Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   TR/Rootkit.Gen2 - Virenscanner wird deaktiviert - Metasploit 7 wird im Startmenue aktiviert - 5mk1owasew99.exe (https://www.trojaner-board.de/166893-tr-rootkit-gen2-virenscanner-deaktiviert-metasploit-7-startmenue-aktiviert-5mk1owasew99-exe.html)

chrischl 13.05.2015 18:58
TR/Rootkit.Gen2 - Virenscanner wird deaktiviert - Metasploit 7 wird im Startmenue aktiviert - 5mk1owasew99.exe
 
Moin Moin und Gruesse aus Buenos Aires.
Bin hier auf ein Problem gestossen und kann es leider nicht alleine loesen. Trotz ADWCleaner und Malwarebytes und altem/sowie neuem Virenscanner taucht der Virus/Trojaner immer wieder im System auf, obwohl ich mehrfach versucht habe ihn zu loeschen.
Das System ist in den letzten Tagen unglaublich langsam geworden und Metaploit Rapid 7 wird im Startmenue immer wieder re-aktiviert. Nachdem Avira zwar 3 Trojaner erkannt hat (Habe nur noch 3 Screenshots), jedoch nicht loeschen konnte, habe ich AVG2015 heruntergeladen, der Scan wird jedoch mehrfach abgebrochen.
Hilfe!!
Weitere Dateien die immer wieder auftauchen sind:
Help_Decrypt
5mk1owasew99.exe und
548bdadaaecaa26.sys

Anscheinend habe wir uns das Ding auf DropBox eingefangen.. Wie kann man das auch loeschen???

Der Rechner laeuft bisher auf Spanisch, da ich das noch nicht veraendern wollte...Wenn ich das aendern soll, dann bitte sagen.

Danke
(Ich hoffe ich hab alles richtig gemacht...)

Code:
efogger_disable by jpshortstuff (23.02.10.1)
Log created at 13:59 on 13/05/2015 (shaka)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...
Unable to read 548bdadaaeecaa26.sys
Unable to read bthmodem.sys
Unable to read bxvbdx.sys
Unable to read cdfs.sys
Unable to read cdrom.sys
Unable to read circlass.sys
Unable to read Classpnp.sys
Unable to read CmBatt.sys
Unable to read cmdide.sys
Unable to read cng.sys
Unable to read compbatt.sys
Unable to read CompositeBus.sys
Unable to read crashdmp.sys
Unable to read crcdisk.sys
Unable to read csc.sys
Unable to read dfsc.sys
Unable to read discache.sys
Unable to read disk.sys
Unable to read Diskdump.sys
Unable to read djsvs.sys
Unable to read drmk.sys
Unable to read drmkaud.sys
Unable to read Dumpata.sys
Unable to read dumpfve.sys
Unable to read dxapi.sys
Unable to read dxg.sys
Unable to read dxgkrnl.sys
Unable to read dxgmms1.sys
Unable to read elxstor.sys
Unable to read errdev.sys
Unable to read evbdx.sys
Unable to read exfat.sys
Unable to read fastfat.sys
Unable to read fdc.sys
Unable to read fileinfo.sys
Unable to read filetrace.sys
Unable to read flpydisk.sys
Unable to read fltMgr.sys
Unable to read fsdepends.sys
Unable to read fs_rec.sys
Unable to read fvevol.sys
Unable to read FWPKCLNT.SYS
Unable to read GAGP30KX.SYS
Unable to read hcw85cir.sys
Unable to read hdaudbus.sys
Unable to read HdAudio.sys
Unable to read HECI.sys
Unable to read hidbatt.sys
Unable to read hidbth.sys
Unable to read hidclass.sys
Unable to read hidir.sys
Unable to read hidparse.sys
Unable to read hidusb.sys
Unable to read HpSAMD.sys
Unable to read http.sys
Unable to read hwpolicy.sys
Unable to read i8042prt.sys
Unable to read iaStor.sys
Unable to read iaStorV.sys
Unable to read igdkmd32.sys
Unable to read iirsp.sys
Unable to read intelide.sys
Unable to read intelppm.sys
Unable to read ipfltdrv.sys
Unable to read IPMIDrv.sys
Unable to read ipnat.sys
Unable to read irda.sys
Unable to read irenum.sys
Unable to read isapnp.sys
Unable to read kbdclass.sys
Unable to read kbdhid.sys
Unable to read ks.sys
Unable to read ksecdd.sys
Unable to read ksecpkg.sys
Unable to read lltdio.sys
Unable to read lsi_fc.sys
Unable to read lsi_sas.sys
Unable to read lsi_sas2.sys
Unable to read lsi_scsi.sys
Unable to read luafv.sys
Unable to read mcd.sys
Unable to read megasas.sys
Unable to read MegaSR.sys
Unable to read modem.sys
Unable to read monitor.sys
Unable to read mouclass.sys
Unable to read mouhid.sys
Unable to read mountmgr.sys
Unable to read mpio.sys
Unable to read mpsdrv.sys
Unable to read mrxdav.sys
Unable to read mrxsmb.sys
Unable to read mrxsmb10.sys
Unable to read mrxsmb20.sys
Unable to read msahci.sys
Unable to read msdsm.sys
Unable to read msfs.sys
Unable to read mshidkmdf.sys
Unable to read msisadrv.sys
Unable to read msiscsi.sys
Unable to read mskssrv.sys
Unable to read mspclock.sys
Unable to read mspqm.sys
Unable to read msrpc.sys
Unable to read mssmbios.sys
Unable to read mstee.sys
Unable to read MTConfig.sys
Unable to read mup.sys
Unable to read ndis.sys
Unable to read ndiscap.sys
Unable to read ndistapi.sys
Unable to read ndisuio.sys
Unable to read ndiswan.sys
Unable to read ndproxy.sys
Unable to read netbios.sys
Unable to read netbt.sys
Unable to read netio.sys
Unable to read nfrd960.sys
Unable to read npfs.sys
Unable to read nsiproxy.sys
Unable to read ntfs.sys
Unable to read null.sys
Unable to read nvraid.sys
Unable to read nvstor.sys
Unable to read NV_AGP.SYS
Unable to read nwifi.sys
Unable to read ohci1394.sys
Unable to read pacer.sys
Unable to read parport.sys
Unable to read partmgr.sys
Unable to read parvdm.sys
Unable to read pci.sys
Unable to read pciide.sys
Unable to read pciidex.sys
Unable to read pcmcia.sys
Unable to read pcw.sys
Unable to read PEAuth.sys
Unable to read portcls.sys
Unable to read processr.sys
Unable to read ql2300.sys
Unable to read ql40xx.sys
Unable to read qwavedrv.sys
Unable to read rasacd.sys
Unable to read rasl2tp.sys
Unable to read raspppoe.sys
Unable to read raspptp.sys
Unable to read rassstp.sys
Unable to read rdbss.sys
Unable to read rdpbus.sys
Unable to read RDPCDD.sys
Unable to read rdpdr.sys
Unable to read RDPENCDD.sys
Unable to read RDPREFMP.sys
Unable to read rdpvideominiport.sys
Unable to read rdpwd.sys
Unable to read rdyboost.sys
Unable to read rmcast.sys
Unable to read RNDISMP.sys
Unable to read rootmdm.sys
Unable to read rspndr.sys
Unable to read Rt86win7.sys
Unable to read RTKVHDA.sys
Unable to read sbp2port.sys
Unable to read scfilter.sys
Unable to read scsiport.sys
Unable to read secdrv.sys
Unable to read serenum.sys
Unable to read serial.sys
Unable to read sermouse.sys
Unable to read sffdisk.sys
Unable to read sffp_mmc.sys
Unable to read sffp_sd.sys
Unable to read sfloppy.sys
Unable to read SISAGP.SYS
Unable to read sisraid2.sys
Unable to read sisraid4.sys
Unable to read smb.sys
Unable to read smclib.sys
Unable to read spldr.sys
Unable to read spsys.sys
Unable to read srv.sys
Unable to read srv2.sys
Unable to read srvnet.sys
Unable to read stexstor.sys
Unable to read storport.sys
Unable to read storvsc.sys
Unable to read swenum.sys
Unable to read tape.sys
Unable to read tcpip.sys
Unable to read tcpipreg.sys
Unable to read tdi.sys
Unable to read tdpipe.sys
Unable to read tdtcp.sys
Unable to read tdx.sys
Unable to read termdd.sys
Unable to read tssecsrv.sys
Unable to read TsUsbFlt.sys
Unable to read tunnel.sys
Unable to read UAGP35.SYS
Unable to read udfs.sys
Unable to read ULIAGPKX.SYS
Unable to read umbus.sys
Unable to read umpass.sys
Unable to read usb8023.sys
Unable to read usbccgp.sys
Unable to read usbcir.sys
Unable to read usbd.sys
Unable to read usbehci.sys
Unable to read usbhub.sys
Unable to read usbohci.sys
Unable to read usbport.sys
Unable to read usbprint.sys
Unable to read usbscan.sys
Unable to read USBSTOR.SYS
Unable to read usbuhci.sys
Unable to read usbvideo.sys
Unable to read vdrvroot.sys
Unable to read vga.sys
Unable to read vgapnp.sys
Unable to read vhdmp.sys
Unable to read VIAAGP.SYS
Unable to read viac7.sys
Unable to read viaide.sys
Unable to read videoprt.sys
Unable to read vmbus.sys
Unable to read VMBusHID.sys
Unable to read vms3cap.sys
Unable to read vmstorfl.sys
Unable to read volmgr.sys
Unable to read volmgrx.sys
Unable to read volsnap.sys
Unable to read vsmraid.sys
Unable to read vwifibus.sys
Unable to read vwififlt.sys
Unable to read vwifimp.sys
Unable to read wacompen.sys
Unable to read wanarp.sys
Unable to read watchdog.sys
Unable to read wd.sys
Unable to read Wdf01000.sys
Unable to read WdfLdr.sys
Unable to read wfplwf.sys
Unable to read wimmount.sys
Unable to read winhv.sys
Unable to read winusb.sys
Unable to read wmiacpi.sys
Unable to read wmilib.sys
Unable to read ws2ifsl.sys
Unable to read WUDFPf.sys
Unable to read WUDFRd.sys


-=E.O.F=-

Code:
Additional scan result of Farbar Recovery Scan Tool (x86) Version: 09-05-2015
Ran by shaka at 2015-05-13 14:00:54
Running from C:\Users\shaka\Downloads
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrador (S-1-5-21-248733116-1412973945-2583540736-500 - Administrator - Disabled)
Invitado (S-1-5-21-248733116-1412973945-2583540736-501 - Limited - Disabled)
shaka (S-1-5-21-248733116-1412973945-2583540736-1000 - Administrator - Enabled) => C:\Users\shaka

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: AVG AntiVirus Free Edition 2015 (Disabled - Out of date) {4D41356F-32AD-7C42-C820-63775EE4F413}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: AVG AntiVirus Free Edition 2015 (Disabled - Out of date) {F620D48B-1497-73CC-F290-58052563BEAE}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

AVG 2015 (HKLM\...\AVG) (Version: 2015.0.5941 - AVG Technologies)
AVG 2015 (Version: 15.0.4331 - AVG Technologies) Hidden
AVG 2015 (Version: 15.0.5941 - AVG Technologies) Hidden
BufferChm (Version: 130.0.327.000 - Hewlett-Packard) Hidden
Crystal Reports (HKLM\...\CrystalReports) (Version:  - )
Destinations (Version: 130.0.0.0 - Hewlett-Packard) Hidden
DocProc (Version: 13.0.0.0 - Hewlett-Packard) Hidden
ESET Online Scanner v3 (HKLM\...\ESET Online Scanner) (Version:  - )
Google Chrome (HKLM\...\Google Chrome) (Version: 42.0.2311.152 - Google Inc.)
Google Earth (HKLM\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (Version: 1.3.26.9 - Google Inc.) Hidden
GPBaseService2 (Version: 130.0.367.000 - Hewlett-Packard) Hidden
HP Imaging Device Functions 13.0 (HKLM\...\HP Imaging Device Functions) (Version: 13.0 - HP)
HP Photosmart Essential 3.5 (HKLM\...\HP Photosmart Essential) (Version: 3.5 - HP)
HP Scanjet 2400 (HKLM\...\{D3A65B0A-403B-4C20-A488-BFED2BC5D2EF}) (Version: 13.0 - HP)
HP Solution Center 13.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 13.0 - HP)
HP Update (HKLM\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
HPDiagnosticAlert (Version: 1.00.0000 - Microsoft) Hidden
hpg2410 (Version: 14.0.0.0 - Nombre de su organización) Hidden
HPPhotosmartEssential (Version: 2.04.0000 - Hewlett-Packard) Hidden
HPProductAssistant (Version: 130.0.367.000 - Hewlett-Packard) Hidden
Intel(R) Management Engine Components (HKLM\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.0.4.1441 - Intel Corporation)
Intel(R) OpenCL CPU Runtime (HKLM\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version:  - Intel Corporation)
Intel(R) Processor Graphics (HKLM\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2669 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.0.0.1032 - Intel Corporation)
Intel® Trusted Connect Service Client (HKLM\...\{51A66ED3-200E-4147-8D1E-E8D30936FD26}) (Version: 1.23.605.1 - Intel Corporation)
Malwarebytes Anti-Malware Version 2.1.6.1022 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)
Markey (HKLM\...\Markey1.0) (Version: 1.0 - Markey)
Markey (HKLM\...\Markey3.5) (Version: 3.5 - Prevención Tecnológica S.A.)
Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUS) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP2 Parser and SDK (HKLM\...\{716E0306-8318-4364-8B8F-0CC4E9376BAC}) (Version: 4.20.9818.0 - Microsoft Corporation)
OCR Software by I.R.I.S. 13.0 (HKLM\...\HPOCR) (Version: 13.0 - HP)
Realtek Ethernet Controller Driver (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.49.927.2011 - Realtek)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6521 - Realtek Semiconductor Corp.)
Scan (Version: 13.0.0.0 - Hewlett-Packard) Hidden
Skype Click to Call (HKLM\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)
Skype™ 7.4 (HKLM\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.4.102 - Skype Technologies S.A.)
SolutionCenter (Version: 130.0.369.000 - Hewlett-Packard) Hidden
Visual Studio 2012 x86 Redistributables (HKLM\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VLC media player 2.0.6 (HKLM\...\VLC media player) (Version: 2.0.6 - VideoLAN)
WebReg (Version: 130.0.128.017 - Hewlett-Packard) Hidden
WinRAR 4.20 (32-bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-248733116-1412973945-2583540736-1000_Classes\CLSID\{0B4AA204-AB61-47E3-B5B4-27DCF375EBAC}\localserver32 -> "CDStart.exe" No File

==================== Restore Points  =========================


==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 23:04 - 2013-04-13 20:23 - 00000864 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 validation.sls.microsoft.com

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {26333F52-395A-40AF-85EB-62866E3A9FD2} - System32\Tasks\{7862002D-768C-4093-A780-26FFE95CA295} => Chrome.exe hxxp://ui.skype.com/ui/0/6.6.0.106/es/abandoninstall?page=tsPlugin
Task: {39492BFD-1022-4CCB-8342-FBEFE6A28FAF} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-24] (Google Inc.)
Task: {BD9C3C2F-475C-46F2-882C-97DAD8F857B9} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-24] (Google Inc.)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) ==============

2013-04-13 21:21 - 2013-03-19 01:48 - 00038912 _____ () C:\Windows\system32\CSRSRV.dll
2009-07-13 20:11 - 2009-07-13 22:16 - 00033280 _____ () C:\Windows\system32\pcwum.dll
2009-07-13 20:11 - 2009-07-13 22:16 - 00033280 _____ () c:\windows\system32\pcwum.DLL
2009-07-13 20:11 - 2009-07-13 22:16 - 00033280 _____ () C:\Windows\System32\pcwum.dll
2009-07-13 20:11 - 2009-07-13 22:16 - 00033280 _____ () c:\windows\system32\pcwum.dll
2013-04-16 10:29 - 2012-09-18 15:26 - 00169472 _____ () C:\Windows\System32\zlhp1020.dll
2013-04-16 10:30 - 2012-09-18 15:26 - 00059904 _____ () C:\Windows\system32\spool\PRTPROCS\W32X86\pphp1020.dll
2010-01-30 02:41 - 2010-01-30 02:41 - 04254560 _____ () C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2013-04-13 20:03 - 2012-02-27 13:07 - 00094208 _____ () C:\Windows\System32\IccLibDll.dll
2013-04-18 12:04 - 2013-04-18 12:04 - 00172032 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\8b857add6394c98128874eb2579534e5\IsdiInterop.ni.dll
2013-04-13 19:55 - 2011-11-29 20:00 - 00059392 _____ () C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2013-04-13 19:51 - 2012-03-06 04:27 - 01198872 ____R () C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2015-05-13 10:32 - 2015-05-05 01:06 - 01252680 _____ () C:\Program Files\Google\Chrome\Application\42.0.2311.152\libglesv2.dll
2015-05-13 10:32 - 2015-05-05 01:06 - 00080712 _____ () C:\Program Files\Google\Chrome\Application\42.0.2311.152\libegl.dll
2015-05-13 10:32 - 2015-05-05 01:06 - 14982472 _____ () C:\Program Files\Google\Chrome\Application\42.0.2311.152\PepperFlash\pepflashplayer.dll
2015-05-13 13:55 - 2014-06-26 07:44 - 00358144 _____ () C:\Program Files\ESET\ESET Online Scanner\OnlineCmdLineScanner.exe

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, the associated entry will be removed from the registry.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-248733116-1412973945-2583540736-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\shaka\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 200.49.130.47 - 200.42.4.210

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: AdobeARMservice => 2
MSCONFIG\Services: AdobeFlashPlayerUpdateSvc => 3
MSCONFIG\Services: c2cautoupdatesvc => 2
MSCONFIG\Services: c2cpnrsvc => 2
MSCONFIG\Services: gupdate => 2
MSCONFIG\Services: gupdatem => 3
MSCONFIG\Services: gusvc => 3
MSCONFIG\Services: KMService => 2
MSCONFIG\Services: SkypeUpdate => 2
MSCONFIG\startupfolder: C:^Users^shaka^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^HELP_DECRYPT.HTML => C:\Windows\pss\HELP_DECRYPT.HTML.Startup
MSCONFIG\startupfolder: C:^Users^shaka^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^HELP_DECRYPT.PNG => C:\Windows\pss\HELP_DECRYPT.PNG.Startup
MSCONFIG\startupfolder: C:^Users^shaka^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^HELP_DECRYPT.TXT => C:\Windows\pss\HELP_DECRYPT.TXT.Startup
MSCONFIG\startupfolder: C:^Users^shaka^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^HELP_DECRYPT.URL => C:\Windows\pss\HELP_DECRYPT.URL.Startup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: avgnt => "C:\Program Files\Avira\Antivirus\avgnt.exe" /min
MSCONFIG\startupreg: BCSSync => "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices
MSCONFIG\startupreg: HP Software Update => C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
MSCONFIG\startupreg: hpqSRMon => C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
MSCONFIG\startupreg: IAStorIcon => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
MSCONFIG\startupreg: RTHDVCPL => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
MSCONFIG\startupreg: Skype => "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun
MSCONFIG\startupreg: Windows Search 5.3.10 => "C:\ProgramData\Windows Search 5.3.10\5mk1owasew99.exe"

==================== FirewallRules (whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [{43EA46D2-576A-4D49-87F0-CB599B1A9F9C}] => (Allow) C:\Program Files\AVG\AVG2013\avgmfapx.exe
FirewallRules: [{889A193B-0CF9-4617-ACAB-CDC78B719F8E}] => (Allow) C:\Program Files\AVG\AVG2013\avgmfapx.exe
FirewallRules: [{9C5BA8F1-12DF-4316-8BEC-4FFEE95297A8}] => (Allow) C:\Program Files\Skype\Phone\Skype.exe
FirewallRules: [{1F6799A7-3655-46B2-A8BD-DD3A1E998BE4}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe
FirewallRules: [{37FE0C1C-F4F8-460F-BFBC-A69ABA0607FA}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe
FirewallRules: [{1AF2A179-93CB-41A1-897C-0F4C97EE35FB}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe
FirewallRules: [{387476B0-3580-4F27-A229-469E5222F2AC}] => (Allow) C:\Program Files\common files\hp\digital imaging\bin\hpqphotocrm.exe
FirewallRules: [{B282551C-C29C-43D9-9F1E-C3579876C643}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqsudi.exe
FirewallRules: [{2E2B045C-B6A5-4F0D-B272-838EF219E7AC}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqpsapp.exe
FirewallRules: [{381B57EF-4C70-4B1E-8EC1-16C80BC3CD95}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqpse.exe
FirewallRules: [{1CCD67C9-35AF-415A-975B-0B42DC531DF5}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqgplgtupl.exe
FirewallRules: [{8FDF4CBE-6D1A-4053-B6DE-B07E4344078F}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
FirewallRules: [{42BFC7E9-9F1D-4062-BF03-F8758434D5AC}] => (Allow) C:\Program Files\HP\hp software update\hpwucli.exe
FirewallRules: [TCP Query User{695A6352-C713-4E93-B73C-0D91FAAD09FA}C:\users\shaka\appdata\roaming\dropbox\bin\dropbox.exe] => (Allow) C:\users\shaka\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [UDP Query User{3B58EFB0-4B90-4D15-A134-12562EE5B357}C:\users\shaka\appdata\roaming\dropbox\bin\dropbox.exe] => (Allow) C:\users\shaka\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [{0D4C6489-4111-4FA2-A261-CD582DC318D5}] => (Allow) C:\Program Files\Google\Chrome\Application\chrome.exe
FirewallRules: [{912D1AF4-FD65-4852-8C06-82DF132EE1BB}] => (Allow) C:\Program Files\AVG\AVG2015\avgnsx.exe
FirewallRules: [{15A0BC5E-EB73-467D-86B0-6EF1DF41E623}] => (Allow) C:\Program Files\AVG\AVG2015\avgnsx.exe
FirewallRules: [{C1586590-AC4C-4155-8A93-8C0D1CECB3B9}] => (Allow) C:\Program Files\AVG\AVG2015\avgdiagex.exe
FirewallRules: [{8860B64F-93EB-415E-A78F-5BB71196526C}] => (Allow) C:\Program Files\AVG\AVG2015\avgdiagex.exe
FirewallRules: [{50206D38-EBD5-4011-9FBB-3061A19B73BE}] => (Allow) C:\Program Files\AVG\AVG2015\avgmfapx.exe
FirewallRules: [{B4770506-583E-48B9-8DE5-447CE81EBF39}] => (Allow) C:\Program Files\AVG\AVG2015\avgmfapx.exe
FirewallRules: [{1D3BD8A4-4675-4F8D-85D7-0D675030892B}] => (Allow) C:\Program Files\AVG\AVG2015\avgemcx.exe
FirewallRules: [{236C3B48-1BB4-46A7-B850-775A521863F8}] => (Allow) C:\Program Files\AVG\AVG2015\avgemcx.exe

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (05/13/2015 11:03:37 AM) (Source: VSS) (EventID: 8194) (User: )
Description: Error del Servicio de instantáneas de volumen: error inesperado al consultar la interfaz IVssWriterCallback. HR = 0x80070005, Acceso denegado.
.
A menudo ocurre por una configuración de seguridad incorrecta en el proceso de escritura o de solicitud.


Operación:
  Recopilando datos del escritor

Contexto:
  Id. de clase del escritor: {e8132975-6f93-4464-a53e-1050253ae220}
  Nombre del escritor: System Writer
  Id. de instancia del escritor: {e4c47749-9679-4d3a-915e-4bd4a36a802c}

Error: (05/13/2015 10:30:38 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Nombre de la aplicación con errores: taskhost.exe, versión: 6.1.7601.18010, marca de tiempo: 0x50aee407
Nombre del módulo con errores: ntdll.dll, versión: 6.1.7601.17725, marca de tiempo: 0x4ec49b60
Código de excepción: 0x80000003
Desplazamiento de errores: 0x0006374e
Id. del proceso con errores: 0x738
Hora de inicio de la aplicación con errores: 0xtaskhost.exe0
Ruta de acceso de la aplicación con errores: taskhost.exe1
Ruta de acceso del módulo con errores: taskhost.exe2
Id. del informe: taskhost.exe3

Error: (05/13/2015 10:30:35 AM) (Source: VSS) (EventID: 13) (User: )
Description: Información del Servicio de instantáneas de volumen: el servidor COM con CLSID {e579ab5f-1cc4-44b4-bed9-de0991ff0623} y el nombre Coordinator no puede iniciarse. [0x80070005, Acceso denegado.
]

Error: (05/13/2015 09:24:00 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Nombre de la aplicación con errores: AvastUI.exe, versión: 10.2.2218.942, marca de tiempo: 0x55364e82
Nombre del módulo con errores: ntdll.dll, versión: 6.1.7601.17725, marca de tiempo: 0x4ec49b60
Código de excepción: 0xc000070a
Desplazamiento de errores: 0x0009bdec
Id. del proceso con errores: 0xb74
Hora de inicio de la aplicación con errores: 0xAvastUI.exe0
Ruta de acceso de la aplicación con errores: AvastUI.exe1
Ruta de acceso del módulo con errores: AvastUI.exe2
Id. del informe: AvastUI.exe3

Error: (05/12/2015 11:30:16 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: El programa Explorer.EXE, versión 6.1.7601.17514, dejó de interactuar con Windows y se cerró. Para ver si hay más información disponible acerca del problema, compruebe el historial de problemas en el panel de control Centro de actividades.

