42 - 00000000 ____D () C:\Windows\system32\SPReview
2014-08-16 00:30 - 2009-04-10 23:28 - 00928768 _____ (Microsoft Corporation) C:\Windows\system32\scavenge.dll
2014-08-16 00:30 - 2009-04-10 23:27 - 00057856 _____ (Microsoft Corporation) C:\Windows\system32\compcln.exe
2014-08-16 00:29 - 2009-04-10 23:33 - 00614376 _____ (Microsoft Corporation) C:\Windows\system32\ci.dll
2014-08-16 00:29 - 2009-04-10 23:32 - 01083880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-08-16 00:29 - 2009-04-10 23:32 - 00527848 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys
2014-08-16 00:29 - 2009-04-10 23:32 - 00265688 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\acpi.sys
2014-08-16 00:29 - 2009-04-10 23:32 - 00245736 _____ (Microsoft Corporation) C:\Windows\system32\clfs.sys
2014-08-16 00:29 - 2009-04-10 23:32 - 00223208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-08-16 00:29 - 2009-04-10 23:32 - 00190424 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fltMgr.sys
2014-08-16 00:29 - 2009-04-10 23:32 - 00180712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-08-16 00:29 - 2009-04-10 23:32 - 00161752 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msrpc.sys
2014-08-16 00:29 - 2009-04-10 23:32 - 00149480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\pci.sys
2014-08-16 00:29 - 2009-04-10 23:32 - 00141288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ecache.sys
2014-08-16 00:29 - 2009-04-10 23:32 - 00125928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Classpnp.sys
2014-08-16 00:29 - 2009-04-10 23:32 - 00099816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2014-08-16 00:29 - 2009-04-10 23:32 - 00054248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\partmgr.sys
2014-08-16 00:29 - 2009-04-10 23:32 - 00053736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\disk.sys
2014-08-16 00:29 - 2009-04-10 23:32 - 00050664 _____ (Microsoft Corporation) C:\Windows\system32\PSHED.DLL
2014-08-16 00:29 - 2009-04-10 23:32 - 00048104 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mup.sys
2014-08-16 00:29 - 2009-04-10 23:32 - 00035304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\crashdmp.sys
2014-08-16 00:29 - 2009-04-10 23:32 - 00027624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Dumpata.sys
2014-08-16 00:29 - 2009-04-10 23:28 - 06103040 _____ (Microsoft Corporation) C:\Windows\system32\chtbrkr.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 03174400 _____ (Microsoft Corporation) C:\Windows\system32\netshell.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 03072000 _____ (Microsoft Corporation) C:\Windows\system32\networkmap.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 02515968 _____ (Microsoft Corporation) C:\Windows\system32\accessibilitycpl.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 02226688 _____ (Microsoft Corporation) C:\Windows\system32\networkexplorer.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 02225664 _____ (Microsoft Corporation) C:\Windows\system32\netcenter.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 02153472 _____ (Microsoft Corporation) C:\Windows\system32\oobefldr.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 02134528 _____ (Microsoft Corporation) C:\Windows\system32\FunctionDiscoveryFolder.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01985024 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01856512 _____ (Microsoft Corporation) C:\Windows\system32\dbgeng.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01823744 _____ (Microsoft Corporation) C:\Windows\system32\pnidui.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01788416 _____ (Microsoft Corporation) C:\Windows\system32\d3d9.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01730560 _____ (Microsoft Corporation) C:\Windows\system32\apds.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01671680 _____ (Microsoft Corporation) C:\Windows\system32\chsbrkr.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01645568 _____ (Microsoft Corporation) C:\Windows\system32\connect.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01591296 _____ (Microsoft Corporation) C:\Windows\system32\setupapi.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01589248 _____ (Microsoft Corporation) C:\Windows\system32\msjet40.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01544704 _____ (Microsoft Corporation) C:\Windows\system32\MSVidCtl.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01541120 _____ (Microsoft Corporation) C:\Windows\system32\onex.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01502720 _____ (Microsoft Corporation) C:\Windows\system32\certmgr.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01480704 _____ (Microsoft Corporation) C:\Windows\system32\mssrch.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01459200 _____ (Microsoft Corporation) C:\Windows\system32\esent.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01381376 _____ (Microsoft Corporation) C:\Windows\system32\Query.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01342464 _____ (Microsoft Corporation) C:\Windows\system32\brcpl.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01324032 _____ (Microsoft Corporation) C:\Windows\system32\browseui.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01248768 _____ (Microsoft Corporation) C:\Windows\system32\PerfCenterCPL.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01209856 _____ (Microsoft Corporation) C:\Windows\system32\comsvcs.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01112064 _____ (Microsoft Corporation) C:\Windows\system32\CertEnroll.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01107968 _____ (Microsoft Corporation) C:\Windows\system32\pidgenx.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01078784 _____ (Microsoft Corporation) C:\Windows\system32\diagperf.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01053696 _____ (Microsoft Corporation) C:\Windows\system32\msdtctm.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00978944 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00978432 _____ (Microsoft Corporation) C:\Windows\system32\drmv2clt.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00971264 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00950784 _____ (Microsoft Corporation) C:\Windows\system32\gpedit.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00880640 _____ (Microsoft Corporation) C:\Windows\system32\RacEngn.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00869888 _____ (Microsoft Corporation) C:\Windows\system32\printui.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00856064 _____ (Microsoft Corporation) C:\Windows\system32\mswdat10.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00825856 _____ (Microsoft Corporation) C:\Windows\system32\rasdlg.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00807424 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00805376 _____ (Microsoft Corporation) C:\Windows\system32\NaturalLanguage6.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00758784 _____ (Microsoft Corporation) C:\Windows\system32\qmgr.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00757248 _____ (Microsoft Corporation) C:\Windows\system32\azroles.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00754688 _____ (Microsoft Corporation) C:\Windows\system32\propsys.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00723968 _____ (Microsoft Corporation) C:\Windows\system32\powercpl.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00679936 _____ (Microsoft Corporation) C:\Windows\system32\msvcrt.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00670720 _____ (Microsoft Corporation) C:\Windows\system32\mssvp.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00644608 _____ (Microsoft Corporation) C:\Windows\system32\p2psvc.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00643072 _____ (Microsoft Corporation) C:\Windows\system32\msrepl40.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00642560 _____ (Microsoft Corporation) C:\Windows\system32\rasgcw.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\CertEnrollUI.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\sethc.exe
2014-08-16 00:29 - 2009-04-10 23:28 - 00618496 _____ (Microsoft Corporation) C:\Windows\system32\mswstr10.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00612864 _____ (Microsoft Corporation) C:\Windows\system32\rdpencom.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00595456 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2014-08-16 00:29 - 2009-04-10 23:28 - 00593408 _____ (Microsoft Corporation) C:\Windows\system32\comuid.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00592896 _____ (Microsoft Corporation) C:\Windows\system32\netlogon.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00576512 _____ (Microsoft Corporation) C:\Windows\system32\gpsvc.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00564224 _____ (Microsoft Corporation) C:\Windows\system32\msftedit.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00564224 _____ (Microsoft Corporation) C:\Windows\system32\emdmgmt.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00560640 _____ (Microsoft Corporation) C:\Windows\system32\msdtcprx.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00551936 _____ (Microsoft Corporation) C:\Windows\system32\prnntfy.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00550400 _____ (Microsoft Corporation) C:\Windows\system32\rpcss.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00542720 _____ (Microsoft Corporation) C:\Windows\system32\blackbox.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00542208 _____ (Microsoft Corporation) C:\Windows\system32\pnpui.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00516608 _____ (Microsoft Corporation) C:\Windows\system32\autoplay.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00505344 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00485888 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00483328 _____ (Microsoft Corporation) C:\Windows\system32\samsrv.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00481792 _____ (Microsoft Corporation) C:\Windows\system32\cmdial32.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00478208 _____ (Microsoft Corporation) C:\Windows\system32\DevicePairing.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00469504 _____ (Microsoft Corporation) C:\Windows\system32\newdev.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00467456 _____ (Microsoft Corporation) C:\Windows\system32\netapi32.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00466944 _____ (Microsoft Corporation) C:\Windows\system32\riched20.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00464384 _____ (Microsoft Corporation) C:\Windows\system32\pcaui.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00463872 _____ (Microsoft Corporation) C:\Windows\system32\IasMigReader.exe
2014-08-16 00:29 - 2009-04-10 23:28 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\msxbde40.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00454144 _____ (Microsoft) C:\Windows\system32\IasMigPlugin.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00450560 _____ (Microsoft Corporation) C:\Windows\system32\comdlg32.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00445952 _____ (Microsoft Corporation) C:\Windows\system32\ncryptui.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00444416 _____ (Microsoft Corporation) C:\Windows\system32\dsound.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00441344 _____ (Microsoft Corporation) C:\Windows\system32\SearchIndexer.exe
2014-08-16 00:29 - 2009-04-10 23:28 - 00425472 _____ (Microsoft Corporation) C:\Windows\system32\PhotoMetadataHandler.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00414208 _____ (Microsoft Corporation) C:\Windows\system32\msscp.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00409600 _____ (Microsoft Corporation) C:\Windows\system32\msexch40.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00407552 _____ (Microsoft Corporation) C:\Windows\system32\MPSSVC.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00406528 _____ (Microsoft Corporation) C:\Windows\system32\msvcp60.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00391680 _____ (Microsoft Corporation) C:\Windows\system32\mscms.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00378368 _____ (Microsoft Corporation) C:\Windows\system32\devmgr.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00376832 _____ (Microsoft Corporation) C:\Windows\system32\rasplap.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00368640 _____ (Microsoft Corporation) C:\Windows\system32\mspbde40.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00368640 _____ () C:\Windows\system32\msjetoledb40.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00351744 _____ (Microsoft Corporation) C:\Windows\system32\mssph.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00344064 _____ (Microsoft Corporation) C:\Windows\system32\msrd3x40.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\RelMon.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00339968 _____ (Microsoft Corporation) C:\Windows\system32\msexcl40.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00334848 _____ (Microsoft Corporation) C:\Windows\system32\BFE.DLL
2014-08-16 00:29 - 2009-04-10 23:28 - 00332800 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00327168 _____ (Microsoft Corporation) C:\Windows\system32\P2PGraph.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00324608 _____ (Microsoft Corporation) C:\Windows\system32\sdohlp.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00323584 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00319488 _____ (Microsoft Corporation) C:\Windows\system32\msrd2x40.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00310272 _____ (Microsoft Corporation) C:\Windows\system32\mtxclu.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00306176 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\QAGENTRT.DLL
2014-08-16 00:29 - 2009-04-10 23:28 - 00297472 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00293376 _____ (Microsoft Corporation) C:\Windows\system32\psisdecd.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00293376 _____ (Microsoft Corporation) C:\Windows\system32\photowiz.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\msjtes40.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00288256 _____ (Microsoft Corporation) C:\Windows\system32\modemui.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00286720 _____ (Microsoft Corporation) C:\Windows\system32\rasapi32.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\drmmgrtn.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00282624 _____ (Microsoft Corporation) C:\Windows\system32\mstext40.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00281088 _____ (Microsoft Corporation) C:\Windows\system32\raschap.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00279552 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2014-08-16 00:29 - 2009-04-10 23:28 - 00274432 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00268800 _____ (Microsoft Corporation) C:\Windows\system32\es.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\rasmans.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\rasppp.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\drvstore.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00245760 _____ (Microsoft Corporation) C:\Windows\system32\scansetting.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00242176 _____ (Microsoft Corporation) C:\Windows\system32\pdh.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00241664 _____ (Microsoft Corporation) C:\Windows\system32\msltus40.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00241152 _____ (Microsoft Corporation) C:\Windows\system32\PortableDeviceApi.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00231424 _____ (Microsoft Corporation) C:\Windows\system32\msshsq.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\mscandui.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00217600 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00216064 _____ (Microsoft Corporation) C:\Windows\system32\ntprint.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00204288 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00204288 _____ (Microsoft Corporation) C:\Windows\system32\dhcpcsvc.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00203264 _____ (Microsoft Corporation) C:\Windows\system32\mssphtb.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00199168 _____ (Microsoft Corporation) C:\Windows\system32\adsldpc.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00194560 _____ (Microsoft Corporation) C:\Windows\system32\offfilt.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\eapp3hst.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00185344 _____ (Microsoft Corporation) C:\Windows\system32\SearchProtocolHost.exe
2014-08-16 00:29 - 2009-04-10 23:28 - 00183808 _____ (Microsoft Corporation) C:\Windows\system32\eapphost.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00181760 _____ (Microsoft Corporation) C:\Windows\system32\pnpsetup.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00180736 _____ (Microsoft Corporation) C:\Windows\system32\netplwiz.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00180224 _____ (Microsoft Corporation) C:\Windows\system32\scrobj.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00179712 _____ (Microsoft Corporation) C:\Windows\system32\msnetobj.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00178176 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00177152 _____ (Microsoft Corporation) C:\Windows\system32\scecli.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00175616 _____ (Microsoft Corporation) C:\Windows\system32\dot3svc.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00171008 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00166400 _____ (Microsoft Corporation) C:\Windows\system32\puiapi.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00163328 _____ (Microsoft Corporation) C:\Windows\system32\msutb.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00160768 _____ (Microsoft Corporation) C:\Windows\system32\PortableDeviceTypes.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00155136 _____ (Microsoft Corporation) C:\Windows\system32\rasmontr.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00153088 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00153088 _____ (Microsoft Corporation) C:\Windows\system32\fundisc.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00150528 _____ (Microsoft Corporation) C:\Windows\system32\MMDevAPI.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00150528 _____ (Microsoft Corporation) C:\Windows\system32\iasnap.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00147456 _____ (Microsoft Corporation) C:\Windows\system32\Faultrep.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00142336 _____ (Microsoft Corporation) C:\Windows\system32\fontext.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\scksp.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00137728 _____ (Microsoft Corporation) C:\Windows\system32\dsprop.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\nlhtml.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\eappcfg.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00130560 _____ (Microsoft Corporation) C:\Windows\system32\dhcpcsvc6.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00129024 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00127488 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00122368 _____ (Microsoft Corporation) C:\Windows\system32\inetpp.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00121344 _____ (Microsoft Corporation) C:\Windows\system32\ntmarta.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00120320 _____ (Microsoft Corporation) C:\Windows\system32\EhStorAPI.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00117248 _____ () C:\Windows\system32\EhStorAuthn.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\odbccp32.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00114176 _____ (Microsoft Corporation) C:\Windows\system32\EhStorShell.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00107008 _____ (Microsoft Corporation) C:\Windows\system32\regsvc.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00107008 _____ (Microsoft Corporation) C:\Windows\system32\rdpwsx.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00105472 _____ (Microsoft Corporation) C:\Windows\system32\dmsynth.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00101888 _____ (Microsoft Corporation) C:\Windows\system32\dmusic.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00098816 _____ (Microsoft Corporation) C:\Windows\system32\powrprof.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\oleprn.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\mprapi.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00095232 _____ (Microsoft Corporation) C:\Windows\system32\SCardSvr.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00094720 _____ (Microsoft Corporation) C:\Windows\system32\PortableDeviceClassExtension.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00093696 _____ (Microsoft Corporation) C:\Windows\system32\eappgnui.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00088576 _____ (Microsoft Corporation) C:\Windows\system32\olepro32.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\fdBth.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00087552 _____ (Microsoft Corporation) C:\Windows\system32\SearchFilterHost.exe
2014-08-16 00:29 - 2009-04-10 23:28 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\mssitlb.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\msctfui.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mstlsapi.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\msctfp.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00079872 _____ (Microsoft Corporation) C:\Windows\system32\authz.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00075264 _____ (Microsoft Corporation) C:\Windows\system32\gpapi.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00075264 _____ (Microsoft Corporation) C:\Windows\system32\dot3msm.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00075264 _____ (Microsoft Corporation) C:\Windows\system32\adsmsext.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\propdefs.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\iashlpr.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\sendmail.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\rastapi.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\PNPXAssoc.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\fdWCN.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00068608 _____ (Microsoft Corporation) C:\Windows\system32\mpr.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00068096 _____ (Microsoft Corporation) C:\Windows\system32\fdSSDP.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00067584 _____ (Microsoft Corporation) C:\Windows\system32\regapi.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\fdWSD.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\msjter40.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msscntrs.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00058880 _____ (Microsoft Corporation) C:\Windows\system32\iasacct.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\samlib.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\iasads.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\DevicePairingProxy.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00054272 _____ (Microsoft Corporation) C:\Windows\system32\feclient.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\fdeploy.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\rasdiag.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00049664 _____ (Microsoft Corporation) C:\Windows\system32\dot3cfg.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\iasdatastore.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00045568 _____ (Microsoft Corporation) C:\Windows\system32\bthci.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00045056 _____ (Microsoft Corporation) C:\Windows\system32\dataclen.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\msstrc.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\hbaapi.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00040960 _____ (Microsoft Corporation) C:\Windows\system32\odbcconf.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00040960 _____ (Microsoft Corporation) C:\Windows\system32\bthserv.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\certprop.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\networkitemfactory.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\rtffilt.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\EhStorPwdMgr.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\msscb.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\mssprxy.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00031744 _____ (Microsoft Corporation) C:\Windows\system32\perfdisk.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00031744 _____ (Microsoft Corporation) C:\Windows\system32\cscapi.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00031744 _____ (Microsoft Corporation) C:\Windows\system32\bitsigd.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\msimtf.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\FwRemoteSvr.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\printfilterpipelineprxy.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\hidserv.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\msjint40.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00024064 _____ (Microsoft Corporation) C:\Windows\system32\fdProxy.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\cscdll.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00020992 _____ (Microsoft Corporation) C:\Windows\system32\ExplorerFrame.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00019968 _____ (Microsoft Corporation) C:\Windows\system32\NcdProp.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\MsCtfMonitor.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\msisip.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00015360 _____ (Microsoft Corporation) C:\Windows\system32\inetppui.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\msshooks.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\CHxReadingStringIME.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\fdBthProxy.dll
2014-08-16 00:29 - 2009-04-10 23:27 - 02926592 _____ (Microsoft Corporation) C:\Windows\explorer.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 02092544 _____ (Microsoft Corporation) C:\Windows\system32\dfsr.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 01122304 _____ (Microsoft Corporation) C:\Windows\system32\appwiz.cpl
2014-08-16 00:29 - 2009-04-10 23:27 - 01102848 _____ (Microsoft Corporation) C:\Windows\system32\mmsys.cpl
2014-08-16 00:29 - 2009-04-10 23:27 - 00799744 _____ (Microsoft Corporation) C:\Windows\system32\certutil.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00704512 _____ (Microsoft Corporation) C:\Windows\system32\PhotoScreensaver.scr
2014-08-16 00:29 - 2009-04-10 23:27 - 00666624 _____ (Microsoft Corporation) C:\Windows\system32\printfilterpipelinesvc.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00656896 _____ (Microsoft Corporation) C:\Windows\system32\autoconv.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00643072 _____ (Microsoft Corporation) C:\Windows\system32\autochk.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00640512 _____ (Microsoft Corporation) C:\Windows\system32\bthprops.cpl
2014-08-16 00:29 - 2009-04-10 23:27 - 00636416 _____ (Microsoft Corporation) C:\Windows\system32\autofmt.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00408064 _____ (Microsoft Corporation) C:\Windows\system32\msinfo32.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00407040 _____ (Microsoft Corporation) C:\Windows\system32\dpapimig.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00241128 _____ (Microsoft Corporation) C:\Windows\system32\rsaenh.dll
2014-08-16 00:29 - 2009-04-10 23:27 - 00230912 _____ (Microsoft Corporation) C:\Windows\system32\diskraid.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00217088 _____ (Microsoft Corporation) C:\Windows\system32\psisrndr.ax
2014-08-16 00:29 - 2009-04-10 23:27 - 00215552 _____ (Microsoft Corporation) C:\Windows\system32\certreq.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00205824 _____ (Microsoft Corporation) C:\Windows\system32\eudcedit.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00194048 _____ (Microsoft Corporation) C:\Windows\system32\drvinst.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00182272 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00135168 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00130560 _____ (Microsoft Corporation) C:\Windows\system32\PkgMgr.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00130024 _____ (Microsoft Corporation) C:\Windows\system32\basecsp.dll
2014-08-16 00:29 - 2009-04-10 23:27 - 00128000 _____ (Microsoft Corporation) C:\Windows\system32\gpresult.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00119808 _____ (Microsoft Corporation) C:\Windows\system32\diskpart.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00088576 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00082944 _____ (Microsoft Corporation) C:\Windows\system32\nslookup.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00081920 _____ (Microsoft Corporation) C:\Windows\system32\dwm.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00080896 _____ (Microsoft Corporation) C:\Windows\system32\MSNP.ax
2014-08-16 00:29 - 2009-04-10 23:27 - 00080384 _____ (Microsoft Corporation) C:\Windows\system32\hdwwiz.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\newdev.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\msiexec.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\conime.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\DevicePairingWizard.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\reg.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00060928 _____ (Microsoft Corporation) C:\Windows\system32\findstr.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00058368 _____ (Microsoft Corporation) C:\Windows\system32\PnPUnattend.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00058368 _____ (Microsoft Corporation) C:\Windows\system32\cipher.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00049152 _____ (Microsoft Corporation) C:\Windows\system32\cmmon32.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00046080 _____ (Microsoft Corporation) C:\Windows\system32\csrstub.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\cbsra.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\rekeywiz.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\ftp.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\ocsetup.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\bthudtask.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\PnPutil.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\DeviceEject.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00021504 _____ (Microsoft Corporation) C:\Windows\system32\msacm32.drv
2014-08-16 00:29 - 2009-04-10 23:27 - 00019968 _____ (Microsoft Corporation) C:\Windows\system32\fc.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\rasdial.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\gpupdate.exe
2014-08-16 00:29 - 2009-04-10 23:23 - 00413696 _____ (Microsoft Corporation) C:\Windows\system32\imkr80.ime
2014-08-16 00:29 - 2009-04-10 23:23 - 00124928 _____ (Microsoft Corporation) C:\Windows\system32\quick.ime
2014-08-16 00:29 - 2009-04-10 23:23 - 00124928 _____ (Microsoft Corporation) C:\Windows\system32\qintlgnt.ime
2014-08-16 00:29 - 2009-04-10 23:23 - 00124928 _____ (Microsoft Corporation) C:\Windows\system32\phon.ime
2014-08-16 00:29 - 2009-04-10 23:23 - 00089088 _____ (Microsoft Corporation) C:\Windows\system32\pintlgnt.ime
2014-08-16 00:29 - 2009-04-10 23:22 - 00124928 _____ (Microsoft Corporation) C:\Windows\system32\cintlgnt.ime
2014-08-16 00:29 - 2009-04-10 23:22 - 00124928 _____ (Microsoft Corporation) C:\Windows\system32\chajei.ime
2014-08-16 00:29 - 2009-04-10 23:22 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\f3ahvoas.dll
2014-08-16 00:29 - 2009-04-10 23:21 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2014-08-16 00:29 - 2009-04-10 22:42 - 00093696 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\bridge.sys
2014-08-16 00:29 - 2009-04-10 22:03 - 12240896 _____ (Microsoft Corporation) C:\Windows\system32\NlsLexicons0007.dll
2014-08-16 00:29 - 2009-04-10 22:03 - 02644480 _____ (Microsoft Corporation) C:\Windows\system32\NlsLexicons0009.dll
2014-08-16 00:29 - 2009-04-10 21:51 - 00180736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys
2014-08-16 00:29 - 2009-04-10 21:48 - 00344698 _____ () C:\Windows\system32\eaphost.tmf
2014-08-16 00:29 - 2009-04-10 21:46 - 00121344 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndiswan.sys
2014-08-16 00:29 - 2009-04-10 21:46 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rassstp.sys
2014-08-16 00:29 - 2009-04-10 21:46 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\raspppoe.sys
2014-08-16 00:29 - 2009-04-10 21:46 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\RNDISMP.sys
2014-08-16 00:29 - 2009-04-10 21:45 - 00185856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netbt.sys
2014-08-16 00:29 - 2009-04-10 21:45 - 00113664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rmcast.sys
2014-08-16 00:29 - 2009-04-10 21:45 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\pacer.sys
2014-08-16 00:29 - 2009-04-10 21:43 - 00442788 _____ () C:\Windows\system32\dot3.tmf
2014-08-16 00:29 - 2009-04-10 21:43 - 00392170 _____ () C:\Windows\system32\onex.tmf
2014-08-16 00:29 - 2009-04-10 21:43 - 00148480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\nwifi.sys
2014-08-16 00:29 - 2009-04-10 21:42 - 00561152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hdaudbus.sys
2014-08-16 00:29 - 2009-04-10 21:42 - 00167936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys
2014-08-16 00:29 - 2009-04-10 21:42 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
2014-08-16 00:29 - 2009-04-10 21:42 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidusb.sys
2014-08-16 00:29 - 2009-04-10 21:39 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cdrom.sys
2014-08-16 00:29 - 2009-04-10 21:39 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2014-08-16 00:29 - 2009-04-10 21:27 - 00002560 _____ (Microsoft Corporation) C:\Windows\system32\msimsg.dll
2014-08-16 00:29 - 2009-04-10 21:23 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-08-16 00:29 - 2009-04-10 21:23 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxg.sys
2014-08-16 00:29 - 2009-04-10 21:14 - 00225280 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdbss.sys
2014-08-16 00:29 - 2009-04-10 21:14 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2014-08-16 00:29 - 2009-04-10 21:14 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\npfs.sys
2014-08-16 00:29 - 2009-04-10 21:13 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fastfat.sys
2014-08-16 00:29 - 2009-04-10 21:13 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\exfat.sys
2014-08-16 00:29 - 2009-04-10 21:12 - 00617984 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2014-08-16 00:29 - 2009-03-29 21:42 - 00155456 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll
2014-08-16 00:29 - 2009-03-29 21:42 - 00080720 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll
2014-08-16 00:29 - 2009-02-19 17:20 - 00009212 _____ () C:\Windows\system32\RacUR.xml
2014-08-16 00:29 - 2009-02-18 11:39 - 00779136 _____ (Microsoft Corporation) C:\Windows\system32\PresentationNative_v0300.dll
2014-08-16 00:29 - 2009-02-18 11:39 - 00102816 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2014-08-16 00:29 - 2009-02-18 11:38 - 00099680 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2014-08-16 00:29 - 2009-02-18 11:38 - 00035168 _____ (Microsoft Corporation) C:\Windows\system32\infocardcpl.cpl
2014-08-16 00:28 - 2009-04-10 23:33 - 00986600 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2014-08-16 00:28 - 2009-04-10 23:33 - 00926184 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
2014-08-16 00:28 - 2009-04-10 23:33 - 00292840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\volmgrx.sys
2014-08-16 00:28 - 2009-04-10 23:32 - 00438744 _____ (Microsoft Corporation) C:\Windows\system32\mcupdate_GenuineIntel.dll
2014-08-16 00:28 - 2009-04-10 23:32 - 00226280 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\volsnap.sys
2014-08-16 00:28 - 2009-04-10 23:32 - 00122344 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Storport.sys
2014-08-16 00:28 - 2009-04-10 23:32 - 00019944 _____ (Microsoft Corporation) C:\Windows\system32\kdusb.dll
2014-08-16 00:28 - 2009-04-10 23:32 - 00017896 _____ (Microsoft Corporation) C:\Windows\system32\kd1394.dll
2014-08-16 00:28 - 2009-04-10 23:32 - 00017384 _____ (Microsoft Corporation) C:\Windows\system32\kdcom.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 03217408 _____ (Microsoft Corporation) C:\Windows\system32\WinSAT.exe
2014-08-16 00:28 - 2009-04-10 23:28 - 02205184 _____ (Microsoft Corporation) C:\Windows\system32\SyncCenter.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 02167808 _____ (Microsoft Corporation) C:\Windows\system32\mmcndmgr.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 02012160 _____ (Microsoft Corporation) C:\Windows\system32\milcore.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 01671680 _____ (Microsoft Corporation) C:\Windows\system32\wlanpref.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 01580544 _____ (Microsoft Corporation) C:\Windows\system32\wpccpl.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 01575936 _____ (Microsoft Corporation) C:\Windows\system32\WMVENCOD.DLL
2014-08-16 00:28 - 2009-04-10 23:28 - 01555456 _____ (Microsoft Corporation) C:\Windows\system32\WindowsAnytimeUpgradeCPL.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 01533440 _____ (Microsoft Corporation) C:\Windows\system32\wcnwiz.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 01382912 _____ (Microsoft Corporation) C:\Windows\system32\WMVSDECD.DLL
2014-08-16 00:28 - 2009-04-10 23:28 - 01224192 _____ (Microsoft Corporation) C:\Windows\system32\sud.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 01143296 _____ (Microsoft Corporation) C:\Windows\system32\wercon.exe
2014-08-16 00:28 - 2009-04-10 23:28 - 01123840 _____ (Microsoft Corporation) C:\Windows\system32\usercpl.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 01081344 _____ (Microsoft Corporation) C:\Windows\system32\SLCExt.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 01077248 _____ (Microsoft Corporation) C:\Windows\system32\vssapi.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 01055232 _____ (Microsoft Corporation) C:\Windows\system32\VSSVC.exe
2014-08-16 00:28 - 2009-04-10 23:28 - 01020928 _____ (Microsoft Corporation) C:\Windows\system32\wdc.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 01017856 _____ (Microsoft Corporation) C:\Windows\system32\wevtsvc.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00996352 _____ (Microsoft Corporation) C:\Windows\system32\WMNetMgr.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00968192 _____ (Microsoft Corporation) C:\Windows\system32\wcnwiz2.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00876032 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00860160 _____ (Microsoft Corporation) C:\Windows\system32\WerFaultSecure.exe
2014-08-16 00:28 - 2009-04-10 23:28 - 00777216 _____ (Microsoft Corporation) C:\Windows\system32\slcc.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00759296 _____ (Microsoft Corporation) C:\Windows\system32\ipsecsnp.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00729600 _____ (Microsoft Corporation) C:\Windows\system32\IMJP10K.DLL
2014-08-16 00:28 - 2009-04-10 23:28 - 00712704 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00705536 _____ (Microsoft Corporation) C:\Windows\system32\SmiEngine.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00677376 _____ (Microsoft Corporation) C:\Windows\system32\imapi2fs.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00657408 _____ (Microsoft Corporation) C:\Windows\system32\WMVXENCD.DLL
2014-08-16 00:28 - 2009-04-10 23:28 - 00638976 _____ (Microsoft Corporation) C:\Windows\system32\Utilman.exe
2014-08-16 00:28 - 2009-04-10 23:28 - 00627712 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00586752 _____ (Microsoft Corporation) C:\Windows\system32\stobject.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00582144 _____ (Microsoft Corporation) C:\Windows\system32\SLCommDlg.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00558080 _____ (Microsoft Corporation) C:\Windows\system32\sysmain.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00547840 _____ (Microsoft Corporation) C:\Windows\system32\wiaaut.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00533504 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmsdk.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00532992 _____ (Microsoft Corporation) C:\Windows\system32\wpcao.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00524288 _____ (Microsoft Corporation) C:\Windows\system32\sqlsrv32.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00507904 _____ (Microsoft Corporation) C:\Windows\system32\vdsdyn.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\wiaservc.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00443392 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00438784 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2014-08-16 00:28 - 2009-04-10 23:28 - 00425472 _____ (Microsoft Corporation) C:\Windows\system32\shwebsvc.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00413696 _____ (Microsoft Corporation) C:\Windows\system32\wcncsvc.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00399360 _____ (Microsoft Corporation) C:\Windows\system32\wlangpui.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00396288 _____ (Microsoft Corporation) C:\Windows\system32\ipsmsnap.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00385536 _____ (Microsoft Corporation) C:\Windows\system32\vds.exe
2014-08-16 00:28 - 2009-04-10 23:28 - 00378368 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00378368 _____ (Microsoft Corporation) C:\Windows\system32\imapi2.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00364032 _____ (Microsoft Corporation) C:\Windows\system32\IPSECSVC.DLL
2014-08-16 00:28 - 2009-04-10 23:28 - 00361984 _____ (Microsoft Corporation) C:\Windows\system32\SLUI.exe
2014-08-16 00:28 - 2009-04-10 23:28 - 00356864 _____ (Microsoft Corporation) C:\Windows\system32\MediaMetadataHandler.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00347648 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecsExt.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00342528 _____ (Microsoft Corporation) C:\Windows\system32\zipfldr.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\untfs.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00321536 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00314368 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-08-16 00:28 - 2009-04-10 23:28 - 00311808 _____ (Microsoft Corporation) C:\Windows\system32\swprv.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\wmpeffects.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00301568 _____ (Microsoft Corporation) C:\Windows\system32\srchadmin.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00291328 _____ (Microsoft Corporation) C:\Windows\system32\WscEapPr.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00289792 _____ (Microsoft Corporation) C:\Windows\system32\spinstall.exe
2014-08-16 00:28 - 2009-04-10 23:28 - 00287744 _____ (Microsoft Corporation) C:\Windows\system32\Wldap32.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00282624 _____ (Microsoft Corporation) C:\Windows\system32\w32time.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00273920 _____ (Microsoft Corporation) C:\Windows\system32\wow32.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00252928 _____ (Microsoft Corporation) C:\Windows\system32\iassdo.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00250368 _____ (Microsoft Corporation) C:\Windows\system32\wevtapi.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00244224 _____ (Microsoft Corporation) C:\Windows\system32\wisptis.exe
2014-08-16 00:28 - 2009-04-10 23:28 - 00228352 _____ (Microsoft Corporation) C:\Windows\system32\SLC.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00223744 _____ (Microsoft Corporation) C:\Windows\system32\wscntfy.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\wdscore.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00217088 _____ (Microsoft Corporation) C:\Windows\system32\WerFault.exe
2014-08-16 00:28 - 2009-04-10 23:28 - 00208896 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00203264 _____ (Microsoft Corporation) C:\Windows\system32\uDWM.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\wlanui.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00200704 _____ (Microsoft Corporation) C:\Windows\system32\input.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00197632 _____ (Microsoft Corporation) C:\Windows\system32\SndVol.exe
2014-08-16 00:28 - 2009-04-10 23:28 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\sperror.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00189952 _____ (Microsoft Corporation) C:\Windows\system32\winmm.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00185856 _____ (Microsoft Corporation) C:\Windows\system32\SLLUA.exe
2014-08-16 00:28 - 2009-04-10 23:28 - 00182272 _____ (Microsoft Corporation) C:\Windows\system32\iassam.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00177664 _____ (Microsoft Corporation) C:\Windows\system32\WSDMon.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00165376 _____ (Microsoft Corporation) C:\Windows\system32\WcnNetsh.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00164352 _____ (Microsoft Corporation) C:\Windows\system32\spwizui.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\wevtutil.exe
2014-08-16 00:28 - 2009-04-10 23:28 - 00160768 _____ (Microsoft Corporation) C:\Windows\system32\spoolss.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00158208 _____ (Microsoft Corporation) C:\Windows\system32\iasrad.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00155648 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe
2014-08-16 00:28 - 2009-04-10 23:28 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\korwbrkr.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00142336 _____ (Microsoft Corporation) C:\Windows\system32\spp.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00140800 _____ (Microsoft Corporation) C:\Windows\system32\wusa.exe
2014-08-16 00:28 - 2009-04-10 23:28 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\wpcsvc.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00134656 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00128000 _____ (Microsoft Corporation) C:\Windows\system32\vdsutil.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00126976 _____ (Microsoft Corporation) C:\Windows\system32\wersvc.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00125952 _____ (Microsoft Corporation) C:\Windows\system32\softkbd.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00119296 _____ (Microsoft Corporation) C:\Windows\system32\iasrecst.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\WinSCard.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\imm32.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\spreview.exe
2014-08-16 00:28 - 2009-04-10 23:28 - 00108544 _____ (Microsoft Corporation) C:\Windows\system32\userenv.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\imapi.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00103936 _____ (Microsoft Corporation) C:\Windows\system32\sysclass.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00101376 _____ (Microsoft Corporation) C:\Windows\system32\shsetup.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00091648 _____ (Microsoft Corporation) C:\Windows\system32\IPHLPAPI.DLL
2014-08-16 00:28 - 2009-04-10 23:28 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\wshext.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00083456 _____ (Microsoft) C:\Windows\system32\SMBHelperClass.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00083456 _____ (Microsoft Corporation) C:\Windows\system32\wlgpclnt.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\iassvcs.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00067584 _____ (Microsoft Corporation) C:\Windows\system32\slwmi.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2014-08-16 00:28 - 2009-04-10 23:28 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\wscsvc.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00060928 _____ (Microsoft Corporation) C:\Windows\system32\SLUINotify.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00056320 _____ (Microsoft Corporation) C:\Windows\system32\xmlfilter.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\Storprop.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\mmci.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00050688 _____ (Microsoft Corporation) C:\Windows\system32\wsnmp32.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\l2nacp.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\slcinst.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\mimefilt.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\TSTheme.exe
2014-08-16 00:28 - 2009-04-10 23:28 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\wshbth.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iaspolcy.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\wscapi.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\whealogr.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\ifmon.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\wsepno.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\uxsms.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00020992 _____ (Microsoft Corporation) C:\Windows\system32\wsdchngr.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00020480 _____ (Microsoft Corporation) C:\Windows\system32\version.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00019968 _____ (Microsoft Corporation) C:\Windows\system32\winrnr.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\wscisvif.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\vdmdbg.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\midimap.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\spcmsg.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\mmcico.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\slwga.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\spwinsat.dll
2014-08-16 00:28 - 2009-04-10 23:27 - 03408896 _____ (Microsoft Corporation) C:\Windows\system32\SLsvc.exe
2014-08-16 00:28 - 2009-04-10 23:27 - 01792512 _____ (Microsoft Corporation) C:\Windows\system32\mmc.exe
2014-08-16 00:28 - 2009-04-10 23:27 - 01689600 _____ (Microsoft Corporation) C:\Windows\system32\wscui.cpl
2014-08-16 00:28 - 2009-04-10 23:27 - 00950272 _____ (Microsoft Corporation) C:\Windows\system32\mblctr.exe
2014-08-16 00:28 - 2009-04-10 23:27 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\Magnify.exe
2014-08-16 00:28 - 2009-04-10 23:27 - 00389632 _____ (Microsoft Corporation) C:\Windows\system32\sysmon.ocx
2014-08-16 00:28 - 2009-04-10 23:27 - 00280064 _____ (Microsoft Corporation) C:\Windows\system32\unimdm.tsp
2014-08-16 00:28 - 2009-04-10 23:27 - 00258048 _____ (Microsoft Corporation) C:\Windows\system32\winspool.drv
2014-08-16 00:28 - 2009-04-10 23:27 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\wdmaud.drv
2014-08-16 00:28 - 2009-04-10 23:27 - 00135168 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx
2014-08-16 00:28 - 2009-04-10 23:27 - 00094720 _____ (Microsoft Corporation) C:\Windows\system32\logagent.exe
2014-08-16 00:28 - 2009-04-10 23:27 - 00093696 _____ (Microsoft Corporation) C:\Windows\system32\Kswdmcap.ax
2014-08-16 00:28 - 2009-04-10 23:27 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\logman.exe
2014-08-16 00:28 - 2009-04-10 23:27 - 00026624 _____ (Microsoft Corporation) C:\Windows\system32\ipconfig.exe
2014-08-16 00:28 - 2009-04-10 23:22 - 00883712 _____ (Microsoft Corporation) C:\Windows\system32\IMJP10.IME
2014-08-16 00:28 - 2009-04-10 21:46 - 00208966 _____ () C:\Windows\system32\WFP.TMF
2014-08-16 00:28 - 2009-04-10 21:46 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usb8023.sys
2014-08-16 00:28 - 2009-04-10 21:45 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\smb.sys
2014-08-16 00:28 - 2009-04-10 21:43 - 00196096 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-08-16 00:28 - 2009-04-10 21:42 - 00226304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-08-16 00:28 - 2009-04-10 21:42 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBAUDIO.sys
2014-08-16 00:28 - 2009-04-10 21:42 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBSTOR.SYS
2014-08-16 00:28 - 2009-04-10 21:42 - 00052992 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\stream.sys
2014-08-16 00:28 - 2009-04-10 21:42 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-08-16 00:28 - 2009-04-10 21:42 - 00025856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBCAMD2.sys
2014-08-16 00:28 - 2009-04-10 21:42 - 00025856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBCAMD.sys
2014-08-16 00:28 - 2009-04-10 21:39 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\iscsilog.dll
2014-08-16 00:28 - 2009-04-10 21:38 - 00149504 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ks.sys
2014-08-16 00:28 - 2009-04-10 21:22 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\watchdog.sys
2014-08-16 00:28 - 2009-04-10 21:14 - 00226816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\udfs.sys
2014-08-16 00:28 - 2009-04-10 19:52 - 00684032 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\spsys.sys
2014-08-16 00:28 - 2009-04-10 18:59 - 00107612 _____ () C:\Windows\system32\StructuredQuerySchema.bin
2014-08-16 00:28 - 2009-04-10 18:54 - 03662128 _____ () C:\Windows\system32\locale.nls
2014-08-16 00:28 - 2009-02-19 17:20 - 00009239 _____ () C:\Windows\system32\spcinstrumentation.man
2014-08-16 00:28 - 2009-02-18 11:39 - 00092918 _____ () C:\Windows\system32\slmgr.vbs
2014-08-16 00:28 - 2009-02-18 11:39 - 00035680 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-08-16 00:28 - 2009-02-18 11:38 - 00619864 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2014-08-16 00:28 - 2009-02-18 11:38 - 00009048 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2014-08-16 00:27 - 2009-04-10 23:32 - 00053224 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\termdd.sys
2014-08-16 00:27 - 2009-04-10 23:28 - 01576960 _____ (Microsoft Corporation) C:\Windows\system32\tquery.dll
2014-08-16 00:27 - 2009-04-10 23:28 - 01152000 _____ (Microsoft Corporation) C:\Windows\system32\themecpl.dll
2014-08-16 00:27 - 2009-04-10 23:28 - 00842240 _____ (Microsoft Corporation) C:\Windows\system32\systemcpl.dll
2014-08-16 00:27 - 2009-04-10 23:28 - 00615424 _____ (Microsoft Corporation) C:\Windows\system32\themeui.dll
2014-08-16 00:27 - 2009-04-10 23:28 - 00449024 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2014-08-16 00:27 - 2009-04-10 23:28 - 00313344 _____ (Microsoft Corporation) C:\Windows\system32\thawbrkr.dll
2014-08-16 00:27 - 2009-04-10 23:28 - 00242688 _____ (Microsoft Corporation) C:\Windows\system32\tapisrv.dll
2014-08-16 00:27 - 2009-04-10 23:28 - 00222720 _____ (Microsoft Corporation) C:\Windows\system32\umpnpmgr.dll
2014-08-16 00:27 - 2009-04-10 23:28 - 00170496 _____ (Microsoft Corporation) C:\Windows\system32\tcpipcfg.dll
2014-08-16 00:27 - 2009-04-10 23:28 - 00135168 _____ (Microsoft Corporation) C:\Windows\system32\tcpmon.dll
2014-08-16 00:27 - 2009-04-10 23:28 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\ulib.dll
2014-08-16 00:27 - 2009-04-10 23:23 - 00125952 _____ (Microsoft Corporation) C:\Windows\system32\tintlgnt.ime
2014-08-16 00:27 - 2009-04-10 21:45 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2014-08-16 00:27 - 2009-03-06 18:11 - 00130008 _____ () C:\Windows\system32\systemsf.ebd
2014-08-16 00:24 - 2014-08-16 00:24 - 00000000 ____D () C:\Windows\system32\EventProviders
2014-08-16 00:06 - 2014-08-16 00:23 - 365230920 _____ (Microsoft Corporation) C:\Users\Wichsis\Downloads\Windows6.0-KB948465-X86.exe
2014-08-16 00:04 - 2014-08-16 00:23 - 365230920 _____ (Microsoft Corporation) C:\Users\Wichsis\Downloads\Windows6.0-KB948465-X86(1).exe
2014-08-15 23:42 - 2014-08-15 23:42 - 00002701 _____ () C:\Windows\system32\FSS.txt
2014-08-15 23:41 - 2014-08-15 23:41 - 00415232 _____ (Farbar) C:\Users\Wichsis\Downloads\FSS.exe
2014-08-15 21:08 - 2014-08-15 21:09 - 02347384 _____ (ESET) C:\Users\Wichsis\Downloads\esetsmartinstaller_deu.exe
2014-08-15 20:57 - 2014-08-15 20:57 - 00000000 ____D () C:\Users\Wichsis\AppData\Roaming\Avira
2014-08-15 20:54 - 2014-08-16 11:33 - 00012779 _____ () C:\Users\Wichsis\Desktop\FRST.txt
2014-08-15 20:00 - 2014-08-16 11:28 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-15 19:59 - 2014-08-15 19:59 - 00000899 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-08-15 19:59 - 2014-08-15 19:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-08-15 19:59 - 2014-08-15 19:59 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-15 19:59 - 2014-08-15 19:59 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2014-08-15 19:59 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-08-15 19:59 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-08-15 19:59 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-08-15 19:58 - 2014-08-15 19:58 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Kathi\Downloads\mbam-setup-2.0.2.1012.exe
2014-08-15 19:46 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\system32\sqlite3.dll
2014-08-15 19:44 - 2014-08-15 19:46 - 00000000 ____D () C:\AdwCleaner
2014-08-15 19:42 - 2014-08-15 19:42 - 01356107 _____ () C:\Users\Kathi\Downloads\adwcleaner_3.305.exe
2014-08-15 19:23 - 2014-08-15 19:23 - 00017045 _____ () C:\ComboFix.txt
2014-08-15 19:11 - 2014-08-15 19:23 - 00000000 ____D () C:\ComboFix
2014-08-15 19:11 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-08-15 19:11 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-08-15 19:11 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-08-15 19:11 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-08-15 19:11 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-08-15 19:11 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-08-15 19:11 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-08-15 19:11 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-08-15 19:10 - 2014-08-15 19:23 - 00000000 ____D () C:\Qoobox
2014-08-15 19:10 - 2014-08-15 19:21 - 00000000 ____D () C:\Windows\erdnt
2014-08-15 19:07 - 2014-08-15 19:07 - 05571320 ____R (Swearware) C:\Users\Kathi\Desktop\ComboFix.exe
2014-08-15 17:40 - 2014-08-15 17:40 - 00025127 _____ () C:\Users\Kathi\Desktop\FRST.txt
2014-08-15 17:40 - 2014-08-15 17:40 - 00022313 _____ () C:\Users\Kathi\Desktop\Addition.txt
2014-08-15 17:39 - 2014-08-15 20:30 - 00026282 _____ () C:\Users\Kathi\Downloads\FRST.txt
2014-08-15 17:39 - 2014-08-15 17:39 - 00022313 _____ () C:\Users\Kathi\Downloads\Addition.txt
2014-08-15 17:38 - 2014-08-16 11:33 - 00000000 ____D () C:\FRST
2014-08-15 17:37 - 2014-08-16 11:33 - 01093632 _____ (Farbar) C:\Users\Wichsis\Desktop\FRST.exe
2014-08-12 20:43 - 2014-08-12 20:50 - 151513264 _____ () C:\Users\Kathi\Downloads\avira_free_antivirus06_de(1).exe
2014-08-12 20:42 - 2014-08-12 20:49 - 151513264 _____ () C:\Users\Kathi\Downloads\avira_free_antivirus06_de.exe
2014-08-04 21:09 - 2014-08-04 21:09 - 00000000 ____D () C:\Users\Kathi\AppData\Roaming\dll-files.com
2014-07-30 20:35 - 2014-07-30 20:35 - 00000000 ____D () C:\Program Files\Mozilla Firefox(23)