Identificador de proceso: 868

Hora de inicio: 01d08d22fe2cd795

Hora de finalización: 31

Ruta de acceso de la aplicación: C:\Windows\Explorer.EXE

Identificador de informe: fb53a5b0-f917-11e4-a81f-eca86b747777

Error: (05/12/2015 11:01:57 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Error del Servicio de instantáneas de volumen: error inesperado al consultar la interfaz IVssWriterCallback. HR = 0x80070005, Acceso denegado.
.
A menudo ocurre por una configuración de seguridad incorrecta en el proceso de escritura o de solicitud.


Operación:
  Recopilando datos del escritor

Contexto:
  Id. de clase del escritor: {e8132975-6f93-4464-a53e-1050253ae220}
  Nombre del escritor: System Writer
  Id. de instancia del escritor: {9980a6b2-78b8-445c-8265-5e61a92e039f}

Error: (05/12/2015 10:58:11 PM) (Source: VSS) (EventID: 13) (User: )
Description: Información del Servicio de instantáneas de volumen: el servidor COM con CLSID {e579ab5f-1cc4-44b4-bed9-de0991ff0623} y el nombre Coordinator no puede iniciarse. [0x80070005, Acceso denegado.
]

Error: (05/12/2015 10:58:06 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Nombre de la aplicación con errores: taskhost.exe, versión: 6.1.7601.18010, marca de tiempo: 0x50aee407
Nombre del módulo con errores: ntdll.dll, versión: 6.1.7601.17725, marca de tiempo: 0x4ec49b60
Código de excepción: 0x80000003
Desplazamiento de errores: 0x0006374e
Id. del proceso con errores: 0x80c
Hora de inicio de la aplicación con errores: 0xtaskhost.exe0
Ruta de acceso de la aplicación con errores: taskhost.exe1
Ruta de acceso del módulo con errores: taskhost.exe2
Id. del informe: taskhost.exe3

Error: (05/12/2015 10:51:09 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Nombre de la aplicación con errores: Avira.OE.Systray.exe, versión: 1.1.37.14638, marca de tiempo: 0x5535f74c
Nombre del módulo con errores: unknown, versión: 0.0.0.0, marca de tiempo: 0x00000000
Código de excepción: 0xc0000005
Desplazamiento de errores: 0x05943637
Id. del proceso con errores: 0x1104
Hora de inicio de la aplicación con errores: 0xAvira.OE.Systray.exe0
Ruta de acceso de la aplicación con errores: Avira.OE.Systray.exe1
Ruta de acceso del módulo con errores: Avira.OE.Systray.exe2
Id. del informe: Avira.OE.Systray.exe3

Error: (05/12/2015 10:47:56 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Nombre de la aplicación con errores: Avira.OE.Systray.exe, versión: 1.1.37.14638, marca de tiempo: 0x5535f74c
Nombre del módulo con errores: unknown, versión: 0.0.0.0, marca de tiempo: 0x00000000
Código de excepción: 0xc0000005
Desplazamiento de errores: 0x08cf3637
Id. del proceso con errores: 0x1514
Hora de inicio de la aplicación con errores: 0xAvira.OE.Systray.exe0
Ruta de acceso de la aplicación con errores: Avira.OE.Systray.exe1
Ruta de acceso del módulo con errores: Avira.OE.Systray.exe2
Id. del informe: Avira.OE.Systray.exe3


System errors:
=============
Error: (05/13/2015 01:11:19 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: El siguiente controlador de inicio del sistema o de inicio del arranque no se cargó correctamente:
Avgdiskx
AVGIDSDriver
AVGIDSHX
AVGIDSShim
Avgldx86
Avglogx
Avgmfx86
Avgrkx86
Avgtdix
avipbb
avkmgr
ssmdrv

Error: (05/13/2015 01:11:18 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: El servicio Avira Mail Protection depende del servicio Avira Real-Time Protection, el cual no pudo iniciarse debido al siguiente error:
%%2

Error: (05/13/2015 01:11:18 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: El servicio MBAMService depende del servicio MBAMProtector, el cual no pudo iniciarse debido al siguiente error:
%%31

Error: (05/13/2015 01:11:18 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: El servicio avnetflt no pudo iniciarse debido al siguiente error:
%%31

Error: (05/13/2015 01:11:18 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: El servicio AVGIDSAgent depende del servicio AVGIDSDriver, el cual no pudo iniciarse debido al siguiente error:
%%31

Error: (05/13/2015 01:11:18 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: El servicio Avira Web Protection depende del servicio Avira Real-Time Protection, el cual no pudo iniciarse debido al siguiente error:
%%2

Error: (05/13/2015 01:11:18 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: El servicio Avira Real-Time Protection no pudo iniciarse debido al siguiente error:
%%2

Error: (05/13/2015 01:11:18 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: El servicio Avira Programador no pudo iniciarse debido al siguiente error:
%%2

Error: (05/13/2015 01:11:16 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: El servicio MBAMProtector no pudo iniciarse debido al siguiente error:
%%31

Error: (05/13/2015 01:11:16 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: El servicio avgntflt no pudo iniciarse debido al siguiente error:
%%31


Microsoft Office Sessions:
=========================
Error: (05/13/2015 11:03:37 AM) (Source: VSS) (EventID: 8194) (User: )
Description: 0x80070005, Acceso denegado.


Operación:
  Recopilando datos del escritor

Contexto:
  Id. de clase del escritor: {e8132975-6f93-4464-a53e-1050253ae220}
  Nombre del escritor: System Writer
  Id. de instancia del escritor: {e4c47749-9679-4d3a-915e-4bd4a36a802c}

Error: (05/13/2015 10:30:38 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: taskhost.exe6.1.7601.1801050aee407ntdll.dll6.1.7601.177254ec49b60800000030006374e73801d08d7faa64a4e1C:\Windows\system32\taskhost.exeC:\Windows\SYSTEM32\ntdll.dll3dfc7cde-f974-11e4-b8f9-eca86b747777

Error: (05/13/2015 10:30:35 AM) (Source: VSS) (EventID: 13) (User: )
Description: {e579ab5f-1cc4-44b4-bed9-de0991ff0623}Coordinator0x80070005, Acceso denegado.

Error: (05/13/2015 09:24:00 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: AvastUI.exe10.2.2218.94255364e82ntdll.dll6.1.7601.177254ec49b60c000070a0009bdecb7401d08d777c55c59fC:\Program Files\AVAST Software\Avast\AvastUI.exeC:\Windows\SYSTEM32\ntdll.dlleeec3b61-f96a-11e4-a7a9-eca86b747777

Error: (05/12/2015 11:30:16 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Explorer.EXE6.1.7601.1751486801d08d22fe2cd79531C:\Windows\Explorer.EXEfb53a5b0-f917-11e4-a81f-eca86b747777

Error: (05/12/2015 11:01:57 PM) (Source: VSS) (EventID: 8194) (User: )
Description: 0x80070005, Acceso denegado.


Operación:
  Recopilando datos del escritor

Contexto:
  Id. de clase del escritor: {e8132975-6f93-4464-a53e-1050253ae220}
  Nombre del escritor: System Writer
  Id. de instancia del escritor: {9980a6b2-78b8-445c-8265-5e61a92e039f}

Error: (05/12/2015 10:58:11 PM) (Source: VSS) (EventID: 13) (User: )
Description: {e579ab5f-1cc4-44b4-bed9-de0991ff0623}Coordinator0x80070005, Acceso denegado.

Error: (05/12/2015 10:58:06 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: taskhost.exe6.1.7601.1801050aee407ntdll.dll6.1.7601.177254ec49b60800000030006374e80c01d08d0c2286d8dbC:\Windows\system32\taskhost.exeC:\Windows\SYSTEM32\ntdll.dll7f0061d9-f913-11e4-bc6f-eca86b747777

Error: (05/12/2015 10:51:09 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Avira.OE.Systray.exe1.1.37.146385535f74cunknown0.0.0.000000000c000000505943637110401d08d1f400b655eC:\Program Files\Avira\Launcher\Avira.OE.Systray.exeunknown867b065c-f912-11e4-bc6f-eca86b747777

Error: (05/12/2015 10:47:56 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Avira.OE.Systray.exe1.1.37.146385535f74cunknown0.0.0.000000000c000000508cf3637151401d08d1ed1c878eaC:\Program Files\Avira\Launcher\Avira.OE.Systray.exeunknown135de0a0-f912-11e4-bc6f-eca86b747777


==================== Memory info ===========================

Processor: Intel(R) Pentium(R) CPU G2020 @ 2.90GHz
Percentage of memory in use: 41%
Total physical RAM: 3494.59 MB
Available physical RAM: 2056.86 MB
Total Pagefile: 6987.47 MB
Available Pagefile: 5550.57 MB
Total Virtual: 2047.88 MB
Available Virtual: 1877.03 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:465.66 GB) (Free:431.06 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 5DC69892)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=465.7 GB) - (Type=07 NTFS)

==================== End Of Log ============================



Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 09-05-2015
Ran by shaka (administrator) on OFICINA on 13-05-2015 14:00:25
Running from C:\Users\shaka\Downloads
Loaded Profiles: shaka (Available profiles: shaka)
Platform: Microsoft Windows 7 Enterprise  Service Pack 1 (X86) OS Language: Español (España, internacional)
Internet Explorer Version 9 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgwdsvc.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgemcx.exe
(Google Inc.) C:\Program Files\Google\Update\1.3.26.9\GoogleCrashHandler.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgui.exe
(Microsoft Corporation) C:\Windows\System32\taskmgr.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\msconfig.exe
(ESET) C:\Program Files\ESET\ESET Online Scanner\OnlineScannerApp.exe
() C:\Program Files\ESET\ESET Online Scanner\OnlineCmdLineScanner.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [] => [X]
HKLM\...\Run: [AVG_UI] => C:\Program Files\AVG\AVG2015\avgui.exe [3745232 2015-04-15] (AVG Technologies CZ, s.r.o.)
HKU\S-1-5-21-248733116-1412973945-2583540736-1000\...\MountPoints2: {2d3b77c9-a4a4-11e2-9f54-806e6f6e6963} - D:\EIProcessCaller.exe
HKU\S-1-5-21-248733116-1412973945-2583540736-1000\...\MountPoints2: {4e1a8a16-c215-11e2-b710-eca86b747777} - G:\LaunchU3.exe -a
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [280576 2013-04-15] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-248733116-1412973945-2583540736-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/?pc=SKY2&ocid=SKY2DHP&osmkt=es-ar
HKU\S-1-5-21-248733116-1412973945-2583540736-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://ar.msn.com/?ocid=iehp
HKU\S-1-5-21-248733116-1412973945-2583540736-1000\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = https://mail.google.com/mail/u/1/#inbox
hxxp://www.lanacion.com.ar/
hxxp://www.prefecturanaval.gov.ar/web/es/html/dico_alturas.php
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-248733116-1412973945-2583540736-1000 -> {B6846C33-43CE-41CD-BB51-F754E8F8D9C0} URL = https://www.google.com/search?q={searchTerms}
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2010-03-25] (Microsoft Corporation)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-07-14] (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2010-02-28] (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-07-14] (Microsoft Corporation)
Hosts: 127.0.0.1 validation.sls.microsoft.com
Tcpip\Parameters: [DhcpNameServer] 200.49.130.47 200.42.4.210

FireFox:
========
FF ProfilePath: C:\Users\shaka\AppData\Roaming\Mozilla\Firefox\Profiles\3UZSzQhi.default
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 -> C:\Program Files\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-01-06] (Intel Corporation)
FF Plugin: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-01-06] (Intel Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-09] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-09] (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.6 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2013-04-10] (VideoLAN)
FF Extension: Avira Browser Safety - C:\Users\shaka\AppData\Roaming\Mozilla\Firefox\Profiles\3UZSzQhi.default\Extensions\abs@avira.com [2015-05-12]

Chrome:
=======
CHR HomePage: Default -> hxxp://avg.nation.com/avgtbavg/search/home?cid={E208873C-885A-4286-B6F4-317872DB511A}&mid=491fcc7d9a9147d3b0823de12d909e84-0762da72d5c59cee9c9f5a280d2b05848fe8dcff&lang=es-es&ds=AVG&coid=avgtbavg&pr=fr&d=2013-10-01 13:49:47&v=18.1.0.443&pid=nation&sg=0&sap=hp&cmpid=0913b
CHR StartupUrls: Default -> "hxxp://avg.nation.com/avgtbavg/search/home?cid={E208873C-885A-4286-B6F4-317872DB511A}&mid=491fcc7d9a9147d3b0823de12d909e84-0762da72d5c59cee9c9f5a280d2b05848fe8dcff&lang=es-es&ds=AVG&coid=avgtbavg&pr=fr&d=2013-10-01 13:49:47&v=18.1.0.443&pid=nation&sg=0&sap=hp&cmpid=0913b"
CHR DefaultSearchKeyword: Default -> avg.nation.com
CHR DefaultSearchURL: Default -> hxxp://avg.nation.com/avgtbavg/search/web?cid={E208873C-885A-4286-B6F4-317872DB511A}&mid=491fcc7d9a9147d3b0823de12d909e84-0762da72d5c59cee9c9f5a280d2b05848fe8dcff&lang=es-es&ds=AVG&coid=avgtbavg&pr=fr&d=2013-10-01 13:49:47&v=17.0.1.12&pid=nation&sg=0&sap=dsp&q={searchTerms}&cmpid=0913b
CHR DefaultNewTabURL: Default -> https://avg.nation.com/chroment?espv=2&cid={E208873C-885A-4286-B6F4-317872DB511A}&mid=491fcc7d9a9147d3b0823de12d909e84-0762da72d5c59cee9c9f5a280d2b05848fe8dcff&lang=es-es&ds=AVG&pr=fr&d=2013-10-01 13:49:47&v=18.1.0.443&pid=nation&sg=0
CHR DefaultSuggestURL: Default -> hxxp://toolbar.avg.com/acp?q={searchTerms}&o=1
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\42.0.2311.152\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\42.0.2311.152\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\42.0.2311.152\pdf.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 11.0\Reader\Browser\nppdf32.dll No File
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll No File
CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
CHR Plugin: (VLC Web Plugin) - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
CHR Profile: C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (YouTube) - C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-06-27]
CHR Extension: (Google Search) - C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-06-27]
CHR Extension: (Bookmark Manager) - C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2015-04-27]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-04-21]
CHR Extension: (Google Wallet) - C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-24]
CHR Extension: (Gmail) - C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-06-27]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

Locked "548bdadaaeecaa26" service could not be unlocked. <===== ATTENTION

S2 AVGIDSAgent; C:\Program Files\AVG\AVG2015\avgidsagent.exe [3438032 2015-04-15] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files\AVG\AVG2015\avgwdsvc.exe [311792 2015-04-15] (AVG Technologies CZ, s.r.o.)
S4 c2cautoupdatesvc; C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
S4 c2cpnrsvc; C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
S3 cphs; C:\Windows\system32\IntelCpHeciSvc.exe [276248 2012-03-06] (Intel Corporation)
S3 hpqcxs08; C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll [248832 2009-05-18] (Hewlett-Packard Co.) [File not signed]
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [458464 2012-02-02] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [162648 2012-03-15] (Intel Corporation)
S4 KMService; C:\Windows\system32\srvany.exe [8192 2013-04-13] () [File not signed]
S2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
U3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2009-07-13] (Microsoft Corporation)
S2 AntiVirMailService; "C:\Program Files\Avira\Antivirus\avmailc7.exe" [X]
S2 AntiVirSchedulerService; "C:\Program Files\Avira\Antivirus\sched.exe" [X]
S2 AntiVirService; "C:\Program Files\Avira\Antivirus\avguard.exe" [X]
S2 AntiVirWebService; "C:\Program Files\Avira\Antivirus\avwebg7.exe" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 amdide; C:\Windows\system32\drivers\amdide.sys [14912 2009-07-13] () [File not signed]
S3 AmdK8; C:\Windows\system32\DRIVERS\amdk8.sys [55296 2009-07-13] () [File not signed]
S3 AmdPPM; C:\Windows\system32\DRIVERS\amdppm.sys [52736 2009-07-13] () [File not signed]
S3 amdsata; C:\Windows\system32\drivers\amdsata.sys [80256 2010-11-20] () [File not signed]
S3 amdsbs; C:\Windows\system32\DRIVERS\amdsbs.sys [159312 2009-07-13] () [File not signed]
R0 amdxata; C:\Windows\System32\drivers\amdxata.sys [22400 2010-11-20] () [File not signed]
S3 AppID; C:\Windows\system32\drivers\appid.sys [50176 2010-11-20] () [File not signed]
S3 arc; C:\Windows\system32\DRIVERS\arc.sys [76368 2009-07-13] () [File not signed]
S3 arcsas; C:\Windows\system32\DRIVERS\arcsas.sys [86608 2009-07-13] () [File not signed]
S3 AsyncMac; C:\Windows\System32\DRIVERS\asyncmac.sys [17920 2009-07-13] () [File not signed]
R0 atapi; C:\Windows\System32\drivers\atapi.sys [21584 2009-07-13] () [File not signed]
S1 Avgdiskx; C:\Windows\System32\DRIVERS\avgdiskx.sys [132576 2015-03-11] () [File not signed]
S1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdriverx.sys [226784 2015-04-09] () [File not signed]
S0 AVGIDSHX; C:\Windows\System32\DRIVERS\avgidshx.sys [166880 2015-03-11] () [File not signed]
S1 AVGIDSShim; C:\Windows\System32\DRIVERS\avgidsshimx.sys [29664 2015-03-11] () [File not signed]
S1 Avgldx86; C:\Windows\System32\DRIVERS\avgldx86.sys [206816 2015-04-15] () [File not signed]
S0 Avglogx; C:\Windows\System32\DRIVERS\avglogx.sys [269792 2015-03-11] () [File not signed]
S0 Avgmfx86; C:\Windows\System32\DRIVERS\avgmfx86.sys [110048 2015-04-03] (AVG Technologies CZ, s.r.o.)
S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105864 2015-03-27] (Avira Operations GmbH & Co. KG)
S0 Avgrkx86; C:\Windows\System32\DRIVERS\avgrkx86.sys [35808 2015-03-20] () [File not signed]
S1 Avgtdix; C:\Windows\System32\DRIVERS\avgtdix.sys [213984 2015-04-07] () [File not signed]
S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2015-03-27] (Avira Operations GmbH & Co. KG)
S1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2015-03-27] (Avira Operations GmbH & Co. KG)
S2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [37896 2015-03-27] (Avira Operations GmbH & Co. KG)
S3 b06bdrv; C:\Windows\system32\DRIVERS\bxvbdx.sys [430080 2009-07-13] () [File not signed]
S3 b57nd60x; C:\Windows\System32\DRIVERS\b57nd60x.sys [229888 2009-07-13] () [File not signed]
R1 Beep; C:\Windows\system32\Drivers\Beep.sys [6144 2009-07-13] () [File not signed]
R1 blbdrive; C:\Windows\System32\DRIVERS\blbdrive.sys [35328 2009-07-13] () [File not signed]
R3 bowser; C:\Windows\System32\DRIVERS\bowser.sys [69632 2011-02-23] () [File not signed]
S3 BrFiltLo; C:\Windows\system32\DRIVERS\BrFiltLo.sys [13568 2009-07-13] () [File not signed]
S3 BrFiltUp; C:\Windows\system32\DRIVERS\BrFiltUp.sys [5248 2009-07-13] () [File not signed]
S3 Brserid; C:\Windows\System32\Drivers\Brserid.sys [272128 2009-07-13] () [File not signed]
S3 BrSerWdm; C:\Windows\System32\Drivers\BrSerWdm.sys [62336 2009-07-13] () [File not signed]
S3 BrUsbMdm; C:\Windows\System32\Drivers\BrUsbMdm.sys [12160 2009-07-13] () [File not signed]
S3 BrUsbSer; C:\Windows\System32\Drivers\BrUsbSer.sys [11904 2009-07-13] () [File not signed]
S3 BTHMODEM; C:\Windows\system32\DRIVERS\bthmodem.sys [56320 2009-07-13] () [File not signed]
S4 cdfs; C:\Windows\System32\DRIVERS\cdfs.sys [70656 2009-07-13] () [File not signed]
R1 cdrom; C:\Windows\System32\DRIVERS\cdrom.sys [108544 2010-11-20] () [File not signed]
S3 circlass; C:\Windows\system32\DRIVERS\circlass.sys [37888 2009-07-13] () [File not signed]
R0 CLFS; C:\Windows\System32\CLFS.sys [249408 2009-07-13] () [File not signed]
S3 CmBatt; C:\Windows\system32\DRIVERS\CmBatt.sys [14080 2009-07-13] () [File not signed]
S3 cmdide; C:\Windows\system32\drivers\cmdide.sys [15952 2009-07-13] () [File not signed]
R0 CNG; C:\Windows\System32\Drivers\cng.sys [369336 2012-06-02] () [File not signed]
S3 Compbatt; C:\Windows\system32\DRIVERS\compbatt.sys [19024 2009-07-13] () [File not signed]
R3 CompositeBus; C:\Windows\system32\drivers\CompositeBus.sys [31232 2010-11-20] () [File not signed]
S4 crcdisk; C:\Windows\system32\DRIVERS\crcdisk.sys [22096 2009-07-13] () [File not signed]
R1 CSC; C:\Windows\System32\drivers\csc.sys [388096 2010-11-20] () [File not signed]
R1 DfsC; C:\Windows\System32\Drivers\dfsc.sys [78336 2010-11-20] () [File not signed]
R1 discache; C:\Windows\System32\drivers\discache.sys [32256 2009-07-13] () [File not signed]
R0 Disk; C:\Windows\System32\DRIVERS\disk.sys [57424 2009-07-13] () [File not signed]
S3 drmkaud; C:\Windows\System32\drivers\drmkaud.sys [5120 2009-07-13] () [File not signed]
R3 DXGKrnl; C:\Windows\System32\drivers\dxgkrnl.sys [728448 2010-11-20] () [File not signed]
S3 ebdrv; C:\Windows\system32\DRIVERS\evbdx.sys [3100160 2009-07-13] () [File not signed]
S3 elxstor; C:\Windows\system32\DRIVERS\elxstor.sys [453712 2009-07-13] () [File not signed]
S3 ErrDev; C:\Windows\system32\drivers\errdev.sys [7168 2009-07-13] () [File not signed]
S3 exfat; C:\Windows\system32\Drivers\exfat.sys [142336 2009-07-13] () [File not signed]
S3 fastfat; C:\Windows\system32\Drivers\fastfat.sys [148480 2009-07-13] () [File not signed]
R3 fdc; C:\Windows\System32\DRIVERS\fdc.sys [25088 2009-07-13] () [File not signed]
R0 FileInfo; C:\Windows\System32\drivers\fileinfo.sys [58448 2009-07-13] () [File not signed]
S3 Filetrace; C:\Windows\System32\drivers\filetrace.sys [28160 2009-07-13] () [File not signed]
S3 flpydisk; C:\Windows\system32\DRIVERS\flpydisk.sys [19968 2009-07-13] () [File not signed]
R0 FltMgr; C:\Windows\System32\drivers\fltmgr.sys [198208 2009-07-13] () [File not signed]
S3 FsDepends; C:\Windows\System32\drivers\FsDepends.sys [46160 2009-07-13] () [File not signed]
U0 Fs_Rec; C:\Windows\system32\Drivers\Fs_Rec.sys [19824 2012-03-01] () [File not signed]
R0 fvevol; C:\Windows\System32\DRIVERS\fvevol.sys [194800 2010-11-20] () [File not signed]
S3 gagp30kx; C:\Windows\system32\DRIVERS\gagp30kx.sys [57936 2009-07-13] () [File not signed]
S3 hcw85cir; C:\Windows\system32\drivers\hcw85cir.sys [26624 2009-07-13] () [File not signed]
S3 HdAudAddService; C:\Windows\system32\drivers\HdAudio.sys [304128 2010-11-20] () [File not signed]
R3 HDAudBus; C:\Windows\system32\drivers\HDAudBus.sys [108544 2010-11-20] () [File not signed]
S3 HidBatt; C:\Windows\system32\DRIVERS\HidBatt.sys [21504 2009-07-13] () [File not signed]
S3 HidBth; C:\Windows\system32\DRIVERS\hidbth.sys [91136 2009-07-13] () [File not signed]
S3 HidIr; C:\Windows\system32\DRIVERS\hidir.sys [37888 2009-07-13] () [File not signed]
R3 HidUsb; C:\Windows\System32\DRIVERS\hidusb.sys [24064 2010-11-20] () [File not signed]
S3 HpSAMD; C:\Windows\system32\drivers\HpSAMD.sys [67152 2009-07-13] () [File not signed]
R3 HTTP; C:\Windows\System32\drivers\HTTP.sys [513536 2010-11-20] () [File not signed]
R0 hwpolicy; C:\Windows\System32\drivers\hwpolicy.sys [14208 2010-11-20] () [File not signed]
R3 i8042prt; C:\Windows\system32\drivers\i8042prt.sys [80896 2009-07-13] () [File not signed]
R0 iaStor; C:\Windows\System32\DRIVERS\iaStor.sys [470808 2011-11-29] () [File not signed]
S3 iaStorV; C:\Windows\system32\drivers\iaStorV.sys [332160 2010-11-20] () [File not signed]
R3 igfx; C:\Windows\System32\DRIVERS\igdkmd32.sys [13207552 2012-02-27] () [File not signed]
S3 iirsp; C:\Windows\system32\DRIVERS\iirsp.sys [41040 2009-07-13] () [File not signed]
R3 IntcAzAudAddService; C:\Windows\System32\drivers\RTKVHDA.sys [3919976 2011-12-06] () [File not signed]
S3 intelide; C:\Windows\system32\drivers\intelide.sys [15424 2009-07-13] () [File not signed]
R3 intelppm; C:\Windows\System32\DRIVERS\intelppm.sys [53760 2009-07-13] () [File not signed]
S3 IpFilterDriver; C:\Windows\System32\DRIVERS\ipfltdrv.sys [58880 2009-07-13] () [File not signed]
S3 IPMIDRV; C:\Windows\system32\drivers\IPMIDrv.sys [65536 2010-11-20] () [File not signed]
S3 IPNAT; C:\Windows\System32\drivers\ipnat.sys [101888 2009-07-13] () [File not signed]
S3 IRENUM; C:\Windows\System32\drivers\irenum.sys [13824 2009-07-13] () [File not signed]
S3 isapnp; C:\Windows\system32\drivers\isapnp.sys [46656 2009-07-13] () [File not signed]
S3 iScsiPrt; C:\Windows\system32\drivers\msiscsi.sys [233344 2010-11-20] () [File not signed]
R3 kbdclass; C:\Windows\system32\drivers\kbdclass.sys [42576 2009-07-13] () [File not signed]
S3 kbdhid; C:\Windows\system32\drivers\kbdhid.sys [28160 2010-11-20] () [File not signed]
R0 KSecDD; C:\Windows\System32\Drivers\ksecdd.sys [67440 2012-06-02] () [File not signed]
R0 KSecPkg; C:\Windows\System32\Drivers\ksecpkg.sys [134000 2012-06-02] () [File not signed]
R2 lltdio; C:\Windows\System32\DRIVERS\lltdio.sys [48128 2009-07-13] () [File not signed]
S3 LSI_FC; C:\Windows\system32\DRIVERS\lsi_fc.sys [95824 2009-07-13] () [File not signed]
S3 LSI_SAS; C:\Windows\system32\DRIVERS\lsi_sas.sys [89168 2009-07-13] () [File not signed]
S3 LSI_SAS2; C:\Windows\system32\DRIVERS\lsi_sas2.sys [54864 2009-07-13] () [File not signed]
S3 LSI_SCSI; C:\Windows\system32\DRIVERS\lsi_scsi.sys [96848 2009-07-13] () [File not signed]
R2 luafv; C:\Windows\system32\drivers\luafv.sys [86528 2009-07-13] () [File not signed]
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2015-04-14] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2015-04-14] (Malwarebytes Corporation)
S3 megasas; C:\Windows\system32\DRIVERS\megasas.sys [30800 2009-07-13] () [File not signed]
S3 MegaSR; C:\Windows\system32\DRIVERS\MegaSR.sys [235584 2009-07-13] () [File not signed]
R3 MEI; C:\Windows\System32\DRIVERS\HECI.sys [46080 2011-11-09] () [File not signed]
S3 Modem; C:\Windows\System32\drivers\modem.sys [31744 2009-07-13] () [File not signed]
R3 monitor; C:\Windows\System32\DRIVERS\monitor.sys [23552 2009-07-13] () [File not signed]
R3 mouclass; C:\Windows\System32\DRIVERS\mouclass.sys [41552 2009-07-13] () [File not signed]
R3 mouhid; C:\Windows\System32\DRIVERS\mouhid.sys [26112 2009-07-13] () [File not signed]
R0 mountmgr; C:\Windows\System32\drivers\mountmgr.sys [78208 2010-11-20] () [File not signed]
S3 mpio; C:\Windows\system32\drivers\mpio.sys [130432 2010-11-20] () [File not signed]
R3 mpsdrv; C:\Windows\System32\drivers\mpsdrv.sys [60416 2009-07-13] () [File not signed]
S3 MRxDAV; C:\Windows\system32\drivers\mrxdav.sys [115712 2010-11-20] () [File not signed]
R3 mrxsmb; C:\Windows\System32\DRIVERS\mrxsmb.sys [123904 2011-04-26] () [File not signed]
R3 mrxsmb10; C:\Windows\System32\DRIVERS\mrxsmb10.sys [223744 2011-07-08] () [File not signed]
R3 mrxsmb20; C:\Windows\System32\DRIVERS\mrxsmb20.sys [96768 2011-04-26] () [File not signed]
R0 msahci; C:\Windows\System32\drivers\msahci.sys [28032 2010-11-20] () [File not signed]
S3 msdsm; C:\Windows\system32\drivers\msdsm.sys [116096 2010-11-20] () [File not signed]
R1 Msfs; C:\Windows\system32\Drivers\Msfs.sys [22528 2009-07-13] ()
S3 mshidkmdf; C:\Windows\System32\drivers\mshidkmdf.sys [4096 2009-07-13] () [File not signed]
R0 msisadrv; C:\Windows\System32\drivers\msisadrv.sys [13888 2009-07-13] () [File not signed]
S3 MSKSSRV; C:\Windows\System32\drivers\MSKSSRV.sys [8320 2009-07-13] () [File not signed]
S3 MSPCLOCK; C:\Windows\System32\drivers\MSPCLOCK.sys [5888 2009-07-13] () [File not signed]
S3 MSPQM; C:\Windows\System32\drivers\MSPQM.sys [5504 2009-07-13] () [File not signed]
S3 MsRPC; C:\Windows\system32\Drivers\MsRPC.sys [162896 2009-07-13] () [File not signed]
R1 mssmbios; C:\Windows\system32\drivers\mssmbios.sys [28240 2009-07-13] () [File not signed]
S3 MSTEE; C:\Windows\System32\drivers\MSTEE.sys [6144 2009-07-13] () [File not signed]
S3 MTConfig; C:\Windows\system32\DRIVERS\MTConfig.sys [12288 2009-07-13] () [File not signed]
R0 Mup; C:\Windows\System32\Drivers\mup.sys [49728 2009-07-13] () [File not signed]
S3 NativeWifiP; C:\Windows\System32\DRIVERS\nwifi.sys [267264 2009-07-13] () [File not signed]
R0 NDIS; C:\Windows\System32\drivers\ndis.sys [712576 2010-11-20] () [File not signed]
S3 NdisCap; C:\Windows\System32\DRIVERS\ndiscap.sys [27136 2009-07-13] () [File not signed]
R3 NdisTapi; C:\Windows\System32\DRIVERS\ndistapi.sys [20992 2009-07-13] () [File not signed]
S3 Ndisuio; C:\Windows\System32\DRIVERS\ndisuio.sys [46080 2010-11-20] () [File not signed]
R3 NdisWan; C:\Windows\System32\DRIVERS\ndiswan.sys [118784 2010-11-20] () [File not signed]
R3 NDProxy; C:\Windows\system32\Drivers\NDProxy.sys [48640 2010-11-20] () [File not signed]
R1 NetBIOS; C:\Windows\System32\DRIVERS\netbios.sys [36352 2009-07-13] () [File not signed]
R1 NetBT; C:\Windows\System32\DRIVERS\netbt.sys [187904 2010-11-20] () [File not signed]
S3 nfrd960; C:\Windows\system32\DRIVERS\nfrd960.sys [44624 2009-07-13] () [File not signed]
R1 Npfs; C:\Windows\system32\Drivers\Npfs.sys [35328 2009-07-13] () [File not signed]
R1 nsiproxy; C:\Windows\System32\drivers\nsiproxy.sys [16896 2009-07-13] () [File not signed]
R3 Ntfs; C:\Windows\system32\Drivers\Ntfs.sys [1211264 2010-11-20] ()
R1 Null; C:\Windows\system32\Drivers\Null.sys [4608 2009-07-13] () [File not signed]
S3 nvraid; C:\Windows\system32\drivers\nvraid.sys [117120 2010-11-20] () [File not signed]
S3 nvstor; C:\Windows\system32\drivers\nvstor.sys [143744 2010-11-20] () [File not signed]
S3 nv_agp; C:\Windows\system32\drivers\nv_agp.sys [105024 2009-07-13] () [File not signed]
S3 ohci1394; C:\Windows\system32\drivers\ohci1394.sys [62464 2009-07-13] () [File not signed]
S3 Parport; C:\Windows\system32\DRIVERS\parport.sys [79360 2009-07-13] () [File not signed]
R0 partmgr; C:\Windows\System32\drivers\partmgr.sys [56176 2012-03-17] () [File not signed]
S2 Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [8704 2009-07-13] () [File not signed]
R0 pci; C:\Windows\System32\drivers\pci.sys [153984 2010-11-20] () [File not signed]
S3 pciide; C:\Windows\system32\drivers\pciide.sys [12368 2009-07-13] () [File not signed]
S3 pcmcia; C:\Windows\system32\DRIVERS\pcmcia.sys [180288 2009-07-13] () [File not signed]
R0 pcw; C:\Windows\System32\drivers\pcw.sys [43088 2009-07-13] () [File not signed]
R2 PEAUTH; C:\Windows\System32\drivers\peauth.sys [586752 2009-07-13] () [File not signed]
R3 PptpMiniport; C:\Windows\System32\DRIVERS\raspptp.sys [73728 2009-07-13] () [File not signed]
S3 Processor; C:\Windows\system32\DRIVERS\processr.sys [52224 2009-07-13] () [File not signed]
R1 Psched; C:\Windows\System32\DRIVERS\pacer.sys [104448 2009-07-13] () [File not signed]
S3 ql2300; C:\Windows\system32\DRIVERS\ql2300.sys [1383488 2009-07-13] () [File not signed]
S3 ql40xx; C:\Windows\system32\DRIVERS\ql40xx.sys [106064 2009-07-13] () [File not signed]
S3 QWAVEdrv; C:\Windows\system32\drivers\qwavedrv.sys [31744 2009-07-13] () [File not signed]
S3 RasAcd; C:\Windows\System32\DRIVERS\rasacd.sys [11776 2009-07-13] () [File not signed]
R3 RasAgileVpn; C:\Windows\System32\DRIVERS\AgileVpn.sys [49152 2009-07-13] () [File not signed]
R3 Rasl2tp; C:\Windows\System32\DRIVERS\rasl2tp.sys [78848 2009-07-13] () [File not signed]
R3 RasPppoe; C:\Windows\System32\DRIVERS\raspppoe.sys [77824 2009-07-13] () [File not signed]
R3 RasSstp; C:\Windows\System32\DRIVERS\rassstp.sys [75264 2009-07-13] () [File not signed]
R1 rdbss; C:\Windows\System32\DRIVERS\rdbss.sys [242688 2010-11-20] () [File not signed]
R3 rdpbus; C:\Windows\System32\DRIVERS\rdpbus.sys [18944 2009-07-13] () [File not signed]
R1 RDPCDD; C:\Windows\System32\DRIVERS\RDPCDD.sys [6656 2010-11-20] () [File not signed]
S3 RDPDR; C:\Windows\System32\drivers\rdpdr.sys [133632 2010-11-20] () [File not signed]
R1 RDPENCDD; C:\Windows\System32\drivers\rdpencdd.sys [6656 2009-07-13] () [File not signed]
R1 RDPREFMP; C:\Windows\System32\drivers\rdprefmp.sys [7168 2009-07-13] () [File not signed]
S3 RdpVideoMiniport; C:\Windows\System32\drivers\rdpvideominiport.sys [15872 2010-11-20] () [File not signed]
S3 RDPWD; C:\Windows\system32\Drivers\RDPWD.sys [183808 2012-04-28] () [File not signed]
R0 rdyboost; C:\Windows\System32\drivers\rdyboost.sys [173440 2010-11-20] () [File not signed]
R2 rspndr; C:\Windows\System32\DRIVERS\rspndr.sys [60928 2009-07-13] () [File not signed]
R3 RTL8167; C:\Windows\System32\DRIVERS\Rt86win7.sys [490088 2011-09-29] () [File not signed]
S3 s3cap; C:\Windows\system32\drivers\vms3cap.sys [5632 2010-11-20] () [File not signed]
S3 sbp2port; C:\Windows\system32\drivers\sbp2port.sys [85376 2010-11-20] () [File not signed]
S3 scfilter; C:\Windows\System32\DRIVERS\scfilter.sys [26624 2010-11-20] () [File not signed]
R2 secdrv; C:\Windows\system32\Drivers\secdrv.sys [20480 2009-07-13] () [File not signed]
R3 Serenum; C:\Windows\System32\DRIVERS\serenum.sys [17920 2009-07-13] () [File not signed]
R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [83456 2009-07-13] () [File not signed]
S3 sermouse; C:\Windows\system32\DRIVERS\sermouse.sys [19968 2009-07-13] () [File not signed]
S3 sffdisk; C:\Windows\system32\drivers\sffdisk.sys [11264 2009-07-13] () [File not signed]
S3 sffp_mmc; C:\Windows\system32\drivers\sffp_mmc.sys [12288 2009-07-13] () [File not signed]
S3 sffp_sd; C:\Windows\system32\drivers\sffp_sd.sys [12800 2010-11-20] () [File not signed]
S3 sfloppy; C:\Windows\system32\DRIVERS\sfloppy.sys [13824 2009-07-13] () [File not signed]
S3 sisagp; C:\Windows\system32\drivers\sisagp.sys [52304 2009-07-13] () [File not signed]
S3 SiSRaid2; C:\Windows\system32\DRIVERS\SiSRaid2.sys [40016 2009-07-13] () [File not signed]
S3 SiSRaid4; C:\Windows\system32\DRIVERS\sisraid4.sys [77888 2009-07-13] () [File not signed]
S3 Smb; C:\Windows\System32\DRIVERS\smb.sys [71168 2009-07-13] () [File not signed]
R0 spldr; C:\Windows\system32\Drivers\spldr.sys [17472 2009-07-13] () [File not signed]
R3 srv; C:\Windows\System32\DRIVERS\srv.sys [311808 2011-04-28] () [File not signed]
R3 srv2; C:\Windows\System32\DRIVERS\srv2.sys [310272 2011-04-28] () [File not signed]
R3 srvnet; C:\Windows\System32\DRIVERS\srvnet.sys [114688 2011-04-28] () [File not signed]
S1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2015-03-27] (Avira GmbH)
S3 stexstor; C:\Windows\system32\DRIVERS\stexstor.sys [21072 2009-07-13] () [File not signed]
R0 storflt; C:\Windows\System32\drivers\vmstorfl.sys [40704 2010-11-20] () [File not signed]
S3 storvsc; C:\Windows\system32\drivers\storvsc.sys [28032 2010-11-20] () [File not signed]
R3 swenum; C:\Windows\system32\drivers\swenum.sys [12240 2009-07-13] () [File not signed]
R0 Tcpip; C:\Windows\System32\drivers\tcpip.sys [1293672 2013-01-03] () [File not signed]
S3 TCPIP6; C:\Windows\System32\DRIVERS\tcpip.sys [1293672 2013-01-03] () [File not signed]
R2 tcpipreg; C:\Windows\System32\drivers\tcpipreg.sys [35328 2010-11-20] () [File not signed]
S3 TDPIPE; C:\Windows\System32\drivers\tdpipe.sys [18432 2010-11-20] () [File not signed]
S3 TDTCP; C:\Windows\System32\drivers\tdtcp.sys [24576 2012-02-17] () [File not signed]
R1 tdx; C:\Windows\System32\DRIVERS\tdx.sys [74752 2010-11-20] () [File not signed]
R1 TermDD; C:\Windows\system32\drivers\termdd.sys [53120 2010-11-20] () [File not signed]
S3 tssecsrv; C:\Windows\System32\DRIVERS\tssecsrv.sys [31232 2010-11-20] () [File not signed]
S3 TsUsbFlt; C:\Windows\System32\drivers\tsusbflt.sys [52224 2010-11-20] () [File not signed]
R3 tunnel; C:\Windows\System32\DRIVERS\tunnel.sys [108544 2010-11-20] () [File not signed]
S3 uagp35; C:\Windows\system32\DRIVERS\uagp35.sys [55888 2009-07-13] () [File not signed]
S4 udfs; C:\Windows\System32\DRIVERS\udfs.sys [246784 2010-11-20] () [File not signed]
S3 uliagpkx; C:\Windows\system32\drivers\uliagpkx.sys [57424 2009-07-13] () [File not signed]
R3 umbus; C:\Windows\system32\drivers\umbus.sys [39936 2010-11-20] () [File not signed]
S3 UmPass; C:\Windows\system32\DRIVERS\umpass.sys [8192 2009-07-13] () [File not signed]
S3 usbccgp; C:\Windows\System32\DRIVERS\usbccgp.sys [75776 2010-11-20] () [File not signed]
S3 usbcir; C:\Windows\system32\drivers\usbcir.sys [86016 2009-07-13] () [File not signed]
R3 usbehci; C:\Windows\system32\drivers\usbehci.sys [42496 2010-11-20] () [File not signed]
R3 usbhub; C:\Windows\system32\drivers\usbhub.sys [258560 2010-11-20] () [File not signed]
S3 usbohci; C:\Windows\system32\drivers\usbohci.sys [20480 2009-07-13] () [File not signed]
R3 usbprint; C:\Windows\System32\DRIVERS\usbprint.sys [19968 2009-07-13] () [File not signed]
R3 usbscan; C:\Windows\System32\DRIVERS\usbscan.sys [35840 2009-07-13] () [File not signed]
R3 USBSTOR; C:\Windows\System32\DRIVERS\USBSTOR.SYS [76288 2010-11-20] () [File not signed]
S3 usbuhci; C:\Windows\system32\drivers\usbuhci.sys [24064 2009-07-13] () [File not signed]
S3 usbvideo; C:\Windows\System32\Drivers\usbvideo.sys [146432 2010-11-20] () [File not signed]
R0 vdrvroot; C:\Windows\System32\drivers\vdrvroot.sys [32832 2009-07-13] () [File not signed]
S3 vga; C:\Windows\System32\DRIVERS\vgapnp.sys [26112 2009-07-13] () [File not signed]
R1 VgaSave; C:\Windows\System32\drivers\vga.sys [25088 2009-07-13] () [File not signed]
S3 vhdmp; C:\Windows\system32\drivers\vhdmp.sys [160128 2010-11-20] () [File not signed]
S3 viaagp; C:\Windows\system32\drivers\viaagp.sys [53328 2009-07-13] () [File not signed]
S3 ViaC7; C:\Windows\system32\DRIVERS\viac7.sys [52736 2009-07-13] () [File not signed]
S3 viaide; C:\Windows\system32\drivers\viaide.sys [16976 2009-07-13] () [File not signed]
R0 vmbus; C:\Windows\System32\drivers\vmbus.sys [175360 2010-11-20] () [File not signed]
S3 VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [17920 2010-11-20] () [File not signed]
R0 volmgr; C:\Windows\System32\drivers\volmgr.sys [53120 2010-11-20] () [File not signed]
R0 volmgrx; C:\Windows\System32\drivers\volmgrx.sys [297040 2009-07-13] () [File not signed]
R0 volsnap; C:\Windows\System32\drivers\volsnap.sys [245632 2010-11-20] () [File not signed]
S3 vsmraid; C:\Windows\system32\DRIVERS\vsmraid.sys [141904 2009-07-13] () [File not signed]
S3 vwifibus; C:\Windows\System32\drivers\vwifibus.sys [19968 2009-07-13] () [File not signed]
S3 WacomPen; C:\Windows\system32\DRIVERS\wacompen.sys [21632 2009-07-13] () [File not signed]
S3 WANARP; C:\Windows\System32\DRIVERS\wanarp.sys [63488 2010-11-20] () [File not signed]
R1 Wanarpv6; C:\Windows\System32\DRIVERS\wanarp.sys [63488 2010-11-20] () [File not signed]
S3 Wd; C:\Windows\system32\DRIVERS\wd.sys [19024 2009-07-13] () [File not signed]
R0 Wdf01000; C:\Windows\System32\drivers\Wdf01000.sys [445008 2009-07-13] () [File not signed]
R1 WfpLwf; C:\Windows\System32\DRIVERS\wfplwf.sys [9728 2009-07-13] () [File not signed]
S3 WIMMount; C:\Windows\System32\drivers\wimmount.sys [19008 2009-07-13] () [File not signed]
S3 WinUsb; C:\Windows\System32\DRIVERS\WinUsb.sys [35968 2010-11-20] () [File not signed]
S3 WmiAcpi; C:\Windows\system32\drivers\wmiacpi.sys [11264 2009-07-13] () [File not signed]
S4 ws2ifsl; C:\Windows\system32\drivers\ws2ifsl.sys [16384 2009-07-13] () [File not signed]
R3 WudfPf; C:\Windows\System32\drivers\WudfPf.sys [92672 2010-11-20] () [File not signed]
R3 WUDFRd; C:\Windows\System32\DRIVERS\WUDFRd.sys [132224 2010-11-20] () [File not signed]
U5 548bdadaaeecaa26; C:\Windows\System32\Drivers\548bdadaaeecaa26.sys [85632 2015-05-11] () <===== ATTENTION Necurs Rootkit?
U5 BattC; C:\Windows\System32\Drivers\BattC.sys [25168 2009-07-13] () [File not signed]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-05-13 14:00 - 2015-05-13 14:00 - 00036557 _____ () C:\Users\shaka\Downloads\FRST.txt
2015-05-13 14:00 - 2015-05-13 14:00 - 00000000 ____D () C:\FRST
2015-05-13 13:59 - 2015-05-13 13:59 - 01141248 _____ (Farbar) C:\Users\shaka\Downloads\FRST.exe
2015-05-13 13:59 - 2015-05-13 13:59 - 00014196 _____ () C:\Users\shaka\Downloads\defogger_disable.log
2015-05-13 13:59 - 2015-05-13 13:59 - 00000000 _____ () C:\Users\shaka\defogger_reenable
2015-05-13 13:58 - 2015-05-13 13:58 - 00050477 _____ () C:\Users\shaka\Downloads\Defogger.exe
2015-05-13 13:54 - 2015-05-13 13:54 - 00000000 ____D () C:\Program Files\ESET
2015-05-13 13:51 - 2015-05-13 13:51 - 02347384 _____ (ESET) C:\Users\shaka\Downloads\esetsmartinstaller_deu.exe
2015-05-13 13:16 - 2015-05-13 13:16 - 00000000 ____D () C:\Windows\system32\appmgmt
2015-05-13 12:42 - 2015-05-13 12:42 - 00001308 _____ () C:\Users\shaka\Desktop\AdwCleaner[S3].txt
2015-05-13 11:52 - 2015-05-13 11:52 - 00001190 _____ () C:\Users\shaka\Desktop\AdwCleaner[S2].txt
2015-05-13 11:36 - 2015-05-13 11:36 - 00000951 _____ () C:\Users\Public\Desktop\AVG 2015.lnk
2015-05-13 11:36 - 2015-05-13 11:36 - 00000000 ____D () C:\Users\shaka\AppData\Roaming\AVG2015
2015-05-13 11:36 - 2015-05-13 11:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
2015-05-13 11:35 - 2015-05-13 11:36 - 00000000 ____D () C:\ProgramData\AVG2015
2015-05-13 11:35 - 2015-05-13 11:35 - 00000000 ___HD () C:\$AVG
2015-05-13 11:34 - 2015-05-13 11:34 - 00000000 ____D () C:\Program Files\AVG
2015-05-13 11:33 - 2015-05-13 11:36 - 00000000 ____D () C:\Users\shaka\AppData\Local\Avg2015
2015-05-13 11:23 - 2015-05-13 11:33 - 171931928 _____ (AVG Technologies) C:\Users\shaka\Downloads\avg_free_x86_all_2015_ltst_222_5941 (1).exe
2015-05-13 10:41 - 2015-05-13 12:43 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-05-13 10:41 - 2015-05-13 10:41 - 00001060 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-05-13 10:41 - 2015-05-13 10:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-05-13 10:40 - 2015-05-13 10:41 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2015-05-13 10:40 - 2015-05-13 10:40 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-05-13 10:40 - 2015-04-14 09:37 - 00092888 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-05-13 10:40 - 2015-04-14 09:37 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-05-13 10:40 - 2015-04-14 09:37 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-05-13 10:34 - 2015-05-13 10:35 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\shaka\Desktop\mbam-setup-2.1.6.1022.exe
2015-05-13 10:24 - 2015-05-13 10:24 - 00001070 _____ () C:\Users\shaka\Desktop\AdwCleaner[S1].txt
2015-05-13 10:14 - 2015-05-13 10:14 - 00002624 _____ () C:\Users\shaka\Desktop\AdwCleaner[S0].txt
2015-05-13 10:13 - 2015-05-13 10:13 - 00000000 ____D () C:\Windows\pss
2015-05-13 09:47 - 2015-05-13 12:38 - 00000000 ____D () C:\AdwCleaner
2015-05-13 09:44 - 2015-05-13 09:45 - 02209792 _____ () C:\Users\shaka\Desktop\AdwCleaner_4.204.exe
2015-05-12 23:00 - 2015-05-13 11:06 - 00000000 ____D () C:\ProgramData\AVAST Software
2015-05-12 22:59 - 2015-05-12 23:00 - 05499960 _____ (Avast Software s.r.o.) C:\Users\shaka\Downloads\avast_free_antivirus_setup_online.exe
2015-05-12 20:37 - 2015-05-12 20:37 - 00000000 __SHD () C:\ProgramData\Windows Search 5.3.10
2015-05-12 17:58 - 2015-05-12 17:58 - 00008646 _____ () C:\Users\shaka\HELP_DECRYPT.HTML
2015-05-12 17:58 - 2015-05-12 17:58 - 00008646 _____ () C:\Users\shaka\Documents\HELP_DECRYPT.HTML
2015-05-12 17:58 - 2015-05-12 17:58 - 00004266 _____ () C:\Users\shaka\HELP_DECRYPT.TXT
2015-05-12 17:58 - 2015-05-12 17:58 - 00004266 _____ () C:\Users\shaka\Documents\HELP_DECRYPT.TXT
2015-05-12 17:58 - 2015-05-12 17:58 - 00000296 _____ () C:\Users\shaka\HELP_DECRYPT.URL
2015-05-12 17:58 - 2015-05-12 17:58 - 00000296 _____ () C:\Users\shaka\Documents\HELP_DECRYPT.URL
2015-05-12 13:53 - 2015-05-12 13:53 - 00000000 ____D () C:\Users\shaka\AppData\Roaming\Mozilla
2015-05-12 13:53 - 2015-05-12 13:53 - 00000000 ____D () C:\Users\shaka\AppData\Roaming\Avira
2015-05-12 13:52 - 2015-03-27 14:22 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys
2015-05-12 13:52 - 2015-03-27 14:21 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2015-05-12 13:52 - 2015-03-27 14:21 - 00105864 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2015-05-12 13:52 - 2015-03-27 14:21 - 00037896 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2015-05-12 13:52 - 2015-03-27 14:21 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2015-05-12 13:43 - 2015-05-12 22:53 - 00000000 ____D () C:\ProgramData\Avira
2015-05-12 13:41 - 2015-05-12 13:41 - 04734040 _____ (Avira Operations GmbH & Co. KG) C:\Users\shaka\Downloads\avira_es_av_55522e78a06f2__ws1.exe
2015-05-12 13:39 - 2015-05-12 13:39 - 00188416 _____ () C:\Users\shaka\AppData\Roaming\Setup.exe
2015-05-12 13:39 - 2015-05-12 13:39 - 00000293 _____ () C:\Users\shaka\AppData\Roaming\8178audayu1bjiao
2015-05-12 10:53 - 2015-05-12 10:53 - 00008646 _____ () C:\Users\shaka\AppData\Roaming\HELP_DECRYPT.HTML
2015-05-12 10:53 - 2015-05-12 10:53 - 00008646 _____ () C:\Users\shaka\AppData\Local\HELP_DECRYPT.HTML
2015-05-12 10:53 - 2015-05-12 10:53 - 00008646 _____ () C:\Users\shaka\AppData\HELP_DECRYPT.HTML
2015-05-12 10:53 - 2015-05-12 10:53 - 00004266 _____ () C:\Users\shaka\AppData\Roaming\HELP_DECRYPT.TXT
2015-05-12 10:53 - 2015-05-12 10:53 - 00004266 _____ () C:\Users\shaka\AppData\Local\HELP_DECRYPT.TXT
2015-05-12 10:53 - 2015-05-12 10:53 - 00004266 _____ () C:\Users\shaka\AppData\HELP_DECRYPT.TXT
2015-05-12 10:53 - 2015-05-12 10:53 - 00000296 _____ () C:\Users\shaka\AppData\Roaming\HELP_DECRYPT.URL
2015-05-12 10:53 - 2015-05-12 10:53 - 00000296 _____ () C:\Users\shaka\AppData\Local\HELP_DECRYPT.URL
2015-05-12 10:53 - 2015-05-12 10:53 - 00000296 _____ () C:\Users\shaka\AppData\HELP_DECRYPT.URL
2015-05-12 10:52 - 2015-05-12 10:52 - 00008646 _____ () C:\ProgramData\HELP_DECRYPT.HTML
2015-05-12 10:52 - 2015-05-12 10:52 - 00004266 _____ () C:\ProgramData\HELP_DECRYPT.TXT
2015-05-12 10:52 - 2015-05-12 10:52 - 00000296 _____ () C:\ProgramData\HELP_DECRYPT.URL
2015-05-11 11:14 - 2015-05-11 11:14 - 00085632 _____ () C:\Windows\system32\Drivers\548bdadaaeecaa26.sys
2015-05-11 11:13 - 2015-05-13 13:00 - 00000000 ___HD () C:\ProgramData\{D9E629DC-CB1C-4A97-9900-81922B4EFFD4}
2015-04-15 13:05 - 2015-04-15 13:05 - 00206816 _____ () C:\Windows\system32\Drivers\avgldx86.sys