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-16 11:33 - 2014-08-16 11:33 - 00000000 ____D () C:\Users\Wichsis\Desktop\FRST-OlderVersion
2014-08-16 11:33 - 2014-08-15 20:54 - 00012779 _____ () C:\Users\Wichsis\Desktop\FRST.txt
2014-08-16 11:33 - 2014-08-15 17:38 - 00000000 ____D () C:\FRST
2014-08-16 11:33 - 2014-08-15 17:37 - 01093632 _____ (Farbar) C:\Users\Wichsis\Desktop\FRST.exe
2014-08-16 11:33 - 2009-08-11 21:16 - 00000422 ____H () C:\Windows\Tasks\User_Feed_Synchronization-{7030CE83-CC54-445E-964F-73E63606DF74}.job
2014-08-16 11:32 - 2006-11-02 12:33 - 01592750 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-08-16 11:30 - 2009-07-21 20:26 - 01493344 _____ () C:\Windows\WindowsUpdate.log
2014-08-16 11:29 - 2009-08-11 02:35 - 00000000 ____D () C:\Users\Wichsis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite
2014-08-16 11:28 - 2014-08-15 20:00 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-16 11:28 - 2012-08-18 23:35 - 00001096 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-08-16 11:27 - 2006-11-02 14:58 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-16 11:27 - 2006-11-02 14:45 - 00004784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-16 11:27 - 2006-11-02 14:45 - 00004784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-16 11:25 - 2014-08-16 11:25 - 00000000 ____D () C:\Users\Wichsis\AppData\Local\WindowsUpdate
2014-08-16 11:25 - 2006-11-02 14:58 - 00032514 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-08-16 11:24 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-08-16 11:23 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\de-DE
2014-08-16 11:20 - 2009-08-11 02:39 - 00000000 ____D () C:\Program Files\Microsoft.NET
2014-08-16 11:10 - 2006-11-02 14:44 - 00389288 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-08-16 11:08 - 2014-08-16 11:08 - 00000000 ____D () C:\Windows\system32\WindowsPowerShell
2014-08-16 11:08 - 2006-11-02 13:18 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2014-08-16 11:03 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\rescache
2014-08-16 10:52 - 2014-08-16 10:52 - 00000000 ____D () C:\Windows\system32\x64
2014-08-16 10:46 - 2012-08-18 23:35 - 00001100 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-08-16 10:33 - 2008-01-21 05:02 - 00748726 _____ () C:\Windows\PFRO.log
2014-08-16 01:04 - 2013-08-16 18:35 - 00000000 ____D () C:\Windows\system32\MRT
2014-08-16 01:02 - 2006-11-02 12:24 - 96303304 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-08-16 00:58 - 2009-08-11 02:46 - 00000915 _____ () C:\Users\Wichsis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Mail.lnk
2014-08-16 00:57 - 2011-12-28 18:30 - 00000915 _____ () C:\Users\Kathi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Mail.lnk
2014-08-16 00:57 - 2011-12-28 18:30 - 00000000 ____D () C:\Users\Kathi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite
2014-08-16 00:46 - 2014-08-16 00:45 - 00000000 ____D () C:\Windows\system32\vi-VN
2014-08-16 00:46 - 2014-08-16 00:45 - 00000000 ____D () C:\Windows\system32\eu-ES
2014-08-16 00:46 - 2014-08-16 00:45 - 00000000 ____D () C:\Windows\system32\ca-ES
2014-08-16 00:46 - 2009-06-15 09:26 - 00000000 ____D () C:\Windows\system32\Drivers\de-DE
2014-08-16 00:46 - 2006-11-02 14:35 - 00000000 ____D () C:\Windows\system32\XPSViewer
2014-08-16 00:46 - 2006-11-02 14:35 - 00000000 ____D () C:\Program Files\Windows Sidebar
2014-08-16 00:46 - 2006-11-02 14:35 - 00000000 ____D () C:\Program Files\Windows Photo Gallery
2014-08-16 00:46 - 2006-11-02 14:35 - 00000000 ____D () C:\Program Files\Windows Defender
2014-08-16 00:46 - 2006-11-02 14:35 - 00000000 ____D () C:\Program Files\Windows Collaboration
2014-08-16 00:46 - 2006-11-02 14:35 - 00000000 ____D () C:\Program Files\Windows Calendar
2014-08-16 00:46 - 2006-11-02 14:35 - 00000000 ____D () C:\Program Files\Movie Maker
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\zh-TW
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\zh-CN
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\uk-UA
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\tr-TR
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\th-TH
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\sv-SE
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\sr-Latn-CS
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\SLUI
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\sl-SI
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\sk-SK
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\ru-RU
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\ro-RO
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\pt-PT
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\pt-BR
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\pl-PL
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\nl-NL
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\nb-NO
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\lv-LV
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\lt-LT
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\ko-KR
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\ja-JP
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\it-IT
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\hu-HU
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\hr-HR
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\he-IL
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\fr-FR
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\fi-FI
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\et-EE
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\el-GR
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\bg-BG
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\ar-SA
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\AdvancedInstallers
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\IME
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Program Files\Common Files\System
2014-08-16 00:45 - 2009-06-15 11:13 - 00000000 ____D () C:\Windows\system32\RTCOM
2014-08-16 00:45 - 2006-11-02 14:49 - 00160471 _____ () C:\Windows\setupact.log
2014-08-16 00:42 - 2014-08-16 00:42 - 00000000 ____D () C:\Windows\system32\SPReview
2014-08-16 00:24 - 2014-08-16 00:24 - 00000000 ____D () C:\Windows\system32\EventProviders
2014-08-16 00:23 - 2014-08-16 00:06 - 365230920 _____ (Microsoft Corporation) C:\Users\Wichsis\Downloads\Windows6.0-KB948465-X86.exe
2014-08-16 00:23 - 2014-08-16 00:04 - 365230920 _____ (Microsoft Corporation) C:\Users\Wichsis\Downloads\Windows6.0-KB948465-X86(1).exe
2014-08-15 23:42 - 2014-08-15 23:42 - 00002701 _____ () C:\Windows\system32\FSS.txt
2014-08-15 23:41 - 2014-08-15 23:41 - 00415232 _____ (Farbar) C:\Users\Wichsis\Downloads\FSS.exe
2014-08-15 23:38 - 2012-09-18 20:12 - 00001963 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-08-15 21:09 - 2014-08-15 21:08 - 02347384 _____ (ESET) C:\Users\Wichsis\Downloads\esetsmartinstaller_deu.exe
2014-08-15 20:57 - 2014-08-15 20:57 - 00000000 ____D () C:\Users\Wichsis\AppData\Roaming\Avira
2014-08-15 20:30 - 2014-08-15 17:39 - 00026282 _____ () C:\Users\Kathi\Downloads\FRST.txt
2014-08-15 20:19 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\Speech
2014-08-15 19:59 - 2014-08-15 19:59 - 00000899 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-08-15 19:59 - 2014-08-15 19:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-08-15 19:59 - 2014-08-15 19:59 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-15 19:59 - 2014-08-15 19:59 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2014-08-15 19:58 - 2014-08-15 19:58 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Kathi\Downloads\mbam-setup-2.0.2.1012.exe
2014-08-15 19:46 - 2014-08-15 19:44 - 00000000 ____D () C:\AdwCleaner
2014-08-15 19:46 - 2013-11-02 23:21 - 00000846 _____ () C:\Users\Wichsis\Desktop\Search.lnk
2014-08-15 19:42 - 2014-08-15 19:42 - 01356107 _____ () C:\Users\Kathi\Downloads\adwcleaner_3.305.exe
2014-08-15 19:27 - 2014-04-27 21:32 - 00000000 ___RD () C:\Users\Kathi\Dropbox
2014-08-15 19:23 - 2014-08-15 19:23 - 00017045 _____ () C:\ComboFix.txt
2014-08-15 19:23 - 2014-08-15 19:11 - 00000000 ____D () C:\ComboFix
2014-08-15 19:23 - 2014-08-15 19:10 - 00000000 ____D () C:\Qoobox
2014-08-15 19:23 - 2009-08-11 03:13 - 00000000 ____D () C:\Users\Wichsis\AppData\Local\Google
2014-08-15 19:23 - 2006-11-02 13:18 - 00000000 __RHD () C:\Users\Default
2014-08-15 19:23 - 2006-11-02 13:18 - 00000000 ___RD () C:\Users\Public
2014-08-15 19:21 - 2014-08-15 19:10 - 00000000 ____D () C:\Windows\erdnt
2014-08-15 19:21 - 2006-11-02 12:23 - 00000215 _____ () C:\Windows\system.ini
2014-08-15 19:07 - 2014-08-15 19:07 - 05571320 ____R (Swearware) C:\Users\Kathi\Desktop\ComboFix.exe
2014-08-15 18:45 - 2009-08-11 02:42 - 00106960 _____ () C:\Users\Wichsis\AppData\Local\GDIPFONTCACHEV1.DAT
2014-08-15 17:40 - 2014-08-15 17:40 - 00025127 _____ () C:\Users\Kathi\Desktop\FRST.txt
2014-08-15 17:40 - 2014-08-15 17:40 - 00022313 _____ () C:\Users\Kathi\Desktop\Addition.txt
2014-08-15 17:39 - 2014-08-15 17:39 - 00022313 _____ () C:\Users\Kathi\Downloads\Addition.txt
2014-08-15 17:34 - 2014-04-27 21:29 - 00000000 ____D () C:\Users\Kathi\AppData\Roaming\Dropbox
2014-08-15 17:08 - 2013-06-30 22:48 - 00000422 ____H () C:\Windows\Tasks\User_Feed_Synchronization-{DC24E08D-D800-4C9D-9DE2-5FF59CBB27E4}.job
2014-08-12 23:00 - 2014-06-16 11:05 - 00015080 _____ () C:\Users\Kathi\Desktop\Hochzeitsgeschenke.xlsx
2014-08-12 20:50 - 2014-08-12 20:43 - 151513264 _____ () C:\Users\Kathi\Downloads\avira_free_antivirus06_de(1).exe
2014-08-12 20:49 - 2014-08-12 20:42 - 151513264 _____ () C:\Users\Kathi\Downloads\avira_free_antivirus06_de.exe
2014-08-11 23:09 - 2014-06-16 23:09 - 00018357 _____ () C:\Users\Kathi\Desktop\malediven.xlsx
2014-08-11 23:06 - 2014-06-15 16:51 - 00000000 ____D () C:\Users\Kathi\Desktop\Hochzeit - Standesamt
2014-08-11 22:08 - 2014-02-16 18:46 - 00000000 ____D () C:\Users\Kathi\Desktop\Hochzeit
2014-08-10 14:08 - 2012-01-02 21:32 - 00000000 ____D () C:\Users\Kathi\Documents\Passwörter
2014-08-04 21:09 - 2014-08-04 21:09 - 00000000 ____D () C:\Users\Kathi\AppData\Roaming\dll-files.com
2014-08-04 21:06 - 2012-05-15 18:16 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-08-03 23:26 - 2011-12-28 18:30 - 00000000 ____D () C:\Users\Kathi
2014-08-03 23:26 - 2009-08-11 02:35 - 00000000 ____D () C:\Users\Wichsis
2014-08-03 23:26 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\spool
2014-08-03 23:26 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\Msdtc
2014-08-03 23:26 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\registration
2014-08-03 23:26 - 2006-11-02 12:22 - 37748736 _____ () C:\Windows\system32\config\software_previous
2014-08-03 23:26 - 2006-11-02 12:22 - 17301504 _____ () C:\Windows\system32\config\system_previous
2014-08-03 23:23 - 2006-11-02 12:22 - 42991616 _____ () C:\Windows\system32\config\components_previous
2014-08-03 23:23 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\sam_previous
2014-08-03 14:10 - 2012-10-23 18:37 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-08-03 14:10 - 2012-05-15 18:16 - 00000858 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-08-03 14:10 - 2012-05-15 18:16 - 00000846 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-08-03 00:01 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\security_previous
2014-08-03 00:01 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\default_previous
2014-07-30 20:35 - 2014-07-30 20:35 - 00000000 ____D () C:\Program Files\Mozilla Firefox(23)
2014-07-23 10:52 - 2011-12-28 16:24 - 00231584 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-07-22 21:04 - 2014-04-27 21:32 - 00000919 _____ () C:\Users\Kathi\Desktop\Dropbox.lnk
2014-07-22 21:04 - 2014-04-27 21:31 - 00000000 ____D () C:\Users\Kathi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-07-17 18:58 - 2012-03-23 19:56 - 00000000 ____D () C:\ProgramData\tmp
2014-07-17 18:17 - 2009-08-11 02:37 - 00000000 ____D () C:\Users\Wichsis\AppData\Local\Adobe
2014-07-17 18:16 - 2012-09-18 20:11 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-07-17 18:16 - 2012-02-26 00:06 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl

Some content of TEMP:
====================
C:\Users\Kathi\AppData\Local\temp\avgnt.exe
C:\Users\Wichsis\AppData\Local\temp\avgnt.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-08-16 11:32

==================== End Of Log ============================
--- --- ---

deeprybka 16.08.2014 10:43
Guten Morgähn....Die Addition.txt fehlt... ;)

Katharina123 16.08.2014 10:53
Guten Morgen,

ich muss wohl wieder etwas aufmerksamer lesen.
Hatte erst die Checkbox für die Addition nicht angehakt.
Hier jetzt beides:


FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:16-08-2014 02
Ran by Wichsis (administrator) on KATHARINA on 16-08-2014 11:45:47
Running from C:\Users\Wichsis\Desktop
Platform: Microsoft® Windows Vista™ Home Basic  Service Pack 2 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 8
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Microsoft Corporation) C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe
() C:\Program Files\CyberLink\Shared files\RichVideo.exe
(Skype Technologies S.A.) C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbam.exe
(SAMSUNG Electronics co., LTD.) C:\Program Files\Samsung\EBM\EasyBatteryMgr3.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Samsung Magic Doctor\MagicDoctorKbdHk.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(CyberLink) C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe
(CyberLink Corp.) C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Fred's Software) C:\Program Files\PrintKey2000\Printkey2000.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKU\S-1-5-21-3121953689-2843351358-1462341086-1000\...\Run: [KiesHelper] => C:\Program Files\Samsung\Kies\KiesHelper.exe [943504 2012-02-03] (Samsung)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Printkey2000.lnk
ShortcutTarget: Printkey2000.lnk -> C:\Program Files\PrintKey2000\Printkey2000.exe (Fred's Software)
Startup: C:\Users\Kathi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=SMSN&bmod=SMSN
BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO: Google Toolbar Notifier BHO -> {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} -> C:\Program Files\Google\GoogleToolbarNotifier\5.7.9012.1008\swg.dll (Google Inc.)
BHO: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {6E718D87-6909-4FCE-92D4-EDCB2F725727} hxxp://navigram.com/engine/v1026/Navigram.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Wichsis\AppData\Roaming\Mozilla\Firefox\Profiles\an2mua9h.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.7.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2012-10-23]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2011-12-28]
FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2 [2012-08-30]
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2
FF HKCU\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files\Common Files\DVDVideoSoft\plugins\ff
FF Extension: Download videos and MP3s from YouTube - C:\Program Files\Common Files\DVDVideoSoft\plugins\ff [2013-11-02]

Chrome:
=======
CHR HKLM\...\Chrome\Extension: [aaaaacalgebmfelllfiaoknifldpngjh] - C:\ProgramData\AskPartnerNetwork\Toolbar\AVIRA-V7\CRX\ToolbarCR.crx []