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-05-13 13:59 - 2013-04-13 12:00 - 00000000 ____D () C:\Users\shaka
2015-05-13 13:31 - 2013-06-27 17:24 - 00001024 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-05-13 13:18 - 2009-07-14 01:34 - 00014720 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-05-13 13:18 - 2009-07-14 01:34 - 00014720 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-05-13 13:17 - 2013-06-27 17:24 - 00000000 ____D () C:\Users\shaka\AppData\Local\Google
2015-05-13 13:17 - 2013-06-27 17:24 - 00000000 ____D () C:\Program Files\Google
2015-05-13 13:16 - 2013-04-13 20:48 - 00000000 ____D () C:\ProgramData\Adobe
2015-05-13 13:11 - 2013-06-27 17:24 - 00001020 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-05-13 13:11 - 2013-04-13 19:52 - 00745992 _____ () C:\Windows\PFRO.log
2015-05-13 13:11 - 2009-07-14 01:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-05-13 13:11 - 2009-07-14 01:39 - 00064582 _____ () C:\Windows\setupact.log
2015-05-13 11:59 - 2013-04-13 20:37 - 00000000 ____D () C:\ProgramData\MFAData
2015-05-13 11:46 - 2009-07-14 05:57 - 00000000 ____D () C:\Windows\ShellNew
2015-05-13 11:33 - 2013-04-13 21:24 - 00000000 ____D () C:\Users\shaka\AppData\Roaming\Skype
2015-05-13 11:01 - 2009-07-14 05:43 - 00000000 ____D () C:\Windows\DigitalLocker
2015-05-13 10:49 - 2009-07-13 23:37 - 00000000 ____D () C:\Windows\tracing
2015-05-13 09:36 - 2013-04-13 12:01 - 01423566 _____ () C:\Windows\WindowsUpdate.log
2015-05-12 21:32 - 2013-04-13 19:34 - 00000000 ____D () C:\TempEI4
2015-05-12 20:18 - 2013-08-20 14:23 - 00000000 ____D () C:\Users\shaka\AppData\Roaming\Dropbox
2015-05-12 18:20 - 2013-04-22 15:19 - 00000000 ____D () C:\SRII
2015-05-12 18:17 - 2013-04-22 15:18 - 00000000 ____D () C:\Delta del Paraná
2015-05-12 18:03 - 2013-08-20 14:26 - 00000000 ___RD () C:\Users\shaka\Dropbox
2015-05-12 17:58 - 2013-04-17 11:01 - 00000000 ____D () C:\Users\shaka\Documents\Mis escaneos
2015-05-12 17:32 - 2015-03-16 09:55 - 00000000 ____D () C:\Users\shaka\Tracing
2015-05-12 15:33 - 2009-07-14 01:52 - 00000000 ____D () C:\Windows\system32\FxsTmp
2015-05-12 10:53 - 2014-02-27 13:52 - 00000000 ____D () C:\Users\shaka\AppData\Local\Skype
2015-05-12 10:53 - 2013-04-16 10:38 - 00000000 ____D () C:\Users\shaka\AppData\Local\HP
2015-05-12 10:53 - 2013-04-16 10:29 - 00000000 ____D () C:\Users\shaka\AppData\Roaming\Adobe
2015-05-12 10:53 - 2013-04-16 10:28 - 00000000 ____D () C:\Users\shaka\AppData\Roaming\HP
2015-05-12 10:52 - 2013-04-22 15:19 - 00000000 ____D () C:\Shaka
2015-05-12 10:52 - 2013-04-22 15:18 - 00000000 ____D () C:\Fuska
2015-05-05 14:28 - 2013-04-13 12:03 - 01530242 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-05-01 09:32 - 2013-04-13 21:24 - 00000000 ____D () C:\ProgramData\Skype

==================== Files in the root of some directories =======

2015-05-12 13:39 - 2015-05-12 13:39 - 0000293 _____ () C:\Users\shaka\AppData\Roaming\8178audayu1bjiao
2015-05-12 10:53 - 2015-05-12 10:53 - 0008646 _____ () C:\Users\shaka\AppData\Roaming\HELP_DECRYPT.HTML
2015-05-12 10:53 - 2015-05-12 10:53 - 0045436 _____ () C:\Users\shaka\AppData\Roaming\HELP_DECRYPT.PNG
2015-05-12 10:53 - 2015-05-12 10:53 - 0004266 _____ () C:\Users\shaka\AppData\Roaming\HELP_DECRYPT.TXT
2015-05-12 10:53 - 2015-05-12 10:53 - 0000296 _____ () C:\Users\shaka\AppData\Roaming\HELP_DECRYPT.URL
2015-02-06 16:39 - 2015-02-06 16:39 - 0000824 _____ () C:\Users\shaka\AppData\Roaming\my_stuff.gif
2015-02-06 16:40 - 2015-02-06 16:40 - 0000554 _____ () C:\Users\shaka\AppData\Roaming\re.gif
2015-05-12 13:39 - 2015-05-12 13:39 - 0188416 _____ () C:\Users\shaka\AppData\Roaming\Setup.exe
2015-05-12 10:53 - 2015-05-12 10:53 - 0008646 _____ () C:\Users\shaka\AppData\Local\HELP_DECRYPT.HTML
2015-05-12 10:53 - 2015-05-12 10:53 - 0045436 _____ () C:\Users\shaka\AppData\Local\HELP_DECRYPT.PNG
2015-05-12 10:53 - 2015-05-12 10:53 - 0004266 _____ () C:\Users\shaka\AppData\Local\HELP_DECRYPT.TXT
2015-05-12 10:53 - 2015-05-12 10:53 - 0000296 _____ () C:\Users\shaka\AppData\Local\HELP_DECRYPT.URL
2015-05-12 10:52 - 2015-05-12 10:52 - 0008646 _____ () C:\ProgramData\HELP_DECRYPT.HTML
2015-05-12 10:52 - 2015-05-12 10:52 - 0045436 _____ () C:\ProgramData\HELP_DECRYPT.PNG
2015-05-12 10:52 - 2015-05-12 10:52 - 0004266 _____ () C:\ProgramData\HELP_DECRYPT.TXT
2015-05-12 10:52 - 2015-05-12 10:52 - 0000296 _____ () C:\ProgramData\HELP_DECRYPT.URL
2013-04-16 10:17 - 2013-04-16 10:28 - 0000357 _____ () C:\ProgramData\hpzinstall.log

Some content of TEMP:
====================
C:\Users\shaka\AppData\Local\Temp\avgnt.exe
C:\Users\shaka\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpblnf9z.dll
C:\Users\shaka\AppData\Local\Temp\FlashPlayerUpdate.exe
C:\Users\shaka\AppData\Local\Temp\FP_AX_MSI_INSTALLER.exe
C:\Users\shaka\AppData\Local\Temp\ose00000.exe
C:\Users\shaka\AppData\Local\Temp\Quarantine.exe
C:\Users\shaka\AppData\Local\Temp\SkypeSetup.exe
C:\Users\shaka\AppData\Local\Temp\sqlite3.dll
C:\Users\shaka\AppData\Local\Temp\_is7D49.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys
[2013-04-15 08:10] - [2010-11-20 09:30] - 0245632 ____A () D41D8CD98F00B204E9800998ECF8427E

C:\Windows\system32\Drivers\volsnap.sys No Company Name <===== ATTENTION!



LastRegBack: 2015-05-05 12:12

==================== End Of Log ============================

Code:
# AdwCleaner v4.204 - Registro generado 13/05/2015 en 09:53:31
# Actualizado 12/05/2015 por Xplode
# Base de datos : 2015-05-12.2 [Local]
# Sistema operativo : Windows 7 Enterprise Service Pack 1 (x86)
# Nombre de usuario : shaka - OFICINA
# Ejecutado desde : C:\Users\shaka\Desktop\AdwCleaner_4.204.exe
# Opción : Limpiar

***** [ Servicios ] *****


***** [ Archivos / Carpetas ] *****

Carpeta Eliminar : C:\ProgramData\AVG Security Toolbar
Carpeta Eliminar : C:\ProgramData\Systweak
Carpeta Eliminar : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Advanced System Protector
Carpeta Eliminar : C:\Program Files\Advanced System Protector
Carpeta Eliminar : C:\Users\shaka\AppData\LocalLow\AVG Nation toolbar
Carpeta Eliminar : C:\Users\shaka\AppData\Roaming\Systweak
Carpeta Eliminar : C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\fcfenmboojpjinhpgggodefccipikbpd
Archivo Eliminar : C:\Windows\system32\roboot.exe
Archivo Eliminar : C:\Windows\system32\drivers\548bdadaaeecaa26.sys

***** [ Tareas programadas... ] *****

Tarea Eliminar : Advanced System Protector_startup

***** [ Accesos directos ] *****


***** [ Registro ] *****

Llave Eliminar : HKCU\Software\Google\Chrome\Extensions\fcfenmboojpjinhpgggodefccipikbpd
Llave Eliminar : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE
Llave Eliminar : HKLM\SOFTWARE\Classes\protector_dll.protectorbho
Llave Eliminar : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1
Llave Eliminar : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}
Llave Eliminar : HKLM\SOFTWARE\Classes\CLSID\{408CFAD9-8F13-4747-8EC7-770A339C7237}
Llave Eliminar : HKLM\SOFTWARE\Classes\CLSID\{459DD0F7-0D55-D3DC-67BC-E6BE37E9D762}
Llave Eliminar : HKLM\SOFTWARE\Classes\TypeLib\{07CAC314-E962-4F78-89AB-DD002F2490EE}
Llave Eliminar : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}
Llave Eliminar : HKCU\Software\systweak
Llave Eliminar : HKLM\SOFTWARE\systweak
Llave Eliminar : HKU\.DEFAULT\Software\AVG Nation toolbar

***** [ Navegadores Web ] *****

-\\ Internet Explorer v9.0.8112.16476


-\\ Mozilla Firefox v


-\\ Google Chrome v42.0.2311.135

[C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] - Eliminar [Extension] : fcfenmboojpjinhpgggodefccipikbpd

*************************

AdwCleaner[R0].txt - [2602 bytes] - [13/05/2015 09:48:42]
AdwCleaner[S0].txt - [2485 bytes] - [13/05/2015 09:53:31]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2544  bytes] ##########
Die Scans danach mit AdwCleaner

Code:
# AdwCleaner v4.204 - Registro generado 13/05/2015 en 10:18:46
# Actualizado 12/05/2015 por Xplode
# Base de datos : 2015-05-12.2 [Local]
# Sistema operativo : Windows 7 Enterprise Service Pack 1 (x86)
# Nombre de usuario : shaka - OFICINA
# Ejecutado desde : C:\Users\shaka\Desktop\AdwCleaner_4.204.exe
# Opción : Limpiar

***** [ Servicios ] *****


***** [ Archivos / Carpetas ] *****

Archivo Eliminar : C:\Windows\system32\drivers\548bdadaaeecaa26.sys

***** [ Tareas programadas... ] *****


***** [ Accesos directos ] *****


***** [ Registro ] *****


***** [ Navegadores Web ] *****

-\\ Internet Explorer v9.0.8112.16476


-\\ Mozilla Firefox v


-\\ Google Chrome v42.0.2311.135


*************************

AdwCleaner[R0].txt - [2602 bytes] - [13/05/2015 09:48:42]
AdwCleaner[R1].txt - [1012 bytes] - [13/05/2015 10:17:47]
AdwCleaner[S0].txt - [2624 bytes] - [13/05/2015 09:53:31]
AdwCleaner[S1].txt - [933 bytes] - [13/05/2015 10:18:46]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [991  bytes] ##########
Code:
# AdwCleaner v4.204 - Registro generado 13/05/2015 en 11:48:46
# Actualizado 12/05/2015 por Xplode
# Base de datos : 2015-05-12.2 [Local]
# Sistema operativo : Windows 7 Enterprise Service Pack 1 (x86)
# Nombre de usuario : shaka - OFICINA
# Ejecutado desde : C:\Users\shaka\Desktop\AdwCleaner_4.204.exe
# Opción : Limpiar

***** [ Servicios ] *****


***** [ Archivos / Carpetas ] *****

Archivo Eliminar : C:\Windows\system32\drivers\548bdadaaeecaa26.sys

***** [ Tareas programadas... ] *****


***** [ Accesos directos ] *****


***** [ Registro ] *****


***** [ Navegadores Web ] *****

-\\ Internet Explorer v9.0.8112.16476


-\\ Mozilla Firefox v


-\\ Google Chrome v42.0.2311.152


*************************

AdwCleaner[R0].txt - [2602 bytes] - [13/05/2015 09:48:42]
AdwCleaner[R1].txt - [1012 bytes] - [13/05/2015 10:17:47]
AdwCleaner[R2].txt - [1131 bytes] - [13/05/2015 11:47:51]
AdwCleaner[S0].txt - [2624 bytes] - [13/05/2015 09:53:31]
AdwCleaner[S1].txt - [1070 bytes] - [13/05/2015 10:18:46]
AdwCleaner[S2].txt - [1051 bytes] - [13/05/2015 11:48:46]

########## EOF - C:\AdwCleaner\AdwCleaner[S2].txt - [1110  bytes] ##########
Code:
# AdwCleaner v4.204 - Registro generado 13/05/2015 en 12:38:14
# Actualizado 12/05/2015 por Xplode
# Base de datos : 2015-05-12.2 [Local]
# Sistema operativo : Windows 7 Enterprise Service Pack 1 (x86)
# Nombre de usuario : shaka - OFICINA
# Ejecutado desde : C:\Users\shaka\Desktop\AdwCleaner_4.204.exe
# Opción : Limpiar

***** [ Servicios ] *****


***** [ Archivos / Carpetas ] *****

Archivo Eliminar : C:\Windows\system32\drivers\548bdadaaeecaa26.sys

***** [ Tareas programadas... ] *****


***** [ Accesos directos ] *****


***** [ Registro ] *****


***** [ Navegadores Web ] *****

-\\ Internet Explorer v9.0.8112.16476


-\\ Mozilla Firefox v


-\\ Google Chrome v42.0.2311.152


*************************

AdwCleaner[R0].txt - [2602 bytes] - [13/05/2015 09:48:42]
AdwCleaner[R1].txt - [1012 bytes] - [13/05/2015 10:17:47]
AdwCleaner[R2].txt - [1131 bytes] - [13/05/2015 11:47:51]
AdwCleaner[R3].txt - [1249 bytes] - [13/05/2015 12:37:33]
AdwCleaner[S0].txt - [2624 bytes] - [13/05/2015 09:53:31]
AdwCleaner[S1].txt - [1070 bytes] - [13/05/2015 10:18:46]
AdwCleaner[S2].txt - [1190 bytes] - [13/05/2015 11:48:46]
AdwCleaner[S3].txt - [1169 bytes] - [13/05/2015 12:38:14]

########## EOF - C:\AdwCleaner\AdwCleaner[S3].txt - [1228  bytes] ##########

schrauber 13.05.2015 19:07
hi,


Downloade dir bitte Malwarebytes Anti-Rootkit Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
  • Starte bitte die mbar.exe.
  • Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
  • Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
  • Klicke auf den CleanUp Button und erlaube den Neustart.
  • Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
  • Nach dem Neustart starte die mbar.exe erneut.
  • Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.
Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers

Downloade dir bitte TDSSKiller TDSSKiller.exe und speichere diese Datei auf dem Desktop
  • Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
  • Drücke Start Scan
  • Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
    TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
    Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt
Poste den Inhalt bitte in jedem Fall hier in deinen Thread.

chrischl 13.05.2015 19:24
Wow.. das ging schnell...
Habe hier noch den ESET Scan
Code:
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=a79c92b35fafac48a561db3ab97d71b8
# engine=23831
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2015-05-13 05:47:05
# local_time=2015-05-13 02:47:05 (-0300, Hora estándar de Argentina)
# country="Argentina"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='AVG AntiVirus Free Edition 2015'
# compatibility_mode=1055 16777213 100 100 0 117733609 0 0
# scanned=101861
# found=186
# cleaned=0
# scan_time=1283
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\$Recycle.Bin\S-1-5-21-248733116-1412973945-2583540736-1000\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\$Recycle.Bin\S-1-5-21-248733116-1412973945-2583540736-1000\HELP_DECRYPT.TXT"
sh=05BBF923EFFC0CEAC46F97D7A4338AE75A00C02D ft=1 fh=bf0cf04aa4aad68d vn="MSIL/AdvancedSystemProtector.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Advanced System Protector\Troubleshooter\asp-fixer.scr.vir"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\shaka\AppData\Roaming\Systweak\HELP_DECRYPT.HTML.vir"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\shaka\AppData\Roaming\Systweak\HELP_DECRYPT.TXT.vir"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\shaka\AppData\Roaming\Systweak\Advanced System Protector\HELP_DECRYPT.HTML.vir"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\shaka\AppData\Roaming\Systweak\Advanced System Protector\HELP_DECRYPT.TXT.vir"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\shaka\AppData\Roaming\Systweak\Advanced System Protector\2.1.1000.10843\HELP_DECRYPT.HTML.vir"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\shaka\AppData\Roaming\Systweak\Advanced System Protector\2.1.1000.10843\HELP_DECRYPT.TXT.vir"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\shaka\AppData\Roaming\Systweak\Advanced System Protector\2.1.1000.10844\HELP_DECRYPT.HTML.vir"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\shaka\AppData\Roaming\Systweak\Advanced System Protector\2.1.1000.10844\HELP_DECRYPT.TXT.vir"
sh=4D02516E5ACE56387898DD5EEA8DA2A2D1C147DF ft=1 fh=16b7d4b433d0db89 vn="Variante von Win32/Systweak.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Windows\system32\roboot.exe.vir"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Fuska\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Fuska\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Fuska\Senasa\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Fuska\Senasa\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\ProgramData\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\ProgramData\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\ProgramData\Microsoft\RAC\PublishedData\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\ProgramData\Microsoft\RAC\PublishedData\HELP_DECRYPT.TXT"
sh=FD53A075E6D1F403845DFDE3CA750DC7B199F007 ft=1 fh=e4605efa7de73b8c vn="Variante von Generik.KKTSQUD Trojaner" ac=I fn="C:\ProgramData\Windows Search 5.3.10\5mk1owasew99.exe"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Shaka\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Shaka\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Shaka\Rivera\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Shaka\Rivera\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Shaka\Trabajos\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Shaka\Trabajos\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Shaka\Trabajos\Eugenio\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Shaka\Trabajos\Eugenio\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Shaka\Trabajos\JGF\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Shaka\Trabajos\JGF\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Shaka\Trabajos\JGF\La Salamandra\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Shaka\Trabajos\JGF\La Salamandra\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\All Users\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\All Users\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\All Users\Microsoft\RAC\PublishedData\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\All Users\Microsoft\RAC\PublishedData\HELP_DECRYPT.TXT"
sh=FD53A075E6D1F403845DFDE3CA750DC7B199F007 ft=1 fh=e4605efa7de73b8c vn="Variante von Generik.KKTSQUD Trojaner" ac=I fn="C:\Users\All Users\Windows Search 5.3.10\5mk1owasew99.exe"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Google\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Google\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Google\Chrome\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Google\Chrome\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Google\Chrome\User Data\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Google\Chrome\User Data\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg\0.3.0.2_0\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg\0.3.0.2_0\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg\0.3.0.2_0\audio\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg\0.3.0.2_0\audio\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\HP\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\HP\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\HP\Digital Imaging\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\HP\Digital Imaging\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\HP\Digital Imaging\cache2\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\HP\Digital Imaging\cache2\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\HP\Digital Imaging\db2\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\HP\Digital Imaging\db2\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\HP\Digital Imaging\vault\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\HP\Digital Imaging\vault\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Microsoft\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Microsoft\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Microsoft\Device Metadata\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Microsoft\Device Metadata\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Microsoft\Internet Explorer\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Microsoft\Internet Explorer\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Microsoft\Media Player\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Microsoft\Media Player\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Microsoft\Media Player\Caché de imágenes\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Microsoft\Media Player\Caché de imágenes\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Microsoft\Media Player\Caché de imágenes\LocalMLS\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Microsoft\Media Player\Caché de imágenes\LocalMLS\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Microsoft\Windows Mail\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Microsoft\Windows Mail\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Microsoft\Windows Mail\Backup\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Microsoft\Windows Mail\Backup\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Microsoft\Windows Mail\Backup\old\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Microsoft\Windows Mail\Backup\old\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Microsoft\Windows Mail\Stationery\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Microsoft\Windows Mail\Stationery\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Microsoft\Windows Media\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Microsoft\Windows Media\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Microsoft\Windows Media\12.0\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Microsoft\Windows Media\12.0\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Skype\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Skype\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Skype\Apps\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Skype\Apps\HELP_DECRYPT.TXT"
sh=BB5F8CACFFD9BBE297F73922F6B2F185A8A585F3 ft=1 fh=b373d2bec851b530 vn="Win32/Injector.CAJK Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Temp\nsf7A01.tmp\lashers.dll"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\LocalLow\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\LocalLow\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\LocalLow\Google\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\LocalLow\Google\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\LocalLow\Google\GoogleEarth\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\LocalLow\Google\GoogleEarth\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\LocalLow\Google\GoogleEarth\unified_cache_leveldb_leveldb2\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\LocalLow\Google\GoogleEarth\unified_cache_leveldb_leveldb2\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Adobe\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Adobe\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Adobe\Flash Player\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Adobe\Flash Player\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Adobe\Flash Player\AssetCache\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Adobe\Flash Player\AssetCache\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Adobe\Flash Player\AssetCache\N4DTGKAY\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Adobe\Flash Player\AssetCache\N4DTGKAY\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Dropbox\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Dropbox\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Dropbox\bin\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Dropbox\bin\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Dropbox\instance1\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Dropbox\instance1\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\HP\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\HP\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\HP\WebRegLogs\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\HP\WebRegLogs\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Microsoft\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Microsoft\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Microsoft\Document Building Blocks\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Microsoft\Document Building Blocks\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Microsoft\Document Building Blocks\3082\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Microsoft\Document Building Blocks\3082\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Microsoft\Document Building Blocks\3082\14\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Microsoft\Document Building Blocks\3082\14\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\emo_cache\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\emo_cache\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\emo_cache\asyncdb\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\emo_cache\asyncdb\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\media_cache\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\media_cache\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\media_cache\asyncdb\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\media_cache\asyncdb\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\storage_db\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\storage_db\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\storage_db\asyncdb\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\storage_db\asyncdb\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\qikdb\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\qikdb\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\cadopa\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\cadopa\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\emo_cache\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\emo_cache\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\emo_cache\asyncdb\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\emo_cache\asyncdb\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\media_cache\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\media_cache\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\media_cache\asyncdb\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\media_cache\asyncdb\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\storage_db\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\storage_db\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\storage_db\asyncdb\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\storage_db\asyncdb\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\cadopa\qikdb\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\cadopa\qikdb\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\patricia.guimaraens\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\patricia.guimaraens\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\shared_httpfe\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\shared_httpfe\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\Documents\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\Documents\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\Documents\Mis escaneos\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\Documents\Mis escaneos\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Windows\pss\HELP_DECRYPT.HTML.Startup"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Windows\pss\HELP_DECRYPT.TXT.Startup"
sh=7F29C65D27184E6C1E65253A19154568335D994C ft=1 fh=8dfecc9f0b4d34d4 vn="Win32/AdvancedSystemProtector.A evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\System32\sasnative32.exe"
Den Rest mach ich gleich...

mhmm... Bevor der Scan mit Anti Rootkit losgehen konnte hies es :

Der DDA Treiber konnte nicht gefunden werden. Der Scan wird nach dem Neustart und der Suche nach dem Treiber fortgefuehrt..
Soll ich Neustarten??

chrischl 13.05.2015 20:39
ok.. Neustart gemacht und Das ist von mbar
1.Scan:
Code:
Malwarebytes Anti-Rootkit BETA 1.09.1.1004
www.malwarebytes.org

Database version:
  main:    v2015.05.13.04
  rootkit: v2015.04.21.01

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
shaka :: OFICINA [administrator]

13/05/2015 03:29:14 p.m.
mbar-log-2015-05-13 (15-29-14).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 301283
Time elapsed: 15 minute(s), 19 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 2
C:\WINDOWS\SYSTEM32\drivers\548bdadaaeecaa26.sys (Rootkit.Necurs.R.32) -> Delete on reboot. [d366c589e13d31d16804053c50a45bfb]
C:\Users\shaka\AppData\Local\Temp\nsf7A01.tmp\lashers.dll (Trojan.Injector.ED) -> Delete on reboot. [0127f3a0a5e583b3bf74c648e125946c]

Physical Sectors Detected: 0
(No malicious items detected)

(end)
Das dann der 2.Scan:

Code:
Malwarebytes Anti-Rootkit BETA 1.09.1.1004
www.malwarebytes.org

Database version:
  main:    v2015.05.13.05
  rootkit: v2015.04.21.01

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
shaka :: OFICINA [administrator]

13/05/2015 03:50:56 p.m.
mbar-log-2015-05-13 (15-50-56).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 301886
Time elapsed: 29 minute(s), 3 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)