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-08-15] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-08-15] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1021008 2014-08-15] (Avira Operations GmbH & Co. KG)
R2 MBAMScheduler; C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
S4 MSSQLServerADHelper; C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [45272 2005-10-14] (Microsoft Corporation)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [43520 2008-02-28] (Hewlett-Packard) [File not signed]
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [53248 2008-02-28] (Hewlett-Packard) [File not signed]
R2 RichVideo; C:\Program Files\CyberLink\Shared files\RichVideo.exe [247152 2008-11-25] ()
R2 Skype C2C Service; C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [3064000 2012-10-02] (Skype Technologies S.A.)
S2 APNMCP; "C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [97648 2014-07-03] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-06-05] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-26] (Avira Operations GmbH & Co. KG)
R2 KMDFMEMIO; C:\Windows\System32\DRIVERS\kmdfmemio.sys [13312 2006-11-14] (SAMSUNG ELECTRONICS CO., LTD.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-05-12] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [110296 2014-08-16] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-05-12] (Malwarebytes Corporation)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-08-05] (Avira GmbH)
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-21] (Microsoft Corporation)
S3 catchme; \??\C:\Users\Wichsis\AppData\Local\Temp\catchme.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-16 11:33 - 2014-08-16 11:33 - 00000000 ____D () C:\Users\Wichsis\Desktop\FRST-OlderVersion
2014-08-16 11:25 - 2014-08-16 11:25 - 00000000 ____D () C:\Users\Wichsis\AppData\Local\WindowsUpdate
2014-08-16 11:08 - 2014-08-16 11:08 - 00000000 ____D () C:\Windows\system32\WindowsPowerShell
2014-08-16 10:52 - 2014-08-16 10:52 - 00000000 ____D () C:\Windows\system32\x64
2014-08-16 10:49 - 2009-10-09 23:56 - 01181696 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll
2014-08-16 10:49 - 2009-10-09 23:56 - 00246272 _____ (Microsoft Corporation) C:\Windows\system32\WSManHTTPConfig.exe
2014-08-16 10:49 - 2009-10-09 23:56 - 00241152 _____ (Microsoft Corporation) C:\Windows\system32\winrscmd.dll
2014-08-16 10:49 - 2009-10-09 23:56 - 00214016 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll
2014-08-16 10:49 - 2009-10-09 23:56 - 00145408 _____ (Microsoft Corporation) C:\Windows\system32\WsmAuto.dll
2014-08-16 10:49 - 2009-10-09 23:56 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\pwrshplugin.dll
2014-08-16 10:49 - 2009-10-09 23:56 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\winrs.exe
2014-08-16 10:49 - 2009-10-09 23:56 - 00020480 _____ (Microsoft Corporation) C:\Windows\system32\winrshost.exe
2014-08-16 10:49 - 2009-10-09 23:56 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\wsmprovhost.exe
2014-08-16 10:49 - 2009-10-09 23:56 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\wsmplpxy.dll
2014-08-16 10:49 - 2009-10-09 23:56 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\winrssrv.dll
2014-08-16 10:49 - 2009-10-09 23:56 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\winrsmgr.dll
2014-08-16 10:49 - 2009-10-09 23:55 - 00252416 _____ (Microsoft Corporation) C:\Windows\system32\WSManMigrationPlugin.dll
2014-08-16 10:49 - 2009-10-09 23:55 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\wecsvc.dll
2014-08-16 10:49 - 2009-10-09 23:55 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\wevtfwd.dll
2014-08-16 10:49 - 2009-10-09 23:55 - 00079872 _____ (Microsoft Corporation) C:\Windows\system32\wecutil.exe
2014-08-16 10:49 - 2009-10-09 23:55 - 00056320 _____ (Microsoft Corporation) C:\Windows\system32\wecapi.dll
2014-08-16 10:49 - 2009-10-09 23:55 - 00054272 _____ (Microsoft Corporation) C:\Windows\system32\WsmRes.dll
2014-08-16 10:49 - 2009-08-01 08:27 - 00201184 _____ () C:\Windows\system32\winrm.vbs
2014-08-16 10:49 - 2009-07-16 19:30 - 00004675 _____ () C:\Windows\system32\wsmanconfig_schema.xml
2014-08-16 10:49 - 2009-07-16 19:30 - 00002426 _____ () C:\Windows\system32\WsmTxt.xsl
2014-08-16 10:46 - 2011-04-12 18:07 - 00892416 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-08-16 10:46 - 2011-03-03 17:40 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\Apphlpdm.dll
2014-08-16 10:46 - 2011-03-03 15:35 - 04240384 _____ (Microsoft) C:\Windows\system32\GameUXLegacyGDFs.dll
2014-08-16 10:46 - 2010-08-26 18:34 - 01696256 _____ (Microsoft Corporation) C:\Windows\system32\gameux.dll
2014-08-16 10:46 - 2010-01-25 14:00 - 00471552 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll
2014-08-16 10:46 - 2010-01-25 14:00 - 00471552 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll
2014-08-16 10:46 - 2010-01-25 14:00 - 00152576 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll
2014-08-16 10:46 - 2010-01-25 14:00 - 00152064 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll
2014-08-16 10:46 - 2010-01-25 13:58 - 00332288 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll
2014-08-16 10:46 - 2010-01-25 10:21 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe
2014-08-16 10:46 - 2010-01-25 10:21 - 00518144 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe
2014-08-16 10:46 - 2010-01-25 10:21 - 00347136 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe
2014-08-16 10:46 - 2010-01-25 10:21 - 00346624 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe
2014-08-16 10:46 - 2009-10-23 19:10 - 00714240 _____ (Microsoft Corporation) C:\Windows\system32\timedate.cpl
2014-08-16 10:46 - 2009-09-10 16:58 - 00310784 _____ (Microsoft Corporation) C:\Windows\system32\unregmp2.exe
2014-08-16 00:45 - 2014-08-16 00:46 - 00000000 ____D () C:\Windows\system32\vi-VN
2014-08-16 00:45 - 2014-08-16 00:46 - 00000000 ____D () C:\Windows\system32\eu-ES
2014-08-16 00:45 - 2014-08-16 00:46 - 00000000 ____D () C:\Windows\system32\ca-ES
2014-08-16 00:42 - 2014-08-16 00:42 - 00000000 ____D () C:\Windows\system32\SPReview
2014-08-16 00:30 - 2009-04-10 23:28 - 00928768 _____ (Microsoft Corporation) C:\Windows\system32\scavenge.dll
2014-08-16 00:30 - 2009-04-10 23:27 - 00057856 _____ (Microsoft Corporation) C:\Windows\system32\compcln.exe
2014-08-16 00:29 - 2009-04-10 23:33 - 00614376 _____ (Microsoft Corporation) C:\Windows\system32\ci.dll
2014-08-16 00:29 - 2009-04-10 23:32 - 01083880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-08-16 00:29 - 2009-04-10 23:32 - 00527848 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys
2014-08-16 00:29 - 2009-04-10 23:32 - 00265688 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\acpi.sys
2014-08-16 00:29 - 2009-04-10 23:32 - 00245736 _____ (Microsoft Corporation) C:\Windows\system32\clfs.sys
2014-08-16 00:29 - 2009-04-10 23:32 - 00223208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-08-16 00:29 - 2009-04-10 23:32 - 00190424 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fltMgr.sys
2014-08-16 00:29 - 2009-04-10 23:32 - 00180712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-08-16 00:29 - 2009-04-10 23:32 - 00161752 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msrpc.sys
2014-08-16 00:29 - 2009-04-10 23:32 - 00149480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\pci.sys
2014-08-16 00:29 - 2009-04-10 23:32 - 00141288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ecache.sys
2014-08-16 00:29 - 2009-04-10 23:32 - 00125928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Classpnp.sys
2014-08-16 00:29 - 2009-04-10 23:32 - 00099816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2014-08-16 00:29 - 2009-04-10 23:32 - 00054248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\partmgr.sys
2014-08-16 00:29 - 2009-04-10 23:32 - 00053736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\disk.sys
2014-08-16 00:29 - 2009-04-10 23:32 - 00050664 _____ (Microsoft Corporation) C:\Windows\system32\PSHED.DLL
2014-08-16 00:29 - 2009-04-10 23:32 - 00048104 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mup.sys
2014-08-16 00:29 - 2009-04-10 23:32 - 00035304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\crashdmp.sys
2014-08-16 00:29 - 2009-04-10 23:32 - 00027624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Dumpata.sys
2014-08-16 00:29 - 2009-04-10 23:28 - 06103040 _____ (Microsoft Corporation) C:\Windows\system32\chtbrkr.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 03174400 _____ (Microsoft Corporation) C:\Windows\system32\netshell.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 03072000 _____ (Microsoft Corporation) C:\Windows\system32\networkmap.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 02515968 _____ (Microsoft Corporation) C:\Windows\system32\accessibilitycpl.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 02226688 _____ (Microsoft Corporation) C:\Windows\system32\networkexplorer.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 02225664 _____ (Microsoft Corporation) C:\Windows\system32\netcenter.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 02153472 _____ (Microsoft Corporation) C:\Windows\system32\oobefldr.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 02134528 _____ (Microsoft Corporation) C:\Windows\system32\FunctionDiscoveryFolder.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01985024 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01856512 _____ (Microsoft Corporation) C:\Windows\system32\dbgeng.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01823744 _____ (Microsoft Corporation) C:\Windows\system32\pnidui.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01788416 _____ (Microsoft Corporation) C:\Windows\system32\d3d9.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01730560 _____ (Microsoft Corporation) C:\Windows\system32\apds.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01671680 _____ (Microsoft Corporation) C:\Windows\system32\chsbrkr.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01645568 _____ (Microsoft Corporation) C:\Windows\system32\connect.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01591296 _____ (Microsoft Corporation) C:\Windows\system32\setupapi.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01589248 _____ (Microsoft Corporation) C:\Windows\system32\msjet40.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01544704 _____ (Microsoft Corporation) C:\Windows\system32\MSVidCtl.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01541120 _____ (Microsoft Corporation) C:\Windows\system32\onex.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01502720 _____ (Microsoft Corporation) C:\Windows\system32\certmgr.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01480704 _____ (Microsoft Corporation) C:\Windows\system32\mssrch.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01459200 _____ (Microsoft Corporation) C:\Windows\system32\esent.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01381376 _____ (Microsoft Corporation) C:\Windows\system32\Query.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01342464 _____ (Microsoft Corporation) C:\Windows\system32\brcpl.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01324032 _____ (Microsoft Corporation) C:\Windows\system32\browseui.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01248768 _____ (Microsoft Corporation) C:\Windows\system32\PerfCenterCPL.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01209856 _____ (Microsoft Corporation) C:\Windows\system32\comsvcs.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01112064 _____ (Microsoft Corporation) C:\Windows\system32\CertEnroll.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01107968 _____ (Microsoft Corporation) C:\Windows\system32\pidgenx.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01078784 _____ (Microsoft Corporation) C:\Windows\system32\diagperf.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01053696 _____ (Microsoft Corporation) C:\Windows\system32\msdtctm.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00978944 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00978432 _____ (Microsoft Corporation) C:\Windows\system32\drmv2clt.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00971264 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00950784 _____ (Microsoft Corporation) C:\Windows\system32\gpedit.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00880640 _____ (Microsoft Corporation) C:\Windows\system32\RacEngn.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00869888 _____ (Microsoft Corporation) C:\Windows\system32\printui.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00856064 _____ (Microsoft Corporation) C:\Windows\system32\mswdat10.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00825856 _____ (Microsoft Corporation) C:\Windows\system32\rasdlg.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00807424 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00805376 _____ (Microsoft Corporation) C:\Windows\system32\NaturalLanguage6.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00758784 _____ (Microsoft Corporation) C:\Windows\system32\qmgr.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00757248 _____ (Microsoft Corporation) C:\Windows\system32\azroles.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00754688 _____ (Microsoft Corporation) C:\Windows\system32\propsys.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00723968 _____ (Microsoft Corporation) C:\Windows\system32\powercpl.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00679936 _____ (Microsoft Corporation) C:\Windows\system32\msvcrt.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00670720 _____ (Microsoft Corporation) C:\Windows\system32\mssvp.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00644608 _____ (Microsoft Corporation) C:\Windows\system32\p2psvc.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00643072 _____ (Microsoft Corporation) C:\Windows\system32\msrepl40.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00642560 _____ (Microsoft Corporation) C:\Windows\system32\rasgcw.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\CertEnrollUI.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\sethc.exe
2014-08-16 00:29 - 2009-04-10 23:28 - 00618496 _____ (Microsoft Corporation) C:\Windows\system32\mswstr10.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00612864 _____ (Microsoft Corporation) C:\Windows\system32\rdpencom.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00595456 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2014-08-16 00:29 - 2009-04-10 23:28 - 00593408 _____ (Microsoft Corporation) C:\Windows\system32\comuid.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00592896 _____ (Microsoft Corporation) C:\Windows\system32\netlogon.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00576512 _____ (Microsoft Corporation) C:\Windows\system32\gpsvc.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00564224 _____ (Microsoft Corporation) C:\Windows\system32\msftedit.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00564224 _____ (Microsoft Corporation) C:\Windows\system32\emdmgmt.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00560640 _____ (Microsoft Corporation) C:\Windows\system32\msdtcprx.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00551936 _____ (Microsoft Corporation) C:\Windows\system32\prnntfy.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00550400 _____ (Microsoft Corporation) C:\Windows\system32\rpcss.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00542720 _____ (Microsoft Corporation) C:\Windows\system32\blackbox.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00542208 _____ (Microsoft Corporation) C:\Windows\system32\pnpui.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00516608 _____ (Microsoft Corporation) C:\Windows\system32\autoplay.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00505344 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00485888 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00483328 _____ (Microsoft Corporation) C:\Windows\system32\samsrv.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00481792 _____ (Microsoft Corporation) C:\Windows\system32\cmdial32.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00478208 _____ (Microsoft Corporation) C:\Windows\system32\DevicePairing.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00469504 _____ (Microsoft Corporation) C:\Windows\system32\newdev.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00467456 _____ (Microsoft Corporation) C:\Windows\system32\netapi32.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00466944 _____ (Microsoft Corporation) C:\Windows\system32\riched20.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00464384 _____ (Microsoft Corporation) C:\Windows\system32\pcaui.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00463872 _____ (Microsoft Corporation) C:\Windows\system32\IasMigReader.exe
2014-08-16 00:29 - 2009-04-10 23:28 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\msxbde40.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00454144 _____ (Microsoft) C:\Windows\system32\IasMigPlugin.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00450560 _____ (Microsoft Corporation) C:\Windows\system32\comdlg32.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00445952 _____ (Microsoft Corporation) C:\Windows\system32\ncryptui.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00444416 _____ (Microsoft Corporation) C:\Windows\system32\dsound.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00441344 _____ (Microsoft Corporation) C:\Windows\system32\SearchIndexer.exe
2014-08-16 00:29 - 2009-04-10 23:28 - 00425472 _____ (Microsoft Corporation) C:\Windows\system32\PhotoMetadataHandler.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00414208 _____ (Microsoft Corporation) C:\Windows\system32\msscp.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00409600 _____ (Microsoft Corporation) C:\Windows\system32\msexch40.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00407552 _____ (Microsoft Corporation) C:\Windows\system32\MPSSVC.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00406528 _____ (Microsoft Corporation) C:\Windows\system32\msvcp60.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00391680 _____ (Microsoft Corporation) C:\Windows\system32\mscms.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00378368 _____ (Microsoft Corporation) C:\Windows\system32\devmgr.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00376832 _____ (Microsoft Corporation) C:\Windows\system32\rasplap.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00368640 _____ (Microsoft Corporation) C:\Windows\system32\mspbde40.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00368640 _____ () C:\Windows\system32\msjetoledb40.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00351744 _____ (Microsoft Corporation) C:\Windows\system32\mssph.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00344064 _____ (Microsoft Corporation) C:\Windows\system32\msrd3x40.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\RelMon.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00339968 _____ (Microsoft Corporation) C:\Windows\system32\msexcl40.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00334848 _____ (Microsoft Corporation) C:\Windows\system32\BFE.DLL
2014-08-16 00:29 - 2009-04-10 23:28 - 00332800 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00327168 _____ (Microsoft Corporation) C:\Windows\system32\P2PGraph.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00324608 _____ (Microsoft Corporation) C:\Windows\system32\sdohlp.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00323584 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00319488 _____ (Microsoft Corporation) C:\Windows\system32\msrd2x40.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00310272 _____ (Microsoft Corporation) C:\Windows\system32\mtxclu.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00306176 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\QAGENTRT.DLL
2014-08-16 00:29 - 2009-04-10 23:28 - 00297472 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00293376 _____ (Microsoft Corporation) C:\Windows\system32\psisdecd.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00293376 _____ (Microsoft Corporation) C:\Windows\system32\photowiz.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\msjtes40.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00288256 _____ (Microsoft Corporation) C:\Windows\system32\modemui.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00286720 _____ (Microsoft Corporation) C:\Windows\system32\rasapi32.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\drmmgrtn.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00282624 _____ (Microsoft Corporation) C:\Windows\system32\mstext40.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00281088 _____ (Microsoft Corporation) C:\Windows\system32\raschap.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00279552 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2014-08-16 00:29 - 2009-04-10 23:28 - 00274432 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00268800 _____ (Microsoft Corporation) C:\Windows\system32\es.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\rasmans.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\rasppp.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\drvstore.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00245760 _____ (Microsoft Corporation) C:\Windows\system32\scansetting.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00242176 _____ (Microsoft Corporation) C:\Windows\system32\pdh.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00241664 _____ (Microsoft Corporation) C:\Windows\system32\msltus40.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00241152 _____ (Microsoft Corporation) C:\Windows\system32\PortableDeviceApi.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00231424 _____ (Microsoft Corporation) C:\Windows\system32\msshsq.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\mscandui.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00217600 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00216064 _____ (Microsoft Corporation) C:\Windows\system32\ntprint.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00204288 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00204288 _____ (Microsoft Corporation) C:\Windows\system32\dhcpcsvc.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00203264 _____ (Microsoft Corporation) C:\Windows\system32\mssphtb.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00199168 _____ (Microsoft Corporation) C:\Windows\system32\adsldpc.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00194560 _____ (Microsoft Corporation) C:\Windows\system32\offfilt.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\eapp3hst.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00185344 _____ (Microsoft Corporation) C:\Windows\system32\SearchProtocolHost.exe
2014-08-16 00:29 - 2009-04-10 23:28 - 00183808 _____ (Microsoft Corporation) C:\Windows\system32\eapphost.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00181760 _____ (Microsoft Corporation) C:\Windows\system32\pnpsetup.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00180736 _____ (Microsoft Corporation) C:\Windows\system32\netplwiz.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00180224 _____ (Microsoft Corporation) C:\Windows\system32\scrobj.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00179712 _____ (Microsoft Corporation) C:\Windows\system32\msnetobj.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00178176 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00177152 _____ (Microsoft Corporation) C:\Windows\system32\scecli.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00175616 _____ (Microsoft Corporation) C:\Windows\system32\dot3svc.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00171008 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00166400 _____ (Microsoft Corporation) C:\Windows\system32\puiapi.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00163328 _____ (Microsoft Corporation) C:\Windows\system32\msutb.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00160768 _____ (Microsoft Corporation) C:\Windows\system32\PortableDeviceTypes.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00155136 _____ (Microsoft Corporation) C:\Windows\system32\rasmontr.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00153088 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00153088 _____ (Microsoft Corporation) C:\Windows\system32\fundisc.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00150528 _____ (Microsoft Corporation) C:\Windows\system32\MMDevAPI.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00150528 _____ (Microsoft Corporation) C:\Windows\system32\iasnap.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00147456 _____ (Microsoft Corporation) C:\Windows\system32\Faultrep.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00142336 _____ (Microsoft Corporation) C:\Windows\system32\fontext.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\scksp.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00137728 _____ (Microsoft Corporation) C:\Windows\system32\dsprop.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\nlhtml.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\eappcfg.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00130560 _____ (Microsoft Corporation) C:\Windows\system32\dhcpcsvc6.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00129024 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00127488 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00122368 _____ (Microsoft Corporation) C:\Windows\system32\inetpp.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00121344 _____ (Microsoft Corporation) C:\Windows\system32\ntmarta.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00120320 _____ (Microsoft Corporation) C:\Windows\system32\EhStorAPI.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00117248 _____ () C:\Windows\system32\EhStorAuthn.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\odbccp32.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00114176 _____ (Microsoft Corporation) C:\Windows\system32\EhStorShell.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00107008 _____ (Microsoft Corporation) C:\Windows\system32\regsvc.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00107008 _____ (Microsoft Corporation) C:\Windows\system32\rdpwsx.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00105472 _____ (Microsoft Corporation) C:\Windows\system32\dmsynth.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00101888 _____ (Microsoft Corporation) C:\Windows\system32\dmusic.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00098816 _____ (Microsoft Corporation) C:\Windows\system32\powrprof.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\oleprn.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\mprapi.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00095232 _____ (Microsoft Corporation) C:\Windows\system32\SCardSvr.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00094720 _____ (Microsoft Corporation) C:\Windows\system32\PortableDeviceClassExtension.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00093696 _____ (Microsoft Corporation) C:\Windows\system32\eappgnui.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00088576 _____ (Microsoft Corporation) C:\Windows\system32\olepro32.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\fdBth.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00087552 _____ (Microsoft Corporation) C:\Windows\system32\SearchFilterHost.exe
2014-08-16 00:29 - 2009-04-10 23:28 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\mssitlb.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\msctfui.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mstlsapi.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\msctfp.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00079872 _____ (Microsoft Corporation) C:\Windows\system32\authz.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00075264 _____ (Microsoft Corporation) C:\Windows\system32\gpapi.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00075264 _____ (Microsoft Corporation) C:\Windows\system32\dot3msm.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00075264 _____ (Microsoft Corporation) C:\Windows\system32\adsmsext.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\propdefs.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\iashlpr.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\sendmail.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\rastapi.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\PNPXAssoc.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\fdWCN.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00068608 _____ (Microsoft Corporation) C:\Windows\system32\mpr.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00068096 _____ (Microsoft Corporation) C:\Windows\system32\fdSSDP.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00067584 _____ (Microsoft Corporation) C:\Windows\system32\regapi.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\fdWSD.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\msjter40.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msscntrs.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00058880 _____ (Microsoft Corporation) C:\Windows\system32\iasacct.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\samlib.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\iasads.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\DevicePairingProxy.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00054272 _____ (Microsoft Corporation) C:\Windows\system32\feclient.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\fdeploy.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\rasdiag.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00049664 _____ (Microsoft Corporation) C:\Windows\system32\dot3cfg.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\iasdatastore.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00045568 _____ (Microsoft Corporation) C:\Windows\system32\bthci.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00045056 _____ (Microsoft Corporation) C:\Windows\system32\dataclen.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\msstrc.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\hbaapi.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00040960 _____ (Microsoft Corporation) C:\Windows\system32\odbcconf.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00040960 _____ (Microsoft Corporation) C:\Windows\system32\bthserv.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\certprop.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\networkitemfactory.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\rtffilt.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\EhStorPwdMgr.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\msscb.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\mssprxy.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00031744 _____ (Microsoft Corporation) C:\Windows\system32\perfdisk.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00031744 _____ (Microsoft Corporation) C:\Windows\system32\cscapi.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00031744 _____ (Microsoft Corporation) C:\Windows\system32\bitsigd.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\msimtf.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\FwRemoteSvr.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\printfilterpipelineprxy.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\hidserv.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\msjint40.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00024064 _____ (Microsoft Corporation) C:\Windows\system32\fdProxy.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\cscdll.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00020992 _____ (Microsoft Corporation) C:\Windows\system32\ExplorerFrame.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00019968 _____ (Microsoft Corporation) C:\Windows\system32\NcdProp.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\MsCtfMonitor.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\msisip.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00015360 _____ (Microsoft Corporation) C:\Windows\system32\inetppui.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\msshooks.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\CHxReadingStringIME.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\fdBthProxy.dll
2014-08-16 00:29 - 2009-04-10 23:27 - 02926592 _____ (Microsoft Corporation) C:\Windows\explorer.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 02092544 _____ (Microsoft Corporation) C:\Windows\system32\dfsr.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 01122304 _____ (Microsoft Corporation) C:\Windows\system32\appwiz.cpl
2014-08-16 00:29 - 2009-04-10 23:27 - 01102848 _____ (Microsoft Corporation) C:\Windows\system32\mmsys.cpl
2014-08-16 00:29 - 2009-04-10 23:27 - 00799744 _____ (Microsoft Corporation) C:\Windows\system32\certutil.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00704512 _____ (Microsoft Corporation) C:\Windows\system32\PhotoScreensaver.scr
2014-08-16 00:29 - 2009-04-10 23:27 - 00666624 _____ (Microsoft Corporation) C:\Windows\system32\printfilterpipelinesvc.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00656896 _____ (Microsoft Corporation) C:\Windows\system32\autoconv.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00643072 _____ (Microsoft Corporation) C:\Windows\system32\autochk.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00640512 _____ (Microsoft Corporation) C:\Windows\system32\bthprops.cpl
2014-08-16 00:29 - 2009-04-10 23:27 - 00636416 _____ (Microsoft Corporation) C:\Windows\system32\autofmt.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00408064 _____ (Microsoft Corporation) C:\Windows\system32\msinfo32.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00407040 _____ (Microsoft Corporation) C:\Windows\system32\dpapimig.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00241128 _____ (Microsoft Corporation) C:\Windows\system32\rsaenh.dll
2014-08-16 00:29 - 2009-04-10 23:27 - 00230912 _____ (Microsoft Corporation) C:\Windows\system32\diskraid.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00217088 _____ (Microsoft Corporation) C:\Windows\system32\psisrndr.ax
2014-08-16 00:29 - 2009-04-10 23:27 - 00215552 _____ (Microsoft Corporation) C:\Windows\system32\certreq.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00205824 _____ (Microsoft Corporation) C:\Windows\system32\eudcedit.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00194048 _____ (Microsoft Corporation) C:\Windows\system32\drvinst.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00182272 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00135168 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00130560 _____ (Microsoft Corporation) C:\Windows\system32\PkgMgr.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00130024 _____ (Microsoft Corporation) C:\Windows\system32\basecsp.dll
2014-08-16 00:29 - 2009-04-10 23:27 - 00128000 _____ (Microsoft Corporation) C:\Windows\system32\gpresult.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00119808 _____ (Microsoft Corporation) C:\Windows\system32\diskpart.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00088576 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00082944 _____ (Microsoft Corporation) C:\Windows\system32\nslookup.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00081920 _____ (Microsoft Corporation) C:\Windows\system32\dwm.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00080896 _____ (Microsoft Corporation) C:\Windows\system32\MSNP.ax
2014-08-16 00:29 - 2009-04-10 23:27 - 00080384 _____ (Microsoft Corporation) C:\Windows\system32\hdwwiz.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\newdev.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\msiexec.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\conime.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\DevicePairingWizard.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\reg.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00060928 _____ (Microsoft Corporation) C:\Windows\system32\findstr.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00058368 _____ (Microsoft Corporation) C:\Windows\system32\PnPUnattend.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00058368 _____ (Microsoft Corporation) C:\Windows\system32\cipher.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00049152 _____ (Microsoft Corporation) C:\Windows\system32\cmmon32.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00046080 _____ (Microsoft Corporation) C:\Windows\system32\csrstub.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\cbsra.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\rekeywiz.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\ftp.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\ocsetup.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\bthudtask.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\PnPutil.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\DeviceEject.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00021504 _____ (Microsoft Corporation) C:\Windows\system32\msacm32.drv
2014-08-16 00:29 - 2009-04-10 23:27 - 00019968 _____ (Microsoft Corporation) C:\Windows\system32\fc.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\rasdial.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\gpupdate.exe
2014-08-16 00:29 - 2009-04-10 23:23 - 00413696 _____ (Microsoft Corporation) C:\Windows\system32\imkr80.ime
2014-08-16 00:29 - 2009-04-10 23:23 - 00124928 _____ (Microsoft Corporation) C:\Windows\system32\quick.ime
2014-08-16 00:29 - 2009-04-10 23:23 - 00124928 _____ (Microsoft Corporation) C:\Windows\system32\qintlgnt.ime
2014-08-16 00:29 - 2009-04-10 23:23 - 00124928 _____ (Microsoft Corporation) C:\Windows\system32\phon.ime
2014-08-16 00:29 - 2009-04-10 23:23 - 00089088 _____ (Microsoft Corporation) C:\Windows\system32\pintlgnt.ime
2014-08-16 00:29 - 2009-04-10 23:22 - 00124928 _____ (Microsoft Corporation) C:\Windows\system32\cintlgnt.ime
2014-08-16 00:29 - 2009-04-10 23:22 - 00124928 _____ (Microsoft Corporation) C:\Windows\system32\chajei.ime
2014-08-16 00:29 - 2009-04-10 23:22 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\f3ahvoas.dll
2014-08-16 00:29 - 2009-04-10 23:21 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2014-08-16 00:29 - 2009-04-10 22:42 - 00093696 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\bridge.sys
2014-08-16 00:29 - 2009-04-10 22:03 - 12240896 _____ (Microsoft Corporation) C:\Windows\system32\NlsLexicons0007.dll
2014-08-16 00:29 - 2009-04-10 22:03 - 02644480 _____ (Microsoft Corporation) C:\Windows\system32\NlsLexicons0009.dll
2014-08-16 00:29 - 2009-04-10 21:51 - 00180736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys
2014-08-16 00:29 - 2009-04-10 21:48 - 00344698 _____ () C:\Windows\system32\eaphost.tmf
2014-08-16 00:29 - 2009-04-10 21:46 - 00121344 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndiswan.sys
2014-08-16 00:29 - 2009-04-10 21:46 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rassstp.sys
2014-08-16 00:29 - 2009-04-10 21:46 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\raspppoe.sys
2014-08-16 00:29 - 2009-04-10 21:46 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\RNDISMP.sys
2014-08-16 00:29 - 2009-04-10 21:45 - 00185856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netbt.sys
2014-08-16 00:29 - 2009-04-10 21:45 - 00113664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rmcast.sys
2014-08-16 00:29 - 2009-04-10 21:45 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\pacer.sys
2014-08-16 00:29 - 2009-04-10 21:43 - 00442788 _____ () C:\Windows\system32\dot3.tmf
2014-08-16 00:29 - 2009-04-10 21:43 - 00392170 _____ () C:\Windows\system32\onex.tmf
2014-08-16 00:29 - 2009-04-10 21:43 - 00148480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\nwifi.sys
2014-08-16 00:29 - 2009-04-10 21:42 - 00561152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hdaudbus.sys
2014-08-16 00:29 - 2009-04-10 21:42 - 00167936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys
2014-08-16 00:29 - 2009-04-10 21:42 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
2014-08-16 00:29 - 2009-04-10 21:42 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidusb.sys
2014-08-16 00:29 - 2009-04-10 21:39 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cdrom.sys
2014-08-16 00:29 - 2009-04-10 21:39 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2014-08-16 00:29 - 2009-04-10 21:27 - 00002560 _____ (Microsoft Corporation) C:\Windows\system32\msimsg.dll
2014-08-16 00:29 - 2009-04-10 21:23 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-08-16 00:29 - 2009-04-10 21:23 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxg.sys
2014-08-16 00:29 - 2009-04-10 21:14 - 00225280 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdbss.sys
2014-08-16 00:29 - 2009-04-10 21:14 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2014-08-16 00:29 - 2009-04-10 21:14 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\npfs.sys
2014-08-16 00:29 - 2009-04-10 21:13 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fastfat.sys
2014-08-16 00:29 - 2009-04-10 21:13 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\exfat.sys
2014-08-16 00:29 - 2009-04-10 21:12 - 00617984 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2014-08-16 00:29 - 2009-03-29 21:42 - 00155456 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll
2014-08-16 00:29 - 2009-03-29 21:42 - 00080720 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll
2014-08-16 00:29 - 2009-02-19 17:20 - 00009212 _____ () C:\Windows\system32\RacUR.xml
2014-08-16 00:29 - 2009-02-18 11:39 - 00779136 _____ (Microsoft Corporation) C:\Windows\system32\PresentationNative_v0300.dll
2014-08-16 00:29 - 2009-02-18 11:39 - 00102816 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2014-08-16 00:29 - 2009-02-18 11:38 - 00099680 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2014-08-16 00:29 - 2009-02-18 11:38 - 00035168 _____ (Microsoft Corporation) C:\Windows\system32\infocardcpl.cpl
2014-08-16 00:28 - 2009-04-10 23:33 - 00986600 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2014-08-16 00:28 - 2009-04-10 23:33 - 00926184 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
2014-08-16 00:28 - 2009-04-10 23:33 - 00292840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\volmgrx.sys
2014-08-16 00:28 - 2009-04-10 23:32 - 00438744 _____ (Microsoft Corporation) C:\Windows\system32\mcupdate_GenuineIntel.dll
2014-08-16 00:28 - 2009-04-10 23:32 - 00226280 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\volsnap.sys
2014-08-16 00:28 - 2009-04-10 23:32 - 00122344 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Storport.sys
2014-08-16 00:28 - 2009-04-10 23:32 - 00019944 _____ (Microsoft Corporation) C:\Windows\system32\kdusb.dll
2014-08-16 00:28 - 2009-04-10 23:32 - 00017896 _____ (Microsoft Corporation) C:\Windows\system32\kd1394.dll
2014-08-16 00:28 - 2009-04-10 23:32 - 00017384 _____ (Microsoft Corporation) C:\Windows\system32\kdcom.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 03217408 _____ (Microsoft Corporation) C:\Windows\system32\WinSAT.exe
2014-08-16 00:28 - 2009-04-10 23:28 - 02205184 _____ (Microsoft Corporation) C:\Windows\system32\SyncCenter.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 02167808 _____ (Microsoft Corporation) C:\Windows\system32\mmcndmgr.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 02012160 _____ (Microsoft Corporation) C:\Windows\system32\milcore.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 01671680 _____ (Microsoft Corporation) C:\Windows\system32\wlanpref.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 01580544 _____ (Microsoft Corporation) C:\Windows\system32\wpccpl.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 01575936 _____ (Microsoft Corporation) C:\Windows\system32\WMVENCOD.DLL
2014-08-16 00:28 - 2009-04-10 23:28 - 01555456 _____ (Microsoft Corporation) C:\Windows\system32\WindowsAnytimeUpgradeCPL.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 01533440 _____ (Microsoft Corporation) C:\Windows\system32\wcnwiz.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 01382912 _____ (Microsoft Corporation) C:\Windows\system32\WMVSDECD.DLL
2014-08-16 00:28 - 2009-04-10 23:28 - 01224192 _____ (Microsoft Corporation) C:\Windows\system32\sud.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 01143296 _____ (Microsoft Corporation) C:\Windows\system32\wercon.exe
2014-08-16 00:28 - 2009-04-10 23:28 - 01123840 _____ (Microsoft Corporation) C:\Windows\system32\usercpl.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 01081344 _____ (Microsoft Corporation) C:\Windows\system32\SLCExt.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 01077248 _____ (Microsoft Corporation) C:\Windows\system32\vssapi.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 01055232 _____ (Microsoft Corporation) C:\Windows\system32\VSSVC.exe
2014-08-16 00:28 - 2009-04-10 23:28 - 01020928 _____ (Microsoft Corporation) C:\Windows\system32\wdc.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 01017856 _____ (Microsoft Corporation) C:\Windows\system32\wevtsvc.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00996352 _____ (Microsoft Corporation) C:\Windows\system32\WMNetMgr.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00968192 _____ (Microsoft Corporation) C:\Windows\system32\wcnwiz2.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00876032 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00860160 _____ (Microsoft Corporation) C:\Windows\system32\WerFaultSecure.exe
2014-08-16 00:28 - 2009-04-10 23:28 - 00777216 _____ (Microsoft Corporation) C:\Windows\system32\slcc.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00759296 _____ (Microsoft Corporation) C:\Windows\system32\ipsecsnp.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00729600 _____ (Microsoft Corporation) C:\Windows\system32\IMJP10K.DLL
2014-08-16 00:28 - 2009-04-10 23:28 - 00712704 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00705536 _____ (Microsoft Corporation) C:\Windows\system32\SmiEngine.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00677376 _____ (Microsoft Corporation) C:\Windows\system32\imapi2fs.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00657408 _____ (Microsoft Corporation) C:\Windows\system32\WMVXENCD.DLL
2014-08-16 00:28 - 2009-04-10 23:28 - 00638976 _____ (Microsoft Corporation) C:\Windows\system32\Utilman.exe
2014-08-16 00:28 - 2009-04-10 23:28 - 00627712 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00586752 _____ (Microsoft Corporation) C:\Windows\system32\stobject.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00582144 _____ (Microsoft Corporation) C:\Windows\system32\SLCommDlg.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00558080 _____ (Microsoft Corporation) C:\Windows\system32\sysmain.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00547840 _____ (Microsoft Corporation) C:\Windows\system32\wiaaut.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00533504 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmsdk.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00532992 _____ (Microsoft Corporation) C:\Windows\system32\wpcao.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00524288 _____ (Microsoft Corporation) C:\Windows\system32\sqlsrv32.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00507904 _____ (Microsoft Corporation) C:\Windows\system32\vdsdyn.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\wiaservc.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00443392 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00438784 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2014-08-16 00:28 - 2009-04-10 23:28 - 00425472 _____ (Microsoft Corporation) C:\Windows\system32\shwebsvc.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00413696 _____ (Microsoft Corporation) C:\Windows\system32\wcncsvc.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00399360 _____ (Microsoft Corporation) C:\Windows\system32\wlangpui.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00396288 _____ (Microsoft Corporation) C:\Windows\system32\ipsmsnap.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00385536 _____ (Microsoft Corporation) C:\Windows\system32\vds.exe
2014-08-16 00:28 - 2009-04-10 23:28 - 00378368 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00378368 _____ (Microsoft Corporation) C:\Windows\system32\imapi2.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00364032 _____ (Microsoft Corporation) C:\Windows\system32\IPSECSVC.DLL
2014-08-16 00:28 - 2009-04-10 23:28 - 00361984 _____ (Microsoft Corporation) C:\Windows\system32\SLUI.exe
2014-08-16 00:28 - 2009-04-10 23:28 - 00356864 _____ (Microsoft Corporation) C:\Windows\system32\MediaMetadataHandler.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00347648 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecsExt.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00342528 _____ (Microsoft Corporation) C:\Windows\system32\zipfldr.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\untfs.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00321536 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00314368 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-08-16 00:28 - 2009-04-10 23:28 - 00311808 _____ (Microsoft Corporation) C:\Windows\system32\swprv.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\wmpeffects.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00301568 _____ (Microsoft Corporation) C:\Windows\system32\srchadmin.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00291328 _____ (Microsoft Corporation) C:\Windows\system32\WscEapPr.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00289792 _____ (Microsoft Corporation) C:\Windows\system32\spinstall.exe
2014-08-16 00:28 - 2009-04-10 23:28 - 00287744 _____ (Microsoft Corporation) C:\Windows\system32\Wldap32.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00282624 _____ (Microsoft Corporation) C:\Windows\system32\w32time.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00273920 _____ (Microsoft Corporation) C:\Windows\system32\wow32.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00252928 _____ (Microsoft Corporation) C:\Windows\system32\iassdo.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00250368 _____ (Microsoft Corporation) C:\Windows\system32\wevtapi.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00244224 _____ (Microsoft Corporation) C:\Windows\system32\wisptis.exe
2014-08-16 00:28 - 2009-04-10 23:28 - 00228352 _____ (Microsoft Corporation) C:\Windows\system32\SLC.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00223744 _____ (Microsoft Corporation) C:\Windows\system32\wscntfy.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\wdscore.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00217088 _____ (Microsoft Corporation) C:\Windows\system32\WerFault.exe
2014-08-16 00:28 - 2009-04-10 23:28 - 00208896 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00203264 _____ (Microsoft Corporation) C:\Windows\system32\uDWM.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\wlanui.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00200704 _____ (Microsoft Corporation) C:\Windows\system32\input.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00197632 _____ (Microsoft Corporation) C:\Windows\system32\SndVol.exe
2014-08-16 00:28 - 2009-04-10 23:28 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\sperror.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00189952 _____ (Microsoft Corporation) C:\Windows\system32\winmm.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00185856 _____ (Microsoft Corporation) C:\Windows\system32\SLLUA.exe
2014-08-16 00:28 - 2009-04-10 23:28 - 00182272 _____ (Microsoft Corporation) C:\Windows\system32\iassam.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00177664 _____ (Microsoft Corporation) C:\Windows\system32\WSDMon.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00165376 _____ (Microsoft Corporation) C:\Windows\system32\WcnNetsh.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00164352 _____ (Microsoft Corporation) C:\Windows\system32\spwizui.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\wevtutil.exe
2014-08-16 00:28 - 2009-04-10 23:28 - 00160768 _____ (Microsoft Corporation) C:\Windows\system32\spoolss.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00158208 _____ (Microsoft Corporation) C:\Windows\system32\iasrad.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00155648 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe
2014-08-16 00:28 - 2009-04-10 23:28 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\korwbrkr.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00142336 _____ (Microsoft Corporation) C:\Windows\system32\spp.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00140800 _____ (Microsoft Corporation) C:\Windows\system32\wusa.exe
2014-08-16 00:28 - 2009-04-10 23:28 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\wpcsvc.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00134656 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00128000 _____ (Microsoft Corporation) C:\Windows\system32\vdsutil.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00126976 _____ (Microsoft Corporation) C:\Windows\system32\wersvc.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00125952 _____ (Microsoft Corporation) C:\Windows\system32\softkbd.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00119296 _____ (Microsoft Corporation) C:\Windows\system32\iasrecst.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\WinSCard.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\imm32.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\spreview.exe
2014-08-16 00:28 - 2009-04-10 23:28 - 00108544 _____ (Microsoft Corporation) C:\Windows\system32\userenv.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\imapi.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00103936 _____ (Microsoft Corporation) C:\Windows\system32\sysclass.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00101376 _____ (Microsoft Corporation) C:\Windows\system32\shsetup.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00091648 _____ (Microsoft Corporation) C:\Windows\system32\IPHLPAPI.DLL
2014-08-16 00:28 - 2009-04-10 23:28 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\wshext.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00083456 _____ (Microsoft) C:\Windows\system32\SMBHelperClass.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00083456 _____ (Microsoft Corporation) C:\Windows\system32\wlgpclnt.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\iassvcs.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00067584 _____ (Microsoft Corporation) C:\Windows\system32\slwmi.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2014-08-16 00:28 - 2009-04-10 23:28 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\wscsvc.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00060928 _____ (Microsoft Corporation) C:\Windows\system32\SLUINotify.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00056320 _____ (Microsoft Corporation) C:\Windows\system32\xmlfilter.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\Storprop.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\mmci.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00050688 _____ (Microsoft Corporation) C:\Windows\system32\wsnmp32.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\l2nacp.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\slcinst.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\mimefilt.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\TSTheme.exe
2014-08-16 00:28 - 2009-04-10 23:28 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\wshbth.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iaspolcy.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\wscapi.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\whealogr.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\ifmon.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\wsepno.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\uxsms.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00020992 _____ (Microsoft Corporation) C:\Windows\system32\wsdchngr.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00020480 _____ (Microsoft Corporation) C:\Windows\system32\version.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00019968 _____ (Microsoft Corporation) C:\Windows\system32\winrnr.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\wscisvif.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\vdmdbg.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\midimap.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\spcmsg.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\mmcico.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\slwga.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\spwinsat.dll
2014-08-16 00:28 - 2009-04-10 23:27 - 03408896 _____ (Microsoft Corporation) C:\Windows\system32\SLsvc.exe
2014-08-16 00:28 - 2009-04-10 23:27 - 01792512 _____ (Microsoft Corporation) C:\Windows\system32\mmc.exe
2014-08-16 00:28 - 2009-04-10 23:27 - 01689600 _____ (Microsoft Corporation) C:\Windows\system32\wscui.cpl
2014-08-16 00:28 - 2009-04-10 23:27 - 00950272 _____ (Microsoft Corporation) C:\Windows\system32\mblctr.exe
2014-08-16 00:28 - 2009-04-10 23:27 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\Magnify.exe
2014-08-16 00:28 - 2009-04-10 23:27 - 00389632 _____ (Microsoft Corporation) C:\Windows\system32\sysmon.ocx
2014-08-16 00:28 - 2009-04-10 23:27 - 00280064 _____ (Microsoft Corporation) C:\Windows\system32\unimdm.tsp
2014-08-16 00:28 - 2009-04-10 23:27 - 00258048 _____ (Microsoft Corporation) C:\Windows\system32\winspool.drv
2014-08-16 00:28 - 2009-04-10 23:27 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\wdmaud.drv
2014-08-16 00:28 - 2009-04-10 23:27 - 00135168 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx
2014-08-16 00:28 - 2009-04-10 23:27 - 00094720 _____ (Microsoft Corporation) C:\Windows\system32\logagent.exe
2014-08-16 00:28 - 2009-04-10 23:27 - 00093696 _____ (Microsoft Corporation) C:\Windows\system32\Kswdmcap.ax
2014-08-16 00:28 - 2009-04-10 23:27 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\logman.exe
2014-08-16 00:28 - 2009-04-10 23:27 - 00026624 _____ (Microsoft Corporation) C:\Windows\system32\ipconfig.exe
2014-08-16 00:28 - 2009-04-10 23:22 - 00883712 _____ (Microsoft Corporation) C:\Windows\system32\IMJP10.IME
2014-08-16 00:28 - 2009-04-10 21:46 - 00208966 _____ () C:\Windows\system32\WFP.TMF
2014-08-16 00:28 - 2009-04-10 21:46 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usb8023.sys
2014-08-16 00:28 - 2009-04-10 21:45 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\smb.sys
2014-08-16 00:28 - 2009-04-10 21:43 - 00196096 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-08-16 00:28 - 2009-04-10 21:42 - 00226304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-08-16 00:28 - 2009-04-10 21:42 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBAUDIO.sys
2014-08-16 00:28 - 2009-04-10 21:42 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBSTOR.SYS
2014-08-16 00:28 - 2009-04-10 21:42 - 00052992 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\stream.sys
2014-08-16 00:28 - 2009-04-10 21:42 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-08-16 00:28 - 2009-04-10 21:42 - 00025856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBCAMD2.sys
2014-08-16 00:28 - 2009-04-10 21:42 - 00025856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBCAMD.sys
2014-08-16 00:28 - 2009-04-10 21:39 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\iscsilog.dll
2014-08-16 00:28 - 2009-04-10 21:38 - 00149504 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ks.sys
2014-08-16 00:28 - 2009-04-10 21:22 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\watchdog.sys
2014-08-16 00:28 - 2009-04-10 21:14 - 00226816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\udfs.sys
2014-08-16 00:28 - 2009-04-10 19:52 - 00684032 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\spsys.sys
2014-08-16 00:28 - 2009-04-10 18:59 - 00107612 _____ () C:\Windows\system32\StructuredQuerySchema.bin
2014-08-16 00:28 - 2009-04-10 18:54 - 03662128 _____ () C:\Windows\system32\locale.nls
2014-08-16 00:28 - 2009-02-19 17:20 - 00009239 _____ () C:\Windows\system32\spcinstrumentation.man
2014-08-16 00:28 - 2009-02-18 11:39 - 00092918 _____ () C:\Windows\system32\slmgr.vbs
2014-08-16 00:28 - 2009-02-18 11:39 - 00035680 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-08-16 00:28 - 2009-02-18 11:38 - 00619864 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2014-08-16 00:28 - 2009-02-18 11:38 - 00009048 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2014-08-16 00:27 - 2009-04-10 23:32 - 00053224 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\termdd.sys
2014-08-16 00:27 - 2009-04-10 23:28 - 01576960 _____ (Microsoft Corporation) C:\Windows\system32\tquery.dll
2014-08-16 00:27 - 2009-04-10 23:28 - 01152000 _____ (Microsoft Corporation) C:\Windows\system32\themecpl.dll
2014-08-16 00:27 - 2009-04-10 23:28 - 00842240 _____ (Microsoft Corporation) C:\Windows\system32\systemcpl.dll
2014-08-16 00:27 - 2009-04-10 23:28 - 00615424 _____ (Microsoft Corporation) C:\Windows\system32\themeui.dll
2014-08-16 00:27 - 2009-04-10 23:28 - 00449024 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2014-08-16 00:27 - 2009-04-10 23:28 - 00313344 _____ (Microsoft Corporation) C:\Windows\system32\thawbrkr.dll
2014-08-16 00:27 - 2009-04-10 23:28 - 00242688 _____ (Microsoft Corporation) C:\Windows\system32\tapisrv.dll
2014-08-16 00:27 - 2009-04-10 23:28 - 00222720 _____ (Microsoft Corporation) C:\Windows\system32\umpnpmgr.dll
2014-08-16 00:27 - 2009-04-10 23:28 - 00170496 _____ (Microsoft Corporation) C:\Windows\system32\tcpipcfg.dll
2014-08-16 00:27 - 2009-04-10 23:28 - 00135168 _____ (Microsoft Corporation) C:\Windows\system32\tcpmon.dll
2014-08-16 00:27 - 2009-04-10 23:28 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\ulib.dll
2014-08-16 00:27 - 2009-04-10 23:23 - 00125952 _____ (Microsoft Corporation) C:\Windows\system32\tintlgnt.ime
2014-08-16 00:27 - 2009-04-10 21:45 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2014-08-16 00:27 - 2009-03-06 18:11 - 00130008 _____ () C:\Windows\system32\systemsf.ebd
2014-08-16 00:24 - 2014-08-16 00:24 - 00000000 ____D () C:\Windows\system32\EventProviders
2014-08-16 00:06 - 2014-08-16 00:23 - 365230920 _____ (Microsoft Corporation) C:\Users\Wichsis\Downloads\Windows6.0-KB948465-X86.exe
2014-08-16 00:04 - 2014-08-16 00:23 - 365230920 _____ (Microsoft Corporation) C:\Users\Wichsis\Downloads\Windows6.0-KB948465-X86(1).exe
2014-08-15 23:42 - 2014-08-15 23:42 - 00002701 _____ () C:\Windows\system32\FSS.txt
2014-08-15 23:41 - 2014-08-15 23:41 - 00415232 _____ (Farbar) C:\Users\Wichsis\Downloads\FSS.exe
2014-08-15 21:08 - 2014-08-15 21:09 - 02347384 _____ (ESET) C:\Users\Wichsis\Downloads\esetsmartinstaller_deu.exe
2014-08-15 20:57 - 2014-08-15 20:57 - 00000000 ____D () C:\Users\Wichsis\AppData\Roaming\Avira
2014-08-15 20:54 - 2014-08-16 11:45 - 00012402 _____ () C:\Users\Wichsis\Desktop\FRST.txt
2014-08-15 20:00 - 2014-08-16 11:28 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-15 19:59 - 2014-08-15 19:59 - 00000899 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-08-15 19:59 - 2014-08-15 19:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-08-15 19:59 - 2014-08-15 19:59 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-15 19:59 - 2014-08-15 19:59 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2014-08-15 19:59 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-08-15 19:59 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-08-15 19:59 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-08-15 19:58 - 2014-08-15 19:58 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Kathi\Downloads\mbam-setup-2.0.2.1012.exe
2014-08-15 19:46 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\system32\sqlite3.dll
2014-08-15 19:44 - 2014-08-15 19:46 - 00000000 ____D () C:\AdwCleaner
2014-08-15 19:42 - 2014-08-15 19:42 - 01356107 _____ () C:\Users\Kathi\Downloads\adwcleaner_3.305.exe
2014-08-15 19:23 - 2014-08-15 19:23 - 00017045 _____ () C:\ComboFix.txt
2014-08-15 19:11 - 2014-08-15 19:23 - 00000000 ____D () C:\ComboFix
2014-08-15 19:11 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-08-15 19:11 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-08-15 19:11 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-08-15 19:11 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-08-15 19:11 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-08-15 19:11 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-08-15 19:11 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-08-15 19:11 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-08-15 19:10 - 2014-08-15 19:23 - 00000000 ____D () C:\Qoobox
2014-08-15 19:10 - 2014-08-15 19:21 - 00000000 ____D () C:\Windows\erdnt
2014-08-15 19:07 - 2014-08-15 19:07 - 05571320 ____R (Swearware) C:\Users\Kathi\Desktop\ComboFix.exe
2014-08-15 17:40 - 2014-08-15 17:40 - 00025127 _____ () C:\Users\Kathi\Desktop\FRST.txt
2014-08-15 17:40 - 2014-08-15 17:40 - 00022313 _____ () C:\Users\Kathi\Desktop\Addition.txt
2014-08-15 17:39 - 2014-08-15 20:30 - 00026282 _____ () C:\Users\Kathi\Downloads\FRST.txt
2014-08-15 17:39 - 2014-08-15 17:39 - 00022313 _____ () C:\Users\Kathi\Downloads\Addition.txt
2014-08-15 17:38 - 2014-08-16 11:45 - 00000000 ____D () C:\FRST
2014-08-15 17:37 - 2014-08-16 11:33 - 01093632 _____ (Farbar) C:\Users\Wichsis\Desktop\FRST.exe
2014-08-12 20:43 - 2014-08-12 20:50 - 151513264 _____ () C:\Users\Kathi\Downloads\avira_free_antivirus06_de(1).exe
2014-08-12 20:42 - 2014-08-12 20:49 - 151513264 _____ () C:\Users\Kathi\Downloads\avira_free_antivirus06_de.exe
2014-08-04 21:09 - 2014-08-04 21:09 - 00000000 ____D () C:\Users\Kathi\AppData\Roaming\dll-files.com
2014-07-30 20:35 - 2014-07-30 20:35 - 00000000 ____D () C:\Program Files\Mozilla Firefox(23)