Das von TDSS:
Code:
16:24:30.0350 0x0d18  TDSS rootkit removing tool 3.0.0.44 Jan 22 2015 08:27:04
16:24:40.0880 0x0d18  ============================================================
16:24:40.0880 0x0d18  Current date / time: 2015/05/13 16:24:40.0880
16:24:40.0880 0x0d18  SystemInfo:
16:24:40.0880 0x0d18 
16:24:40.0880 0x0d18  OS Version: 6.1.7601 ServicePack: 1.0
16:24:40.0880 0x0d18  Product type: Workstation
16:24:40.0880 0x0d18  ComputerName: OFICINA
16:24:40.0880 0x0d18  UserName: shaka
16:24:40.0880 0x0d18  Windows directory: C:\Windows
16:24:40.0880 0x0d18  System windows directory: C:\Windows
16:24:40.0880 0x0d18  Processor architecture: Intel x86
16:24:40.0880 0x0d18  Number of processors: 2
16:24:40.0880 0x0d18  Page size: 0x1000
16:24:40.0880 0x0d18  Boot type: Normal boot
16:24:40.0880 0x0d18  ============================================================
16:24:41.0098 0x0d18  KLMD registered as C:\Windows\system32\drivers\39566488.sys
16:24:41.0332 0x0d18  System UUID: {B5FCADAE-8C93-00C5-DD55-D9EC1F27C40C}
16:24:41.0676 0x0d18  Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 ( 465.76 Gb ), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
16:24:41.0676 0x0d18  ============================================================
16:24:41.0676 0x0d18  \Device\Harddisk0\DR0:
16:24:41.0676 0x0d18  MBR partitions:
16:24:41.0676 0x0d18  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000
16:24:41.0676 0x0d18  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x3A353000
16:24:41.0676 0x0d18  ============================================================
16:24:41.0707 0x0d18  C: <-> \Device\Harddisk0\DR0\Partition2
16:24:41.0707 0x0d18  ============================================================
16:24:41.0707 0x0d18  Initialize success
16:24:41.0707 0x0d18  ============================================================
16:25:23.0889 0x052c  ============================================================
16:25:23.0889 0x052c  Scan started
16:25:23.0889 0x052c  Mode: Manual; SigCheck; TDLFS;
16:25:23.0889 0x052c  ============================================================
16:25:23.0889 0x052c  KSN ping started
16:25:37.0805 0x052c  KSN ping finished: true
16:25:38.0725 0x052c  ================ Scan system memory ========================
16:25:38.0725 0x052c  System memory - ok
16:25:38.0725 0x052c  ================ Scan services =============================
16:25:38.0943 0x052c  [ 1B133875B8AA8AC48969BD3458AFE9F5, 01753BDD47F3F9BC0E0D23A069B9C56D4AE6A6B6295BC19B95AE245D25B12744 ] 1394ohci        C:\Windows\system32\drivers\1394ohci.sys
16:25:39.0037 0x052c  1394ohci - ok
16:25:39.0084 0x052c  [ CEA80C80BED809AA0DA6FEBC04733349, AE69C142DC2210A4AE657C23CEA4A6E7CB32C4F4EBA039414123CAC52157509B ] ACPI            C:\Windows\system32\drivers\ACPI.sys
16:25:39.0099 0x052c  ACPI - ok
16:25:39.0115 0x052c  [ 1EFBC664ABFF416D1D07DB115DCB264F, BF94D069D692140B792DBF4FD3CB0127D27C26CC5BFB6B0C28A8B6346767EE58 ] AcpiPmi        C:\Windows\system32\drivers\acpipmi.sys
16:25:39.0193 0x052c  AcpiPmi - ok
16:25:39.0224 0x052c  [ 21E785EBD7DC90A06391141AAC7892FB, A2D3D764C5E6DC0AD5AAF48485FFB8B121D2A40DC08ECF2D2CB92278A1002B25 ] adp94xx        C:\Windows\system32\DRIVERS\adp94xx.sys
16:25:39.0255 0x052c  adp94xx - ok
16:25:39.0287 0x052c  [ 0C676BC278D5B59FF5ABD57BBE9123F2, 339E8A433D186BAAB6FCB44C82CC9FB6FCD63C87981449494CBEB2072CB6B7BB ] adpahci        C:\Windows\system32\DRIVERS\adpahci.sys
16:25:39.0302 0x052c  adpahci - ok
16:25:39.0318 0x052c  [ 7C7B5EE4B7B822EC85321FE23A27DB33, A934AFB71D439555E6376DA9B34F82E8D39A300A4547BE9AC9311F6A3C36270C ] adpu320        C:\Windows\system32\DRIVERS\adpu320.sys
16:25:39.0318 0x052c  adpu320 - ok
16:25:39.0349 0x052c  [ 8B5EEFEEC1E6D1A72A06C526628AD161, 026CDF4C96F4D493E7BABF79A14C4B0B5ADCCEF0B081FFFA2E3B243B2414167F ] AeLookupSvc    C:\Windows\System32\aelupsvc.dll
16:25:39.0365 0x052c  AeLookupSvc - ok
16:25:39.0411 0x052c  [ 9EBBBA55060F786F0FCAA3893BFA2806, 2E5A0FA2995989E9391771024839F5AD040A041CEE56787286D8FC421E26FE90 ] AFD            C:\Windows\system32\drivers\afd.sys
16:25:39.0443 0x052c  AFD - ok
16:25:39.0474 0x052c  [ 507812C3054C21CEF746B6EE3D04DD6E, D7E59350AC338AD229E3D10C76E32AE16D120311B263714A9CD94AB538633B0E ] agp440          C:\Windows\system32\drivers\agp440.sys
16:25:39.0489 0x052c  agp440 - ok
16:25:39.0521 0x052c  [ 8B30250D573A8F6B4BD23195160D8707, 64EC289AFCD63D84EAFD9D81C50D0A77BCC79A1EFF32C50B2776BB0C0151757D ] aic78xx        C:\Windows\system32\DRIVERS\djsvs.sys
16:25:39.0536 0x052c  aic78xx - ok
16:25:39.0567 0x052c  [ 18A54E132947CD98FEA9ACCC57F98F13, 9D39AF972785E49F0DD12C4BAEF39A79CD69F098886BF152AF1B7CCE2E902115 ] ALG            C:\Windows\System32\alg.exe
16:25:39.0567 0x052c  ALG - ok
16:25:39.0599 0x052c  [ 0D40BCF52EA90FC7DF2AEAB6503DEA44, 1D1AA8F50935D976C29DE7A84708CADBBBDD936F0DD2C059E820F0D21367B3B6 ] aliide          C:\Windows\system32\drivers\aliide.sys
16:25:39.0614 0x052c  aliide - ok
16:25:39.0645 0x052c  [ 3C6600A0696E90A463771C7422E23AB5, 370B33DC1C25B981628A318BAE434A78A5F0A0DA93C2896DC7A3D7B87AE1A5E7 ] amdagp          C:\Windows\system32\drivers\amdagp.sys
16:25:39.0661 0x052c  amdagp - ok
16:25:39.0692 0x052c  [ CD5914170297126B6266860198D1D4F0, 2239FCBD1A7EC27CE4F10DA36AE6BD6CCB87E5128C82CA71B84BFE5AF5602A60 ] amdide          C:\Windows\system32\drivers\amdide.sys
16:25:39.0708 0x052c  amdide - ok
16:25:39.0723 0x052c  [ 00DDA200D71BAC534BF56A9DB5DFD666, CA316B1FFD85BA1CF8664B3229DA1F238A5341E016059F7ED89702324CFD124B ] AmdK8          C:\Windows\system32\DRIVERS\amdk8.sys
16:25:39.0755 0x052c  AmdK8 - ok
16:25:39.0755 0x052c  [ 3CBF30F5370FDA40DD3E87DF38EA53B6, 7EACF1743367BE805357B6FD10F8F99E9B1C301FE3782D77719347B13DFA65EC ] AmdPPM          C:\Windows\system32\DRIVERS\amdppm.sys
16:25:39.0786 0x052c  AmdPPM - ok
16:25:39.0817 0x052c  [ E7F4D42D8076EC60E21715CD11743A0D, 91AC020A70964F8783C999BDE8AB8391A3FA3AFC1CD4BC52A43625A2010A53E7 ] amdsata        C:\Windows\system32\drivers\amdsata.sys
16:25:39.0833 0x052c  amdsata - ok
16:25:39.0848 0x052c  [ EA43AF0C423FF267355F74E7A53BDABA, 3F1335909AB0281A2FBDD7AD90E18309E091656CD32B48894B992789D8C61DB4 ] amdsbs          C:\Windows\system32\DRIVERS\amdsbs.sys
16:25:39.0864 0x052c  amdsbs - ok
16:25:39.0879 0x052c  [ 146459D2B08BFDCBFA856D9947043C81, AC7F2069717601F949B0968EA651899D497170A93B84281B66D3CE5C382DDECB ] amdxata        C:\Windows\system32\drivers\amdxata.sys
16:25:39.0895 0x052c  amdxata - ok
16:25:39.0926 0x052c  AntiVirMailService - ok
16:25:39.0926 0x052c  AntiVirSchedulerService - ok
16:25:39.0926 0x052c  AntiVirService - ok
16:25:39.0926 0x052c  AntiVirWebService - ok
16:25:39.0957 0x052c  [ AEA177F783E20150ACE5383EE368DA19, 8FA9EE27AA1F22E8B8FE33A21028CA1E0062BAA95CB132C20D55B98C03B4254F ] AppID          C:\Windows\system32\drivers\appid.sys
16:25:40.0035 0x052c  AppID - ok
16:25:40.0067 0x052c  [ 62A9C86CB6085E20DB4823E4E97826F5, E0F840B49710022C4FB437002AD06F64B0F6B5D628B32D00F2B66765E6B97E4B ] AppIDSvc        C:\Windows\System32\appidsvc.dll
16:25:40.0098 0x052c  AppIDSvc - ok
16:25:40.0129 0x052c  [ FB1959012294D6AD43E5304DF65E3C26, CFE906B07FF71A178CF9C254B056C6F5A303DDC511F0E4E1E75808F1D5326495 ] Appinfo        C:\Windows\System32\appinfo.dll
16:25:40.0145 0x052c  Appinfo - ok
16:25:40.0176 0x052c  [ A45D184DF6A8803DA13A0B329517A64A, C1D16B60A6D69689AE951DC3D6884ED2E233D144B3FC0B86BC1C50AAAAA01ED2 ] AppMgmt        C:\Windows\System32\appmgmts.dll
16:25:40.0191 0x052c  AppMgmt - ok
16:25:40.0223 0x052c  [ 2932004F49677BD84DBC72EDB754FFB3, 73F84582244AC53994A2F4499A119B4A84A6BF7FD3046C29A8080C763DE540B8 ] arc            C:\Windows\system32\DRIVERS\arc.sys
16:25:40.0238 0x052c  arc - ok
16:25:40.0269 0x052c  [ 5D6F36C46FD283AE1B57BD2E9FEB0BC7, F7C9C3B4F2C816F57A43B2921672858C291054220BADE291044343778216F6BA ] arcsas          C:\Windows\system32\DRIVERS\arcsas.sys
16:25:40.0285 0x052c  arcsas - ok
16:25:40.0301 0x052c  [ ADD2ADE1C2B285AB8378D2DAAF991481, 7965A705F37924C0EC7A934E64E89C5DF4069816E2EEA3509E0AC90F78910519 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys
16:25:40.0394 0x052c  AsyncMac - ok
16:25:40.0441 0x052c  [ 338C86357871C167A96AB976519BF59E, F28CC534523D1701B0552F5D7E18E88369C4218BDB1F69110C3E31D395884AD6 ] atapi          C:\Windows\system32\drivers\atapi.sys
16:25:40.0457 0x052c  atapi - ok
16:25:40.0503 0x052c  [ CE3B4E731638D2EF62FCB419BE0D39F0, 3B98179CB0101778D9E7810D2CD46D9C0D7120E141BA11471666E7D9EB3C93CC ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
16:25:40.0550 0x052c  AudioEndpointBuilder - ok
16:25:40.0550 0x052c  [ CE3B4E731638D2EF62FCB419BE0D39F0, 3B98179CB0101778D9E7810D2CD46D9C0D7120E141BA11471666E7D9EB3C93CC ] Audiosrv        C:\Windows\System32\Audiosrv.dll
16:25:40.0581 0x052c  Audiosrv - ok
16:25:40.0644 0x052c  [ 6FF619B5DD6C05DB3D8BA4888EE06B03, 945FC37D86BE7B2B81276988EBD78FB24300F330625134058A8AE6D3FBC44E60 ] Avgdiskx        C:\Windows\system32\DRIVERS\avgdiskx.sys
16:25:40.0675 0x052c  Avgdiskx - ok
16:25:40.0831 0x052c  [ ADDD8FF660E3758A4D3C6B47EE71356E, 4B49F4EB513A9DCFB3AD1C0B0105BE913D1B3FB2C2603C7A37DFF4E4FBAE7E53 ] AVGIDSAgent    C:\Program Files\AVG\AVG2015\avgidsagent.exe
16:25:40.0909 0x052c  AVGIDSAgent - ok
16:25:40.0956 0x052c  [ D060A39BFD1C95A4A1CEDCEFBD8BEF89, DC3BFB4A818706C6C74AFAB62A84DFEE0656956300EADC6F71F66E5AEAC47C6B ] AVGIDSDriver    C:\Windows\system32\DRIVERS\avgidsdriverx.sys
16:25:40.0987 0x052c  AVGIDSDriver - ok
16:25:40.0987 0x052c  [ 4EA0B18E82A51154467CD6A1DB5D2771, 63A78ADE7F23AFBEC991E2FD33C451CFAB50C39DFD75EC41388E81873BB3BEF5 ] AVGIDSHX        C:\Windows\system32\DRIVERS\avgidshx.sys
16:25:41.0018 0x052c  AVGIDSHX - ok
16:25:41.0034 0x052c  [ 120A658BF7CEF020E512D732A439DE0F, CF1EAEE2A506B86C6144DD40DAF62A5F08B1E1E2C364663EA19FF1C447FD0D1A ] AVGIDSShim      C:\Windows\system32\DRIVERS\avgidsshimx.sys
16:25:41.0049 0x052c  AVGIDSShim - ok
16:25:41.0081 0x052c  [ 5897D0F8F83A9FD81F48F64324221EC9, CAC18B1D773C01D556DA929746032A82E64A2F693CACCE25144172691A8F9626 ] Avgldx86        C:\Windows\system32\DRIVERS\avgldx86.sys
16:25:41.0096 0x052c  Avgldx86 - ok
16:25:41.0159 0x052c  [ 960F9A86D0D2585C51BE45912DDEF3DF, 9F8229138F860A7DFCA4482961D6671FFE1BB1E252B40A3E6E757E9D1806828F ] Avglogx        C:\Windows\system32\DRIVERS\avglogx.sys
16:25:41.0190 0x052c  Avglogx - ok
16:25:41.0205 0x052c  [ 0C577B0E18097204DA73FDE1BDD7BAA3, 264D9F4550332CD34ADE31108DBA25431E6B75FE94CBA92C77DC6891EFF50812 ] Avgmfx86        C:\Windows\system32\DRIVERS\avgmfx86.sys
16:25:41.0221 0x052c  Avgmfx86 - ok
16:25:41.0237 0x052c  [ AF5DA81B19AFA730F1E5246AD81D140A, 532951071F56896A3B5D47874C14D996C8620EA02F87D4BA21B083EC804FB166 ] avgntflt        C:\Windows\system32\DRIVERS\avgntflt.sys
16:25:41.0252 0x052c  avgntflt - ok
16:25:41.0299 0x052c  [ 33744E25E83260527272125F5624FFC6, CDB7DEA22124CCC3DB98BCC3588B2D6F1B35EE3B49947E1F5EE2BC33967815E5 ] Avgrkx86        C:\Windows\system32\DRIVERS\avgrkx86.sys
16:25:41.0315 0x052c  Avgrkx86 - ok
16:25:41.0346 0x052c  [ B5F24281DF67005DFDB7593D5C27F837, 6D5DDDDDA4DFE197CC6419DFFD0149C0221204BB0B39F9C38CC2E0D7A7213604 ] Avgtdix        C:\Windows\system32\DRIVERS\avgtdix.sys
16:25:41.0361 0x052c  Avgtdix - ok
16:25:41.0393 0x052c  [ 95A260961EB2401BE0FAB69B7A8A049C, 1966BBE90BA409CA04069B9B0DF4D5DFA179F40DEED2BFF53F950787B32376F5 ] avgwd          C:\Program Files\AVG\AVG2015\avgwdsvc.exe
16:25:41.0424 0x052c  avgwd - ok
16:25:41.0455 0x052c  [ A5674637BCA212D9FE136ADFA04C9857, 95F3632EBB041C539816D285EBE1F379D46A4187379C69D4683D9F4DECBDB80C ] avipbb          C:\Windows\system32\DRIVERS\avipbb.sys
16:25:41.0486 0x052c  avipbb - ok
16:25:41.0502 0x052c  [ D8C712305F73CD34D1B344810E522728, 49A474FF6CA44E8427D7A8290B47395125B0148AF384CF2B3B1FA495A4718CBA ] avkmgr          C:\Windows\system32\DRIVERS\avkmgr.sys
16:25:41.0517 0x052c  avkmgr - ok
16:25:41.0533 0x052c  [ 3303FB85532093FC6723632B5947E8C4, F8301069A8EAD7303CAE5B7CAE3F119747E7B7B4402178018EB5254087238A42 ] avnetflt        C:\Windows\system32\DRIVERS\avnetflt.sys
16:25:41.0533 0x052c  avnetflt - ok
16:25:41.0580 0x052c  [ 6E30D02AAC9CAC84F421622E3A2F6178, 229DC527C1D6C778BCA2C855A2A6F6D2C4B0F4F6DE56C886B3AAD26E3347952C ] AxInstSV        C:\Windows\System32\AxInstSV.dll
16:25:41.0595 0x052c  AxInstSV - ok
16:25:41.0627 0x052c  [ 1A231ABEC60FD316EC54C66715543CEC, 09E2897BA80737997A286EA5408C03DD3CC0EBACD24CB391C2455B6D4BE7D67E ] b06bdrv        C:\Windows\system32\DRIVERS\bxvbdx.sys
16:25:41.0658 0x052c  b06bdrv - ok
16:25:41.0689 0x052c  [ BD8869EB9CDE6BBE4508D869929869EE, F4363A12EBFDBB89C69FD59B22F9EE05BADA07D477A1DF2DE01F59D6EE496543 ] b57nd60x        C:\Windows\system32\DRIVERS\b57nd60x.sys
16:25:41.0705 0x052c  b57nd60x - ok
16:25:41.0736 0x052c  [ EE1E9C3BB8228AE423DD38DB69128E71, ED54FD9795F3A4D32F02BED6052AD9404409A05644CDBEBFF19C662D104DA95A ] BDESVC          C:\Windows\System32\bdesvc.dll
16:25:41.0767 0x052c  BDESVC - ok
16:25:41.0767 0x052c  [ 505506526A9D467307B3C393DEDAF858, 8AD6F1492E357F57CF42261497BA29122045D4FC0DCC9669AA5AC9B2A4BABFA4 ] Beep            C:\Windows\system32\drivers\Beep.sys
16:25:41.0798 0x052c  Beep - ok
16:25:41.0845 0x052c  [ 1E2BAC209D184BB851E1A187D8A29136, 53933C938DA5126986FFF2918C1F522ABE93ABAB460AE32E4453161C2F7B68DF ] BFE            C:\Windows\System32\bfe.dll
16:25:41.0876 0x052c  BFE - ok
16:25:41.0907 0x052c  [ E585445D5021971FAE10393F0F1C3961, 178C008A9A0A6BFDA65EB0B98C510271360AD4474F22F13594F5EB60AA4E1CF5 ] BITS            C:\Windows\System32\qmgr.dll
16:25:41.0939 0x052c  BITS - ok
16:25:41.0970 0x052c  [ 2287078ED48FCFC477B05B20CF38F36F, 55BCA6174E6034A8D61CBE4126B2F1989F6052BFA624BEA9C0A0A664AEC74521 ] blbdrive        C:\Windows\system32\DRIVERS\blbdrive.sys
16:25:42.0001 0x052c  blbdrive - ok
16:25:42.0017 0x052c  [ 8F2DA3028D5FCBD1A060A3DE64CD6506, E234672E9CFE1A95AD2E78E306E41E010B870221E6EBBC0E2B0BE2FA5CE0CD76 ] bowser          C:\Windows\system32\DRIVERS\bowser.sys
16:25:42.0048 0x052c  bowser - ok
16:25:42.0063 0x052c  [ 9F9ACC7F7CCDE8A15C282D3F88B43309, A9131334BD9CF8FD60BA9D54AA054E2DF2BE1219FB650DF1464F2787BDEAE98F ] BrFiltLo        C:\Windows\system32\DRIVERS\BrFiltLo.sys
16:25:42.0157 0x052c  BrFiltLo - ok
16:25:42.0173 0x052c  [ 56801AD62213A41F6497F96DEE83755A, 0DEB8318FB47DF6473C171C795C735E26A73FA12232876C6856549EA16F33361 ] BrFiltUp        C:\Windows\system32\DRIVERS\BrFiltUp.sys
16:25:42.0188 0x052c  BrFiltUp - ok
16:25:42.0219 0x052c  [ 3DAA727B5B0A45039B0E1C9A211B8400, 903B51E75F0C503A0E255120F53BF51B047B219FEC1E15F2F1D02DDD562FC73B ] Browser        C:\Windows\System32\browser.dll
16:25:42.0251 0x052c  Browser - ok
16:25:42.0282 0x052c  [ 845B8CE732E67F3B4133164868C666EA, 9309B094CD9B5EBC46295A5EB806BED472C3CEDE3B5F6F497EBDABA496A2A27F ] Brserid        C:\Windows\System32\Drivers\Brserid.sys
16:25:42.0313 0x052c  Brserid - ok
16:25:42.0329 0x052c  [ 203F0B1E73ADADBBB7B7B1FABD901F6B, 782FA7B26940FE479C49C9BAA2EB582CDAAAD607013E9BCFC85E6FBBB7D49A6D ] BrSerWdm        C:\Windows\System32\Drivers\BrSerWdm.sys
16:25:42.0344 0x052c  BrSerWdm - ok
16:25:42.0344 0x052c  [ BD456606156BA17E60A04E18016AE54B, DFBDC9DA6A3EA40BACFF204BC6C55C2C122B5885D2CBF6D45054DE43EE15EC4D ] BrUsbMdm        C:\Windows\System32\Drivers\BrUsbMdm.sys
16:25:42.0360 0x052c  BrUsbMdm - ok
16:25:42.0375 0x052c  [ AF72ED54503F717A43268B3CC5FAEC2E, 4A638669B0C30B1BDED242A8BF2015A37749570FF4D67D190BACC8D7E0C44468 ] BrUsbSer        C:\Windows\System32\Drivers\BrUsbSer.sys
16:25:42.0375 0x052c  BrUsbSer - ok
16:25:42.0391 0x052c  [ ED3DF7C56CE0084EB2034432FC56565A, B5B75E002E7BC0209582C635CCCA26DB569BDB23C33A126634E00C6434BF941B ] BTHMODEM        C:\Windows\system32\DRIVERS\bthmodem.sys
16:25:42.0407 0x052c  BTHMODEM - ok
16:25:42.0438 0x052c  [ 1DF19C96EEF6C29D1C3E1A8678E07190, 1F4BB161FF3A1C5B1465BB52F3520FEDB7ACB1FAA132466F07D16DB8E394AEA5 ] bthserv        C:\Windows\system32\bthserv.dll
16:25:42.0485 0x052c  bthserv - ok
16:25:42.0641 0x052c  [ 1F79342D9EB530A48742F651E570983A, 99E0B613C23FA8591E248DFA6FF2D3EE19E262BE6E070A0E43E256B69687017F ] c2cautoupdatesvc C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
16:25:42.0672 0x052c  c2cautoupdatesvc - ok
16:25:42.0750 0x052c  [ E4938E0A376CF0B9D989EE5C0A146891, 9DF6AB5781CD60862D9664CA9A8AF0696A1FB6D09D804CD8DE9630F40DE59E90 ] c2cpnrsvc      C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
16:25:42.0797 0x052c  c2cpnrsvc - ok
16:25:42.0828 0x052c  [ 77EA11B065E0A8AB902D78145CA51E10, 160EB3BBE9E5F3CC4A02584E6F2576A812C7565B940D74838B983F1EE51FA73A ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys
16:25:42.0843 0x052c  cdfs - ok
16:25:42.0890 0x052c  [ BE167ED0FDB9C1FA1133953C18D5A6C9, E26A851CA13E7300F977E5B20FA5D25FD0E1442AB6AD5DB58BBDB2DAAD87027C ] cdrom          C:\Windows\system32\DRIVERS\cdrom.sys
16:25:42.0906 0x052c  cdrom - ok
16:25:42.0968 0x052c  [ 319C6B309773D063541D01DF8AC6F55F, 182F392FE839499D159A30A3CD04B5D0C87219930BFB1A7456880B7DA75B9820 ] CertPropSvc    C:\Windows\System32\certprop.dll
16:25:42.0999 0x052c  CertPropSvc - ok
16:25:43.0046 0x052c  [ 3FE3FE94A34DF6FB06E6418D0F6A0060, 6B3A2A26609A75B690D4C0B3059E40822F3B3DB08943F58EC496BABDA7D0A735 ] circlass        C:\Windows\system32\DRIVERS\circlass.sys
16:25:43.0062 0x052c  circlass - ok
16:25:43.0093 0x052c  [ 635181E0E9BBF16871BF5380D71DB02D, 58D5150C6F3B9F1730FFDF3A8A2ABF5FF207F9785BD66C0C1E03A0F1C223A26A ] CLFS            C:\Windows\system32\CLFS.sys
16:25:43.0109 0x052c  CLFS - ok
16:25:43.0171 0x052c  [ D88040F816FDA31C3B466F0FA0918F29, 39D3630E623DA25B8444B6D3AAAB16B98E7E289C5619E19A85D47B74C71449F3 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
16:25:43.0187 0x052c  clr_optimization_v2.0.50727_32 - ok
16:25:43.0218 0x052c  [ DEA805815E587DAD1DD2C502220B5616, 2D6A7668C95352B818F5EC59FF462894935833D34190257DA9CAC7E67FD3631C ] CmBatt          C:\Windows\system32\DRIVERS\CmBatt.sys
16:25:43.0233 0x052c  CmBatt - ok
16:25:43.0249 0x052c  [ C537B1DB64D495B9B4717B4D6D9EDBF2, 400EEFE662DE117C9CC956E4CBD5E98F28F962E7447CD93E8A78FDD8CA39EB4B ] cmdide          C:\Windows\system32\drivers\cmdide.sys
16:25:43.0265 0x052c  cmdide - ok
16:25:43.0311 0x052c  [ 247B4CE2DAB1160CD422D532D5241E1F, CFE04DBE48B23B084C3F4C3D0F483B26F322E4693176D8739A412BE5D8BE597E ] CNG            C:\Windows\system32\Drivers\cng.sys
16:25:43.0343 0x052c  CNG - ok
16:25:43.0358 0x052c  [ A6023D3823C37043986713F118A89BEE, FAC239A7FA6251C7EDFFA34B4BAE3910B8BC0BD4A3574B6DB6931A8D691E207B ] Compbatt        C:\Windows\system32\DRIVERS\compbatt.sys
16:25:43.0389 0x052c  Compbatt - ok
16:25:43.0405 0x052c  [ CBE8C58A8579CFE5FCCF809E6F114E89, AC083A1C649EBA18C59FCC1772D0784B10E2B8C63094E3C14388E147DBC3F6DF ] CompositeBus    C:\Windows\system32\drivers\CompositeBus.sys
16:25:43.0421 0x052c  CompositeBus - ok
16:25:43.0436 0x052c  COMSysApp - ok
16:25:43.0483 0x052c  [ E2E7892E2E771DFC7607040B34F41857, B898DD160EF1832FC9A917C3159C76B90554FA5EA6945BC116F552BC6DB83C75 ] cphs            C:\Windows\system32\IntelCpHeciSvc.exe
16:25:43.0499 0x052c  cphs - ok
16:25:43.0530 0x052c  [ 2C4EBCFC84A9B44F209DFF6C6E6C61D1, 6FC323217D82EF661BA0E3F949B61B05BB5235D1A69C81D24876C2153FAECEF6 ] crcdisk        C:\Windows\system32\DRIVERS\crcdisk.sys
16:25:43.0545 0x052c  crcdisk - ok
16:25:43.0577 0x052c  [ 96C0E38905CFD788313BE8E11DAE3F2F, C6497C68942D8DC542A9C7D003ED14BDFBD74C33CD8240628CEF74E81D122D2B ] CryptSvc        C:\Windows\system32\cryptsvc.dll
16:25:43.0608 0x052c  CryptSvc - ok
16:25:43.0639 0x052c  [ 3C2177A897B4CA2788C6FB0C3FD81D4B, 98575CBD0664586E6211D02E71BDD52CBAA149A1658573550E29E74E5F7B1553 ] CSC            C:\Windows\system32\drivers\csc.sys
16:25:43.0670 0x052c  CSC - ok
16:25:43.0701 0x052c  [ 15F93B37F6801943360D9EB42485D5D3, DD6838C6496CB15F8BB57A6596F6A64ADD9C36B09F062295699131232712B558 ] CscService      C:\Windows\System32\cscsvc.dll
16:25:43.0717 0x052c  CscService - ok
16:25:43.0764 0x052c  [ 7660F01D3B38ACA1747E397D21D790AF, 04611B43705C064C2A8331F6D3F8E4530295694AE2C3E3EC3F62CFF4A5EFA88D ] DcomLaunch      C:\Windows\system32\rpcss.dll
16:25:43.0795 0x052c  DcomLaunch - ok
16:25:43.0811 0x052c  [ 8D6E10A2D9A5EED59562D9B82CF804E1, 888F9650F4E872BA8F4E0C27E38A6672A561042B17EBA40E306A22357965B0AD ] defragsvc      C:\Windows\System32\defragsvc.dll
16:25:43.0842 0x052c  defragsvc - ok
16:25:43.0873 0x052c  [ F024449C97EC1E464AAFFDA18593DB88, 7EF1E241892E098A472BCA14C724DFF1AACCF190954AF1C4A38B6D542CC74BD2 ] DfsC            C:\Windows\system32\Drivers\dfsc.sys
16:25:43.0904 0x052c  DfsC - ok
16:25:43.0935 0x052c  [ E9E01EB683C132F7FA27CD607B8A2B63, 4D9037B458C522874619143A4176BCED42472C68933E6E83D37B67242706F3C4 ] Dhcp            C:\Windows\system32\dhcpcore.dll
16:25:43.0967 0x052c  Dhcp - ok
16:25:44.0013 0x052c  [ 1A050B0274BFB3890703D490F330C0DA, 79D74F4679A2EE040FAAF4D0392A9311239A10A5F8A5CCB48656C6F89B6D62FB ] discache        C:\Windows\system32\drivers\discache.sys
16:25:44.0029 0x052c  discache - ok
16:25:44.0076 0x052c  [ 565003F326F99802E68CA78F2A68E9FF, ABC42B24DBA4FFC411120E09278EF26AF56CCAB463B69B4BD6C530B4A07063D2 ] Disk            C:\Windows\system32\DRIVERS\disk.sys
16:25:44.0091 0x052c  Disk - ok
16:25:44.0123 0x052c  [ 33EF4861F19A0736B11314AAD9AE28D0, 4C4B84365D85758E3263B88F157D8B086B392C6F1EA5F0F3DB6BF87EF90248EC ] Dnscache        C:\Windows\System32\dnsrslvr.dll
16:25:44.0138 0x052c  Dnscache - ok
16:25:44.0185 0x052c  [ 366BA8FB4B7BB7435E3B9EACB3843F67, 65B7C61ACF34F1F0149045AA9E09A3F917A927963237A385A914D0B80551DC31 ] dot3svc        C:\Windows\System32\dot3svc.dll
16:25:44.0247 0x052c  dot3svc - ok
16:25:44.0294 0x052c  [ 8EC04CA86F1D68DA9E11952EB85973D6, 2E3FBC2D683D1274E8BC45EEEA87D43B77EDDCAAF0D453296D9FDA6B9D717071 ] DPS            C:\Windows\system32\dps.dll
16:25:44.0325 0x052c  DPS - ok
16:25:44.0341 0x052c  [ B918E7C5F9BF77202F89E1A9539F2EB4, C589A37DE50BBEF22E2DAA9682EA43147F614AA1AF7DAAA942BA5FC192313A0B ] drmkaud        C:\Windows\system32\drivers\drmkaud.sys
16:25:44.0372 0x052c  drmkaud - ok
16:25:44.0403 0x052c  [ 23F5D28378A160352BA8F817BD8C71CB, 11BF7B7E6276C28EFF74B8AF89B493CBB89B394D2A091708EDA15DA5C342FF19 ] DXGKrnl        C:\Windows\System32\drivers\dxgkrnl.sys
16:25:44.0419 0x052c  DXGKrnl - ok
16:25:44.0450 0x052c  [ 8600142FA91C1B96367D3300AD0F3F3A, 5713625E27DF11FAAFDA7AC79899A6AD813166E167088FA990EC5DE87DBE83DF ] EapHost        C:\Windows\System32\eapsvc.dll
16:25:44.0466 0x052c  EapHost - ok
16:25:44.0575 0x052c  [ 024E1B5CAC09731E4D868E64DBFB4AB0, AB0826A74BBEE5B7A1B035861B665C79BC98305CFC7D82BEF420558FBD3EE994 ] ebdrv          C:\Windows\system32\DRIVERS\evbdx.sys
16:25:44.0669 0x052c  ebdrv - ok
16:25:44.0700 0x052c  [ 81951F51E318AECC2D68559E47485CC4, ACF76395EF4A2ED03AB919A9DA04D3A4C03B4D0EDC60BE123B3BE1AFE78BC71B ] EFS            C:\Windows\System32\lsass.exe
16:25:44.0715 0x052c  EFS - ok
16:25:44.0778 0x052c  [ A8C362018EFC87BEB013EE28F29C0863, 07971C681FBD391C0BA0172618AF8AD77520182207F1C57F134B34D6A113857F ] ehRecvr        C:\Windows\ehome\ehRecvr.exe
16:25:44.0809 0x052c  ehRecvr - ok
16:25:44.0840 0x052c  [ D389BFF34F80CAEDE417BF9D1507996A, 12859B9925D7A4631DE61A820922F43F56ED23C2AF014CBF36322685E5CF641E ] ehSched        C:\Windows\ehome\ehsched.exe
16:25:44.0856 0x052c  ehSched - ok
16:25:44.0887 0x052c  [ 0ED67910C8C326796FAA00B2BF6D9D3C, 97FAA7627A162B0AEC15545E0165D13355D535B4157604BB87F8EEB72ECD24A8 ] elxstor        C:\Windows\system32\DRIVERS\elxstor.sys
16:25:44.0903 0x052c  elxstor - ok
16:25:44.0918 0x052c  [ 8FC3208352DD3912C94367A206AB3F11, 69B65C12BDADD4B730508674B1B77C5496612B4ACCC447DB9AFE49ADEA8CBF02 ] ErrDev          C:\Windows\system32\drivers\errdev.sys
16:25:44.0949 0x052c  ErrDev - ok
16:25:45.0012 0x052c  [ F6916EFC29D9953D5D0DF06882AE8E16, ED41893960018D5EC2F7829B1DE4B6967D9FD074D60B11B9EB854E3E0948EC24 ] EventSystem    C:\Windows\system32\es.dll
16:25:45.0059 0x052c  EventSystem - ok
16:25:45.0059 0x052c  [ 2DC9108D74081149CC8B651D3A26207F, 75CB47923A867DDAC512701CE71DFCFC340FC3A2E27F4255D0836A1FBC463176 ] exfat          C:\Windows\system32\drivers\exfat.sys
16:25:45.0105 0x052c  exfat - ok
16:25:45.0152 0x052c  [ 7E0AB74553476622FB6AE36F73D97D35, 41463A255FDA1D550B3385EC7C73ABC343B1BBBE9CEE4DF9F2A8B3E7338C4947 ] fastfat        C:\Windows\system32\drivers\fastfat.sys
16:25:45.0183 0x052c  fastfat - ok
16:25:45.0246 0x052c  [ 967EA5B213E9984CBE270205DF37755B, 43153E23210B03FAE16897D62D55B8742F834EDC695F8401EAB5DE307F62602D ] Fax            C:\Windows\system32\fxssvc.exe
16:25:45.0277 0x052c  Fax - ok
16:25:45.0308 0x052c  [ E817A017F82DF2A1F8CFDBDA29388B29, 4CC9320A21E6FEA2D16C48D6BEA14391B695BD541A3C5FDDAEEE086A414FC837 ] fdc            C:\Windows\system32\DRIVERS\fdc.sys
16:25:45.0308 0x052c  fdc - ok
16:25:45.0339 0x052c  [ F3222C893BD2F5821A0179E5C71E88FB, A85B947249DBB986358CCD4B158DD58A9301F074F3C6CCCDEF2D01F432E59D1B ] fdPHost        C:\Windows\system32\fdPHost.dll
16:25:45.0371 0x052c  fdPHost - ok
16:25:45.0402 0x052c  [ 7DBE8CBFE79EFBDEB98C9FB08D3A9A5B, 0E76C29D2A974A3F2FBFCB63D066D4136B78E02F6B1F579B1865CA7A76193987 ] FDResPub        C:\Windows\system32\fdrespub.dll
16:25:45.0417 0x052c  FDResPub - ok
16:25:45.0449 0x052c  [ 6CF00369C97F3CF563BE99BE983D13D8, F65F35324A2FB9DFB533B1C4D089D990CC242218FE83414329D07B786D8EFF33 ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys
16:25:45.0464 0x052c  FileInfo - ok
16:25:45.0464 0x052c  [ 42C51DC94C91DA21CB9196EB64C45DB9, 388C68D12ECC8FFE3116FEAAF4DB7B80CF4A3F97E935788DD21C6ADE2369F635 ] Filetrace      C:\Windows\system32\drivers\filetrace.sys
16:25:45.0495 0x052c  Filetrace - ok
16:25:45.0511 0x052c  [ 87907AA70CB3C56600F1C2FB8841579B, CA1CD82A1CD453617CE5EA431A1836997F14E3580554E8A516D9FE1E9926D979 ] flpydisk        C:\Windows\system32\DRIVERS\flpydisk.sys
16:25:45.0527 0x052c  flpydisk - ok
16:25:45.0542 0x052c  [ 7520EC808E0C35E0EE6F841294316653, 6EC65511B4838A7172A8F89E35C2F9DF4F0BFCE3BE12EDA790F3EB567102FF67 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys
16:25:45.0558 0x052c  FltMgr - ok
16:25:45.0605 0x052c  [ FA6C66E4364D7DA57AADE5DCC03BB999, 9C0D0A04D2558CF60B7F7185CC9B369CDDD3B1C625960910CECF07611F288378 ] FontCache      C:\Windows\system32\FntCache.dll
16:25:45.0667 0x052c  FontCache - ok
16:25:45.0714 0x052c  [ E56F39F6B7FDA0AC77A79B0FD3DE1A2F, DBED26852B99B362152DA9CD4F31A1883EF6F9B496F3CF3772A197BA72DB61DA ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
16:25:45.0729 0x052c  FontCache3.0.0.0 - ok
16:25:45.0745 0x052c  [ 1A16B57943853E598CFF37FE2B8CBF1D, 87609F46F3B8123552141FD70866E895220B1BBD92BC2B580CAF49201AA0197E ] FsDepends      C:\Windows\system32\drivers\FsDepends.sys
16:25:45.0761 0x052c  FsDepends - ok
16:25:45.0792 0x052c  [ 7DAE5EBCC80E45D3253F4923DC424D05, 8A2C4D5591509B0B0A44583520617A9AE34F32BB6E68A012A7D7870ED24F703A ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys
16:25:45.0807 0x052c  Fs_Rec - ok
16:25:45.0839 0x052c  [ 8A73E79089B282100B9393B644CB853B, 844DC5AADFABBD050B967904B796BA06BFD64C9112616EA26229D084F8B3AD41 ] fvevol          C:\Windows\system32\DRIVERS\fvevol.sys
16:25:45.0854 0x052c  fvevol - ok
16:25:45.0885 0x052c  [ 65EE0C7A58B65E74AE05637418153938, 0E1A398ADD8411AF4CCC3344D67BE1B261320C58328BD5C5855A357476FAEBEF ] gagp30kx        C:\Windows\system32\DRIVERS\gagp30kx.sys
16:25:45.0901 0x052c  gagp30kx - ok
16:25:45.0932 0x052c  [ E897EAF5ED6BA41E081060C9B447A673, A428DC68516F19C6C53A8B62E4BDB2587E70FB751B9D77700B6B147D347DA157 ] gpsvc          C:\Windows\System32\gpsvc.dll
16:25:45.0979 0x052c  gpsvc - ok
16:25:46.0041 0x052c  [ 51508F0C2476177E50C31B0BBFBF1BDB, 3F62A05181D54711180C8727AC66D624AFA7FC816A4ACC4DC0CFCF2D2DBE7F87 ] gupdate        C:\Program Files\Google\Update\GoogleUpdate.exe
16:25:46.0057 0x052c  gupdate - ok
16:25:46.0073 0x052c  [ 51508F0C2476177E50C31B0BBFBF1BDB, 3F62A05181D54711180C8727AC66D624AFA7FC816A4ACC4DC0CFCF2D2DBE7F87 ] gupdatem        C:\Program Files\Google\Update\GoogleUpdate.exe
16:25:46.0088 0x052c  gupdatem - ok
16:25:46.0104 0x052c  [ C44E3C2BAB6837DB337DDEE7544736DB, 88A24FF7D2FECCEAFFD421B2039A0FB623DA47A6B220B80EF1E52DD26D9E222D ] hcw85cir        C:\Windows\system32\drivers\hcw85cir.sys
16:25:46.0119 0x052c  hcw85cir - ok
16:25:46.0166 0x052c  [ A5EF29D5315111C80A5C1ABAD14C8972, A181DA72E946F121C3F4A19438C547B0BFD15138AB1DB5465945EC89DF1F6B0A ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
16:25:46.0182 0x052c  HdAudAddService - ok
16:25:46.0197 0x052c  [ 9036377B8A6C15DC2EEC53E489D159B5, 1E56D2ACFE92E6DF96D755B05C63D580EED82C210F075C8623E138BEE6BCD41B ] HDAudBus        C:\Windows\system32\drivers\HDAudBus.sys
16:25:46.0213 0x052c  HDAudBus - ok
16:25:46.0244 0x052c  [ 1D58A7F3E11A9731D0EAAAA8405ACC36, 7056FA18B86FBD52C4A6092D80476C02553EA053D6A0BEDB01A2FA5E152D5215 ] HidBatt        C:\Windows\system32\DRIVERS\HidBatt.sys
16:25:46.0260 0x052c  HidBatt - ok
16:25:46.0260 0x052c  [ 89448F40E6DF260C206A193A4683BA78, 71E0FCC32AE6FF8DFF420DB0383D6A200E1EAE14BD2E32453F92CE18B31C1F3C ] HidBth          C:\Windows\system32\DRIVERS\hidbth.sys
16:25:46.0275 0x052c  HidBth - ok
16:25:46.0291 0x052c  [ CF50B4CF4A4F229B9F3C08351F99CA5E, B97843620AF80FF0EC8F2C438255C0A42A756C6314FAF3DEF415DE16E14C108F ] HidIr          C:\Windows\system32\DRIVERS\hidir.sys
16:25:46.0307 0x052c  HidIr - ok
16:25:46.0307 0x052c  [ 2BC6F6A1992B3A77F5F41432CA6B3B6B, 2AF3312F1C8C8923C0A29AA5DAE57CE269417E53DEA2F0CCCC8DB57029698FE1 ] hidserv        C:\Windows\system32\hidserv.dll
16:25:46.0338 0x052c  hidserv - ok
16:25:46.0385 0x052c  [ 10C19F8290891AF023EAEC0832E1EB4D, E208553029488A6EE2F5216CC9FE5F93E9931A94C0D0625253BB159E30642853 ] HidUsb          C:\Windows\system32\DRIVERS\hidusb.sys
16:25:46.0400 0x052c  HidUsb - ok
16:25:46.0416 0x052c  [ 196B4E3F4CCCC24AF836CE58FACBB699, 7A2E1F603A073421FA0987EFB96647F1F0F2D4E0C82AA62EBC041585DA811DAF ] hkmsvc          C:\Windows\system32\kmsvc.dll
16:25:46.0447 0x052c  hkmsvc - ok
16:25:46.0463 0x052c  [ 6658F4404DE03D75FE3BA09F7ABA6A30, E51D9C1580A283EB862F09B73AAE1B647DD683A53F3DD99834222F12DD15E40F ] HomeGroupListener C:\Windows\system32\ListSvc.dll
16:25:46.0478 0x052c  HomeGroupListener - ok
16:25:46.0509 0x052c  [ DBC02D918FFF1CAD628ACBE0C0EAA8E8, 02121800D9062692C102475876AE8143EBE46D855E8328B8CDCFE6A2F0D19696 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
16:25:46.0525 0x052c  HomeGroupProvider - ok
16:25:46.0619 0x052c  [ BA09645B01CF9778FBD01A7B082CCA3C, BA240A2DC0B98DEE7270B10BD5FDD566222D139AD1F45101474179DDC4A00469 ] hpqcxs08        C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll
16:25:46.0634 0x052c  hpqcxs08 - detected UnsignedFile.Multi.Generic ( 1 )
16:25:49.0551 0x052c  Detect skipped due to KSN trusted
16:25:49.0551 0x052c  hpqcxs08 - ok
16:25:49.0567 0x052c  [ 295FDC419039090EB8B49FFDBB374549, 670E8015FD374640C6570F56F7FE8DE4D8F92E7A8072F5D1B2B95D0BD699CEF7 ] HpSAMD          C:\Windows\system32\drivers\HpSAMD.sys
16:25:49.0583 0x052c  HpSAMD - ok
16:25:49.0629 0x052c  [ 871917B07A141BFF43D76D8844D48106, 30C702008D0EE57D63F74864967DD19A55A268E77E42B5B3CC73037AD51D2987 ] HTTP            C:\Windows\system32\drivers\HTTP.sys
16:25:49.0676 0x052c  HTTP - ok
16:25:49.0676 0x052c  [ 0C4E035C7F105F1299258C90886C64C5, CFB4FBE7B28058E6D3E6E508CF3C1645F6AAE0AFEB4C5364835B9C42311DF0D4 ] hwpolicy        C:\Windows\system32\drivers\hwpolicy.sys
16:25:49.0692 0x052c  hwpolicy - ok
16:25:49.0723 0x052c  [ F151F0BDC47F4A28B1B20A0818EA36D6, 84B24B5796D9F70A8C37773F5484A4606CC7908370CCD942627ACBEDC4952D79 ] i8042prt        C:\Windows\system32\drivers\i8042prt.sys
16:25:49.0739 0x052c  i8042prt - ok
16:25:49.0801 0x052c  [ E64665E2A6CAEB52C8AE6E5EB6F3FD7C, 3D123E673F334B47A7F90B6F462C0A3DF5684D51F6F87163F3F9D34CF5CAD62F ] iaStor          C:\Windows\system32\DRIVERS\iaStor.sys
16:25:49.0817 0x052c  iaStor - ok
16:25:49.0848 0x052c  [ 7D4B9A48430ED57ACA6373B71D5904CA, 6ED72DAA7A4951142F036364E8F237E74246EF3E9EA089448DEF15380DAB0DB3 ] IAStorDataMgrSvc C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
16:25:49.0848 0x052c  IAStorDataMgrSvc - ok
16:25:49.0879 0x052c  [ A3CAE5D281DB4CFF7CFF8233507EE5AD, 2666107220B9F301193F2CF85A3D6B09E6E42CC150152D10A8886E47A3FD9B0D ] iaStorV        C:\Windows\system32\drivers\iaStorV.sys
16:25:49.0895 0x052c  iaStorV - ok
16:25:49.0941 0x052c  [ C521D7EB6497BB1AF6AFA89E322FB43C, BDDCFCBB5B76A9295669B5AC9F732D6127199ED5C300770B554C4E4794F66BB7 ] idsvc          C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
16:25:49.0973 0x052c  idsvc - ok
16:25:50.0300 0x052c  [ 7398C9E652DECC072A174F637AAB6C44, 8F20C2C257EB7387D14886AFF67448D1E19B2126044D40E31D5FE2EDE59EA576 ] igfx            C:\Windows\system32\DRIVERS\igdkmd32.sys
16:25:50.0737 0x052c  igfx - ok
16:25:50.0784 0x052c  [ 4173FF5708F3236CF25195FECD742915, 0A9C0701DF6EAC6602BE342FC13C7950EF04BB5BDF7D96C2C5DABBD2A29AA55D ] iirsp          C:\Windows\system32\DRIVERS\iirsp.sys
16:25:50.0799 0x052c  iirsp - ok
16:25:50.0846 0x052c  [ F95622F161474511B8D80D6B093AA610, F2320E25EB9B4AA9A8366BD3AA23EABEBE111A5610D3A62EBA47D90427D5BC26 ] IKEEXT          C:\Windows\System32\ikeext.dll
16:25:50.0909 0x052c  IKEEXT - ok
16:25:51.0065 0x052c  [ 4BA9DC6AF6EFE9C6E1D2570D61C75D1D, 262C17A6BDF1BBA9E042669B289E9D73EB354E81E16F6F1DA54D78EBBDD837CC ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHDA.sys
16:25:51.0158 0x052c  IntcAzAudAddService - ok
16:25:51.0205 0x052c  [ C86A9AA1CBC4C3C2C5C9DD0F6D939926, E8D3C2BA7679895AC4836FA9568B8264E5512C1163CFFF4E9E14C406CDF60059 ] Intel(R) Capability Licensing Service Interface C:\Program Files\Intel\iCLS Client\HeciServer.exe
16:25:51.0221 0x052c  Intel(R) Capability Licensing Service Interface - ok
16:25:51.0252 0x052c  [ A0F12F2C9BA6C72F3987CE780E77C130, 5F53DF8BE1621AA7DFB655CFD9C95E0AFA1AD3CE2E290E19D7B7FB3C6E380034 ] intelide        C:\Windows\system32\drivers\intelide.sys
16:25:51.0267 0x052c  intelide - ok
16:25:51.0283 0x052c  [ 3B514D27BFC4ACCB4037BC6685F766E0, F12D7AC62F8550E6F33B28AD751D8413AB7FFEF963242D99FFA76CE8A48B027A ] intelppm        C:\Windows\system32\DRIVERS\intelppm.sys
16:25:51.0299 0x052c  intelppm - ok
16:25:51.0314 0x052c  [ ACB364B9075A45C0736E5C47BE5CAE19, 202F77C659103D2D0E787B8CB0A23BE32EA5AA2E6B3B0A0F0A8DFA906AB3C0C0 ] IPBusEnum      C:\Windows\system32\ipbusenum.dll
16:25:51.0345 0x052c  IPBusEnum - ok
16:25:51.0345 0x052c  [ 709D1761D3B19A932FF0238EA6D50200, 0A9D2C3A6E91CA45540555B40CB4E2DF3EBE98C1D164C4EECEE20C86782F5823 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys
16:25:51.0377 0x052c  IpFilterDriver - ok
16:25:51.0423 0x052c  [ 4D65A07B795D6674312F879D09AA7663, 8D72FE0B51A6FF71F85D2602DB3AE91C8749F70869B6789552F047BA81411EDA ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll
16:25:51.0455 0x052c  iphlpsvc - ok
16:25:51.0486 0x052c  [ 4BD7134618C1D2A27466A099062547BF, 20284ABEF4433A59E2981F4143CAEC67DC990864FE0B9E3DC70EE0B88539E964 ] IPMIDRV        C:\Windows\system32\drivers\IPMIDrv.sys
16:25:51.0501 0x052c  IPMIDRV - ok
16:25:51.0517 0x052c  [ A5FA468D67ABCDAA36264E463A7BB0CD, EDB828D596E43372F97DAE1AADA46428C4C45FB80646DDC64FAD5F25C826CF63 ] IPNAT          C:\Windows\system32\drivers\ipnat.sys
16:25:51.0548 0x052c  IPNAT - ok
16:25:51.0579 0x052c  [ 42996CFF20A3084A56017B7902307E9F, 688176DAB91BE569280E4822E4C5BDE755794D293591C53F8047AD59C441751D ] IRENUM          C:\Windows\system32\drivers\irenum.sys
16:25:51.0579 0x052c  IRENUM - ok
16:25:51.0626 0x052c  [ 1F32BB6B38F62F7DF1A7AB7292638A35, 86522358680FBB1CEBC56B4D139290689BB0F71A3EC78CE883E4D75D0B37586F ] isapnp          C:\Windows\system32\drivers\isapnp.sys
16:25:51.0626 0x052c  isapnp - ok
16:25:51.0642 0x052c  [ CB7A9ABB12B8415BCE5D74994C7BA3AE, 464BFF3F5EEE985BE075E23E1813F5CB82A9A0771A92C6D889B13B867BCDF647 ] iScsiPrt        C:\Windows\system32\drivers\msiscsi.sys
16:25:51.0657 0x052c  iScsiPrt - ok
16:25:51.0720 0x052c  [ 13E838EA8652F8451F29301D3B56B17B, 2FE65DDBB0ACFD34227001616D0B66B8748132DB7C0FA9342D3AB404B92732CC ] jhi_service    C:\Program Files\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
16:25:51.0735 0x052c  jhi_service - ok
16:25:51.0767 0x052c  [ ADEF52CA1AEAE82B50DF86B56413107E, A3AE1E96B04AC81665ABBD3CB267DFB3F78376DAE18FB0DBD447908DDAAA22D2 ] kbdclass        C:\Windows\system32\drivers\kbdclass.sys
16:25:51.0782 0x052c  kbdclass - ok
16:25:51.0813 0x052c  [ 9E3CED91863E6EE98C24794D05E27A71, 90CF59F20E14E4A5A793266805E82BF7AE1F0CF4C7BAB1FD2EEF3B53C5DF770F ] kbdhid          C:\Windows\system32\drivers\kbdhid.sys
16:25:51.0845 0x052c  kbdhid - ok
16:25:51.0891 0x052c  [ 81951F51E318AECC2D68559E47485CC4, ACF76395EF4A2ED03AB919A9DA04D3A4C03B4D0EDC60BE123B3BE1AFE78BC71B ] KeyIso          C:\Windows\system32\lsass.exe
16:25:51.0907 0x052c  KeyIso - ok
16:25:51.0938 0x052c  [ 4635935FC972C582632BF45C26BFCB0E, ABD4AFD71B3C2BD3F741BBE3CEC52C4FA63AC78D353101D2E7DC4DE2725D1CA1 ] KMService      C:\Windows\system32\srvany.exe
16:25:51.0954 0x052c  KMService - detected UnsignedFile.Multi.Generic ( 1 )
16:25:54.0824 0x052c  Detect skipped due to KSN trusted
16:25:54.0824 0x052c  KMService - ok
16:25:54.0855 0x052c  [ B7895B4182C0D16F6EFADEB8081E8D36, BAC3BAD22207C8826125FD7721C96F2C7A238960FD9398A3D4573E14648E9DB9 ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys
16:25:54.0871 0x052c  KSecDD - ok
16:25:54.0887 0x052c  [ D30159AC9237519FBC62C6EC247D2D46, 10BDE041C95D0CCD3591ED497002043FEC3A5F732D7AE311FBA457E0FE16CE4B ] KSecPkg        C:\Windows\system32\Drivers\ksecpkg.sys
16:25:54.0902 0x052c  KSecPkg - ok
16:25:54.0933 0x052c  [ 89A7B9CC98D0D80C6F31B91C0A310FCD, 4583CAEEE0D50C0C7CE955E533FDA063CDC37B69033D41EF22EF1BA242E4C747 ] KtmRm          C:\Windows\system32\msdtckrm.dll
16:25:54.0965 0x052c  KtmRm - ok
16:25:54.0980 0x052c  [ D64AF876D53ECA3668BB97B51B4E70AB, D5C07C019BFEAFBEDC29AB5060356A3B07449712B21B50E03378BEF04AF180F9 ] LanmanServer    C:\Windows\system32\srvsvc.dll
16:25:55.0011 0x052c  LanmanServer - ok
16:25:55.0011 0x052c  [ 58405E4F68BA8E4057C6E914F326ABA2, C3E6519A1A38F1B3597D4391E42ABFE8F1F5E86256C4B3BD876CDAD9BB68B0A6 ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
16:25:55.0043 0x052c  LanmanWorkstation - ok
16:25:55.0074 0x052c  [ F7611EC07349979DA9B0AE1F18CCC7A6, 879AA7A391966F00761CA039C25EBC62F6712DD5461694911EEC673E12DE103E ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys
16:25:55.0089 0x052c  lltdio - ok
16:25:55.0121 0x052c  [ 5700673E13A2117FA3B9020C852C01E2, 6684A2905EE8C438F2A64BE47E51A54D287B08DEFB8E0AE7FC2809D845EE3C5F ] lltdsvc        C:\Windows\System32\lltdsvc.dll
16:25:55.0167 0x052c  lltdsvc - ok
16:25:55.0167 0x052c  [ 55CA01BA19D0006C8F2639B6C045E08B, 4DBBDC820C514DB18CC13F8EE178F8C4E39C295C6E3C255416C235553CE7BDC1 ] lmhosts        C:\Windows\System32\lmhsvc.dll
16:25:55.0199 0x052c  lmhosts - ok
16:25:55.0230 0x052c  [ BD9457699AC9C1A0FE43398043617279, 7955D2F5B9CB4FAD53F8D2CCC163FD575714175623F03DA1C3C2495CE3C0F342 ] LMS            C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
16:25:55.0245 0x052c  LMS - ok
16:25:55.0245 0x052c  [ EB119A53CCF2ACC000AC71B065B78FEF, 1FD60735C4945AE565C223F0B47EAF9602D8777E3D15600914C1A9D761215AF9 ] LSI_FC          C:\Windows\system32\DRIVERS\lsi_fc.sys
16:25:55.0261 0x052c  LSI_FC - ok
16:25:55.0292 0x052c  [ 8ADE1C877256A22E49B75D1CC9161F9C, 3D64F233DC866537E50549A7C1A2B40A954055B22F0BDA39825B04C38C607CB7 ] LSI_SAS        C:\Windows\system32\DRIVERS\lsi_sas.sys
16:25:55.0292 0x052c  LSI_SAS - ok
16:25:55.0308 0x052c  [ DC9DC3D3DAA0E276FD2EC262E38B11E9, A264990857CBC74036799E17A087130626C0A09BE19879019BAF2D761C62AECC ] LSI_SAS2        C:\Windows\system32\DRIVERS\lsi_sas2.sys
16:25:55.0323 0x052c  LSI_SAS2 - ok
16:25:55.0339 0x052c  [ 0A036C7D7CAB643A7F07135AC47E0524, 2F662D07FCB74B8D493156DB555EAA90A47E93CF14C7B30039D2FE47EB8682B8 ] LSI_SCSI        C:\Windows\system32\DRIVERS\lsi_scsi.sys
16:25:55.0355 0x052c  LSI_SCSI - ok
16:25:55.0386 0x052c  [ 6703E366CC18D3B6E534F5CF7DF39CEE, 7396B9AF938284D99EC51206A7B2FA4A0DC10A493DCE6707818B03A7473782C4 ] luafv          C:\Windows\system32\drivers\luafv.sys
16:25:55.0417 0x052c  luafv - ok
16:25:55.0479 0x052c  [ 3C21F7E95FFCA33EF1A83AA33D9663CF, C843116969E1CDBA45AEF98B33BEDBA9200C62CDB52CD7056CE6768A1EF3A637 ] MBAMProtector  C:\Windows\system32\drivers\mbam.sys
16:25:55.0495 0x052c  MBAMProtector - ok
16:25:55.0557 0x052c  [ 2B983F067AEE3F9EB4DF5E97F45D21D1, 0B9ED0E91FF01A5445927650113E320C3C0EA16F1401AA55A509DDBF704DF22F ] MBAMService    C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe
16:25:55.0589 0x052c  MBAMService - ok
16:25:55.0620 0x052c  [ 167BCE00050B19DA25065335645A3C7A, 5CD3EA3E09B4ED318AB6151F56A17B0E4C8CE32DBB77342A39DEF53908F7D2F0 ] MBAMWebAccessControl C:\Windows\system32\drivers\mwac.sys
16:25:55.0635 0x052c  MBAMWebAccessControl - ok
16:25:55.0667 0x052c  [ BFB9EE8EE977EFE85D1A3105ABEF6DD1, D2A84EBF0C0B7A14AD432FD2EF43CC12300027AEA3FA4075659FB088AB62B588 ] Mcx2Svc        C:\Windows\system32\Mcx2Svc.dll
16:25:55.0682 0x052c  Mcx2Svc - ok
16:25:55.0698 0x052c  [ 0FFF5B045293002AB38EB1FD1FC2FB74, 49071B565FD5B2DE43EC00D8518C3BE70843F38919E82F13104B8C1FAFB20374 ] megasas        C:\Windows\system32\DRIVERS\megasas.sys
16:25:55.0713 0x052c  megasas - ok
16:25:55.0729 0x052c  [ DCBAB2920C75F390CAF1D29F675D03D6, 85C3A7A010BEA5E3C6179161B295F2CB900A6A214833A5F87A4327392880E2BB ] MegaSR          C:\Windows\system32\DRIVERS\MegaSR.sys
16:25:55.0745 0x052c  MegaSR - ok
16:25:55.0791 0x052c  [ 240D715CFE4FB8F4CDA76F6863E62334, B410C88F0D4749AB843E03BB8BA215A8E3F291404C1B68824A5963A2381188FB ] MEI            C:\Windows\system32\DRIVERS\HECI.sys
16:25:55.0807 0x052c  MEI - ok
16:25:55.0854 0x052c  Microsoft SharePoint Workspace Audit Service - ok
16:25:55.0869 0x052c  [ 146B6F43A673379A3C670E86D89BE5EA, C4412DCF80DE6B55466F399413271364F14BC0819C224AA161EDDC31A9775440 ] MMCSS          C:\Windows\system32\mmcss.dll
16:25:55.0901 0x052c  MMCSS - ok
16:25:55.0916 0x052c  [ F001861E5700EE84E2D4E52C712F4964, F4DC5AEED6F34D76CCEF360862CC47EF71097BE0813C8CE04EE5F0DB387DFFAE ] Modem          C:\Windows\system32\drivers\modem.sys
16:25:55.0932 0x052c  Modem - ok
16:25:55.0963 0x052c  [ 79D10964DE86B292320E9DFE02282A23, 52714827B7EEDACA55326A4E4F6158D4942DFAA3BACDE303A2F569BF3F4FAA72 ] monitor        C:\Windows\system32\DRIVERS\monitor.sys
16:25:55.0994 0x052c  monitor - ok
16:25:56.0041 0x052c  [ FB18CC1D4C2E716B6B903B0AC0CC0609, F10CCA63493782B16DE6B96B94A27078DBE68AECEF34FDF840CFF86D2C6E3C5E ] mouclass        C:\Windows\system32\DRIVERS\mouclass.sys
16:25:56.0057 0x052c  mouclass - ok
16:25:56.0072 0x052c  [ 2C388D2CD01C9042596CF3C8F3C7B24D, B2FB72272BB01AEDA4047B57C943B7E9BD8A6497854F8CC34672AAA592D0A703 ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys
16:25:56.0088 0x052c  mouhid - ok
16:25:56.0119 0x052c  [ FC8771F45ECCCFD89684E38842539B9B, 806DDF2B4830CA866582FE74A521BB7DF26CA0E19013DAF584D3677FB48CC77A ] mountmgr        C:\Windows\system32\drivers\mountmgr.sys
16:25:56.0135 0x052c  mountmgr - ok
16:25:56.0150 0x052c  [ 2D699FB6E89CE0D8DA14ECC03B3EDFE0, D3D903EEA465D77345AAC9B9F02CDEADF4831212EA2DE4FCA33BEE26EBB47420 ] mpio            C:\Windows\system32\drivers\mpio.sys
16:25:56.0150 0x052c  mpio - ok
16:25:56.0181 0x052c  [ AD2723A7B53DD1AACAE6AD8C0BFBF4D0, 1D6DCFA0E56C3E55B6AED819176E751502F863BA0FCF4F0B3253A81D208141A2 ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys
16:25:56.0197 0x052c  mpsdrv - ok
16:25:56.0228 0x052c  [ 9835584E999D25004E1EE8E5F3E3B881, 71798B0CBE9AE69F1F29B845319019C69EC7F415CBABB3B87DDE92C360675021 ] MpsSvc          C:\Windows\system32\mpssvc.dll
16:25:56.0259 0x052c  MpsSvc - ok
16:25:56.0275 0x052c  [ CEB46AB7C01C9F825F8CC6BABC18166A, AA98898204FC58878502C170FE6ED8BA681396DDD8BF3689D0C3642DEA87BEF8 ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys
16:25:56.0291 0x052c  MRxDAV - ok
16:25:56.0337 0x052c  [ 5D16C921E3671636C0EBA3BBAAC5FD25, 5BC107B95CAFC88F51FBB9F657B99944B20627A2B618F263093D7045E4FFD65C ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys
16:25:56.0353 0x052c  mrxsmb - ok
16:25:56.0369 0x052c  [ 6D17A4791ACA19328C685D256349FEFC, 012AA3D84EEAAF53780D06D2D11B9727DFC3441F3FAD75BC9E751FB814403668 ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys