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-16 11:46 - 2012-08-18 23:35 - 00001100 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-08-16 11:46 - 2012-08-18 23:35 - 00001096 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-08-16 11:45 - 2014-08-15 20:54 - 00012402 _____ () C:\Users\Wichsis\Desktop\FRST.txt
2014-08-16 11:45 - 2014-08-15 17:38 - 00000000 ____D () C:\FRST
2014-08-16 11:44 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\rescache
2014-08-16 11:43 - 2009-08-11 21:16 - 00000422 ____H () C:\Windows\Tasks\User_Feed_Synchronization-{7030CE83-CC54-445E-964F-73E63606DF74}.job
2014-08-16 11:39 - 2009-08-11 02:42 - 00107528 _____ () C:\Users\Wichsis\AppData\Local\GDIPFONTCACHEV1.DAT
2014-08-16 11:33 - 2014-08-16 11:33 - 00000000 ____D () C:\Users\Wichsis\Desktop\FRST-OlderVersion
2014-08-16 11:33 - 2014-08-15 17:37 - 01093632 _____ (Farbar) C:\Users\Wichsis\Desktop\FRST.exe
2014-08-16 11:32 - 2006-11-02 12:33 - 01592750 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-08-16 11:30 - 2009-07-21 20:26 - 01493344 _____ () C:\Windows\WindowsUpdate.log
2014-08-16 11:29 - 2009-08-11 02:35 - 00000000 ____D () C:\Users\Wichsis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite
2014-08-16 11:28 - 2014-08-15 20:00 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-16 11:27 - 2006-11-02 14:58 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-16 11:27 - 2006-11-02 14:45 - 00004784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-16 11:27 - 2006-11-02 14:45 - 00004784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-16 11:25 - 2014-08-16 11:25 - 00000000 ____D () C:\Users\Wichsis\AppData\Local\WindowsUpdate
2014-08-16 11:25 - 2006-11-02 14:58 - 00032514 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-08-16 11:24 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-08-16 11:23 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\de-DE
2014-08-16 11:20 - 2009-08-11 02:39 - 00000000 ____D () C:\Program Files\Microsoft.NET
2014-08-16 11:10 - 2006-11-02 14:44 - 00389288 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-08-16 11:08 - 2014-08-16 11:08 - 00000000 ____D () C:\Windows\system32\WindowsPowerShell
2014-08-16 11:08 - 2006-11-02 13:18 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2014-08-16 10:52 - 2014-08-16 10:52 - 00000000 ____D () C:\Windows\system32\x64
2014-08-16 10:33 - 2008-01-21 05:02 - 00748726 _____ () C:\Windows\PFRO.log
2014-08-16 01:04 - 2013-08-16 18:35 - 00000000 ____D () C:\Windows\system32\MRT
2014-08-16 01:02 - 2006-11-02 12:24 - 96303304 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-08-16 00:58 - 2009-08-11 02:46 - 00000915 _____ () C:\Users\Wichsis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Mail.lnk
2014-08-16 00:57 - 2011-12-28 18:30 - 00000915 _____ () C:\Users\Kathi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Mail.lnk
2014-08-16 00:57 - 2011-12-28 18:30 - 00000000 ____D () C:\Users\Kathi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite
2014-08-16 00:46 - 2014-08-16 00:45 - 00000000 ____D () C:\Windows\system32\vi-VN
2014-08-16 00:46 - 2014-08-16 00:45 - 00000000 ____D () C:\Windows\system32\eu-ES
2014-08-16 00:46 - 2014-08-16 00:45 - 00000000 ____D () C:\Windows\system32\ca-ES
2014-08-16 00:46 - 2009-06-15 09:26 - 00000000 ____D () C:\Windows\system32\Drivers\de-DE
2014-08-16 00:46 - 2006-11-02 14:35 - 00000000 ____D () C:\Windows\system32\XPSViewer
2014-08-16 00:46 - 2006-11-02 14:35 - 00000000 ____D () C:\Program Files\Windows Sidebar
2014-08-16 00:46 - 2006-11-02 14:35 - 00000000 ____D () C:\Program Files\Windows Photo Gallery
2014-08-16 00:46 - 2006-11-02 14:35 - 00000000 ____D () C:\Program Files\Windows Defender
2014-08-16 00:46 - 2006-11-02 14:35 - 00000000 ____D () C:\Program Files\Windows Collaboration
2014-08-16 00:46 - 2006-11-02 14:35 - 00000000 ____D () C:\Program Files\Windows Calendar
2014-08-16 00:46 - 2006-11-02 14:35 - 00000000 ____D () C:\Program Files\Movie Maker
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\zh-TW
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\zh-CN
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\uk-UA
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\tr-TR
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\th-TH
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\sv-SE
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\sr-Latn-CS
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\SLUI
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\sl-SI
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\sk-SK
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\ru-RU
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\ro-RO
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\pt-PT
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\pt-BR
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\pl-PL
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\nl-NL
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\nb-NO
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\lv-LV
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\lt-LT
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\ko-KR
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\ja-JP
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\it-IT
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\hu-HU
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\hr-HR
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\he-IL
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\fr-FR
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\fi-FI
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\et-EE
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\el-GR
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\bg-BG
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\ar-SA
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\AdvancedInstallers
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\IME
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Program Files\Common Files\System
2014-08-16 00:45 - 2009-06-15 11:13 - 00000000 ____D () C:\Windows\system32\RTCOM
2014-08-16 00:45 - 2006-11-02 14:49 - 00160471 _____ () C:\Windows\setupact.log
2014-08-16 00:42 - 2014-08-16 00:42 - 00000000 ____D () C:\Windows\system32\SPReview
2014-08-16 00:24 - 2014-08-16 00:24 - 00000000 ____D () C:\Windows\system32\EventProviders
2014-08-16 00:23 - 2014-08-16 00:06 - 365230920 _____ (Microsoft Corporation) C:\Users\Wichsis\Downloads\Windows6.0-KB948465-X86.exe
2014-08-16 00:23 - 2014-08-16 00:04 - 365230920 _____ (Microsoft Corporation) C:\Users\Wichsis\Downloads\Windows6.0-KB948465-X86(1).exe
2014-08-15 23:42 - 2014-08-15 23:42 - 00002701 _____ () C:\Windows\system32\FSS.txt
2014-08-15 23:41 - 2014-08-15 23:41 - 00415232 _____ (Farbar) C:\Users\Wichsis\Downloads\FSS.exe
2014-08-15 23:38 - 2012-09-18 20:12 - 00001963 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-08-15 21:09 - 2014-08-15 21:08 - 02347384 _____ (ESET) C:\Users\Wichsis\Downloads\esetsmartinstaller_deu.exe
2014-08-15 20:57 - 2014-08-15 20:57 - 00000000 ____D () C:\Users\Wichsis\AppData\Roaming\Avira
2014-08-15 20:30 - 2014-08-15 17:39 - 00026282 _____ () C:\Users\Kathi\Downloads\FRST.txt
2014-08-15 20:19 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\Speech
2014-08-15 19:59 - 2014-08-15 19:59 - 00000899 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-08-15 19:59 - 2014-08-15 19:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-08-15 19:59 - 2014-08-15 19:59 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-15 19:59 - 2014-08-15 19:59 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2014-08-15 19:58 - 2014-08-15 19:58 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Kathi\Downloads\mbam-setup-2.0.2.1012.exe
2014-08-15 19:46 - 2014-08-15 19:44 - 00000000 ____D () C:\AdwCleaner
2014-08-15 19:46 - 2013-11-02 23:21 - 00000846 _____ () C:\Users\Wichsis\Desktop\Search.lnk
2014-08-15 19:42 - 2014-08-15 19:42 - 01356107 _____ () C:\Users\Kathi\Downloads\adwcleaner_3.305.exe
2014-08-15 19:27 - 2014-04-27 21:32 - 00000000 ___RD () C:\Users\Kathi\Dropbox
2014-08-15 19:23 - 2014-08-15 19:23 - 00017045 _____ () C:\ComboFix.txt
2014-08-15 19:23 - 2014-08-15 19:11 - 00000000 ____D () C:\ComboFix
2014-08-15 19:23 - 2014-08-15 19:10 - 00000000 ____D () C:\Qoobox
2014-08-15 19:23 - 2009-08-11 03:13 - 00000000 ____D () C:\Users\Wichsis\AppData\Local\Google
2014-08-15 19:23 - 2006-11-02 13:18 - 00000000 __RHD () C:\Users\Default
2014-08-15 19:23 - 2006-11-02 13:18 - 00000000 ___RD () C:\Users\Public
2014-08-15 19:21 - 2014-08-15 19:10 - 00000000 ____D () C:\Windows\erdnt
2014-08-15 19:21 - 2006-11-02 12:23 - 00000215 _____ () C:\Windows\system.ini
2014-08-15 19:07 - 2014-08-15 19:07 - 05571320 ____R (Swearware) C:\Users\Kathi\Desktop\ComboFix.exe
2014-08-15 17:40 - 2014-08-15 17:40 - 00025127 _____ () C:\Users\Kathi\Desktop\FRST.txt
2014-08-15 17:40 - 2014-08-15 17:40 - 00022313 _____ () C:\Users\Kathi\Desktop\Addition.txt
2014-08-15 17:39 - 2014-08-15 17:39 - 00022313 _____ () C:\Users\Kathi\Downloads\Addition.txt
2014-08-15 17:34 - 2014-04-27 21:29 - 00000000 ____D () C:\Users\Kathi\AppData\Roaming\Dropbox
2014-08-15 17:08 - 2013-06-30 22:48 - 00000422 ____H () C:\Windows\Tasks\User_Feed_Synchronization-{DC24E08D-D800-4C9D-9DE2-5FF59CBB27E4}.job
2014-08-12 23:00 - 2014-06-16 11:05 - 00015080 _____ () C:\Users\Kathi\Desktop\Hochzeitsgeschenke.xlsx
2014-08-12 20:50 - 2014-08-12 20:43 - 151513264 _____ () C:\Users\Kathi\Downloads\avira_free_antivirus06_de(1).exe
2014-08-12 20:49 - 2014-08-12 20:42 - 151513264 _____ () C:\Users\Kathi\Downloads\avira_free_antivirus06_de.exe
2014-08-11 23:09 - 2014-06-16 23:09 - 00018357 _____ () C:\Users\Kathi\Desktop\malediven.xlsx
2014-08-11 23:06 - 2014-06-15 16:51 - 00000000 ____D () C:\Users\Kathi\Desktop\Hochzeit - Standesamt
2014-08-11 22:08 - 2014-02-16 18:46 - 00000000 ____D () C:\Users\Kathi\Desktop\Hochzeit
2014-08-10 14:08 - 2012-01-02 21:32 - 00000000 ____D () C:\Users\Kathi\Documents\Passwörter
2014-08-04 21:09 - 2014-08-04 21:09 - 00000000 ____D () C:\Users\Kathi\AppData\Roaming\dll-files.com
2014-08-04 21:06 - 2012-05-15 18:16 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-08-03 23:26 - 2011-12-28 18:30 - 00000000 ____D () C:\Users\Kathi
2014-08-03 23:26 - 2009-08-11 02:35 - 00000000 ____D () C:\Users\Wichsis
2014-08-03 23:26 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\spool
2014-08-03 23:26 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\Msdtc
2014-08-03 23:26 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\registration
2014-08-03 23:26 - 2006-11-02 12:22 - 37748736 _____ () C:\Windows\system32\config\software_previous
2014-08-03 23:26 - 2006-11-02 12:22 - 17301504 _____ () C:\Windows\system32\config\system_previous
2014-08-03 23:23 - 2006-11-02 12:22 - 42991616 _____ () C:\Windows\system32\config\components_previous
2014-08-03 23:23 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\sam_previous
2014-08-03 14:10 - 2012-10-23 18:37 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-08-03 14:10 - 2012-05-15 18:16 - 00000858 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-08-03 14:10 - 2012-05-15 18:16 - 00000846 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-08-03 00:01 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\security_previous
2014-08-03 00:01 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\default_previous
2014-07-30 20:35 - 2014-07-30 20:35 - 00000000 ____D () C:\Program Files\Mozilla Firefox(23)
2014-07-23 10:52 - 2011-12-28 16:24 - 00231584 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-07-22 21:04 - 2014-04-27 21:32 - 00000919 _____ () C:\Users\Kathi\Desktop\Dropbox.lnk
2014-07-22 21:04 - 2014-04-27 21:31 - 00000000 ____D () C:\Users\Kathi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-07-17 18:58 - 2012-03-23 19:56 - 00000000 ____D () C:\ProgramData\tmp
2014-07-17 18:17 - 2009-08-11 02:37 - 00000000 ____D () C:\Users\Wichsis\AppData\Local\Adobe
2014-07-17 18:16 - 2012-09-18 20:11 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-07-17 18:16 - 2012-02-26 00:06 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl

Some content of TEMP:
====================
C:\Users\Kathi\AppData\Local\temp\avgnt.exe
C:\Users\Wichsis\AppData\Local\temp\avgnt.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-08-16 11:32

==================== End Of Log ============================
--- --- ---

Katharina123 16.08.2014 10:54
Code:
Additional scan result of Farbar Recovery Scan Tool (x86) Version:16-08-2014 02
Ran by Wichsis at 2014-08-16 11:46:25
Running from C:\Users\Wichsis\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

32 Bit HP CIO Components Installer (Version: 2.1.4 - Hewlett-Packard) Hidden
Adobe Flash Player 11 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 11.4.402.278 - Adobe Systems Incorporated)
Adobe Flash Player 14 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Reader 9.2 - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-A92000000001}) (Version: 9.2.0 - Adobe Systems Incorporated)
Adobe Shockwave Player 11.6 (HKLM\...\Adobe Shockwave Player) (Version: 11.6.5.635 - Adobe Systems, Inc.)
Atheros WLAN Client (HKLM\...\{3832FA99-2EDD-41E0-94AD-FBF9FABAFEF9}) (Version: 14.00.0000 - WLAN)
Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 14.0.6.552 - Avira)
Avira SearchFree Toolbar (HKLM\...\{41564952-412D-5637-00A7-A758B70C0600}) (Version: 12.6.0.1900 - APN, LLC)
BatteryLifeExtender (HKLM\...\{AA16A9E5-40E9-44F5-801E-6B3D3CFE79E5}) (Version: 1.0.0 - Samsung)
Business Contact Manager für Outlook 2007 SP1 (HKLM\...\Business Contact Manager) (Version: 3.0.7311.0 - Microsoft Corporation)
Business Contact Manager für Outlook 2007 SP1 (Version: 3.0.7311.0 - Microsoft Corporation) Hidden
capella 7 (HKLM\...\{7BDBF713-CB99-4B66-800B-F563BC7F0560}) (Version: 7.1.21 - capella software AG)
CyberLink DVD Suite (HKLM\...\InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 6.0.2604 - CyberLink Corp.)
CyberLink DVD Suite (Version: 6.0.2604 - CyberLink Corp.) Hidden
CyberLink LabelPrint (HKLM\...\{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.20.3605 - CyberLink Corp.)
CyberLink Power2Go (HKLM\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.0.2809 - CyberLink Corp.)
CyberLink Power2Go (Version: 6.0.2809 - CyberLink Corp.) Hidden
CyberLink PowerDirector (HKLM\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 7.0.2426 - CyberLink Corp.)
CyberLink PowerDirector (Version: 7.0.2426 - CyberLink Corp.) Hidden
CyberLink PowerDVD 8 (HKLM\...\InstallShield_{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}) (Version: 8.0.2815 - CyberLink Corp.)
CyberLink PowerDVD 8 (Version: 8.0.2815 - CyberLink Corp.) Hidden
CyberLink PowerProducer (HKLM\...\InstallShield_{B7A0CE06-068E-11D6-97FD-0050BACBF861}) (Version: 5.0.1.1410 - CyberLink Corp.)
CyberLink PowerProducer (Version: 5.0.1.1410 - CyberLink Corp.) Hidden
dm-Fotowelt (HKLM\...\dm-Fotowelt) (Version: 5.1.3 - CEWE Stiftung u Co. KGaA)
Easy Battery Manager (HKLM\...\{6F730513-8688-4C3C-90A3-6B9792CE2EF3}) (Version: 3.2.1.7 - Samsung)
Easy Display Manager (HKLM\...\{17283B95-21A8-4996-97DA-547A48DB266F}) (Version: 2.3 - Samsung Electronics Co., Ltd.)
Easy Network Manager (HKLM\...\{A7581D39-EA20-4883-A480-80C21047052B}) (Version: 4.0.2 - Samsung)
Easy SpeedUp Manager (HKLM\...\{EF367AA4-070B-493C-9575-85BE59D789C9}) (Version: 2.0.2.6 - )
Free YouTube to MP3 Converter version 3.12.35.514 (HKLM\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.35.514 - DVDVideoSoft Ltd.)
Google Chrome (HKLM\...\Google Chrome) (Version: 36.0.1985.143 - Google Inc.)
Google Earth Plug-in (HKLM\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Toolbar for Internet Explorer (HKLM\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.5111.1712 - Google Inc.)
Google Toolbar for Internet Explorer (Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (Version: 1.3.24.15 - Google Inc.) Hidden
IKEA Home Planner (HKLM\...\{B3276CB1-20B6-4AF9-AAEC-E72C83816495}) (Version: 2.0.3 - IKEA IT)
imagine digital freedom - Samsung (HKLM\...\{8E106A57-A17E-431D-B48F-175E42EB9F74}) (Version: 1.0.2.2 - Samsung Electronics Co. Ltd.,)
Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version:  - Intel Corporation)
Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version:  - Intel Corporation)
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Office 2003 Web Components (HKLM\...\{90A40407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8003.0 - Microsoft Corporation)
Microsoft Office 2007 Primary Interop Assemblies (HKLM\...\{50120000-1105-0000-0000-0000000FF1CE}) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Office Excel MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Home and Student 2007 (HKLM\...\HOMESTUDENTR) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Small Business Connectivity Components (HKLM\...\{A939D341-5A04-4E0A-BB55-3E65B386432D}) (Version: 2.0.7024.0 - Microsoft Corporation)
Microsoft Office Suite Activation Assistant (HKLM\...\{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}) (Version: 2.9 - Microsoft Corporation)
Microsoft Office Word MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft SQL Server 2005 (HKLM\...\Microsoft SQL Server 2005) (Version:  - Microsoft Corporation)
Microsoft SQL Server 2005 Express Edition (MSSMLBIZ) (Version: 9.2.3042.00 - Microsoft Corporation) Hidden
Microsoft SQL Server Native Client (HKLM\...\{1D1D8ADC-BF08-4E61-9393-5FA305B16864}) (Version: 9.00.3042.00 - Microsoft Corporation)
Microsoft SQL Server VSS Writer (HKLM\...\{5C759B74-34F4-43C6-A5D9-039CB754C5E9}) (Version: 9.00.3042.00 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 31.0 (x86 de) (HKLM\...\Mozilla Firefox 31.0 (x86 de)) (Version: 31.0 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 31.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
PCTroubleshooting (HKLM\...\{68CAE442-579C-4D84-AA5F-253852522ED5}) (Version: 2.0.0.4 - Samsung Electronics Co.,LTD.)
PrintKey2000 (HKLM\...\PrintKey2000) (Version:  - )
Realtek 8136 8168 8169 Ethernet Driver (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0004 - Realtek)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5837 - Realtek Semiconductor Corp.)
Samsung Kies (HKLM\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.2.0.12014_18 - Samsung Electronics Co., Ltd.)
Samsung Kies (Version: 2.2.0.12014_18 - Samsung Electronics Co., Ltd.) Hidden
Samsung Magic Doctor (HKLM\...\{32D6A58F-9659-446C-BBFC-E6F2B41F24DC}) (Version: 5.0 - Samsung Electronics Co., LTD)
Samsung Recovery Solution III (HKLM\...\{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}) (Version: 3.0.0.9 - Samsung)
Samsung Update Plus (HKLM\...\{D3F2FAA5-FEC4-42AA-9ABA-1F763919A2B5}) (Version: 2.0 - Samsung Electronics Co., Ltd.)
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.4.103.0 - SAMSUNG Electronics Co., Ltd.)
SimCity™ Societies (HKLM\...\{0B5154C0-8F00-4616-B0AB-6240AE80D9CE}) (Version: 1.0.0.0 - Electronic Arts)
Skype Click to Call (HKLM\...\{B6CF2967-C81E-40C0-9815-C05774FEF120}) (Version: 6.3.11079 - Skype Technologies S.A.)
Skype™ 6.3 (HKLM\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.3.105 - Skype Technologies S.A.)
SmartWebPrinting (Version: 110.0.182.000 - Hewlett-Packard) Hidden
Spelling Dictionaries Support For Adobe Reader 9 (HKLM\...\{AC76BA86-7AD7-5464-3428-900000000004}) (Version: 9.0.0 - Adobe Systems Incorporated)
swMSM (Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 11.1.3.2 - Synaptics)
Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch) (HKLM\...\{07629207-FAA0-4F1A-8092-BF5085BE511F}) (Version: 9.00.3042.00 - Microsoft Corporation)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (HKLM\...\{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB963707) (Version: 1 - Microsoft Corporation)
User Guide (HKLM\...\{BAE68339-B0F6-4D33-9554-5A3DB2DFF5DA}) (Version: 1.0 - )
VLC media player 1.1.11 (HKLM\...\VLC media player) (Version: 1.1.11 - VideoLAN)
Yahoo Community Smartbar (HKLM\...\{B5945149-A282-42E9-B43A-815E404F0580}) (Version: 1.185.66.12678 - Linkury Inc.) <==== ATTENTION
Yahoo Community Smartbar Engine (HKCU\...\{876aa0b9-a466-4542-8090-2464af9cb967}) (Version: 1.185.66.12678 - Linkury Inc.) <==== ATTENTION

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

15-08-2014 22:26:56 Windows Vista™ Service Pack 2
15-08-2014 23:01:41 Windows Update
16-08-2014 08:47:03 Windows Update
16-08-2014 09:18:32 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2006-11-02 12:23 - 2006-09-18 23:41 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1      localhost
::1            localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {15466A52-4664-4A65-9E9C-9BBFA160F6F1} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Signature Update => c:\program files\windows defender\MpCmdRun.exe [2008-01-21] (Microsoft Corporation)
Task: {18DFD9FC-082E-4E9B-8285-5F21D2B4EDAE} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {19D4039D-5E6B-4F99-BFF9-63177728BF9B} - System32\Tasks\EasyBatteryManager => C:\Program Files\Samsung\EBM\EasyBatteryMgr3.exe [2008-12-10] (SAMSUNG Electronics co., LTD.)
Task: {3DD74738-9513-4705-9004-BC736CDF5AB3} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\netsh.exe [2006-11-02] (Microsoft Corporation)
Task: {5916F864-469C-4391-8604-E4EA141A2699} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-21] ()
Task: {66272A2A-7C9A-4A74-99A6-BA34D3111465} - System32\Tasks\SUPBackground => C:\Program Files\Samsung\Samsung Update Plus\SUPBackground.exe [2010-04-20] ()
Task: {72BE2131-C30D-4303-ACC9-BDE24C4902AA} - System32\Tasks\EasyDisplayMgr => C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe [2009-05-15] (Samsung Electronics Co., Ltd.)
Task: {7C5A51E8-1AD7-48C6-8879-257A8A9609F5} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {8B0E6FAB-F43A-4988-AF0A-A21646C212F0} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {8C7623EB-E204-4667-904E-B63149A480FF} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2012-08-18] (Google Inc.)
Task: {9ED703A9-5FFD-40D5-895A-4385EE1509DE} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-21] (Microsoft Corporation)
Task: {B5268D72-D0C1-4BF7-8579-3AF9CB1112CE} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2012-08-18] (Google Inc.)
Task: {BD6AA34F-4839-455B-A927-A1BE582253C6} - System32\Tasks\SamsungMagicDoctor => C:\Program Files\Samsung\Samsung Magic Doctor\MagicDoctorKbdHk.exe [2008-08-26] (Samsung Electronics Co., Ltd.)
Task: {C35332B5-11CF-499B-BCEA-A00D88F6DE52} - System32\Tasks\Java Update Scheduler => C:\Program Files\Common Files\Java\Java Update\jusched.exe
Task: {E2B51B7C-59C4-43F7-BC8E-5CF6691533FF} - System32\Tasks\BatteryLifeExtender => C:\Program Files\Samsung\BatteryLifeExtender\BatteryLifeExtender.exe [2009-03-13] (Samsung Electronics. Co. Ltd.)
Task: {F0794984-29E7-4E64-B814-9728B072B284} - System32\Tasks\EasySpeedUpManager => C:\Program Files\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe [2009-05-28] (Samsung Electronics Co., Ltd.)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\User_Feed_Synchronization-{7030CE83-CC54-445E-964F-73E63606DF74}.job => C:\Windows\system32\msfeedssync.exe
Task: C:\Windows\Tasks\User_Feed_Synchronization-{DC24E08D-D800-4C9D-9DE2-5FF59CBB27E4}.job => C:\Windows\system32\msfeedssync.exe

==================== Loaded Modules (whitelisted) =============

2009-06-15 11:21 - 2008-11-25 16:27 - 00247152 _____ () C:\Program Files\CyberLink\Shared files\RichVideo.exe
2009-06-15 11:26 - 2006-08-12 05:48 - 00049152 _____ () C:\Program Files\Samsung\Samsung Magic Doctor\HookDllPS2.dll
2009-06-15 11:24 - 2006-08-12 05:48 - 00049152 _____ () C:\Program Files\Samsung\Easy Display Manager\HookDllPS2.dll
2009-06-15 11:24 - 2006-08-12 05:48 - 00049152 _____ () C:\Program Files\SAMSUNG\EasySpeedUpManager\HookDllPS2.dll
2008-12-24 05:29 - 2008-12-24 05:29 - 00619816 ____N () C:\Program Files\CyberLink\Power2Go\CLMediaLibrary.dll
2008-12-24 05:30 - 2008-12-24 05:30 - 00013096 ____N () C:\Program Files\CyberLink\Power2Go\CLMLSvcPS.dll
2012-10-23 18:37 - 2014-07-17 07:42 - 03800688 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (08/16/2014 11:28:21 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/16/2014 11:24:41 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 11) (User: )
Description: hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabEin erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.

Error: (08/16/2014 11:24:40 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 11) (User: )
Description: hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabEin erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.

Error: (08/16/2014 11:24:36 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 11) (User: )
Description: hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabEin erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.

Error: (08/16/2014 11:24:36 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 11) (User: )
Description: hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabEin erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.

Error: (08/16/2014 11:24:35 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 11) (User: )
Description: hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabEin erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.

Error: (08/16/2014 11:24:34 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 11) (User: )
Description: hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabEin erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.

Error: (08/16/2014 11:23:56 AM) (Source: .NET Runtime Optimization Service) (EventID: 1101) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - Failed to compile: Microsoft.Transactions.Bridge, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a . Error code = 0x80070005

Error: (08/16/2014 11:23:45 AM) (Source: .NET Runtime Optimization Service) (EventID: 1101) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - Failed to compile: System.ServiceModel, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 . Error code = 0x80070005

Error: (08/16/2014 11:23:28 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 11) (User: )
Description: hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabEin erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.


System errors:
=============
Error: (08/16/2014 11:32:59 AM) (Source: iaStor) (EventID: 9) (User: )
Description: Das Gerät \Device\Ide\iaStor0 hat innerhalb der Fehlerwartezeit nicht geantwortet.

Error: (08/16/2014 11:30:44 AM) (Source: Microsoft-Windows-LanguagePackSetup) (EventID: 1001) (User: NT-AUTORITÄT)
Description: 0x80070032

Error: (08/16/2014 11:28:23 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Parallel port driver%%1058

Error: (08/16/2014 11:15:27 AM) (Source: Microsoft-Windows-LanguagePackSetup) (EventID: 1001) (User: NT-AUTORITÄT)
Description: 0x80070032

Error: (08/16/2014 11:11:22 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Parallel port driver%%1058

Error: (08/16/2014 10:36:57 AM) (Source: Microsoft-Windows-LanguagePackSetup) (EventID: 1001) (User: NT-AUTORITÄT)
Description: 0x80070032

Error: (08/16/2014 10:36:11 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Parallel port driver%%1058

Error: (08/16/2014 00:53:22 AM) (Source: Microsoft-Windows-LanguagePackSetup) (EventID: 1000) (User: NT-AUTORITÄT)
Description: 0x80080005

Error: (08/16/2014 00:53:22 AM) (Source: Microsoft-Windows-LanguagePackSetup) (EventID: 1001) (User: NT-AUTORITÄT)
Description: 0x80004005

Error: (08/16/2014 00:53:21 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {752073A1-23F2-4396-85F0-8FDB879ED0ED}


Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2014-08-16 11:46:15.980
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-16 11:46:15.827
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-16 11:46:15.681
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-16 11:46:15.528
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-16 11:34:09.774
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-16 11:34:09.640
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-16 11:34:09.505
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-16 11:34:09.366
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-16 11:28:11.666
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-16 11:12:04.349
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info ===========================

Processor: Intel(R) Pentium(R) Dual CPU T3400 @ 2.16GHz
Percentage of memory in use: 46%
Total physical RAM: 3031.88 MB
Available physical RAM: 1632.95 MB
Total Pagefile: 6292.16 MB
Available Pagefile: 4547.24 MB
Total Virtual: 2047.88 MB
Available Virtual: 1911.69 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:109.88 GB) (Free:16.25 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: () (Fixed) (Total:110 GB) (Free:71.21 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 232.9 GB) (Disk ID: D4BD9B58)
Partition 1: (Not Active) - (Size=13 GB) - (Type=27)
Partition 2: (Active) - (Size=109.9 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=110 GB) - (Type=07 NTFS)

==================== End Of Log ============================

deeprybka 16.08.2014 11:19
Hi,

schau mal ob Du das Yahoo Community Smartbar-Zeug mit Revo finden und deinstallieren kannst. Vielleicht ist es auch nur noch ein "leerer" Eintrag.

Lade Dir bitte Revo Uninstallerhttp://deeprybka.trojaner-board.de/b...ninstaller.pnghier herunter. Entpacke die zip-Datei auf den Desktop.
Dann schau mal hier ob Du den IE 9 installieren kannst.
Internet Explorer - Microsoft Download Center

Damit dann das aufrufen:
Flash-Link mit dem Internet Explorer aufrufen. Flash aktualisieren. Optionale Angebote ablehnen.

Das neueste Java von hier installieren:
Java installieren.


http://www.trojaner-board.de/extra/lesestoff.pngGibt es jetzt noch Probleme mit dem PC? Wenn ja, welche?

Katharina123 16.08.2014 20:38
Ich habe die Schritte soweit erledigt.
Sieht eigentlich alles gut aus.

Regenschirm von Avira ist offen und meldet "Ihr Computer ist sicher".

Das Windows-Sicherheitscenter meldet allerdings folgendes:

Virenschutz:
Avira Desktop hat gemeldet , dass es ausgeschaltet ist.

Schutz vor Spyware...
Windows Defender als auch Avira Desktop haben gemeldet, dass sie ausgeschaltet sind.
Wenn ich hier auf "Einschalten" drücke, tut sich nix.

Ich denke aber, dass Avira schon aktiv ist, dass das nur das Sicherheitscenter nicht erkennt, oder?

deeprybka 16.08.2014 20:55
Hi,
probiere das mal aus und sag bitte ob es was gebracht hat OK? :)
Wichtig mit der rechten Maustaste als Admin starten und alle Meldungen mit Ja bestätigen. PC wird neugestartet!

Drücke bitte die http://deeprybka.trojaner-board.de/b...ne/revo/w7.png + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument
Code:
net stop winmgmt
del %windir%\System32\Wbem\Repository
net start winmgmt
shutdown /r
  • Wähle Datei --> Speichern unter
  • Dateiname: avira.bat
  • Dateityp: Wähle Alle Dateien (*.*)
  • Speichere die Datei auf deinem Desktop. Es sollte nun ungefähr so aussehen http://larusso.trojaner-board.de/Images/bat.jpg
  • Starte die avira.bat.
Vista und Win7 User: Mit Rechtsklick "als Administrator starten"

Katharina123 16.08.2014 21:45
Situation hat sich etwas verändert, passt aber immer noch nicht ganz.

Im Windows-Sicherheitscenter wird jetzt "Schutz vor Spyware und anderer schädlicher Software" als "Ein" angezeigt.

Beim Virenschutz im Sicherheitscenter heißt es jetzt aber "Es wurde keine Antivirussoftware auf diesem Computer gefunden".

Avira-Regenschirm ist offen und meldet "Ihr Rechner ist geschützt".

deeprybka 16.08.2014 21:50
Vista und Avira...:rofl:
So, dann hätte ich jetzt noch gerne frische Logs... :)

Schritt 1

http://filepony.de/icon/frst.pnghttp://deeprybka.trojaner-board.de/b...t/frstscan.png

Bitte starte FRST erneut, markiere auch die checkbox http://deeprybka.trojaner-board.de/b...t/addition.pngund drücke auf Scan.
Bitte poste mir den Inhalt der beiden Logs die erstellt werden.

Katharina123 16.08.2014 22:01
So, hier die Logs:

Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:16-08-2014 02
Ran by Wichsis (administrator) on KATHARINA on 16-08-2014 22:50:56
Running from C:\Users\Wichsis\Desktop
Platform: Microsoft® Windows Vista™ Home Basic  Service Pack 2 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Microsoft Corporation) C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe
() C:\Program Files\CyberLink\Shared files\RichVideo.exe
(Skype Technologies S.A.) C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbam.exe
(SAMSUNG Electronics co., LTD.) C:\Program Files\Samsung\EBM\EasyBatteryMgr3.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Samsung Magic Doctor\MagicDoctorKbdHk.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(CyberLink) C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe
(CyberLink Corp.) C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Fred's Software) C:\Program Files\PrintKey2000\Printkey2000.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Google Inc.) C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil32_14_0_0_176_ActiveX.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKU\S-1-5-21-3121953689-2843351358-1462341086-1000\...\Run: [KiesHelper] => C:\Program Files\Samsung\Kies\KiesHelper.exe [943504 2012-02-03] (Samsung)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Printkey2000.lnk
ShortcutTarget: Printkey2000.lnk -> C:\Program Files\PrintKey2000\Printkey2000.exe (Fred's Software)
Startup: C:\Users\Kathi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.msn.com/?ocid=EIE9HP&PC=UP50
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://de.msn.com/?ocid=EIE9HP&PC=UP50
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=SMSN&bmod=SMSN
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO: Google Toolbar Notifier BHO -> {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} -> C:\Program Files\Google\GoogleToolbarNotifier\5.7.9012.1008\swg.dll (Google Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {6E718D87-6909-4FCE-92D4-EDCB2F725727} hxxp://navigram.com/engine/v1026/Navigram.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Wichsis\AppData\Roaming\Mozilla\Firefox\Profiles\an2mua9h.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2012-10-23]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2011-12-28]
FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2 [2012-08-30]
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2
FF HKCU\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files\Common Files\DVDVideoSoft\plugins\ff
FF Extension: Download videos and MP3s from YouTube - C:\Program Files\Common Files\DVDVideoSoft\plugins\ff [2013-11-02]

Chrome:
=======
CHR HKLM\...\Chrome\Extension: [aaaaacalgebmfelllfiaoknifldpngjh] - C:\ProgramData\AskPartnerNetwork\Toolbar\AVIRA-V7\CRX\ToolbarCR.crx []

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-08-15] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-08-15] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1021008 2014-08-15] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe [141392 2014-07-24] (Avira Operations GmbH & Co. KG)
R2 MBAMScheduler; C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
S4 MSSQLServerADHelper; C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [45272 2005-10-14] (Microsoft Corporation)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [43520 2008-02-28] (Hewlett-Packard) [File not signed]
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [53248 2008-02-28] (Hewlett-Packard) [File not signed]
R2 RichVideo; C:\Program Files\CyberLink\Shared files\RichVideo.exe [247152 2008-11-25] ()
R2 Skype C2C Service; C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [3064000 2012-10-02] (Skype Technologies S.A.)
S2 APNMCP; "C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [97648 2014-07-03] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-06-05] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-26] (Avira Operations GmbH & Co. KG)
R2 KMDFMEMIO; C:\Windows\System32\DRIVERS\kmdfmemio.sys [13312 2006-11-14] (SAMSUNG ELECTRONICS CO., LTD.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-05-12] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [110296 2014-08-16] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-05-12] (Malwarebytes Corporation)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-08-05] (Avira GmbH)
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-21] (Microsoft Corporation)
S3 catchme; \??\C:\Users\Wichsis\AppData\Local\Temp\catchme.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-16 22:29 - 2014-08-16 22:29 - 00000100 _____ () C:\Users\Wichsis\Desktop\avira.bat
2014-08-16 22:17 - 2014-08-16 22:17 - 00001002 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-08-16 22:10 - 2014-08-16 22:18 - 00000000 ____D () C:\ProgramData\Package Cache
2014-08-16 21:21 - 2014-08-16 21:21 - 00000000 ____D () C:\Users\Wichsis\AppData\Roaming\Oracle
2014-08-16 21:20 - 2014-08-16 21:20 - 00000000 ____D () C:\Windows\Sun
2014-08-16 21:19 - 2014-08-16 21:20 - 00000000 ____D () C:\ProgramData\Oracle
2014-08-16 21:19 - 2014-08-16 21:19 - 00000000 ____D () C:\Program Files\Common Files\Java
2014-08-16 21:19 - 2014-08-16 21:18 - 00272808 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-08-16 21:18 - 2014-08-16 21:18 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-08-16 21:18 - 2014-08-16 21:18 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-08-16 21:18 - 2014-08-16 21:18 - 00096680 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-08-16 21:18 - 2014-08-16 21:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-08-16 21:18 - 2014-08-16 21:18 - 00000000 ____D () C:\Program Files\Java
2014-08-16 21:15 - 2014-08-16 22:14 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-08-16 21:07 - 2012-06-03 00:19 - 01933848 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-08-16 21:07 - 2012-06-03 00:19 - 00577048 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-08-16 21:07 - 2012-06-03 00:19 - 00053784 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-08-16 21:07 - 2012-06-03 00:19 - 00045080 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-08-16 21:07 - 2012-06-03 00:19 - 00035864 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-08-16 21:07 - 2012-06-03 00:12 - 02422272 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-08-16 21:07 - 2012-06-03 00:12 - 00088576 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-08-16 21:07 - 2012-06-02 15:19 - 00171904 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-08-16 21:07 - 2012-06-02 15:12 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-08-16 21:03 - 2014-08-16 21:03 - 00000949 _____ () C:\Users\Kathi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-08-16 12:45 - 2014-08-16 12:45 - 12353024 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 09711616 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 03695416 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2014-08-16 12:45 - 2014-08-16 12:45 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-08-16 12:45 - 2014-08-16 12:45 - 01810432 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-08-16 12:45 - 2014-08-16 12:45 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 01106432 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00434176 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00367104 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2014-08-16 12:45 - 2014-08-16 12:45 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00353584 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00227840 _____ (Microsoft Corporation) C:\Windows\system32\ieaksie.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00203776 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\ieakui.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00162304 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00161792 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00152064 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2014-08-16 12:45 - 2014-08-16 12:45 - 00150528 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2014-08-16 12:45 - 2014-08-16 12:45 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-08-16 12:45 - 2014-08-16 12:45 - 00130560 _____ (Microsoft Corporation) C:\Windows\system32\ieakeng.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00118784 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00114176 _____ (Microsoft Corporation) C:\Windows\system32\advpack.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00110592 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00101888 _____ (Microsoft Corporation) C:\Windows\system32\admparse.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00078848 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2014-08-16 12:45 - 2014-08-16 12:45 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2014-08-16 12:45 - 2014-08-16 12:45 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-08-16 12:45 - 2014-08-16 12:45 - 00073728 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2014-08-16 12:45 - 2014-08-16 12:45 - 00054272 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00031744 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2014-08-16 12:45 - 2014-08-16 12:45 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-08-16 12:44 - 2014-08-16 12:47 - 00000000 ___HD () C:\Windows\msdownld.tmp
2014-08-16 12:44 - 2014-08-16 12:44 - 02873344 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2014-08-16 12:44 - 2014-08-16 12:44 - 01554432 _____ (Microsoft Corporation) C:\Windows\system32\xpsservices.dll
2014-08-16 12:44 - 2014-08-16 12:44 - 01172480 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-08-16 12:44 - 2014-08-16 12:44 - 01075712 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2014-08-16 12:44 - 2014-08-16 12:44 - 01068544 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2014-08-16 12:44 - 2014-08-16 12:44 - 01029120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll
2014-08-16 12:44 - 2014-08-16 12:44 - 00979456 _____ (Microsoft Corporation) C:\Windows\system32\MFH264Dec.dll
2014-08-16 12:44 - 2014-08-16 12:44 - 00876032 _____ (Microsoft Corporation) C:\Windows\system32\XpsPrint.dll
2014-08-16 12:44 - 2014-08-16 12:44 - 00847360 _____ (Microsoft Corporation) C:\Windows\system32\OpcServices.dll
2014-08-16 12:44 - 2014-08-16 12:44 - 00797184 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2014-08-16 12:44 - 2014-08-16 12:44 - 00683008 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2014-08-16 12:44 - 2014-08-16 12:44 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\printfilterpipelinesvc.exe
2014-08-16 12:44 - 2014-08-16 12:44 - 00638336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-08-16 12:44 - 2014-08-16 12:44 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\stobject.dll
2014-08-16 12:44 - 2014-08-16 12:44 - 00486400 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2014-08-16 12:44 - 2014-08-16 12:44 - 00478720 _____ (Microsoft Corporation) C:\Windows\system32\dxgi.dll
2014-08-16 12:44 - 2014-08-16 12:44 - 00357376 _____ (Microsoft Corporation) C:\Windows\system32\MFHEAACdec.dll
2014-08-16 12:44 - 2014-08-16 12:44 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\mfmp4src.dll
2014-08-16 12:44 - 2014-08-16 12:44 - 00288768 _____ (Microsoft Corporation) C:\Windows\system32\XpsGdiConverter.dll
2014-08-16 12:44 - 2014-08-16 12:44 - 00261632 _____ (Microsoft Corporation) C:\Windows\system32\mfreadwrite.dll
2014-08-16 12:44 - 2014-08-16 12:44 - 00258048 _____ (Microsoft Corporation) C:\Windows\system32\winspool.drv
2014-08-16 12:44 - 2014-08-16 12:44 - 00219648 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll
2014-08-16 12:44 - 2014-08-16 12:44 - 00209920 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll
2014-08-16 12:44 - 2014-08-16 12:44 - 00189952 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll
2014-08-16 12:44 - 2014-08-16 12:44 - 00160768 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll
2014-08-16 12:44 - 2014-08-16 12:44 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\XpsRasterService.dll
2014-08-16 12:44 - 2014-08-16 12:44 - 00098816 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2014-08-16 12:44 - 2014-08-16 12:44 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2014-08-16 12:44 - 2014-08-16 12:44 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\printfilterpipelineprxy.dll
2014-08-16 12:42 - 2014-08-16 12:42 - 00974848 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-08-16 12:42 - 2014-08-16 12:42 - 00519680 _____ (Microsoft Corporation) C:\Windows\system32\d3d11.dll
2014-08-16 12:42 - 2014-08-16 12:42 - 00369664 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2014-08-16 12:42 - 2014-08-16 12:42 - 00321024 _____ (Microsoft Corporation) C:\Windows\system32\PhotoMetadataHandler.dll
2014-08-16 12:42 - 2014-08-16 12:42 - 00252928 _____ (Microsoft Corporation) C:\Windows\system32\dxdiag.exe
2014-08-16 12:42 - 2014-08-16 12:42 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\dxdiagn.dll
2014-08-16 12:42 - 2014-08-16 12:42 - 00189440 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecsExt.dll
2014-08-16 12:34 - 2014-08-16 12:48 - 00010949 _____ () C:\Windows\IE9_main.log
2014-08-16 12:25 - 2014-08-16 12:25 - 00000000 ____D () C:\Users\Wichsis\Desktop\revouninstaller-portable
2014-08-16 11:46 - 2014-08-16 11:47 - 00025891 _____ () C:\Users\Wichsis\Desktop\Addition.txt
2014-08-16 11:33 - 2014-08-16 11:33 - 00000000 ____D () C:\Users\Wichsis\Desktop\FRST-OlderVersion
2014-08-16 11:25 - 2014-08-16 11:25 - 00000000 ____D () C:\Users\Wichsis\AppData\Local\WindowsUpdate
2014-08-16 11:08 - 2014-08-16 11:08 - 00000000 ____D () C:\Windows\system32\WindowsPowerShell
2014-08-16 10:52 - 2014-08-16 10:52 - 00000000 ____D () C:\Windows\system32\x64
2014-08-16 10:49 - 2009-10-09 23:56 - 01181696 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll
2014-08-16 10:49 - 2009-10-09 23:56 - 00246272 _____ (Microsoft Corporation) C:\Windows\system32\WSManHTTPConfig.exe
2014-08-16 10:49 - 2009-10-09 23:56 - 00241152 _____ (Microsoft Corporation) C:\Windows\system32\winrscmd.dll
2014-08-16 10:49 - 2009-10-09 23:56 - 00214016 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll
2014-08-16 10:49 - 2009-10-09 23:56 - 00145408 _____ (Microsoft Corporation) C:\Windows\system32\WsmAuto.dll
2014-08-16 10:49 - 2009-10-09 23:56 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\pwrshplugin.dll
2014-08-16 10:49 - 2009-10-09 23:56 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\winrs.exe
2014-08-16 10:49 - 2009-10-09 23:56 - 00020480 _____ (Microsoft Corporation) C:\Windows\system32\winrshost.exe
2014-08-16 10:49 - 2009-10-09 23:56 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\wsmprovhost.exe
2014-08-16 10:49 - 2009-10-09 23:56 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\wsmplpxy.dll
2014-08-16 10:49 - 2009-10-09 23:56 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\winrssrv.dll
2014-08-16 10:49 - 2009-10-09 23:56 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\winrsmgr.dll
2014-08-16 10:49 - 2009-10-09 23:55 - 00252416 _____ (Microsoft Corporation) C:\Windows\system32\WSManMigrationPlugin.dll
2014-08-16 10:49 - 2009-10-09 23:55 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\wecsvc.dll
2014-08-16 10:49 - 2009-10-09 23:55 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\wevtfwd.dll
2014-08-16 10:49 - 2009-10-09 23:55 - 00079872 _____ (Microsoft Corporation) C:\Windows\system32\wecutil.exe
2014-08-16 10:49 - 2009-10-09 23:55 - 00056320 _____ (Microsoft Corporation) C:\Windows\system32\wecapi.dll
2014-08-16 10:49 - 2009-10-09 23:55 - 00054272 _____ (Microsoft Corporation) C:\Windows\system32\WsmRes.dll
2014-08-16 10:49 - 2009-08-01 08:27 - 00201184 _____ () C:\Windows\system32\winrm.vbs
2014-08-16 10:49 - 2009-07-16 19:30 - 00004675 _____ () C:\Windows\system32\wsmanconfig_schema.xml
2014-08-16 10:49 - 2009-07-16 19:30 - 00002426 _____ () C:\Windows\system32\WsmTxt.xsl
2014-08-16 10:46 - 2011-04-12 18:07 - 00892416 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-08-16 10:46 - 2011-03-03 17:40 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\Apphlpdm.dll
2014-08-16 10:46 - 2011-03-03 15:35 - 04240384 _____ (Microsoft) C:\Windows\system32\GameUXLegacyGDFs.dll
2014-08-16 10:46 - 2010-08-26 18:34 - 01696256 _____ (Microsoft Corporation) C:\Windows\system32\gameux.dll
2014-08-16 10:46 - 2010-01-25 14:00 - 00471552 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll
2014-08-16 10:46 - 2010-01-25 14:00 - 00471552 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll
2014-08-16 10:46 - 2010-01-25 14:00 - 00152576 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll
2014-08-16 10:46 - 2010-01-25 14:00 - 00152064 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll
2014-08-16 10:46 - 2010-01-25 13:58 - 00332288 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll
2014-08-16 10:46 - 2010-01-25 10:21 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe
2014-08-16 10:46 - 2010-01-25 10:21 - 00518144 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe
2014-08-16 10:46 - 2010-01-25 10:21 - 00347136 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe
2014-08-16 10:46 - 2010-01-25 10:21 - 00346624 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe
2014-08-16 10:46 - 2009-10-23 19:10 - 00714240 _____ (Microsoft Corporation) C:\Windows\system32\timedate.cpl
2014-08-16 10:46 - 2009-09-10 16:58 - 00310784 _____ (Microsoft Corporation) C:\Windows\system32\unregmp2.exe
2014-08-16 00:45 - 2014-08-16 00:46 - 00000000 ____D () C:\Windows\system32\vi-VN
2014-08-16 00:45 - 2014-08-16 00:46 - 00000000 ____D () C:\Windows\system32\eu-ES
2014-08-16 00:45 - 2014-08-16 00:46 - 00000000 ____D () C:\Windows\system32\ca-ES
2014-08-16 00:42 - 2014-08-16 00:42 - 00000000 ____D () C:\Windows\system32\SPReview
2014-08-16 00:30 - 2009-04-10 23:28 - 00928768 _____ (Microsoft Corporation) C:\Windows\system32\scavenge.dll
2014-08-16 00:30 - 2009-04-10 23:27 - 00057856 _____ (Microsoft Corporation) C:\Windows\system32\compcln.exe
2014-08-16 00:29 - 2009-04-10 23:33 - 00614376 _____ (Microsoft Corporation) C:\Windows\system32\ci.dll
2014-08-16 00:29 - 2009-04-10 23:32 - 01083880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-08-16 00:29 - 2009-04-10 23:32 - 00527848 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys
2014-08-16 00:29 - 2009-04-10 23:32 - 00265688 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\acpi.sys
2014-08-16 00:29 - 2009-04-10 23:32 - 00245736 _____ (Microsoft Corporation) C:\Windows\system32\clfs.sys
2014-08-16 00:29 - 2009-04-10 23:32 - 00223208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-08-16 00:29 - 2009-04-10 23:32 - 00190424 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fltMgr.sys
2014-08-16 00:29 - 2009-04-10 23:32 - 00180712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-08-16 00:29 - 2009-04-10 23:32 - 00161752 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msrpc.sys
2014-08-16 00:29 - 2009-04-10 23:32 - 00149480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\pci.sys
2014-08-16 00:29 - 2009-04-10 23:32 - 00141288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ecache.sys
2014-08-16 00:29 - 2009-04-10 23:32 - 00125928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Classpnp.sys
2014-08-16 00:29 - 2009-04-10 23:32 - 00099816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2014-08-16 00:29 - 2009-04-10 23:32 - 00054248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\partmgr.sys
2014-08-16 00:29 - 2009-04-10 23:32 - 00053736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\disk.sys
2014-08-16 00:29 - 2009-04-10 23:32 - 00050664 _____ (Microsoft Corporation) C:\Windows\system32\PSHED.DLL
2014-08-16 00:29 - 2009-04-10 23:32 - 00048104 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mup.sys
2014-08-16 00:29 - 2009-04-10 23:32 - 00035304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\crashdmp.sys
2014-08-16 00:29 - 2009-04-10 23:32 - 00027624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Dumpata.sys
2014-08-16 00:29 - 2009-04-10 23:28 - 06103040 _____ (Microsoft Corporation) C:\Windows\system32\chtbrkr.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 03174400 _____ (Microsoft Corporation) C:\Windows\system32\netshell.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 03072000 _____ (Microsoft Corporation) C:\Windows\system32\networkmap.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 02515968 _____ (Microsoft Corporation) C:\Windows\system32\accessibilitycpl.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 02226688 _____ (Microsoft Corporation) C:\Windows\system32\networkexplorer.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 02225664 _____ (Microsoft Corporation) C:\Windows\system32\netcenter.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 02153472 _____ (Microsoft Corporation) C:\Windows\system32\oobefldr.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 02134528 _____ (Microsoft Corporation) C:\Windows\system32\FunctionDiscoveryFolder.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01985024 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01856512 _____ (Microsoft Corporation) C:\Windows\system32\dbgeng.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01823744 _____ (Microsoft Corporation) C:\Windows\system32\pnidui.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01788416 _____ (Microsoft Corporation) C:\Windows\system32\d3d9.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01730560 _____ (Microsoft Corporation) C:\Windows\system32\apds.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01671680 _____ (Microsoft Corporation) C:\Windows\system32\chsbrkr.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01645568 _____ (Microsoft Corporation) C:\Windows\system32\connect.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01591296 _____ (Microsoft Corporation) C:\Windows\system32\setupapi.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01589248 _____ (Microsoft Corporation) C:\Windows\system32\msjet40.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01544704 _____ (Microsoft Corporation) C:\Windows\system32\MSVidCtl.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01541120 _____ (Microsoft Corporation) C:\Windows\system32\onex.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01502720 _____ (Microsoft Corporation) C:\Windows\system32\certmgr.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01480704 _____ (Microsoft Corporation) C:\Windows\system32\mssrch.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01459200 _____ (Microsoft Corporation) C:\Windows\system32\esent.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01381376 _____ (Microsoft Corporation) C:\Windows\system32\Query.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01342464 _____ (Microsoft Corporation) C:\Windows\system32\brcpl.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01324032 _____ (Microsoft Corporation) C:\Windows\system32\browseui.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01248768 _____ (Microsoft Corporation) C:\Windows\system32\PerfCenterCPL.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01209856 _____ (Microsoft Corporation) C:\Windows\system32\comsvcs.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01112064 _____ (Microsoft Corporation) C:\Windows\system32\CertEnroll.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01107968 _____ (Microsoft Corporation) C:\Windows\system32\pidgenx.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01078784 _____ (Microsoft Corporation) C:\Windows\system32\diagperf.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 01053696 _____ (Microsoft Corporation) C:\Windows\system32\msdtctm.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00978944 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00978432 _____ (Microsoft Corporation) C:\Windows\system32\drmv2clt.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00971264 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00950784 _____ (Microsoft Corporation) C:\Windows\system32\gpedit.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00880640 _____ (Microsoft Corporation) C:\Windows\system32\RacEngn.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00869888 _____ (Microsoft Corporation) C:\Windows\system32\printui.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00856064 _____ (Microsoft Corporation) C:\Windows\system32\mswdat10.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00825856 _____ (Microsoft Corporation) C:\Windows\system32\rasdlg.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00807424 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00805376 _____ (Microsoft Corporation) C:\Windows\system32\NaturalLanguage6.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00758784 _____ (Microsoft Corporation) C:\Windows\system32\qmgr.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00757248 _____ (Microsoft Corporation) C:\Windows\system32\azroles.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00754688 _____ (Microsoft Corporation) C:\Windows\system32\propsys.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00723968 _____ (Microsoft Corporation) C:\Windows\system32\powercpl.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00679936 _____ (Microsoft Corporation) C:\Windows\system32\msvcrt.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00670720 _____ (Microsoft Corporation) C:\Windows\system32\mssvp.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00644608 _____ (Microsoft Corporation) C:\Windows\system32\p2psvc.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00643072 _____ (Microsoft Corporation) C:\Windows\system32\msrepl40.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00642560 _____ (Microsoft Corporation) C:\Windows\system32\rasgcw.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\CertEnrollUI.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\sethc.exe
2014-08-16 00:29 - 2009-04-10 23:28 - 00618496 _____ (Microsoft Corporation) C:\Windows\system32\mswstr10.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00612864 _____ (Microsoft Corporation) C:\Windows\system32\rdpencom.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00595456 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2014-08-16 00:29 - 2009-04-10 23:28 - 00593408 _____ (Microsoft Corporation) C:\Windows\system32\comuid.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00592896 _____ (Microsoft Corporation) C:\Windows\system32\netlogon.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00576512 _____ (Microsoft Corporation) C:\Windows\system32\gpsvc.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00564224 _____ (Microsoft Corporation) C:\Windows\system32\msftedit.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00564224 _____ (Microsoft Corporation) C:\Windows\system32\emdmgmt.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00560640 _____ (Microsoft Corporation) C:\Windows\system32\msdtcprx.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00551936 _____ (Microsoft Corporation) C:\Windows\system32\prnntfy.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00550400 _____ (Microsoft Corporation) C:\Windows\system32\rpcss.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00542720 _____ (Microsoft Corporation) C:\Windows\system32\blackbox.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00542208 _____ (Microsoft Corporation) C:\Windows\system32\pnpui.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00516608 _____ (Microsoft Corporation) C:\Windows\system32\autoplay.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00505344 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00485888 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00483328 _____ (Microsoft Corporation) C:\Windows\system32\samsrv.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00481792 _____ (Microsoft Corporation) C:\Windows\system32\cmdial32.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00478208 _____ (Microsoft Corporation) C:\Windows\system32\DevicePairing.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00469504 _____ (Microsoft Corporation) C:\Windows\system32\newdev.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00467456 _____ (Microsoft Corporation) C:\Windows\system32\netapi32.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00466944 _____ (Microsoft Corporation) C:\Windows\system32\riched20.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00464384 _____ (Microsoft Corporation) C:\Windows\system32\pcaui.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00463872 _____ (Microsoft Corporation) C:\Windows\system32\IasMigReader.exe
2014-08-16 00:29 - 2009-04-10 23:28 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\msxbde40.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00454144 _____ (Microsoft) C:\Windows\system32\IasMigPlugin.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00450560 _____ (Microsoft Corporation) C:\Windows\system32\comdlg32.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00445952 _____ (Microsoft Corporation) C:\Windows\system32\ncryptui.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00444416 _____ (Microsoft Corporation) C:\Windows\system32\dsound.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00441344 _____ (Microsoft Corporation) C:\Windows\system32\SearchIndexer.exe
2014-08-16 00:29 - 2009-04-10 23:28 - 00414208 _____ (Microsoft Corporation) C:\Windows\system32\msscp.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00409600 _____ (Microsoft Corporation) C:\Windows\system32\msexch40.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00407552 _____ (Microsoft Corporation) C:\Windows\system32\MPSSVC.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00406528 _____ (Microsoft Corporation) C:\Windows\system32\msvcp60.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00391680 _____ (Microsoft Corporation) C:\Windows\system32\mscms.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00378368 _____ (Microsoft Corporation) C:\Windows\system32\devmgr.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00376832 _____ (Microsoft Corporation) C:\Windows\system32\rasplap.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00368640 _____ (Microsoft Corporation) C:\Windows\system32\mspbde40.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00368640 _____ () C:\Windows\system32\msjetoledb40.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00351744 _____ (Microsoft Corporation) C:\Windows\system32\mssph.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00344064 _____ (Microsoft Corporation) C:\Windows\system32\msrd3x40.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\RelMon.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00339968 _____ (Microsoft Corporation) C:\Windows\system32\msexcl40.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00334848 _____ (Microsoft Corporation) C:\Windows\system32\BFE.DLL
2014-08-16 00:29 - 2009-04-10 23:28 - 00332800 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00327168 _____ (Microsoft Corporation) C:\Windows\system32\P2PGraph.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00324608 _____ (Microsoft Corporation) C:\Windows\system32\sdohlp.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00323584 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00319488 _____ (Microsoft Corporation) C:\Windows\system32\msrd2x40.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00310272 _____ (Microsoft Corporation) C:\Windows\system32\mtxclu.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00306176 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\QAGENTRT.DLL
2014-08-16 00:29 - 2009-04-10 23:28 - 00297472 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00293376 _____ (Microsoft Corporation) C:\Windows\system32\psisdecd.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00293376 _____ (Microsoft Corporation) C:\Windows\system32\photowiz.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\msjtes40.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00288256 _____ (Microsoft Corporation) C:\Windows\system32\modemui.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00286720 _____ (Microsoft Corporation) C:\Windows\system32\rasapi32.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\drmmgrtn.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00282624 _____ (Microsoft Corporation) C:\Windows\system32\mstext40.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00281088 _____ (Microsoft Corporation) C:\Windows\system32\raschap.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00279552 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2014-08-16 00:29 - 2009-04-10 23:28 - 00274432 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00268800 _____ (Microsoft Corporation) C:\Windows\system32\es.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\rasmans.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\rasppp.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\drvstore.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00245760 _____ (Microsoft Corporation) C:\Windows\system32\scansetting.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00242176 _____ (Microsoft Corporation) C:\Windows\system32\pdh.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00241664 _____ (Microsoft Corporation) C:\Windows\system32\msltus40.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00241152 _____ (Microsoft Corporation) C:\Windows\system32\PortableDeviceApi.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00231424 _____ (Microsoft Corporation) C:\Windows\system32\msshsq.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\mscandui.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00217600 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00216064 _____ (Microsoft Corporation) C:\Windows\system32\ntprint.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00204288 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00204288 _____ (Microsoft Corporation) C:\Windows\system32\dhcpcsvc.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00203264 _____ (Microsoft Corporation) C:\Windows\system32\mssphtb.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00199168 _____ (Microsoft Corporation) C:\Windows\system32\adsldpc.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00194560 _____ (Microsoft Corporation) C:\Windows\system32\offfilt.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\eapp3hst.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00185344 _____ (Microsoft Corporation) C:\Windows\system32\SearchProtocolHost.exe
2014-08-16 00:29 - 2009-04-10 23:28 - 00183808 _____ (Microsoft Corporation) C:\Windows\system32\eapphost.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00181760 _____ (Microsoft Corporation) C:\Windows\system32\pnpsetup.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00180736 _____ (Microsoft Corporation) C:\Windows\system32\netplwiz.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00180224 _____ (Microsoft Corporation) C:\Windows\system32\scrobj.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00179712 _____ (Microsoft Corporation) C:\Windows\system32\msnetobj.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00178176 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00177152 _____ (Microsoft Corporation) C:\Windows\system32\scecli.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00175616 _____ (Microsoft Corporation) C:\Windows\system32\dot3svc.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00171008 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00166400 _____ (Microsoft Corporation) C:\Windows\system32\puiapi.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00163328 _____ (Microsoft Corporation) C:\Windows\system32\msutb.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00160768 _____ (Microsoft Corporation) C:\Windows\system32\PortableDeviceTypes.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00155136 _____ (Microsoft Corporation) C:\Windows\system32\rasmontr.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00153088 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00153088 _____ (Microsoft Corporation) C:\Windows\system32\fundisc.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00150528 _____ (Microsoft Corporation) C:\Windows\system32\MMDevAPI.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00150528 _____ (Microsoft Corporation) C:\Windows\system32\iasnap.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00147456 _____ (Microsoft Corporation) C:\Windows\system32\Faultrep.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00142336 _____ (Microsoft Corporation) C:\Windows\system32\fontext.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\scksp.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00137728 _____ (Microsoft Corporation) C:\Windows\system32\dsprop.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\nlhtml.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\eappcfg.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00130560 _____ (Microsoft Corporation) C:\Windows\system32\dhcpcsvc6.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00129024 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00127488 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00122368 _____ (Microsoft Corporation) C:\Windows\system32\inetpp.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00121344 _____ (Microsoft Corporation) C:\Windows\system32\ntmarta.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00120320 _____ (Microsoft Corporation) C:\Windows\system32\EhStorAPI.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00117248 _____ () C:\Windows\system32\EhStorAuthn.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\odbccp32.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00114176 _____ (Microsoft Corporation) C:\Windows\system32\EhStorShell.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00107008 _____ (Microsoft Corporation) C:\Windows\system32\regsvc.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00107008 _____ (Microsoft Corporation) C:\Windows\system32\rdpwsx.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00105472 _____ (Microsoft Corporation) C:\Windows\system32\dmsynth.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00101888 _____ (Microsoft Corporation) C:\Windows\system32\dmusic.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00098816 _____ (Microsoft Corporation) C:\Windows\system32\powrprof.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\oleprn.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\mprapi.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00095232 _____ (Microsoft Corporation) C:\Windows\system32\SCardSvr.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00094720 _____ (Microsoft Corporation) C:\Windows\system32\PortableDeviceClassExtension.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00093696 _____ (Microsoft Corporation) C:\Windows\system32\eappgnui.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00088576 _____ (Microsoft Corporation) C:\Windows\system32\olepro32.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\fdBth.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00087552 _____ (Microsoft Corporation) C:\Windows\system32\SearchFilterHost.exe
2014-08-16 00:29 - 2009-04-10 23:28 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\mssitlb.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\msctfui.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mstlsapi.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\msctfp.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00079872 _____ (Microsoft Corporation) C:\Windows\system32\authz.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00075264 _____ (Microsoft Corporation) C:\Windows\system32\gpapi.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00075264 _____ (Microsoft Corporation) C:\Windows\system32\dot3msm.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00075264 _____ (Microsoft Corporation) C:\Windows\system32\adsmsext.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\propdefs.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\iashlpr.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\sendmail.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\rastapi.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\PNPXAssoc.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\fdWCN.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00068608 _____ (Microsoft Corporation) C:\Windows\system32\mpr.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00068096 _____ (Microsoft Corporation) C:\Windows\system32\fdSSDP.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00067584 _____ (Microsoft Corporation) C:\Windows\system32\regapi.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\fdWSD.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\msjter40.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msscntrs.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00058880 _____ (Microsoft Corporation) C:\Windows\system32\iasacct.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\samlib.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\iasads.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\DevicePairingProxy.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00054272 _____ (Microsoft Corporation) C:\Windows\system32\feclient.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\fdeploy.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\rasdiag.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00049664 _____ (Microsoft Corporation) C:\Windows\system32\dot3cfg.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\iasdatastore.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00045568 _____ (Microsoft Corporation) C:\Windows\system32\bthci.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00045056 _____ (Microsoft Corporation) C:\Windows\system32\dataclen.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\msstrc.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\hbaapi.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00040960 _____ (Microsoft Corporation) C:\Windows\system32\odbcconf.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00040960 _____ (Microsoft Corporation) C:\Windows\system32\bthserv.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\certprop.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\networkitemfactory.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\rtffilt.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\EhStorPwdMgr.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\msscb.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\mssprxy.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00031744 _____ (Microsoft Corporation) C:\Windows\system32\perfdisk.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00031744 _____ (Microsoft Corporation) C:\Windows\system32\cscapi.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00031744 _____ (Microsoft Corporation) C:\Windows\system32\bitsigd.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\msimtf.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\FwRemoteSvr.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\hidserv.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\msjint40.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00024064 _____ (Microsoft Corporation) C:\Windows\system32\fdProxy.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\cscdll.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00020992 _____ (Microsoft Corporation) C:\Windows\system32\ExplorerFrame.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00019968 _____ (Microsoft Corporation) C:\Windows\system32\NcdProp.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\MsCtfMonitor.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\msisip.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00015360 _____ (Microsoft Corporation) C:\Windows\system32\inetppui.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\msshooks.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\CHxReadingStringIME.dll
2014-08-16 00:29 - 2009-04-10 23:28 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\fdBthProxy.dll
2014-08-16 00:29 - 2009-04-10 23:27 - 02926592 _____ (Microsoft Corporation) C:\Windows\explorer.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 02092544 _____ (Microsoft Corporation) C:\Windows\system32\dfsr.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 01122304 _____ (Microsoft Corporation) C:\Windows\system32\appwiz.cpl
2014-08-16 00:29 - 2009-04-10 23:27 - 01102848 _____ (Microsoft Corporation) C:\Windows\system32\mmsys.cpl
2014-08-16 00:29 - 2009-04-10 23:27 - 00799744 _____ (Microsoft Corporation) C:\Windows\system32\certutil.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00704512 _____ (Microsoft Corporation) C:\Windows\system32\PhotoScreensaver.scr
2014-08-16 00:29 - 2009-04-10 23:27 - 00656896 _____ (Microsoft Corporation) C:\Windows\system32\autoconv.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00643072 _____ (Microsoft Corporation) C:\Windows\system32\autochk.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00640512 _____ (Microsoft Corporation)

Katharina123 16.08.2014 22:03
Ich musste das FRST-Log aufteilen, da zu wenige Zeichen zur Verfügung standen:

Code:
C:\Windows\system32\bthprops.cpl
2014-08-16 00:29 - 2009-04-10 23:27 - 00636416 _____ (Microsoft Corporation) C:\Windows\system32\autofmt.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00408064 _____ (Microsoft Corporation) C:\Windows\system32\msinfo32.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00407040 _____ (Microsoft Corporation) C:\Windows\system32\dpapimig.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00241128 _____ (Microsoft Corporation) C:\Windows\system32\rsaenh.dll
2014-08-16 00:29 - 2009-04-10 23:27 - 00230912 _____ (Microsoft Corporation) C:\Windows\system32\diskraid.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00217088 _____ (Microsoft Corporation) C:\Windows\system32\psisrndr.ax
2014-08-16 00:29 - 2009-04-10 23:27 - 00215552 _____ (Microsoft Corporation) C:\Windows\system32\certreq.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00205824 _____ (Microsoft Corporation) C:\Windows\system32\eudcedit.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00194048 _____ (Microsoft Corporation) C:\Windows\system32\drvinst.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00182272 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00135168 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00130560 _____ (Microsoft Corporation) C:\Windows\system32\PkgMgr.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00130024 _____ (Microsoft Corporation) C:\Windows\system32\basecsp.dll
2014-08-16 00:29 - 2009-04-10 23:27 - 00128000 _____ (Microsoft Corporation) C:\Windows\system32\gpresult.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00119808 _____ (Microsoft Corporation) C:\Windows\system32\diskpart.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00088576 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00082944 _____ (Microsoft Corporation) C:\Windows\system32\nslookup.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00081920 _____ (Microsoft Corporation) C:\Windows\system32\dwm.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00080896 _____ (Microsoft Corporation) C:\Windows\system32\MSNP.ax
2014-08-16 00:29 - 2009-04-10 23:27 - 00080384 _____ (Microsoft Corporation) C:\Windows\system32\hdwwiz.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\newdev.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\msiexec.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\conime.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\DevicePairingWizard.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\reg.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00060928 _____ (Microsoft Corporation) C:\Windows\system32\findstr.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00058368 _____ (Microsoft Corporation) C:\Windows\system32\PnPUnattend.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00058368 _____ (Microsoft Corporation) C:\Windows\system32\cipher.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00049152 _____ (Microsoft Corporation) C:\Windows\system32\cmmon32.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00046080 _____ (Microsoft Corporation) C:\Windows\system32\csrstub.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\cbsra.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\rekeywiz.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\ftp.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\ocsetup.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\bthudtask.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\PnPutil.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\DeviceEject.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00021504 _____ (Microsoft Corporation) C:\Windows\system32\msacm32.drv
2014-08-16 00:29 - 2009-04-10 23:27 - 00019968 _____ (Microsoft Corporation) C:\Windows\system32\fc.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\rasdial.exe
2014-08-16 00:29 - 2009-04-10 23:27 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\gpupdate.exe
2014-08-16 00:29 - 2009-04-10 23:23 - 00413696 _____ (Microsoft Corporation) C:\Windows\system32\imkr80.ime
2014-08-16 00:29 - 2009-04-10 23:23 - 00124928 _____ (Microsoft Corporation) C:\Windows\system32\quick.ime
2014-08-16 00:29 - 2009-04-10 23:23 - 00124928 _____ (Microsoft Corporation) C:\Windows\system32\qintlgnt.ime
2014-08-16 00:29 - 2009-04-10 23:23 - 00124928 _____ (Microsoft Corporation) C:\Windows\system32\phon.ime
2014-08-16 00:29 - 2009-04-10 23:23 - 00089088 _____ (Microsoft Corporation) C:\Windows\system32\pintlgnt.ime
2014-08-16 00:29 - 2009-04-10 23:22 - 00124928 _____ (Microsoft Corporation) C:\Windows\system32\cintlgnt.ime
2014-08-16 00:29 - 2009-04-10 23:22 - 00124928 _____ (Microsoft Corporation) C:\Windows\system32\chajei.ime
2014-08-16 00:29 - 2009-04-10 23:22 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\f3ahvoas.dll
2014-08-16 00:29 - 2009-04-10 22:42 - 00093696 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\bridge.sys
2014-08-16 00:29 - 2009-04-10 22:03 - 12240896 _____ (Microsoft Corporation) C:\Windows\system32\NlsLexicons0007.dll
2014-08-16 00:29 - 2009-04-10 22:03 - 02644480 _____ (Microsoft Corporation) C:\Windows\system32\NlsLexicons0009.dll
2014-08-16 00:29 - 2009-04-10 21:51 - 00180736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys
2014-08-16 00:29 - 2009-04-10 21:48 - 00344698 _____ () C:\Windows\system32\eaphost.tmf
2014-08-16 00:29 - 2009-04-10 21:46 - 00121344 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndiswan.sys
2014-08-16 00:29 - 2009-04-10 21:46 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rassstp.sys
2014-08-16 00:29 - 2009-04-10 21:46 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\raspppoe.sys
2014-08-16 00:29 - 2009-04-10 21:46 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\RNDISMP.sys
2014-08-16 00:29 - 2009-04-10 21:45 - 00185856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netbt.sys
2014-08-16 00:29 - 2009-04-10 21:45 - 00113664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rmcast.sys
2014-08-16 00:29 - 2009-04-10 21:45 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\pacer.sys
2014-08-16 00:29 - 2009-04-10 21:43 - 00442788 _____ () C:\Windows\system32\dot3.tmf
2014-08-16 00:29 - 2009-04-10 21:43 - 00392170 _____ () C:\Windows\system32\onex.tmf
2014-08-16 00:29 - 2009-04-10 21:43 - 00148480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\nwifi.sys
2014-08-16 00:29 - 2009-04-10 21:42 - 00561152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hdaudbus.sys
2014-08-16 00:29 - 2009-04-10 21:42 - 00167936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys
2014-08-16 00:29 - 2009-04-10 21:42 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
2014-08-16 00:29 - 2009-04-10 21:42 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidusb.sys
2014-08-16 00:29 - 2009-04-10 21:39 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cdrom.sys
2014-08-16 00:29 - 2009-04-10 21:39 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2014-08-16 00:29 - 2009-04-10 21:27 - 00002560 _____ (Microsoft Corporation) C:\Windows\system32\msimsg.dll
2014-08-16 00:29 - 2009-04-10 21:23 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxg.sys
2014-08-16 00:29 - 2009-04-10 21:14 - 00225280 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdbss.sys
2014-08-16 00:29 - 2009-04-10 21:14 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2014-08-16 00:29 - 2009-04-10 21:14 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\npfs.sys
2014-08-16 00:29 - 2009-04-10 21:13 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fastfat.sys
2014-08-16 00:29 - 2009-04-10 21:13 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\exfat.sys
2014-08-16 00:29 - 2009-04-10 21:12 - 00617984 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2014-08-16 00:29 - 2009-03-29 21:42 - 00155456 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll
2014-08-16 00:29 - 2009-03-29 21:42 - 00080720 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll
2014-08-16 00:29 - 2009-02-19 17:20 - 00009212 _____ () C:\Windows\system32\RacUR.xml
2014-08-16 00:29 - 2009-02-18 11:39 - 00779136 _____ (Microsoft Corporation) C:\Windows\system32\PresentationNative_v0300.dll
2014-08-16 00:29 - 2009-02-18 11:39 - 00102816 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2014-08-16 00:29 - 2009-02-18 11:38 - 00099680 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2014-08-16 00:29 - 2009-02-18 11:38 - 00035168 _____ (Microsoft Corporation) C:\Windows\system32\infocardcpl.cpl
2014-08-16 00:28 - 2009-04-10 23:33 - 00986600 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2014-08-16 00:28 - 2009-04-10 23:33 - 00926184 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
2014-08-16 00:28 - 2009-04-10 23:33 - 00292840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\volmgrx.sys
2014-08-16 00:28 - 2009-04-10 23:32 - 00438744 _____ (Microsoft Corporation) C:\Windows\system32\mcupdate_GenuineIntel.dll
2014-08-16 00:28 - 2009-04-10 23:32 - 00226280 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\volsnap.sys
2014-08-16 00:28 - 2009-04-10 23:32 - 00122344 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Storport.sys
2014-08-16 00:28 - 2009-04-10 23:32 - 00019944 _____ (Microsoft Corporation) C:\Windows\system32\kdusb.dll
2014-08-16 00:28 - 2009-04-10 23:32 - 00017896 _____ (Microsoft Corporation) C:\Windows\system32\kd1394.dll
2014-08-16 00:28 - 2009-04-10 23:32 - 00017384 _____ (Microsoft Corporation) C:\Windows\system32\kdcom.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 03217408 _____ (Microsoft Corporation) C:\Windows\system32\WinSAT.exe
2014-08-16 00:28 - 2009-04-10 23:28 - 02205184 _____ (Microsoft Corporation) C:\Windows\system32\SyncCenter.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 02167808 _____ (Microsoft Corporation) C:\Windows\system32\mmcndmgr.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 02012160 _____ (Microsoft Corporation) C:\Windows\system32\milcore.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 01671680 _____ (Microsoft Corporation) C:\Windows\system32\wlanpref.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 01580544 _____ (Microsoft Corporation) C:\Windows\system32\wpccpl.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 01575936 _____ (Microsoft Corporation) C:\Windows\system32\WMVENCOD.DLL
2014-08-16 00:28 - 2009-04-10 23:28 - 01555456 _____ (Microsoft Corporation) C:\Windows\system32\WindowsAnytimeUpgradeCPL.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 01533440 _____ (Microsoft Corporation) C:\Windows\system32\wcnwiz.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 01382912 _____ (Microsoft Corporation) C:\Windows\system32\WMVSDECD.DLL
2014-08-16 00:28 - 2009-04-10 23:28 - 01224192 _____ (Microsoft Corporation) C:\Windows\system32\sud.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 01143296 _____ (Microsoft Corporation) C:\Windows\system32\wercon.exe
2014-08-16 00:28 - 2009-04-10 23:28 - 01123840 _____ (Microsoft Corporation) C:\Windows\system32\usercpl.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 01081344 _____ (Microsoft Corporation) C:\Windows\system32\SLCExt.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 01077248 _____ (Microsoft Corporation) C:\Windows\system32\vssapi.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 01055232 _____ (Microsoft Corporation) C:\Windows\system32\VSSVC.exe
2014-08-16 00:28 - 2009-04-10 23:28 - 01020928 _____ (Microsoft Corporation) C:\Windows\system32\wdc.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 01017856 _____ (Microsoft Corporation) C:\Windows\system32\wevtsvc.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00996352 _____ (Microsoft Corporation) C:\Windows\system32\WMNetMgr.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00968192 _____ (Microsoft Corporation) C:\Windows\system32\wcnwiz2.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00876032 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00860160 _____ (Microsoft Corporation) C:\Windows\system32\WerFaultSecure.exe
2014-08-16 00:28 - 2009-04-10 23:28 - 00777216 _____ (Microsoft Corporation) C:\Windows\system32\slcc.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00759296 _____ (Microsoft Corporation) C:\Windows\system32\ipsecsnp.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00729600 _____ (Microsoft Corporation) C:\Windows\system32\IMJP10K.DLL
2014-08-16 00:28 - 2009-04-10 23:28 - 00705536 _____ (Microsoft Corporation) C:\Windows\system32\SmiEngine.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00677376 _____ (Microsoft Corporation) C:\Windows\system32\imapi2fs.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00657408 _____ (Microsoft Corporation) C:\Windows\system32\WMVXENCD.DLL
2014-08-16 00:28 - 2009-04-10 23:28 - 00638976 _____ (Microsoft Corporation) C:\Windows\system32\Utilman.exe
2014-08-16 00:28 - 2009-04-10 23:28 - 00627712 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00582144 _____ (Microsoft Corporation) C:\Windows\system32\SLCommDlg.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00558080 _____ (Microsoft Corporation) C:\Windows\system32\sysmain.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00547840 _____ (Microsoft Corporation) C:\Windows\system32\wiaaut.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00533504 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmsdk.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00532992 _____ (Microsoft Corporation) C:\Windows\system32\wpcao.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00524288 _____ (Microsoft Corporation) C:\Windows\system32\sqlsrv32.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00507904 _____ (Microsoft Corporation) C:\Windows\system32\vdsdyn.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\wiaservc.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00443392 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00438784 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2014-08-16 00:28 - 2009-04-10 23:28 - 00425472 _____ (Microsoft Corporation) C:\Windows\system32\shwebsvc.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00413696 _____ (Microsoft Corporation) C:\Windows\system32\wcncsvc.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00399360 _____ (Microsoft Corporation) C:\Windows\system32\wlangpui.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00396288 _____ (Microsoft Corporation) C:\Windows\system32\ipsmsnap.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00385536 _____ (Microsoft Corporation) C:\Windows\system32\vds.exe
2014-08-16 00:28 - 2009-04-10 23:28 - 00378368 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00378368 _____ (Microsoft Corporation) C:\Windows\system32\imapi2.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00364032 _____ (Microsoft Corporation) C:\Windows\system32\IPSECSVC.DLL
2014-08-16 00:28 - 2009-04-10 23:28 - 00361984 _____ (Microsoft Corporation) C:\Windows\system32\SLUI.exe
2014-08-16 00:28 - 2009-04-10 23:28 - 00356864 _____ (Microsoft Corporation) C:\Windows\system32\MediaMetadataHandler.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00342528 _____ (Microsoft Corporation) C:\Windows\system32\zipfldr.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\untfs.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00314368 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-08-16 00:28 - 2009-04-10 23:28 - 00311808 _____ (Microsoft Corporation) C:\Windows\system32\swprv.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\wmpeffects.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00301568 _____ (Microsoft Corporation) C:\Windows\system32\srchadmin.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00291328 _____ (Microsoft Corporation) C:\Windows\system32\WscEapPr.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00289792 _____ (Microsoft Corporation) C:\Windows\system32\spinstall.exe
2014-08-16 00:28 - 2009-04-10 23:28 - 00287744 _____ (Microsoft Corporation) C:\Windows\system32\Wldap32.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00282624 _____ (Microsoft Corporation) C:\Windows\system32\w32time.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00273920 _____ (Microsoft Corporation) C:\Windows\system32\wow32.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00252928 _____ (Microsoft Corporation) C:\Windows\system32\iassdo.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00250368 _____ (Microsoft Corporation) C:\Windows\system32\wevtapi.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00244224 _____ (Microsoft Corporation) C:\Windows\system32\wisptis.exe
2014-08-16 00:28 - 2009-04-10 23:28 - 00228352 _____ (Microsoft Corporation) C:\Windows\system32\SLC.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00223744 _____ (Microsoft Corporation) C:\Windows\system32\wscntfy.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\wdscore.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00217088 _____ (Microsoft Corporation) C:\Windows\system32\WerFault.exe
2014-08-16 00:28 - 2009-04-10 23:28 - 00203264 _____ (Microsoft Corporation) C:\Windows\system32\uDWM.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\wlanui.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00200704 _____ (Microsoft Corporation) C:\Windows\system32\input.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00197632 _____ (Microsoft Corporation) C:\Windows\system32\SndVol.exe
2014-08-16 00:28 - 2009-04-10 23:28 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\sperror.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00189952 _____ (Microsoft Corporation) C:\Windows\system32\winmm.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00185856 _____ (Microsoft Corporation) C:\Windows\system32\SLLUA.exe
2014-08-16 00:28 - 2009-04-10 23:28 - 00182272 _____ (Microsoft Corporation) C:\Windows\system32\iassam.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00177664 _____ (Microsoft Corporation) C:\Windows\system32\WSDMon.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00165376 _____ (Microsoft Corporation) C:\Windows\system32\WcnNetsh.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00164352 _____ (Microsoft Corporation) C:\Windows\system32\spwizui.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\wevtutil.exe
2014-08-16 00:28 - 2009-04-10 23:28 - 00160768 _____ (Microsoft Corporation) C:\Windows\system32\spoolss.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00158208 _____ (Microsoft Corporation) C:\Windows\system32\iasrad.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00155648 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe
2014-08-16 00:28 - 2009-04-10 23:28 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\korwbrkr.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00142336 _____ (Microsoft Corporation) C:\Windows\system32\spp.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00140800 _____ (Microsoft Corporation) C:\Windows\system32\wusa.exe
2014-08-16 00:28 - 2009-04-10 23:28 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\wpcsvc.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00134656 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00128000 _____ (Microsoft Corporation) C:\Windows\system32\vdsutil.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00126976 _____ (Microsoft Corporation) C:\Windows\system32\wersvc.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00125952 _____ (Microsoft Corporation) C:\Windows\system32\softkbd.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00119296 _____ (Microsoft Corporation) C:\Windows\system32\iasrecst.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\WinSCard.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\imm32.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\spreview.exe
2014-08-16 00:28 - 2009-04-10 23:28 - 00108544 _____ (Microsoft Corporation) C:\Windows\system32\userenv.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\imapi.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00103936 _____ (Microsoft Corporation) C:\Windows\system32\sysclass.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00101376 _____ (Microsoft Corporation) C:\Windows\system32\shsetup.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00091648 _____ (Microsoft Corporation) C:\Windows\system32\IPHLPAPI.DLL
2014-08-16 00:28 - 2009-04-10 23:28 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\wshext.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00083456 _____ (Microsoft) C:\Windows\system32\SMBHelperClass.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00083456 _____ (Microsoft Corporation) C:\Windows\system32\wlgpclnt.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\iassvcs.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00067584 _____ (Microsoft Corporation) C:\Windows\system32\slwmi.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2014-08-16 00:28 - 2009-04-10 23:28 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\wscsvc.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00060928 _____ (Microsoft Corporation) C:\Windows\system32\SLUINotify.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00056320 _____ (Microsoft Corporation) C:\Windows\system32\xmlfilter.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\Storprop.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\mmci.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00050688 _____ (Microsoft Corporation) C:\Windows\system32\wsnmp32.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\l2nacp.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\slcinst.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\mimefilt.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\TSTheme.exe
2014-08-16 00:28 - 2009-04-10 23:28 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\wshbth.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iaspolcy.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\wscapi.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\whealogr.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\ifmon.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\wsepno.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\uxsms.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00020992 _____ (Microsoft Corporation) C:\Windows\system32\wsdchngr.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00020480 _____ (Microsoft Corporation) C:\Windows\system32\version.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00019968 _____ (Microsoft Corporation) C:\Windows\system32\winrnr.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\wscisvif.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\vdmdbg.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\midimap.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\spcmsg.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\mmcico.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\slwga.dll
2014-08-16 00:28 - 2009-04-10 23:28 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\spwinsat.dll
2014-08-16 00:28 - 2009-04-10 23:27 - 03408896 _____ (Microsoft Corporation) C:\Windows\system32\SLsvc.exe
2014-08-16 00:28 - 2009-04-10 23:27 - 01792512 _____ (Microsoft Corporation) C:\Windows\system32\mmc.exe
2014-08-16 00:28 - 2009-04-10 23:27 - 01689600 _____ (Microsoft Corporation) C:\Windows\system32\wscui.cpl
2014-08-16 00:28 - 2009-04-10 23:27 - 00950272 _____ (Microsoft Corporation) C:\Windows\system32\mblctr.exe
2014-08-16 00:28 - 2009-04-10 23:27 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\Magnify.exe
2014-08-16 00:28 - 2009-04-10 23:27 - 00389632 _____ (Microsoft Corporation) C:\Windows\system32\sysmon.ocx
2014-08-16 00:28 - 2009-04-10 23:27 - 00280064 _____ (Microsoft Corporation) C:\Windows\system32\unimdm.tsp
2014-08-16 00:28 - 2009-04-10 23:27 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\wdmaud.drv
2014-08-16 00:28 - 2009-04-10 23:27 - 00135168 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx
2014-08-16 00:28 - 2009-04-10 23:27 - 00094720 _____ (Microsoft Corporation) C:\Windows\system32\logagent.exe
2014-08-16 00:28 - 2009-04-10 23:27 - 00093696 _____ (Microsoft Corporation) C:\Windows\system32\Kswdmcap.ax
2014-08-16 00:28 - 2009-04-10 23:27 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\logman.exe
2014-08-16 00:28 - 2009-04-10 23:27 - 00026624 _____ (Microsoft Corporation) C:\Windows\system32\ipconfig.exe
2014-08-16 00:28 - 2009-04-10 23:22 - 00883712 _____ (Microsoft Corporation) C:\Windows\system32\IMJP10.IME
2014-08-16 00:28 - 2009-04-10 21:46 - 00208966 _____ () C:\Windows\system32\WFP.TMF
2014-08-16 00:28 - 2009-04-10 21:46 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usb8023.sys
2014-08-16 00:28 - 2009-04-10 21:45 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\smb.sys
2014-08-16 00:28 - 2009-04-10 21:43 - 00196096 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-08-16 00:28 - 2009-04-10 21:42 - 00226304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-08-16 00:28 - 2009-04-10 21:42 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBAUDIO.sys
2014-08-16 00:28 - 2009-04-10 21:42 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBSTOR.SYS
2014-08-16 00:28 - 2009-04-10 21:42 - 00052992 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\stream.sys
2014-08-16 00:28 - 2009-04-10 21:42 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-08-16 00:28 - 2009-04-10 21:42 - 00025856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBCAMD2.sys
2014-08-16 00:28 - 2009-04-10 21:42 - 00025856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBCAMD.sys
2014-08-16 00:28 - 2009-04-10 21:39 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\iscsilog.dll
2014-08-16 00:28 - 2009-04-10 21:38 - 00149504 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ks.sys
2014-08-16 00:28 - 2009-04-10 21:22 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\watchdog.sys
2014-08-16 00:28 - 2009-04-10 21:14 - 00226816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\udfs.sys
2014-08-16 00:28 - 2009-04-10 19:52 - 00684032 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\spsys.sys
2014-08-16 00:28 - 2009-04-10 18:59 - 00107612 _____ () C:\Windows\system32\StructuredQuerySchema.bin
2014-08-16 00:28 - 2009-04-10 18:54 - 03662128 _____ () C:\Windows\system32\locale.nls
2014-08-16 00:28 - 2009-02-19 17:20 - 00009239 _____ () C:\Windows\system32\spcinstrumentation.man
2014-08-16 00:28 - 2009-02-18 11:39 - 00092918 _____ () C:\Windows\system32\slmgr.vbs
2014-08-16 00:28 - 2009-02-18 11:39 - 00035680 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-08-16 00:28 - 2009-02-18 11:38 - 00619864 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2014-08-16 00:28 - 2009-02-18 11:38 - 00009048 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2014-08-16 00:27 - 2009-04-10 23:32 - 00053224 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\termdd.sys
2014-08-16 00:27 - 2009-04-10 23:28 - 01576960 _____ (Microsoft Corporation) C:\Windows\system32\tquery.dll
2014-08-16 00:27 - 2009-04-10 23:28 - 01152000 _____ (Microsoft Corporation) C:\Windows\system32\themecpl.dll
2014-08-16 00:27 - 2009-04-10 23:28 - 00842240 _____ (Microsoft Corporation) C:\Windows\system32\systemcpl.dll
2014-08-16 00:27 - 2009-04-10 23:28 - 00615424 _____ (Microsoft Corporation) C:\Windows\system32\themeui.dll
2014-08-16 00:27 - 2009-04-10 23:28 - 00449024 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2014-08-16 00:27 - 2009-04-10 23:28 - 00313344 _____ (Microsoft Corporation) C:\Windows\system32\thawbrkr.dll
2014-08-16 00:27 - 2009-04-10 23:28 - 00242688 _____ (Microsoft Corporation) C:\Windows\system32\tapisrv.dll
2014-08-16 00:27 - 2009-04-10 23:28 - 00222720 _____ (Microsoft Corporation) C:\Windows\system32\umpnpmgr.dll
2014-08-16 00:27 - 2009-04-10 23:28 - 00170496 _____ (Microsoft Corporation) C:\Windows\system32\tcpipcfg.dll
2014-08-16 00:27 - 2009-04-10 23:28 - 00135168 _____ (Microsoft Corporation) C:\Windows\system32\tcpmon.dll
2014-08-16 00:27 - 2009-04-10 23:28 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\ulib.dll
2014-08-16 00:27 - 2009-04-10 23:23 - 00125952 _____ (Microsoft Corporation) C:\Windows\system32\tintlgnt.ime
2014-08-16 00:27 - 2009-04-10 21:45 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2014-08-16 00:27 - 2009-03-06 18:11 - 00130008 _____ () C:\Windows\system32\systemsf.ebd
2014-08-16 00:24 - 2014-08-16 00:24 - 00000000 ____D () C:\Windows\system32\EventProviders
2014-08-16 00:06 - 2014-08-16 00:23 - 365230920 _____ (Microsoft Corporation) C:\Users\Wichsis\Downloads\Windows6.0-KB948465-X86.exe
2014-08-16 00:04 - 2014-08-16 00:23 - 365230920 _____ (Microsoft Corporation) C:\Users\Wichsis\Downloads\Windows6.0-KB948465-X86(1).exe
2014-08-15 23:42 - 2014-08-15 23:42 - 00002701 _____ () C:\Windows\system32\FSS.txt
2014-08-15 23:41 - 2014-08-15 23:41 - 00415232 _____ (Farbar) C:\Users\Wichsis\Downloads\FSS.exe
2014-08-15 21:08 - 2014-08-15 21:09 - 02347384 _____ (ESET) C:\Users\Wichsis\Downloads\esetsmartinstaller_deu.exe
2014-08-15 20:57 - 2014-08-15 20:57 - 00000000 ____D () C:\Users\Wichsis\AppData\Roaming\Avira
2014-08-15 20:54 - 2014-08-16 22:51 - 00013914 _____ () C:\Users\Wichsis\Desktop\FRST.txt
2014-08-15 20:00 - 2014-08-16 22:36 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-15 19:59 - 2014-08-15 19:59 - 00000899 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-08-15 19:59 - 2014-08-15 19:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-08-15 19:59 - 2014-08-15 19:59 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-15 19:59 - 2014-08-15 19:59 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2014-08-15 19:59 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-08-15 19:59 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-08-15 19:59 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-08-15 19:58 - 2014-08-15 19:58 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Kathi\Downloads\mbam-setup-2.0.2.1012.exe
2014-08-15 19:46 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\system32\sqlite3.dll
2014-08-15 19:44 - 2014-08-15 19:46 - 00000000 ____D () C:\AdwCleaner
2014-08-15 19:42 - 2014-08-15 19:42 - 01356107 _____ () C:\Users\Kathi\Downloads\adwcleaner_3.305.exe
2014-08-15 19:23 - 2014-08-15 19:23 - 00017045 _____ () C:\ComboFix.txt
2014-08-15 19:11 - 2014-08-15 19:23 - 00000000 ____D () C:\ComboFix
2014-08-15 19:11 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-08-15 19:11 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-08-15 19:11 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-08-15 19:11 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-08-15 19:11 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-08-15 19:11 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-08-15 19:11 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-08-15 19:11 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-08-15 19:10 - 2014-08-15 19:23 - 00000000 ____D () C:\Qoobox
2014-08-15 19:10 - 2014-08-15 19:21 - 00000000 ____D () C:\Windows\erdnt
2014-08-15 19:07 - 2014-08-15 19:07 - 05571320 ____R (Swearware) C:\Users\Kathi\Desktop\ComboFix.exe
2014-08-15 17:40 - 2014-08-15 17:40 - 00025127 _____ () C:\Users\Kathi\Desktop\FRST.txt
2014-08-15 17:40 - 2014-08-15 17:40 - 00022313 _____ () C:\Users\Kathi\Desktop\Addition.txt
2014-08-15 17:39 - 2014-08-15 20:30 - 00026282 _____ () C:\Users\Kathi\Downloads\FRST.txt
2014-08-15 17:39 - 2014-08-15 17:39 - 00022313 _____ () C:\Users\Kathi\Downloads\Addition.txt
2014-08-15 17:38 - 2014-08-16 22:51 - 00000000 ____D () C:\FRST
2014-08-15 17:37 - 2014-08-16 11:33 - 01093632 _____ (Farbar) C:\Users\Wichsis\Desktop\FRST.exe
2014-08-12 20:43 - 2014-08-12 20:50 - 151513264 _____ () C:\Users\Kathi\Downloads\avira_free_antivirus06_de(1).exe
2014-08-12 20:42 - 2014-08-12 20:49 - 151513264 _____ () C:\Users\Kathi\Downloads\avira_free_antivirus06_de.exe
2014-08-04 21:09 - 2014-08-04 21:09 - 00000000 ____D () C:\Users\Kathi\AppData\Roaming\dll-files.com
2014-07-30 20:35 - 2014-07-30 20:35 - 00000000 ____D () C:\Program Files\Mozilla Firefox(23)

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-16 22:51 - 2014-08-15 20:54 - 00013914 _____ () C:\Users\Wichsis\Desktop\FRST.txt
2014-08-16 22:51 - 2014-08-15 17:38 - 00000000 ____D () C:\FRST
2014-08-16 22:46 - 2012-08-18 23:35 - 00001100 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-08-16 22:42 - 2009-07-21 20:26 - 01435806 _____ () C:\Windows\WindowsUpdate.log
2014-08-16 22:40 - 2006-11-02 12:33 - 01592750 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-08-16 22:36 - 2014-08-15 20:00 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-16 22:34 - 2012-08-18 23:35 - 00001096 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-08-16 22:33 - 2006-11-02 14:58 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-16 22:33 - 2006-11-02 14:45 - 00004784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-16 22:33 - 2006-11-02 14:45 - 00004784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-16 22:31 - 2006-11-02 14:58 - 00032514 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-08-16 22:29 - 2014-08-16 22:29 - 00000100 _____ () C:\Users\Wichsis\Desktop\avira.bat
2014-08-16 22:26 - 2009-08-11 02:35 - 00000000 ____D () C:\Users\Wichsis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite
2014-08-16 22:18 - 2014-08-16 22:10 - 00000000 ____D () C:\ProgramData\Package Cache
2014-08-16 22:17 - 2014-08-16 22:17 - 00001002 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-08-16 22:17 - 2013-08-06 22:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-08-16 22:17 - 2013-08-06 22:00 - 00000000 ____D () C:\Program Files\Avira
2014-08-16 22:14 - 2014-08-16 21:15 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-08-16 22:11 - 2013-08-06 22:00 - 00000000 ____D () C:\ProgramData\Avira
2014-08-16 22:07 - 2011-12-28 18:30 - 00000000 ____D () C:\Users\Kathi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite
2014-08-16 21:50 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\rescache
2014-08-16 21:27 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\de-DE
2014-08-16 21:21 - 2014-08-16 21:21 - 00000000 ____D () C:\Users\Wichsis\AppData\Roaming\Oracle
2014-08-16 21:20 - 2014-08-16 21:20 - 00000000 ____D () C:\Windows\Sun
2014-08-16 21:20 - 2014-08-16 21:19 - 00000000 ____D () C:\ProgramData\Oracle
2014-08-16 21:19 - 2014-08-16 21:19 - 00000000 ____D () C:\Program Files\Common Files\Java
2014-08-16 21:18 - 2014-08-16 21:19 - 00272808 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-08-16 21:18 - 2014-08-16 21:18 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-08-16 21:18 - 2014-08-16 21:18 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-08-16 21:18 - 2014-08-16 21:18 - 00096680 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-08-16 21:18 - 2014-08-16 21:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-08-16 21:18 - 2014-08-16 21:18 - 00000000 ____D () C:\Program Files\Java
2014-08-16 21:15 - 2012-09-18 20:11 - 00699568 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-08-16 21:15 - 2012-02-26 00:06 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-08-16 21:03 - 2014-08-16 21:03 - 00000949 _____ () C:\Users\Kathi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-08-16 12:53 - 2009-08-11 02:47 - 00000949 _____ () C:\Users\Wichsis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-08-16 12:49 - 2009-06-15 09:26 - 00000000 ____D () C:\Windows\system32\Drivers\de-DE
2014-08-16 12:49 - 2006-11-02 13:18 - 00000000 ___RD () C:\Windows\Offline Web Pages
2014-08-16 12:48 - 2014-08-16 12:34 - 00010949 _____ () C:\Windows\IE9_main.log
2014-08-16 12:47 - 2014-08-16 12:44 - 00000000 ___HD () C:\Windows\msdownld.tmp
2014-08-16 12:45 - 2014-08-16 12:45 - 12353024 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 09711616 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 03695416 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2014-08-16 12:45 - 2014-08-16 12:45 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-08-16 12:45 - 2014-08-16 12:45 - 01810432 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-08-16 12:45 - 2014-08-16 12:45 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 01106432 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00434176 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00367104 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2014-08-16 12:45 - 2014-08-16 12:45 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00353584 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00227840 _____ (Microsoft Corporation) C:\Windows\system32\ieaksie.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00203776 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\ieakui.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00162304 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00161792 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00152064 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2014-08-16 12:45 - 2014-08-16 12:45 - 00150528 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2014-08-16 12:45 - 2014-08-16 12:45 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-08-16 12:45 - 2014-08-16 12:45 - 00130560 _____ (Microsoft Corporation) C:\Windows\system32\ieakeng.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00118784 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00114176 _____ (Microsoft Corporation) C:\Windows\system32\advpack.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00110592 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00101888 _____ (Microsoft Corporation) C:\Windows\system32\admparse.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00078848 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2014-08-16 12:45 - 2014-08-16 12:45 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2014-08-16 12:45 - 2014-08-16 12:45 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-08-16 12:45 - 2014-08-16 12:45 - 00073728 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2014-08-16 12:45 - 2014-08-16 12:45 - 00054272 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00031744 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2014-08-16 12:45 - 2014-08-16 12:45 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2014-08-16 12:45 - 2014-08-16 12:45 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-08-16 12:45 - 2006-11-02 08:32 - 00008798 _____ () C:\Windows\system32\icrav03.rat
2014-08-16 12:45 - 2006-11-02 08:32 - 00001988 _____ () C:\Windows\system32\ticrf.rat
2014-08-16 12:44 - 2014-08-16 12:44 - 02873344 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2014-08-16 12:44 - 2014-08-16 12:44 - 01554432 _____ (Microsoft Corporation) C:\Windows\system32\xpsservices.dll
2014-08-16 12:44 - 2014-08-16 12:44 - 01172480 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-08-16 12:44 - 2014-08-16 12:44 - 01075712 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2014-08-16 12:44 - 2014-08-16 12:44 - 01068544 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2014-08-16 12:44 - 2014-08-16 12:44 - 01029120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll
2014-08-16 12:44 - 2014-08-16 12:44 - 00979456 _____ (Microsoft Corporation) C:\Windows\system32\MFH264Dec.dll
2014-08-16 12:44 - 2014-08-16 12:44 - 00876032 _____ (Microsoft Corporation) C:\Windows\system32\XpsPrint.dll
2014-08-16 12:44 - 2014-08-16 12:44 - 00847360 _____ (Microsoft Corporation) C:\Windows\system32\OpcServices.dll
2014-08-16 12:44 - 2014-08-16 12:44 - 00797184 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2014-08-16 12:44 - 2014-08-16 12:44 - 00683008 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2014-08-16 12:44 - 2014-08-16 12:44 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\printfilterpipelinesvc.exe
2014-08-16 12:44 - 2014-08-16 12:44 - 00638336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-08-16 12:44 - 2014-08-16 12:44 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\stobject.dll
2014-08-16 12:44 - 2014-08-16 12:44 - 00486400 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2014-08-16 12:44 - 2014-08-16 12:44 - 00478720 _____ (Microsoft Corporation) C:\Windows\system32\dxgi.dll
2014-08-16 12:44 - 2014-08-16 12:44 - 00357376 _____ (Microsoft Corporation) C:\Windows\system32\MFHEAACdec.dll
2014-08-16 12:44 - 2014-08-16 12:44 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\mfmp4src.dll
2014-08-16 12:44 - 2014-08-16 12:44 - 00288768 _____ (Microsoft Corporation) C:\Windows\system32\XpsGdiConverter.dll
2014-08-16 12:44 - 2014-08-16 12:44 - 00261632 _____ (Microsoft Corporation) C:\Windows\system32\mfreadwrite.dll
2014-08-16 12:44 - 2014-08-16 12:44 - 00258048 _____ (Microsoft Corporation) C:\Windows\system32\winspool.drv
2014-08-16 12:44 - 2014-08-16 12:44 - 00219648 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll
2014-08-16 12:44 - 2014-08-16 12:44 - 00209920 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll
2014-08-16 12:44 - 2014-08-16 12:44 - 00189952 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll
2014-08-16 12:44 - 2014-08-16 12:44 - 00160768 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll
2014-08-16 12:44 - 2014-08-16 12:44 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\XpsRasterService.dll
2014-08-16 12:44 - 2014-08-16 12:44 - 00098816 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2014-08-16 12:44 - 2014-08-16 12:44 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2014-08-16 12:44 - 2014-08-16 12:44 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\printfilterpipelineprxy.dll
2014-08-16 12:42 - 2014-08-16 12:42 - 00974848 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-08-16 12:42 - 2014-08-16 12:42 - 00519680 _____ (Microsoft Corporation) C:\Windows\system32\d3d11.dll
2014-08-16 12:42 - 2014-08-16 12:42 - 00369664 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2014-08-16 12:42 - 2014-08-16 12:42 - 00321024 _____ (Microsoft Corporation) C:\Windows\system32\PhotoMetadataHandler.dll
2014-08-16 12:42 - 2014-08-16 12:42 - 00252928 _____ (Microsoft Corporation) C:\Windows\system32\dxdiag.exe
2014-08-16 12:42 - 2014-08-16 12:42 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\dxdiagn.dll
2014-08-16 12:42 - 2014-08-16 12:42 - 00189440 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecsExt.dll
2014-08-16 12:25 - 2014-08-16 12:25 - 00000000 ____D () C:\Users\Wichsis\Desktop\revouninstaller-portable
2014-08-16 12:24 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-08-16 11:47 - 2014-08-16 11:46 - 00025891 _____ () C:\Users\Wichsis\Desktop\Addition.txt
2014-08-16 11:39 - 2009-08-11 02:42 - 00107528 _____ () C:\Users\Wichsis\AppData\Local\GDIPFONTCACHEV1.DAT
2014-08-16 11:33 - 2014-08-16 11:33 - 00000000 ____D () C:\Users\Wichsis\Desktop\FRST-OlderVersion
2014-08-16 11:33 - 2014-08-15 17:37 - 01093632 _____ (Farbar) C:\Users\Wichsis\Desktop\FRST.exe
2014-08-16 11:25 - 2014-08-16 11:25 - 00000000 ____D () C:\Users\Wichsis\AppData\Local\WindowsUpdate
2014-08-16 11:20 - 2009-08-11 02:39 - 00000000 ____D () C:\Program Files\Microsoft.NET
2014-08-16 11:10 - 2006-11-02 14:44 - 00389288 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-08-16 11:08 - 2014-08-16 11:08 - 00000000 ____D () C:\Windows\system32\WindowsPowerShell
2014-08-16 11:08 - 2006-11-02 13:18 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2014-08-16 10:52 - 2014-08-16 10:52 - 00000000 ____D () C:\Windows\system32\x64
2014-08-16 10:33 - 2008-01-21 05:02 - 00748726 _____ () C:\Windows\PFRO.log
2014-08-16 01:04 - 2013-08-16 18:35 - 00000000 ____D () C:\Windows\system32\MRT
2014-08-16 01:02 - 2006-11-02 12:24 - 96303304 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-08-16 00:58 - 2009-08-11 02:46 - 00000915 _____ () C:\Users\Wichsis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Mail.lnk
2014-08-16 00:57 - 2011-12-28 18:30 - 00000915 _____ () C:\Users\Kathi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Mail.lnk
2014-08-16 00:46 - 2014-08-16 00:45 - 00000000 ____D () C:\Windows\system32\vi-VN
2014-08-16 00:46 - 2014-08-16 00:45 - 00000000 ____D () C:\Windows\system32\eu-ES
2014-08-16 00:46 - 2014-08-16 00:45 - 00000000 ____D () C:\Windows\system32\ca-ES
2014-08-16 00:46 - 2006-11-02 14:35 - 00000000 ____D () C:\Windows\system32\XPSViewer
2014-08-16 00:46 - 2006-11-02 14:35 - 00000000 ____D () C:\Program Files\Windows Sidebar
2014-08-16 00:46 - 2006-11-02 14:35 - 00000000 ____D () C:\Program Files\Windows Photo Gallery
2014-08-16 00:46 - 2006-11-02 14:35 - 00000000 ____D () C:\Program Files\Windows Defender
2014-08-16 00:46 - 2006-11-02 14:35 - 00000000 ____D () C:\Program Files\Windows Collaboration
2014-08-16 00:46 - 2006-11-02 14:35 - 00000000 ____D () C:\Program Files\Windows Calendar
2014-08-16 00:46 - 2006-11-02 14:35 - 00000000 ____D () C:\Program Files\Movie Maker
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\zh-TW
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\zh-CN
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\uk-UA
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\tr-TR
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\th-TH
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\sv-SE
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\sr-Latn-CS
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\SLUI
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\sl-SI
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\sk-SK
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\ru-RU
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\ro-RO
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\pt-PT
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\pt-BR
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\pl-PL
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\nl-NL
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\nb-NO
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\lv-LV
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\lt-LT
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\ko-KR
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\ja-JP
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\it-IT
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\hu-HU
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\hr-HR
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\he-IL
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\fr-FR
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\fi-FI
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\et-EE
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\el-GR
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\bg-BG
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\ar-SA
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\AdvancedInstallers
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\IME
2014-08-16 00:46 - 2006-11-02 13:18 - 00000000 ____D () C:\Program Files\Common Files\System
2014-08-16 00:45 - 2009-06-15 11:13 - 00000000 ____D () C:\Windows\system32\RTCOM
2014-08-16 00:45 - 2006-11-02 14:49 - 00160471 _____ () C:\Windows\setupact.log
2014-08-16 00:42 - 2014-08-16 00:42 - 00000000 ____D () C:\Windows\system32\SPReview
2014-08-16 00:24 - 2014-08-16 00:24 - 00000000 ____D () C:\Windows\system32\EventProviders
2014-08-16 00:23 - 2014-08-16 00:06 - 365230920 _____ (Microsoft Corporation) C:\Users\Wichsis\Downloads\Windows6.0-KB948465-X86.exe
2014-08-16 00:23 - 2014-08-16 00:04 - 365230920 _____ (Microsoft Corporation) C:\Users\Wichsis\Downloads\Windows6.0-KB948465-X86(1).exe
2014-08-15 23:42 - 2014-08-15 23:42 - 00002701 _____ () C:\Windows\system32\FSS.txt
2014-08-15 23:41 - 2014-08-15 23:41 - 00415232 _____ (Farbar) C:\Users\Wichsis\Downloads\FSS.exe
2014-08-15 23:38 - 2012-09-18 20:12 - 00001963 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-08-15 21:09 - 2014-08-15 21:08 - 02347384 _____ (ESET) C:\Users\Wichsis\Downloads\esetsmartinstaller_deu.exe
2014-08-15 20:57 - 2014-08-15 20:57 - 00000000 ____D () C:\Users\Wichsis\AppData\Roaming\Avira
2014-08-15 20:30 - 2014-08-15 17:39 - 00026282 _____ () C:\Users\Kathi\Downloads\FRST.txt
2014-08-15 20:19 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\Speech
2014-08-15 19:59 - 2014-08-15 19:59 - 00000899 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-08-15 19:59 - 2014-08-15 19:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-08-15 19:59 - 2014-08-15 19:59 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-15 19:59 - 2014-08-15 19:59 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2014-08-15 19:58 - 2014-08-15 19:58 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Kathi\Downloads\mbam-setup-2.0.2.1012.exe
2014-08-15 19:46 - 2014-08-15 19:44 - 00000000 ____D () C:\AdwCleaner
2014-08-15 19:46 - 2013-11-02 23:21 - 00000846 _____ () C:\Users\Wichsis\Desktop\Search.lnk
2014-08-15 19:42 - 2014-08-15 19:42 - 01356107 _____ () C:\Users\Kathi\Downloads\adwcleaner_3.305.exe
2014-08-15 19:27 - 2014-04-27 21:32 - 00000000 ___RD () C:\Users\Kathi\Dropbox
2014-08-15 19:23 - 2014-08-15 19:23 - 00017045 _____ () C:\ComboFix.txt
2014-08-15 19:23 - 2014-08-15 19:11 - 00000000 ____D () C:\ComboFix
2014-08-15 19:23 - 2014-08-15 19:10 - 00000000 ____D () C:\Qoobox
2014-08-15 19:23 - 2009-08-11 03:13 - 00000000 ____D () C:\Users\Wichsis\AppData\Local\Google
2014-08-15 19:23 - 2006-11-02 13:18 - 00000000 __RHD () C:\Users\Default
2014-08-15 19:23 - 2006-11-02 13:18 - 00000000 ___RD () C:\Users\Public
2014-08-15 19:21 - 2014-08-15 19:10 - 00000000 ____D () C:\Windows\erdnt
2014-08-15 19:21 - 2006-11-02 12:23 - 00000215 _____ () C:\Windows\system.ini
2014-08-15 19:07 - 2014-08-15 19:07 - 05571320 ____R (Swearware) C:\Users\Kathi\Desktop\ComboFix.exe
2014-08-15 17:40 - 2014-08-15 17:40 - 00025127 _____ () C:\Users\Kathi\Desktop\FRST.txt
2014-08-15 17:40 - 2014-08-15 17:40 - 00022313 _____ () C:\Users\Kathi\Desktop\Addition.txt
2014-08-15 17:39 - 2014-08-15 17:39 - 00022313 _____ () C:\Users\Kathi\Downloads\Addition.txt
2014-08-15 17:34 - 2014-04-27 21:29 - 00000000 ____D () C:\Users\Kathi\AppData\Roaming\Dropbox
2014-08-12 23:00 - 2014-06-16 11:05 - 00015080 _____ () C:\Users\Kathi\Desktop\Hochzeitsgeschenke.xlsx
2014-08-12 20:50 - 2014-08-12 20:43 - 151513264 _____ () C:\Users\Kathi\Downloads\avira_free_antivirus06_de(1).exe
2014-08-12 20:49 - 2014-08-12 20:42 - 151513264 _____ () C:\Users\Kathi\Downloads\avira_free_antivirus06_de.exe
2014-08-11 23:09 - 2014-06-16 23:09 - 00018357 _____ () C:\Users\Kathi\Desktop\malediven.xlsx
2014-08-11 23:06 - 2014-06-15 16:51 - 00000000 ____D () C:\Users\Kathi\Desktop\Hochzeit - Standesamt
2014-08-11 22:08 - 2014-02-16 18:46 - 00000000 ____D () C:\Users\Kathi\Desktop\Hochzeit
2014-08-10 14:08 - 2012-01-02 21:32 - 00000000 ____D () C:\Users\Kathi\Documents\Passwörter
2014-08-04 21:09 - 2014-08-04 21:09 - 00000000 ____D () C:\Users\Kathi\AppData\Roaming\dll-files.com
2014-08-04 21:06 - 2012-05-15 18:16 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-08-03 23:26 - 2011-12-28 18:30 - 00000000 ____D () C:\Users\Kathi
2014-08-03 23:26 - 2009-08-11 02:35 - 00000000 ____D () C:\Users\Wichsis
2014-08-03 23:26 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\spool
2014-08-03 23:26 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\Msdtc
2014-08-03 23:26 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\registration
2014-08-03 23:26 - 2006-11-02 12:22 - 37748736 _____ () C:\Windows\system32\config\software_previous
2014-08-03 23:26 - 2006-11-02 12:22 - 17301504 _____ () C:\Windows\system32\config\system_previous
2014-08-03 23:23 - 2006-11-02 12:22 - 42991616 _____ () C:\Windows\system32\config\components_previous
2014-08-03 23:23 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\sam_previous
2014-08-03 14:10 - 2012-10-23 18:37 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-08-03 14:10 - 2012-05-15 18:16 - 00000858 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-08-03 14:10 - 2012-05-15 18:16 - 00000846 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-08-03 00:01 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\security_previous
2014-08-03 00:01 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\default_previous
2014-07-30 20:35 - 2014-07-30 20:35 - 00000000 ____D () C:\Program Files\Mozilla Firefox(23)
2014-07-23 10:52 - 2011-12-28 16:24 - 00231584 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-07-22 21:04 - 2014-04-27 21:32 - 00000919 _____ () C:\Users\Kathi\Desktop\Dropbox.lnk
2014-07-22 21:04 - 2014-04-27 21:31 - 00000000 ____D () C:\Users\Kathi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-07-17 18:58 - 2012-03-23 19:56 - 00000000 ____D () C:\ProgramData\tmp

Some content of TEMP:
====================
C:\Users\Kathi\AppData\Local\temp\avgnt.exe
C:\Users\Wichsis\AppData\Local\temp\avgnt.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-08-16 22:38

==================== End Of Log =========================
Code:
Additional scan result of Farbar Recovery Scan Tool (x86) Version:16-08-2014 02
Ran by Wichsis at 2014-08-16 22:52:11
Running from C:\Users\Wichsis\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

32 Bit HP CIO Components Installer (Version: 2.1.4 - Hewlett-Packard) Hidden
Adobe Flash Player 14 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 14.0.0.176 - Adobe Systems Incorporated)
Adobe Flash Player 14 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Reader 9.2 - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-A92000000001}) (Version: 9.2.0 - Adobe Systems Incorporated)
Adobe Shockwave Player 11.6 (HKLM\...\Adobe Shockwave Player) (Version: 11.6.5.635 - Adobe Systems, Inc.)
Atheros WLAN Client (HKLM\...\{3832FA99-2EDD-41E0-94AD-FBF9FABAFEF9}) (Version: 14.00.0000 - WLAN)
Avira (HKLM\...\{9590977b-7b6f-467e-a11a-efa1fae804da}) (Version: 1.1.18.30000 - Avira Operations GmbH & Co. KG)
Avira (Version: 1.1.18.30000 - Avira Operations GmbH & Co. KG) Hidden
Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 14.0.6.552 - Avira)
Avira SearchFree Toolbar (HKLM\...\{41564952-412D-5637-00A7-A758B70C0600}) (Version: 12.6.0.1900 - APN, LLC)
BatteryLifeExtender (HKLM\...\{AA16A9E5-40E9-44F5-801E-6B3D3CFE79E5}) (Version: 1.0.0 - Samsung)
Business Contact Manager für Outlook 2007 SP1 (HKLM\...\Business Contact Manager) (Version: 3.0.7311.0 - Microsoft Corporation)
Business Contact Manager für Outlook 2007 SP1 (Version: 3.0.7311.0 - Microsoft Corporation) Hidden
capella 7 (HKLM\...\{7BDBF713-CB99-4B66-800B-F563BC7F0560}) (Version: 7.1.21 - capella software AG)
CyberLink DVD Suite (HKLM\...\InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 6.0.2604 - CyberLink Corp.)
CyberLink DVD Suite (Version: 6.0.2604 - CyberLink Corp.) Hidden
CyberLink LabelPrint (HKLM\...\{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.20.3605 - CyberLink Corp.)
CyberLink Power2Go (HKLM\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.0.2809 - CyberLink Corp.)
CyberLink Power2Go (Version: 6.0.2809 - CyberLink Corp.) Hidden
CyberLink PowerDirector (HKLM\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 7.0.2426 - CyberLink Corp.)
CyberLink PowerDirector (Version: 7.0.2426 - CyberLink Corp.) Hidden
CyberLink PowerDVD 8 (HKLM\...\InstallShield_{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}) (Version: 8.0.2815 - CyberLink Corp.)
CyberLink PowerDVD 8 (Version: 8.0.2815 - CyberLink Corp.) Hidden
CyberLink PowerProducer (HKLM\...\InstallShield_{B7A0CE06-068E-11D6-97FD-0050BACBF861}) (Version: 5.0.1.1410 - CyberLink Corp.)
CyberLink PowerProducer (Version: 5.0.1.1410 - CyberLink Corp.) Hidden
dm-Fotowelt (HKLM\...\dm-Fotowelt) (Version: 5.1.3 - CEWE Stiftung u Co. KGaA)
Easy Battery Manager (HKLM\...\{6F730513-8688-4C3C-90A3-6B9792CE2EF3}) (Version: 3.2.1.7 - Samsung)
Easy Display Manager (HKLM\...\{17283B95-21A8-4996-97DA-547A48DB266F}) (Version: 2.3 - Samsung Electronics Co., Ltd.)
Easy Network Manager (HKLM\...\{A7581D39-EA20-4883-A480-80C21047052B}) (Version: 4.0.2 - Samsung)
Easy SpeedUp Manager (HKLM\...\{EF367AA4-070B-493C-9575-85BE59D789C9}) (Version: 2.0.2.6 - )
Free YouTube to MP3 Converter version 3.12.35.514 (HKLM\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.35.514 - DVDVideoSoft Ltd.)
Google Chrome (HKLM\...\Google Chrome) (Version: 36.0.1985.143 - Google Inc.)
Google Earth Plug-in (HKLM\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Toolbar for Internet Explorer (HKLM\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.5111.1712 - Google Inc.)
Google Toolbar for Internet Explorer (Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (Version: 1.3.24.15 - Google Inc.) Hidden
IKEA Home Planner (HKLM\...\{B3276CB1-20B6-4AF9-AAEC-E72C83816495}) (Version: 2.0.3 - IKEA IT)
imagine digital freedom - Samsung (HKLM\...\{8E106A57-A17E-431D-B48F-175E42EB9F74}) (Version: 1.0.2.2 - Samsung Electronics Co. Ltd.,)
Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version:  - Intel Corporation)
Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version:  - Intel Corporation)
Java 7 Update 67 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F03217067FF}) (Version: 7.0.670 - Oracle)
Java Auto Updater (Version: 2.1.67.1 - Oracle, Inc.) Hidden
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Office 2003 Web Components (HKLM\...\{90A40407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8003.0 - Microsoft Corporation)
Microsoft Office 2007 Primary Interop Assemblies (HKLM\...\{50120000-1105-0000-0000-0000000FF1CE}) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Office Excel MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Home and Student 2007 (HKLM\...\HOMESTUDENTR) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Small Business Connectivity Components (HKLM\...\{A939D341-5A04-4E0A-BB55-3E65B386432D}) (Version: 2.0.7024.0 - Microsoft Corporation)
Microsoft Office Suite Activation Assistant (HKLM\...\{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}) (Version: 2.9 - Microsoft Corporation)
Microsoft Office Word MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft SQL Server 2005 (HKLM\...\Microsoft SQL Server 2005) (Version:  - Microsoft Corporation)
Microsoft SQL Server 2005 Express Edition (MSSMLBIZ) (Version: 9.2.3042.00 - Microsoft Corporation) Hidden
Microsoft SQL Server Native Client (HKLM\...\{1D1D8ADC-BF08-4E61-9393-5FA305B16864}) (Version: 9.00.3042.00 - Microsoft Corporation)
Microsoft SQL Server VSS Writer (HKLM\...\{5C759B74-34F4-43C6-A5D9-039CB754C5E9}) (Version: 9.00.3042.00 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 31.0 (x86 de) (HKLM\...\Mozilla Firefox 31.0 (x86 de)) (Version: 31.0 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 31.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
PCTroubleshooting (HKLM\...\{68CAE442-579C-4D84-AA5F-253852522ED5}) (Version: 2.0.0.4 - Samsung Electronics Co.,LTD.)
PrintKey2000 (HKLM\...\PrintKey2000) (Version:  - )
Realtek 8136 8168 8169 Ethernet Driver (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0004 - Realtek)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5837 - Realtek Semiconductor Corp.)
Samsung Kies (HKLM\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.2.0.12014_18 - Samsung Electronics Co., Ltd.)
Samsung Kies (Version: 2.2.0.12014_18 - Samsung Electronics Co., Ltd.) Hidden
Samsung Magic Doctor (HKLM\...\{32D6A58F-9659-446C-BBFC-E6F2B41F24DC}) (Version: 5.0 - Samsung Electronics Co., LTD)
Samsung Recovery Solution III (HKLM\...\{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}) (Version: 3.0.0.9 - Samsung)
Samsung Update Plus (HKLM\...\{D3F2FAA5-FEC4-42AA-9ABA-1F763919A2B5}) (Version: 2.0 - Samsung Electronics Co., Ltd.)
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.4.103.0 - SAMSUNG Electronics Co., Ltd.)
SimCity™ Societies (HKLM\...\{0B5154C0-8F00-4616-B0AB-6240AE80D9CE}) (Version: 1.0.0.0 - Electronic Arts)
Skype Click to Call (HKLM\...\{B6CF2967-C81E-40C0-9815-C05774FEF120}) (Version: 6.3.11079 - Skype Technologies S.A.)
Skype™ 6.3 (HKLM\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.3.105 - Skype Technologies S.A.)
SmartWebPrinting (Version: 110.0.182.000 - Hewlett-Packard) Hidden
Spelling Dictionaries Support For Adobe Reader 9 (HKLM\...\{AC76BA86-7AD7-5464-3428-900000000004}) (Version: 9.0.0 - Adobe Systems Incorporated)
swMSM (Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 11.1.3.2 - Synaptics)
Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch) (HKLM\...\{07629207-FAA0-4F1A-8092-BF5085BE511F}) (Version: 9.00.3042.00 - Microsoft Corporation)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (HKLM\...\{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB963707) (Version: 1 - Microsoft Corporation)
User Guide (HKLM\...\{BAE68339-B0F6-4D33-9554-5A3DB2DFF5DA}) (Version: 1.0 - )
VLC media player 1.1.11 (HKLM\...\VLC media player) (Version: 1.1.11 - VideoLAN)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

15-08-2014 22:26:56 Windows Vista™ Service Pack 2
15-08-2014 23:01:41 Windows Update
16-08-2014 08:47:03 Windows Update
16-08-2014 09:18:32 Windows Update
16-08-2014 10:27:19 Revo Uninstaller's restore point - Yahoo Community Smartbar
16-08-2014 10:31:47 Revo Uninstaller's restore point - Yahoo Community Smartbar Engine
16-08-2014 10:42:12 Windows-Modulinstallation
16-08-2014 10:45:44 Windows Update
16-08-2014 19:06:41 Windows Update
16-08-2014 19:17:44 Installed Java 7 Update 67

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2006-11-02 12:23 - 2006-09-18 23:41 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1      localhost
::1            localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0FBA0A12-F1E9-48A2-81EF-2E0D28EFF19A} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-08-16] (Adobe Systems Incorporated)
Task: {18DFD9FC-082E-4E9B-8285-5F21D2B4EDAE} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {19D4039D-5E6B-4F99-BFF9-63177728BF9B} - System32\Tasks\EasyBatteryManager => C:\Program Files\Samsung\EBM\EasyBatteryMgr3.exe [2008-12-10] (SAMSUNG Electronics co., LTD.)
Task: {3DD74738-9513-4705-9004-BC736CDF5AB3} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\netsh.exe [2006-11-02] (Microsoft Corporation)
Task: {5916F864-469C-4391-8604-E4EA141A2699} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-21] ()
Task: {66272A2A-7C9A-4A74-99A6-BA34D3111465} - System32\Tasks\SUPBackground => C:\Program Files\Samsung\Samsung Update Plus\SUPBackground.exe [2010-04-20] ()
Task: {72BE2131-C30D-4303-ACC9-BDE24C4902AA} - System32\Tasks\EasyDisplayMgr => C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe [2009-05-15] (Samsung Electronics Co., Ltd.)
Task: {7C5A51E8-1AD7-48C6-8879-257A8A9609F5} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {8B0E6FAB-F43A-4988-AF0A-A21646C212F0} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {8C7623EB-E204-4667-904E-B63149A480FF} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2012-08-18] (Google Inc.)
Task: {9ED703A9-5FFD-40D5-895A-4385EE1509DE} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-21] (Microsoft Corporation)
Task: {B5268D72-D0C1-4BF7-8579-3AF9CB1112CE} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2012-08-18] (Google Inc.)
Task: {BD6AA34F-4839-455B-A927-A1BE582253C6} - System32\Tasks\SamsungMagicDoctor => C:\Program Files\Samsung\Samsung Magic Doctor\MagicDoctorKbdHk.exe [2008-08-26] (Samsung Electronics Co., Ltd.)
Task: {C35332B5-11CF-499B-BCEA-A00D88F6DE52} - System32\Tasks\Java Update Scheduler => C:\Program Files\Common Files\Java\Java Update\jusched.exe [2014-07-25] (Oracle Corporation)
Task: {DAC7F51D-AA79-4050-9F25-C34ED5EB1345} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Signature Update => c:\program files\windows defender\MpCmdRun.exe [2008-01-21] (Microsoft Corporation)
Task: {E2B51B7C-59C4-43F7-BC8E-5CF6691533FF} - System32\Tasks\BatteryLifeExtender => C:\Program Files\Samsung\BatteryLifeExtender\BatteryLifeExtender.exe [2009-03-13] (Samsung Electronics. Co. Ltd.)
Task: {F0794984-29E7-4E64-B814-9728B072B284} - System32\Tasks\EasySpeedUpManager => C:\Program Files\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe [2009-05-28] (Samsung Electronics Co., Ltd.)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2009-06-15 11:21 - 2008-11-25 16:27 - 00247152 _____ () C:\Program Files\CyberLink\Shared files\RichVideo.exe
2014-07-24 11:50 - 2014-07-24 11:50 - 00137296 _____ () C:\Program Files\Avira\My Avira\Avira.OE.NativeCore.dll
2014-07-24 11:49 - 2014-07-24 11:49 - 00065104 _____ () C:\Program Files\Avira\My Avira\Avira.OE.AvConnectorNative.dll
2009-06-15 11:26 - 2006-08-12 05:48 - 00049152 _____ () C:\Program Files\Samsung\Samsung Magic Doctor\HookDllPS2.dll
2009-06-15 11:24 - 2006-08-12 05:48 - 00049152 _____ () C:\Program Files\Samsung\Easy Display Manager\HookDllPS2.dll
2009-06-15 11:24 - 2006-08-12 05:48 - 00049152 _____ () C:\Program Files\SAMSUNG\EasySpeedUpManager\HookDllPS2.dll
2008-12-24 05:29 - 2008-12-24 05:29 - 00619816 ____N () C:\Program Files\CyberLink\Power2Go\CLMediaLibrary.dll
2008-12-24 05:30 - 2008-12-24 05:30 - 00013096 ____N () C:\Program Files\CyberLink\Power2Go\CLMLSvcPS.dll
2014-08-16 22:26 - 2014-07-24 11:50 - 00049744 _____ () C:\Users\Wichsis\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (08/16/2014 10:35:38 PM) (Source: WinMgmt) (EventID: 4) (User: )
Description: 0x8004100aC:\PROGRAM FILES\MICROSOFT SQL SERVER\90\SHARED\SQLMGMPROVIDERXPSP2UP.MOF

Error: (08/16/2014 10:35:37 PM) (Source: WinMgmt) (EventID: 4) (User: )
Description: 0x8004401eC:\WINDOWS\SYSTEM32\WBEM\IT-IT\WHQLPROV.MFL

Error: (08/16/2014 10:35:36 PM) (Source: WinMgmt) (EventID: 4) (User: )
Description: 0x8004401eC:\WINDOWS\SYSTEM32\WBEM\IT-IT\USERPROFILEWMIPROVIDER.MFL

Error: (08/16/2014 10:35:36 PM) (Source: WinMgmt) (EventID: 4) (User: )
Description: 0x8004401eC:\WINDOWS\SYSTEM32\WBEM\IT-IT\ISCSIDSC.MFL

Error: (08/16/2014 10:35:36 PM) (Source: WinMgmt) (EventID: 4) (User: )
Description: 0x8004401eC:\WINDOWS\SYSTEM32\WBEM\IT-IT\ISCSIPRF.MFL

Error: (08/16/2014 10:35:36 PM) (Source: WinMgmt) (EventID: 4) (User: )
Description: 0x8004401eC:\WINDOWS\SYSTEM32\WBEM\IT-IT\RSOP.MFL

Error: (08/16/2014 10:35:36 PM) (Source: WinMgmt) (EventID: 4) (User: )
Description: 0x8004401eC:\WINDOWS\SYSTEM32\WBEM\IT-IT\VDS.MFL

Error: (08/16/2014 10:35:36 PM) (Source: WinMgmt) (EventID: 4) (User: )
Description: 0x8004401eC:\WINDOWS\SYSTEM32\WBEM\IT-IT\VSS.MFL

Error: (08/16/2014 10:35:36 PM) (Source: WinMgmt) (EventID: 4) (User: )
Description: 0x8004401eC:\WINDOWS\SYSTEM32\WBEM\IT-IT\WMIPSESS.MFL

Error: (08/16/2014 10:35:36 PM) (Source: WinMgmt) (EventID: 4) (User: )
Description: 0x8004401eC:\WINDOWS\SYSTEM32\WBEM\IT-IT\WMIPDSKQ.MFL


System errors:
=============
Error: (08/16/2014 10:38:09 PM) (Source: Microsoft-Windows-LanguagePackSetup) (EventID: 1001) (User: NT-AUTORITÄT)
Description: 0x80070032

Error: (08/16/2014 10:36:45 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Avira Browser-Schutz%%1053

Error: (08/16/2014 10:36:45 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: 30000Avira Browser-Schutz

Error: (08/16/2014 10:36:45 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Parallel port driver%%1058

Error: (08/16/2014 09:30:54 PM) (Source: Microsoft-Windows-LanguagePackSetup) (EventID: 1001) (User: NT-AUTORITÄT)
Description: 0x80070032

Error: (08/16/2014 09:29:00 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Parallel port driver%%1058

Error: (08/16/2014 09:08:49 PM) (Source: Microsoft-Windows-Servicing) (EventID: 4385) (User: NT-AUTORITÄT)
Description: Windows-Wartung konnte das Update Aux aus Paket WindowsUpdateClient-SelfUpdate-Aux-AuxComp-Package_de-DE(Language Pack) nicht in den Status Bereitgestellt(Staged) setzen.

Error: (08/16/2014 09:08:49 PM) (Source: Microsoft-Windows-Servicing) (EventID: 4375) (User: NT-AUTORITÄT)
Description: Windows-Wartung konnte das Paket WindowsUpdateClient-SelfUpdate-Aux-AuxComp-Package_de-DE (Language Pack) nicht in den Status Installation angefordert(Install Requested) setzen.

Error: (08/16/2014 09:08:49 PM) (Source: Microsoft-Windows-Servicing) (EventID: 4385) (User: NT-AUTORITÄT)
Description: Windows-Wartung konnte das Update AuxResourcesLP aus Paket WindowsUpdateClient-SelfUpdate-Aux-Package(Language Pack) nicht in den Status Bereitgestellt(Staged) setzen.

Error: (08/16/2014 09:08:49 PM) (Source: Microsoft-Windows-Servicing) (EventID: 4375) (User: NT-AUTORITÄT)
Description: Windows-Wartung konnte das Paket WindowsUpdateClient-SelfUpdate-Aux-Package (Language Pack) nicht in den Status Installation angefordert(Install Requested) setzen.


Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2014-08-16 22:51:58.890
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-16 22:51:58.635
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-16 22:51:58.382
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-16 22:51:58.134
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-16 22:51:57.691
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-16 22:51:57.402
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-16 22:51:57.138
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-16 22:51:56.876
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-16 22:51:12.604
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-16 22:51:12.344
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info ===========================

Processor: Intel(R) Pentium(R) Dual CPU T3400 @ 2.16GHz
Percentage of memory in use: 48%
Total physical RAM: 3031.88 MB
Available physical RAM: 1566.23 MB
Total Pagefile: 6300.16 MB
Available Pagefile: 4393.92 MB
Total Virtual: 2047.88 MB
Available Virtual: 1907.84 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:109.88 GB) (Free:11.4 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: () (Fixed) (Total:110 GB) (Free:71.21 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 232.9 GB) (Disk ID: D4BD9B58)
Partition 1: (Not Active) - (Size=13 GB) - (Type=27)
Partition 2: (Active) - (Size=109.9 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=110 GB) - (Type=07 NTFS)

==================== End Of Log ============================

deeprybka 16.08.2014 22:14
:daumenhoc Na da sieht doch schon sehr gut aus! Prima Mitarbeit von Dir.

Einen letzten Versuch mach ich noch. Ansonsten musst Du halt Avira mal de- und reinstallieren wenn Dich die Meldung im Sicherheitscenter zu sehr stört. Laufen tut es und der Schutz ist vorhanden.


Schritt 1

http://filepony.de/icon/frst.pnghttp://deeprybka.trojaner-board.de/b...st/frstfix.png

Drücke bitte die http://deeprybka.trojaner-board.de/b...ne/revo/w7.png + R Taste und schreibe notepad in das Ausführen Fenster.
Klicke auf OK und kopiere nun den Text aus der Codebox in das leere Textdokument:
Code:
cmd: winmgmt /verifyrepository
cmd: winmgmt /salvagerepository
Emptytemp:
Speichere dieses bitte als Fixlist.txt in das Verzeichnis ab, in dem sich auch die FRST-Anwendung befindet.
  • Starte FRST und drücke auf den Fix-Button.
  • Das Tool erstellt eine "Fixlog.txt" -Datei.
  • Poste mir bitte deren Inhalt.

PC startet neu!

Katharina123 16.08.2014 22:37
Ich danke Dir für Deine Hilfe, ich mach ja nur, was Du sagst, sonst wäre ich verloren.
Das sind für mich alles böhmische Dörfer :stirn:

Nach dem Neustart gerade kommt keine Meldung mehr vom Sicherheitscenter.
Allerdings musste ich den Avira-Browserschutz manuell starten, aber das wäre kein Problem, wenn ich das jetzt immer machen muss.

Hier der Fixlog:

Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version:16-08-2014 02
Ran by Wichsis at 2014-08-16 23:22:48 Run:3
Running from C:\Users\Wichsis\Desktop
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
cmd: winmgmt /verifyrepository
cmd: winmgmt /salvagerepository
Emptytemp:
*****************


=========  winmgmt /verifyrepository =========

Das WMI-Repository ist konsistent.

========= End of CMD: =========


=========  winmgmt /salvagerepository =========

Das WMI-Repository ist konsistent.

========= End of CMD: =========

EmptyTemp: => Removed 358.2 MB temporary data.


The system needed a reboot.

==== End of Fixlog ====

deeprybka 16.08.2014 22:39
Gut, dann haben wir es! ;)

http://deeprybka.trojaner-board.de/b...cleanupneu.png
Cleanup:
(Die Reihenfolge ist hier entscheidend)


http://deeprybka.trojaner-board.de/b...s/combofix.png Combofix-Deinstallation.
  • Wichtig: Bitte Antivirus-Programm, evtl. vorhandenes Skript-Blocking und Anti-Malware Programme deaktivieren.
  • Drücke bitte die http://deeprybka.trojaner-board.de/b...ne/revo/w7.png + R Taste und schreibe Combofix /Uninstall in das Ausführen-Fenster.
  • Klicke auf OK.
    Damit wird Combofix komplett entfernt und der Cache der Systemwiederherstellung geleert.
  • Nun die eben deaktivierten Programme wieder aktivieren.


Alle Logs gepostet? Ja! Dann lade Dir bitte http://filepony.de/icon/delfix.pngDelFix herunter.
  • Schließe alle offenen Programme.
  • Starte die delfix.exe mit einem Doppelklick.
  • Setze vor jede Funktion ein Häkchen.
  • Klicke auf Start.

Hinweis: DelFix entfernt u.a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
Starte Deinen Rechner abschließend neu. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein, kannst Du diese bedenkenlos löschen.




>>clean<<
Wir haben es geschafft! :abklatsch:
Die Logs sehen für mich im Moment sauber aus.

Wenn Du möchtest, kannst Du hier sagen, ob Du mit mir und meiner Hilfe zufrieden warst...:dankeschoen:und/oder das Forum mit einer kleinen Spende http://www.trojaner-board.de/extra/spende.png unterstützen. :applaus:
Es bleibt mir nur noch, Dir unbeschwertes und sicheres Surfen zu wünschen und dass wir uns hier so bald nicht wiedersehen. ;)

http://www.trojaner-board.de/extra/lesestoff.pngWie kann ich mich in Zukunft besser schützen?

Tipps, Dos & Don'ts

http://deeprybka.trojaner-board.de/b...ast/schild.pngUpdates & Software
Sicherheitslücken in deren alten Versionen werden dazu ausgenutzt, um beim einfachen Besuch einer manipulierten Website per "Drive-by" Malware zu installieren.

Ich empfehle z.B. die Verwendung von Mozilla Firefox statt des Internet Explorers. Zudem lassen sich mit dem Firefox auch PDF-Dokumente öffnen.



http://deeprybka.trojaner-board.de/b...ast/schild.pngFirewall, Antivirus & Co.
http://s1.directupload.net/images/140701/eivrliwa.pngCracks, Downloads & Co.


Neben unbemerkten Drive-by Installationen wird Malware aber auch oft mehr oder weniger aktiv vom Benutzer selbst installiert.
Der Besuch dubioser Websites kann bereits Risiken bergen. Auch wenn der Virenscanner im Moment darin keine Bedrohung erkennt, muss das nichts bedeuten.
Illegale Cracks, Keygens und Serials sind ein ausgesprochen einfacher und beliebter Weg um Malware zu verbreiten.
Bei Dateien aus Peer-to-Peer- und Filesharingprogrammen oder von Filehostern kann man nie sicher sein, ob auch wirklich drin ist, was drauf steht. (Trojanisches Pferd^^)
Oft wird auch versucht, den Benutzer mit mehr oder weniger trickreichen Methoden zu verleiten, eine für ihn verhängnisvolle Handlung selbst auszuführen (Überbegriff Social Engineering).
  • Surfe daher mit Vorsicht und klicke mit Verstand.
  • Sei skeptisch bei unerwarteten E-Mails, insbesondere wenn sie Anhänge enthalten. Auch wenn sie auf den ersten Blick authentisch wirken, persönliche Daten von Dir enthalten oder vermeintlich von einem bekannten Absender stammen: Lieber nochmals in Ruhe überdenken oder nachfragen, anstatt einfach mal Links oder ausführbare Anhänge öffnen oder irgendwo Deine Daten eingeben.
  • Auch in sozialen Netzwerken oder über Instant Messaging Systeme können schädliche Links oder Dateien die Runde machen. Erhältst Du von einem Deiner Freunde eine Nachricht, die merkwürdig ist oder so sensationell interessant, dass man einfach draufklicken muss, dann hat bei ihm/ihr wahrscheinlich Neugier über Verstand gesiegt und Du solltest nicht denselben Fehler machen.

Nervige Adware (Werbung) und unnötige Toolbars werden auch meist durch den Benutzer selbst mitinstalliert.
  • Lade Software in erster Priorität immer direkt vom Hersteller herunter. Viele Softwareportale (z.B. Softonic) packen noch unnützes Zeug mit in die Installation. Alternativ dazu wähle ein sauberes Portal wie Filepony oder heise.
  • Wähle beim Installieren von Software immer die benutzerdefinierte Option und entferne den Haken bei allen optional angebotenen Toolbars oder sonstigen, fürs Programm, irrelevanten Ergänzungen.
  • Um Adware wieder los zu werden, empfiehlt sich zunächst die Deinstallation sowie die anschließende Resteentfernung mit Adwarecleaner .


Abschließend noch ein paar grundsätzliche Bemerkungen:
  • Erstelle regelmäßig Backups Deiner wichtigen Dateien oder des Systems.
  • Der Nutzen von Registry-Cleanern, Optimizern usw. zur Performancesteigerung ist umstritten. Ich empfehle deshalb, die Finger von der Registry zu lassen und lieber die windowseigene Datenträgerbereinigung zu verwenden.

Katharina123 16.08.2014 23:00
Ok, perfekt.
Vielen herzlichen Dank :daumenhoc und noch einen schönen Abend!

Viele Grüße
Katharina

deeprybka 16.08.2014 23:09
Gerne! Dir auch! Alles Gute! :)


Alle Zeitangaben in WEZ +1. Es ist jetzt 08:30 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27