16:25:56.0384 0x052c  mrxsmb10 - ok
16:25:56.0384 0x052c  [ B81F204D146000BE76651A50670A5E9E, 78193D0F967BE9829E53F9B500342934B4B1E1F4CEFC444382959E2061BC3B17 ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys
16:25:56.0400 0x052c  mrxsmb20 - ok
16:25:56.0431 0x052c  [ 012C5F4E9349E711E11E0F19A8589F0A, 208B92DFCF7AD43202660FBBC9FF5E03AEDBEE38178FF3628EB74CB6CD37C584 ] msahci          C:\Windows\system32\drivers\msahci.sys
16:25:56.0447 0x052c  msahci - ok
16:25:56.0462 0x052c  [ 55055F8AD8BE27A64C831322A780A228, C2C9FD1F61302997117B1CD0835E8234405BB80084065ED05363B77868397304 ] msdsm          C:\Windows\system32\drivers\msdsm.sys
16:25:56.0478 0x052c  msdsm - ok
16:25:56.0493 0x052c  [ E1BCE74A3BD9902B72599C0192A07E27, 5162EB623FE64E9DFEAC6CA2410EFA1314E62EC13207FFBFED2D61AA887603C4 ] MSDTC          C:\Windows\System32\msdtc.exe
16:25:56.0509 0x052c  MSDTC - ok
16:25:56.0525 0x052c  [ DAEFB28E3AF5A76ABCC2C3078C07327F, 6EB558532400B489763BAE7203538DE5F196282A8CB46A1B31D59120FC5AFCEF ] Msfs            C:\Windows\system32\drivers\Msfs.sys
16:25:56.0540 0x052c  Msfs - ok
16:25:56.0556 0x052c  [ 3E1E5767043C5AF9367F0056295E9F84, B2EDFECD3C14E4FE1BA87D9A86334043A9BD696A554EBD186DA7EAEB2EBD4F70 ] mshidkmdf      C:\Windows\System32\drivers\mshidkmdf.sys
16:25:56.0571 0x052c  mshidkmdf - ok
16:25:56.0603 0x052c  [ 0A4E5757AE09FA9622E3158CC1AEF114, ED574E420E57374E328C7C526504ECA569C164287966F06019EC207CB17F2C54 ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys
16:25:56.0618 0x052c  msisadrv - ok
16:25:56.0649 0x052c  [ 90F7D9E6B6F27E1A707D4A297F077828, BEFC220EAA7307849600748842ACB9254A6A91158812D9B23EFAF912C498BA7F ] MSiSCSI        C:\Windows\system32\iscsiexe.dll
16:25:56.0681 0x052c  MSiSCSI - ok
16:25:56.0681 0x052c  msiserver - ok
16:25:56.0712 0x052c  [ 8C0860D6366AAFFB6C5BB9DF9448E631, 949C5A14E57F2D7385543C17C3485E7ADE36EA2016F6E0A1866571D2EDE90A77 ] MSKSSRV        C:\Windows\system32\drivers\MSKSSRV.sys
16:25:56.0743 0x052c  MSKSSRV - ok
16:25:56.0774 0x052c  [ 3EA8B949F963562CEDBB549EAC0C11CE, 1B0B2F16A1790282504F3C548D47C3281EFB440D5D9711A1EF76D6371B768D2D ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys
16:25:56.0790 0x052c  MSPCLOCK - ok
16:25:56.0790 0x052c  [ F456E973590D663B1073E9C463B40932, 48BA6D5580EE7B6A4C06E04772FD35B51779553FC0DD6C5C30DD8B5DEEB25B11 ] MSPQM          C:\Windows\system32\drivers\MSPQM.sys
16:25:56.0821 0x052c  MSPQM - ok
16:25:56.0821 0x052c  [ 0E008FC4819D238C51D7C93E7B41E560, 141FCEBDD05874407EAEC35A9DCD3BB16F2A428F23E55487D6A5DBFCADBF10D2 ] MsRPC          C:\Windows\system32\drivers\MsRPC.sys
16:25:56.0837 0x052c  MsRPC - ok
16:25:56.0868 0x052c  [ FC6B9FF600CC585EA38B12589BD4E246, F05DB01AE1955D2468CE6B51E51998B111CA3B0BDEED090EE6B99B625CBA564A ] mssmbios        C:\Windows\system32\drivers\mssmbios.sys
16:25:56.0883 0x052c  mssmbios - ok
16:25:56.0915 0x052c  [ B42C6B921F61A6E55159B8BE6CD54A36, 6BB0A7BE005B8F281E551D1B8046CE4202372BC7AE0161881C858BFAC675FE1C ] MSTEE          C:\Windows\system32\drivers\MSTEE.sys
16:25:56.0946 0x052c  MSTEE - ok
16:25:56.0961 0x052c  [ 33599130F44E1F34631CEA241DE8AC84, E15B31D1AFDC8DC6D2B21D4215796A99ECC69EEDBB06CEED01AECC3C99A44C8B ] MTConfig        C:\Windows\system32\DRIVERS\MTConfig.sys
16:25:56.0977 0x052c  MTConfig - ok
16:25:56.0977 0x052c  [ 159FAD02F64E6381758C990F753BCC80, E55AB01DCFA95ECAB24A2A9656E28FF9D064BA08B3D82DC8AA42F5991BA09598 ] Mup            C:\Windows\system32\Drivers\mup.sys
16:25:56.0993 0x052c  Mup - ok
16:25:57.0024 0x052c  [ 61D57A5D7C6D9AFE10E77DAE6E1B445E, D252248532142E9E2332DA693BC51B795102CA938B568FF04981E98B19BFBC5C ] napagent        C:\Windows\system32\qagentRT.dll
16:25:57.0055 0x052c  napagent - ok
16:25:57.0117 0x052c  [ 26384429FCD85D83746F63E798AB1480, 957C115C263A4B4DC854558B43ECE632D8E2BCCB744E23A01EBA7476BA2E7FFB ] NativeWifiP    C:\Windows\system32\DRIVERS\nwifi.sys
16:25:57.0149 0x052c  NativeWifiP - ok
16:25:57.0180 0x052c  [ E7C54812A2AAF43316EB6930C1FFA108, C8A6FC1957FA29A3B372132FEA9145538BC767044A11D77316D3D1A3EAA60630 ] NDIS            C:\Windows\system32\drivers\ndis.sys
16:25:57.0195 0x052c  NDIS - ok
16:25:57.0211 0x052c  [ 0E1787AA6C9191D3D319E8BAFE86F80C, F535022747355B2C66424BDA892D7DCB820C2EB8EE05BAE5BC6D1B1D65186278 ] NdisCap        C:\Windows\system32\DRIVERS\ndiscap.sys
16:25:57.0242 0x052c  NdisCap - ok
16:25:57.0258 0x052c  [ E4A8AEC125A2E43A9E32AFEEA7C9C888, 6EA181117126FC70B3C1DD1AC73CC26D1603A2CF49E47F66623E2C9489C49B55 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys
16:25:57.0273 0x052c  NdisTapi - ok
16:25:57.0289 0x052c  [ D8A65DAFB3EB41CBB622745676FCD072, 874D3C3D247C4A309DA813DB1D2EDB0037D3C489824BD5FE95B0C20699764EF7 ] Ndisuio        C:\Windows\system32\DRIVERS\ndisuio.sys
16:25:57.0336 0x052c  Ndisuio - ok
16:25:57.0351 0x052c  [ 38FBE267E7E6983311179230FACB1017, CFD1CBCA59650795C030DB30E5795B37C11C736E14003AE1DAB081BA5C0C9B14 ] NdisWan        C:\Windows\system32\DRIVERS\ndiswan.sys
16:25:57.0398 0x052c  NdisWan - ok
16:25:57.0414 0x052c  [ A4BDC541E69674FBFF1A8FF00BE913F2, 18CCFD063E9870B8B6958715BC0414C4D920AE63528EA1E9D7E30F7138918FFA ] NDProxy        C:\Windows\system32\drivers\NDProxy.sys
16:25:57.0461 0x052c  NDProxy - ok
16:25:57.0476 0x052c  [ 80B275B1CE3B0E79909DB7B39AF74D51, 75B406B0D9D28239D4EB2A298419A5F78A58237D88C5FD688EF1DFFAFACCF796 ] NetBIOS        C:\Windows\system32\DRIVERS\netbios.sys
16:25:57.0492 0x052c  NetBIOS - ok
16:25:57.0523 0x052c  [ 280122DDCF04B378EDD1AD54D71C1E54, F98B2ADE34F7E67C7C06C1D0FFB80ECBC353D044D4B4784CD952910345DC2ED0 ] NetBT          C:\Windows\system32\DRIVERS\netbt.sys
16:25:57.0539 0x052c  NetBT - ok
16:25:57.0554 0x052c  [ 81951F51E318AECC2D68559E47485CC4, ACF76395EF4A2ED03AB919A9DA04D3A4C03B4D0EDC60BE123B3BE1AFE78BC71B ] Netlogon        C:\Windows\system32\lsass.exe
16:25:57.0554 0x052c  Netlogon - ok
16:25:57.0585 0x052c  [ 7CCCFCA7510684768DA22092D1FA4DB2, BB9E4F8FABBF596D888E6D303CB54A336D9DFF95B36AEA9369D2ED787DDC4B5D ] Netman          C:\Windows\System32\netman.dll
16:25:57.0617 0x052c  Netman - ok
16:25:57.0632 0x052c  [ 8C338238C16777A802D6A9211EB2BA50, 0D08A47CD403EDA5E8CAD7409BBBBCDC29A9861D2DC41D42B68B22B1AA1EBDD6 ] netprofm        C:\Windows\System32\netprofm.dll
16:25:57.0663 0x052c  netprofm - ok
16:25:57.0695 0x052c  [ F476EC40033CDB91EFBE73EB99B8362D, B17535037BC070F9AE1F6B381C2DBEE27658A8FDE15FB0E061F485EA7C7CBE59 ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
16:25:57.0710 0x052c  NetTcpPortSharing - ok
16:25:57.0726 0x052c  [ 1D85C4B390B0EE09C7A46B91EFB2C097, 6A8850B151E88EE371F3CC543A946302DDF9494908D684B8B0C706A42CC54348 ] nfrd960        C:\Windows\system32\DRIVERS\nfrd960.sys
16:25:57.0741 0x052c  nfrd960 - ok
16:25:57.0757 0x052c  [ 912084381D30D8B89EC4E293053F4710, 99B8CD043DF531D4B9725ED167F63CED220608B2FED3EE8250C217D15762DFD7 ] NlaSvc          C:\Windows\System32\nlasvc.dll
16:25:57.0788 0x052c  NlaSvc - ok
16:25:57.0804 0x052c  [ 1DB262A9F8C087E8153D89BEF3D2235F, A51EE5D5AD3CD76B74BEA9C66C462608BF3B50C53DAA4110A75DB10495A8C101 ] Npfs            C:\Windows\system32\drivers\Npfs.sys
16:25:57.0835 0x052c  Npfs - ok
16:25:57.0866 0x052c  [ BA387E955E890C8A88306D9B8D06BF17, 3477BD9686C5777A93251C154512671AAA7533B18C536DF51F7B1D6D28E7F8A5 ] nsi            C:\Windows\system32\nsisvc.dll
16:25:57.0913 0x052c  nsi - ok
16:25:57.0913 0x052c  [ E9A0A4D07E53D8FEA2BB8387A3293C58, 690CAD6C4E35ECC1172A2E1FD3933DF73158B3BF42CB21244269612A53DE4D7A ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys
16:25:57.0944 0x052c  nsiproxy - ok
16:25:57.0975 0x052c  [ 33C3093D09017CFE2E219F2472BFF6EB, DE46C7A53C3606F036DED1EE8A81B79CAF3171A7E97DA2F71712E2DA046A262E ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys
16:25:58.0007 0x052c  Ntfs - ok
16:25:58.0022 0x052c  [ F9756A98D69098DCA8945D62858A812C, 572ADBFCFDE2030B34A013AADC14DBC144EB3F34D06991E2464A3EA9605BC045 ] Null            C:\Windows\system32\drivers\Null.sys
16:25:58.0053 0x052c  Null - ok
16:25:58.0069 0x052c  [ AF2EEC9580C1D32FB7EAF105D9784061, 6DAAE3BCA048ACD7FFD26A65C793C461933179070F03855FE3DC3C01F968163A ] nvraid          C:\Windows\system32\drivers\nvraid.sys
16:25:58.0085 0x052c  nvraid - ok
16:25:58.0100 0x052c  [ 9283C58EBAA2618F93482EB5DABCEC82, 0BC119D4EAFDEA879E4C1CFBA5402499DBD1970EDF963C6D2034D4867C34D15E ] nvstor          C:\Windows\system32\drivers\nvstor.sys
16:25:58.0116 0x052c  nvstor - ok
16:25:58.0131 0x052c  [ 5A0983915F02BAE73267CC2A041F717D, D83461D74597BF2BE042FEFCC27FCD18BF63CB8135B0666D731D50951C3468A8 ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys
16:25:58.0147 0x052c  nv_agp - ok
16:25:58.0163 0x052c  [ 08A70A1F2CDDE9BB49B885CB817A66EB, 0BB98123B544124B144F3E95D77E01E973D060B8B2302503FF24ABBBE803EB63 ] ohci1394        C:\Windows\system32\drivers\ohci1394.sys
16:25:58.0194 0x052c  ohci1394 - ok
16:25:58.0256 0x052c  [ 9D10F99A6712E28F8ACD5641E3A7EA6B, 70964A0ED9011EA94044E15FA77EDD9CF535CC79ED8E03A3721FF007E69595CC ] ose            C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
16:25:58.0272 0x052c  ose - ok
16:25:58.0428 0x052c  [ 358A9CCA612C68EB2F07DDAD4CE1D8D7, F342100E2E9001F11FDF93F856B50FA43F9B85D2C6B5706EC0433E77206498DA ] osppsvc        C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
16:25:58.0553 0x052c  osppsvc - ok
16:25:58.0584 0x052c  [ 82A8521DDC60710C3D3D3E7325209BEC, C4E34571EDD57C7FBB3D736B5FE8BD154624705B5C8EA2EC898F19F75B9A5942 ] p2pimsvc        C:\Windows\system32\pnrpsvc.dll
16:25:58.0599 0x052c  p2pimsvc - ok
16:25:58.0631 0x052c  [ 59C3DDD501E39E006DAC31BF55150D91, E02B63AB7F34CF6FF3F644AF354D10004E6F50014E03172D80BD78934EF71EF1 ] p2psvc          C:\Windows\system32\p2psvc.dll
16:25:58.0646 0x052c  p2psvc - ok
16:25:58.0677 0x052c  [ 2EA877ED5DD9713C5AC74E8EA7348D14, 14BA3722CE5F8FF07F2D97DCDD6558EB49C9B02E5E6FAD6D9F18D354733EFECE ] Parport        C:\Windows\system32\DRIVERS\parport.sys
16:25:58.0693 0x052c  Parport - ok
16:25:58.0709 0x052c  [ 3F34A1B4C5F6475F320C275E63AFCE9B, 31295D5121C0C3F2085E0EEBA260EEE4CA003993C026E2F81986D19158036E6B ] partmgr        C:\Windows\system32\drivers\partmgr.sys
16:25:58.0724 0x052c  partmgr - ok
16:25:58.0740 0x052c  [ EB0A59F29C19B86479D36B35983DAADC, AC09AFE7F13BE4079D01383BAC44091997E1AAF6512C9673A42B9E3780EB08A8 ] Parvdm          C:\Windows\system32\DRIVERS\parvdm.sys
16:25:58.0740 0x052c  Parvdm - ok
16:25:58.0771 0x052c  [ 358AB7956D3160000726574083DFC8A6, 6CAFD4D1B8AB8C1D167ADC018985DDAB5AC2CBFFB3434FE6390F14AF50C19025 ] PcaSvc          C:\Windows\System32\pcasvc.dll
16:25:58.0787 0x052c  PcaSvc - ok
16:25:58.0802 0x052c  [ 673E55C3498EB970088E812EA820AA8F, 1F81315664B8CBFDD569416C0ECCE4C6251F34577313A0858AB46609781303B5 ] pci            C:\Windows\system32\drivers\pci.sys
16:25:58.0818 0x052c  pci - ok
16:25:58.0849 0x052c  [ AFE86F419014DB4E5593F69FFE26CE0A, CAF36E61BE7B511D3A03A65FF5A3017CEE4D2F53005B410F2D4A2AAE9FED4C00 ] pciide          C:\Windows\system32\drivers\pciide.sys
16:25:58.0849 0x052c  pciide - ok
16:25:58.0880 0x052c  [ F396431B31693E71E8A80687EF523506, BC614FC21E029E2497F1CCE3131BBD295B827F2310762B47D5BBC7703D80554B ] pcmcia          C:\Windows\system32\DRIVERS\pcmcia.sys
16:25:58.0896 0x052c  pcmcia - ok
16:25:58.0911 0x052c  [ 250F6B43D2B613172035C6747AEEB19F, A91F15B133F2619912CF750E6F3662E011CD0FA4B9477CE532CE3196D23307D9 ] pcw            C:\Windows\system32\drivers\pcw.sys
16:25:58.0911 0x052c  pcw - ok
16:25:58.0943 0x052c  [ 9E0104BA49F4E6973749A02BF41344ED, B32F39F38DB48D77FBA884DEE34112BAB81CCEF5DD2EAAA12D9589D73D2BB116 ] PEAUTH          C:\Windows\system32\drivers\peauth.sys
16:25:58.0974 0x052c  PEAUTH - ok
16:25:59.0021 0x052c  [ AF4D64D2A57B9772CF3801950B8058A6, C9C493A3775E6E1660CE5DF75DA574D0C04245FB88CF41B96217A725359C350D ] PeerDistSvc    C:\Windows\system32\peerdistsvc.dll
16:25:59.0067 0x052c  PeerDistSvc - ok
16:25:59.0145 0x052c  [ 414BBA67A3DED1D28437EB66AEB8A720, D6DF254E2615FA402044824DCD9004F579FC0DF74B90E44C99D5F0253CF8AD88 ] pla            C:\Windows\system32\pla.dll
16:25:59.0208 0x052c  pla - ok
16:25:59.0255 0x052c  [ EC7BC28D207DA09E79B3E9FAF8B232CA, A42F8F69C3CD753D787A5D558659DEA2CC306C896D75B8C82549219CF654504F ] PlugPlay        C:\Windows\system32\umpnpmgr.dll
16:25:59.0286 0x052c  PlugPlay - ok
16:25:59.0301 0x052c  [ 63FF8572611249931EB16BB8EED6AFC8, 9732CCBCB93A7A4BEC88812B952C20244479E9BD781240C195E57F09E619EA33 ] PNRPAutoReg    C:\Windows\system32\pnrpauto.dll
16:25:59.0317 0x052c  PNRPAutoReg - ok
16:25:59.0333 0x052c  [ 82A8521DDC60710C3D3D3E7325209BEC, C4E34571EDD57C7FBB3D736B5FE8BD154624705B5C8EA2EC898F19F75B9A5942 ] PNRPsvc        C:\Windows\system32\pnrpsvc.dll
16:25:59.0348 0x052c  PNRPsvc - ok
16:25:59.0395 0x052c  [ 53946B69BA0836BD95B03759530C81EC, 7F14A34635354CCA0F5342C8D9DF5A6AA1B94F6A508BD8834029E9BACF252920 ] PolicyAgent    C:\Windows\System32\ipsecsvc.dll
16:25:59.0426 0x052c  PolicyAgent - ok
16:25:59.0457 0x052c  [ F87D30E72E03D579A5199CCB3831D6EA, B09328E89954584F97908FA5946376BA990B8C650DABCBF3CA3B08719937C694 ] Power          C:\Windows\system32\umpo.dll
16:25:59.0473 0x052c  Power - ok
16:25:59.0489 0x052c  [ 631E3E205AD6D86F2AED6A4A8E69F2DB, 1D3BF0CFC37D91A3A56246920B9CF1084E78A055D56E85A773417809C58C8065 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys
16:25:59.0535 0x052c  PptpMiniport - ok
16:25:59.0567 0x052c  [ 85B1E3A0C7585BC4AAE6899EC6FCF011, 1E067113C146D6842D7FB04007F363D6FB7783C6BC7C9AB6614E44075C4F86C3 ] Processor      C:\Windows\system32\DRIVERS\processr.sys
16:25:59.0598 0x052c  Processor - ok
16:25:59.0691 0x052c  [ 43CA4CCC22D52FB58E8988F0198851D0, DF67BD70D9D82677AE61244B4E54677A5008A7F5EB531DF2A7E7D33F1658EA78 ] ProfSvc        C:\Windows\system32\profsvc.dll
16:25:59.0723 0x052c  ProfSvc - ok
16:25:59.0738 0x052c  [ 81951F51E318AECC2D68559E47485CC4, ACF76395EF4A2ED03AB919A9DA04D3A4C03B4D0EDC60BE123B3BE1AFE78BC71B ] ProtectedStorage C:\Windows\system32\lsass.exe
16:25:59.0738 0x052c  ProtectedStorage - ok
16:25:59.0785 0x052c  [ 6270CCAE2A86DE6D146529FE55B3246A, 463209CBAF1B0E269DC8FC6FBDEE5BB7E5ADB5D3F024930BFD0B97E0A9678883 ] Psched          C:\Windows\system32\DRIVERS\pacer.sys
16:25:59.0801 0x052c  Psched - ok
16:25:59.0847 0x052c  [ AB95ECF1F6659A60DDC166D8315B0751, 0ED6D3460D28978BADF31B930DBB3298A6A10EFF8883763EABA0E36A21A0E83D ] ql2300          C:\Windows\system32\DRIVERS\ql2300.sys
16:25:59.0894 0x052c  ql2300 - ok
16:25:59.0910 0x052c  [ B4DD51DD25182244B86737DC51AF2270, 7E62B04F054A6330B7F9968222523BDE8F3EE47A11D17E6C0E2D5ACDC07B9E6B ] ql40xx          C:\Windows\system32\DRIVERS\ql40xx.sys
16:25:59.0925 0x052c  ql40xx - ok
16:25:59.0941 0x052c  [ 31AC809E7707EB580B2BDB760390765A, A8481FD19A0F778F5591B7676F591F664ADC68B6867E663C0F9564173F4AC909 ] QWAVE          C:\Windows\system32\qwave.dll
16:25:59.0957 0x052c  QWAVE - ok
16:25:59.0972 0x052c  [ 584078CA1B95CA72DF2A27C336F9719D, 836F115C92D343463C14A9DE39648C1EFA7C7EE4720F5C692EE0F68B84830121 ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys
16:25:59.0972 0x052c  QWAVEdrv - ok
16:26:00.0003 0x052c  [ 30A81B53C766D0133BB86D234E5556AB, 726C6B83B5ACAA84CAB1689B6DD6DDAE3199D61A57B5D7B5B5A0F62FCF838090 ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys
16:26:00.0019 0x052c  RasAcd - ok
16:26:00.0050 0x052c  [ 57EC4AEF73660166074D8F7F31C0D4FD, C66B425EC4DB5E7FD289AE631C9B019EB16717C55E80FAE964BB22203E4AACEF ] RasAgileVpn    C:\Windows\system32\DRIVERS\AgileVpn.sys
16:26:00.0066 0x052c  RasAgileVpn - ok
16:26:00.0097 0x052c  [ A60F1839849C0C00739787FD5EC03F13, B210DFA5A843CF1DA73635F168E2EA5052CBED15C664F8523CDFB34CA165D0E0 ] RasAuto        C:\Windows\System32\rasauto.dll
16:26:00.0113 0x052c  RasAuto - ok
16:26:00.0128 0x052c  [ D9F91EAFEC2815365CBE6D167E4E332A, 8350457A39D141C13807E7DB5A8D4113197C4016F7744B9993391F4AEA0C4A5C ] Rasl2tp        C:\Windows\system32\DRIVERS\rasl2tp.sys
16:26:00.0159 0x052c  Rasl2tp - ok
16:26:00.0191 0x052c  [ CB9E04DC05EACF5B9A36CA276D475006, 4D8C0AEF1D4F84F375AD2BAF786C9F6C52316A3E655B913449E71AD7C0FCA56E ] RasMan          C:\Windows\System32\rasmans.dll
16:26:00.0253 0x052c  RasMan - ok
16:26:00.0284 0x052c  [ 0FE8B15916307A6AC12BFB6A63E45507, 64119474DE7499E6E8B82E78BBD50074B3AA70B3E8329089FAE9B7F29919004E ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys
16:26:00.0300 0x052c  RasPppoe - ok
16:26:00.0315 0x052c  [ 44101F495A83EA6401D886E7FD70096B, 56A0CE5C89870752B9B2AB795C1A248CA28209E049B2F20CCA0308CBE2488A0A ] RasSstp        C:\Windows\system32\DRIVERS\rassstp.sys
16:26:00.0331 0x052c  RasSstp - ok
16:26:00.0362 0x052c  [ D528BC58A489409BA40334EBF96A311B, C71E9A4B101DB6C3183B9F97B9098D73D6FE1B12C05C2EB3CE8A8041BEE6BA61 ] rdbss          C:\Windows\system32\DRIVERS\rdbss.sys
16:26:00.0378 0x052c  rdbss - ok
16:26:00.0393 0x052c  [ 0D8F05481CB76E70E1DA06EE9F0DA9DF, 2AFCBE3237D27AFBF095F91F1FCCA63E6890F34A9E4F00E5C34C92394CDA89FB ] rdpbus          C:\Windows\system32\DRIVERS\rdpbus.sys
16:26:00.0409 0x052c  rdpbus - ok
16:26:00.0440 0x052c  [ 23DAE03F29D253AE74C44F99E515F9A1, 8FED93D10B2062F0526FE3508101F8FCF8F72DEB90AFB472EB7CBAE83A0EC430 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys
16:26:00.0456 0x052c  RDPCDD - ok
16:26:00.0471 0x052c  [ B973FCFC50DC1434E1970A146F7E3885, BE797E5F5AE34D37F8DA1134CE94DD14DBE36D2BC405B97E992E2257848B7CA9 ] RDPDR          C:\Windows\system32\drivers\rdpdr.sys
16:26:00.0487 0x052c  RDPDR - ok
16:26:00.0503 0x052c  [ 5A53CA1598DD4156D44196D200C94B8A, 8112FE14FEC94C67B1C5BDE4171E37584F1D0098D2C557C9E4BDD3E0291E25E4 ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys
16:26:00.0518 0x052c  RDPENCDD - ok
16:26:00.0534 0x052c  [ 44B0A53CD4F27D50ED461DAE0C0B4E1F, CDA80B08E67AD034081C0C920CD66147689F1844403CBC552F65005E7C011A91 ] RDPREFMP        C:\Windows\system32\drivers\rdprefmp.sys
16:26:00.0549 0x052c  RDPREFMP - ok
16:26:00.0596 0x052c  [ 68A0387F58E226DEEE23D9715955572A, F95BB1D2BB3E79AF47B1C715BB5E3003EEF888AAA963F46F4A2FE8AFBD4F37A4 ] RdpVideoMiniport C:\Windows\system32\drivers\rdpvideominiport.sys
16:26:00.0627 0x052c  RdpVideoMiniport - ok
16:26:00.0643 0x052c  [ F031683E6D1FEA157ABB2FF260B51E61, 83B552819A5964152882C527E1421DBCEAACC74DEB897E3C4B53F52F1467FED3 ] RDPWD          C:\Windows\system32\drivers\RDPWD.sys
16:26:00.0659 0x052c  RDPWD - ok
16:26:00.0674 0x052c  [ 518395321DC96FE2C9F0E96AC743B656, 5F6A0880B4F3EE7196259EA362DA9554B0687B0236F9A8E5CF7A4A77F01F1776 ] rdyboost        C:\Windows\system32\drivers\rdyboost.sys
16:26:00.0690 0x052c  rdyboost - ok
16:26:00.0705 0x052c  [ 7B5E1419717FAC363A31CC302895217A, 048B96B127CC20833948DAE53C59886D5C725ECA7A744424A01339447D2DDC32 ] RemoteAccess    C:\Windows\System32\mprdim.dll
16:26:00.0737 0x052c  RemoteAccess - ok
16:26:00.0752 0x052c  [ CB9A8683F4EF2BF99E123D79950D7935, B9FA3E7E91E76D975CF40BFA37909E50F29CC13AB1399007884710651827E9AA ] RemoteRegistry  C:\Windows\system32\regsvc.dll
16:26:00.0768 0x052c  RemoteRegistry - ok
16:26:00.0799 0x052c  [ 78D072F35BC45D9E4E1B61895C152234, 80C924EE1156B4E3172E83DCB9C60817E87885FB9377647E0BF90153E415B1CA ] RpcEptMapper    C:\Windows\System32\RpcEpMap.dll
16:26:00.0815 0x052c  RpcEptMapper - ok
16:26:00.0830 0x052c  [ 94D36C0E44677DD26981D2BFEEF2A29D, D77A93AC60536F3706E8A0154C0C2199E888B7748C84DB7437254FF175F4DF55 ] RpcLocator      C:\Windows\system32\locator.exe
16:26:00.0846 0x052c  RpcLocator - ok
16:26:00.0861 0x052c  [ 7660F01D3B38ACA1747E397D21D790AF, 04611B43705C064C2A8331F6D3F8E4530295694AE2C3E3EC3F62CFF4A5EFA88D ] RpcSs          C:\Windows\system32\rpcss.dll
16:26:00.0893 0x052c  RpcSs - ok
16:26:00.0908 0x052c  [ 032B0D36AD92B582D869879F5AF5B928, 0F8F18A6A0A689957B886D9368015889091094EDA18BE532093F06A70A7CE184 ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys
16:26:00.0939 0x052c  rspndr - ok
16:26:00.0986 0x052c  [ 6A2586DCB5B04A52404699EB325DF1DB, 07EA046410E23C3CCBCA20EBD187D4B5C1E1480359654FEB756EDFAAA8FFEAFD ] RTL8167        C:\Windows\system32\DRIVERS\Rt86win7.sys
16:26:01.0017 0x052c  RTL8167 - ok
16:26:01.0049 0x052c  [ 7FA7F2E249A5DCBB7970630E15E1F482, 9633B193F3FDA67BC551C6DCA4788AB83E9F45F77763EE579D02FE5D6B80DEDF ] s3cap          C:\Windows\system32\drivers\vms3cap.sys
16:26:01.0064 0x052c  s3cap - ok
16:26:01.0064 0x052c  [ 81951F51E318AECC2D68559E47485CC4, ACF76395EF4A2ED03AB919A9DA04D3A4C03B4D0EDC60BE123B3BE1AFE78BC71B ] SamSs          C:\Windows\system32\lsass.exe
16:26:01.0080 0x052c  SamSs - ok
16:26:01.0095 0x052c  [ 05D860DA1040F111503AC416CCEF2BCA, DAE2F37D09A5A42F945BC8E27E4EA2303521081783A80CEE7FEE7C5A1C2CFC5E ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys
16:26:01.0111 0x052c  sbp2port - ok
16:26:01.0127 0x052c  [ 8FC518FFE9519C2631D37515A68009C4, 21E10585470CF9FC3BD1977F8A426686CD2FA6BD2094B9E3594B21C7C4541D25 ] SCardSvr        C:\Windows\System32\SCardSvr.dll
16:26:01.0158 0x052c  SCardSvr - ok
16:26:01.0173 0x052c  [ 0693B5EC673E34DC147E195779A4DCF6, AF1B56FBF3ADABF94CD9DBA67586B8746DE135151F6B3D1B0EE315BC1E2DB670 ] scfilter        C:\Windows\system32\DRIVERS\scfilter.sys
16:26:01.0189 0x052c  scfilter - ok
16:26:01.0251 0x052c  [ A04BB13F8A72F8B6E8B4071723E4E336, E63287FF71C39CBF64C3347C455324C8437F9CF398153E269543588B65389502 ] Schedule        C:\Windows\system32\schedsvc.dll
16:26:01.0345 0x052c  Schedule - ok
16:26:01.0361 0x052c  [ 319C6B309773D063541D01DF8AC6F55F, 182F392FE839499D159A30A3CD04B5D0C87219930BFB1A7456880B7DA75B9820 ] SCPolicySvc    C:\Windows\System32\certprop.dll
16:26:01.0392 0x052c  SCPolicySvc - ok
16:26:01.0407 0x052c  [ 08236C4BCE5EDD0A0318A438AF28E0F7, 77727F963F63C4CEC11E7AAD5FB3836179701D512CA9436C3170B9E6A4E5F888 ] SDRSVC          C:\Windows\System32\SDRSVC.dll
16:26:01.0423 0x052c  SDRSVC - ok
16:26:01.0439 0x052c  [ 90A3935D05B494A5A39D37E71F09A677, F72733A69BC6E1A2BB91D7632FF3463C12563F60FDCC00A2CDD67FF20D479952 ] secdrv          C:\Windows\system32\drivers\secdrv.sys
16:26:01.0470 0x052c  secdrv - ok
16:26:01.0485 0x052c  [ A59B3A4442C52060CC7A85293AA3546F, 1776D6DEE51991149265AAF39E17065E301C5FA1FF4068653DC0010B9B27185D ] seclogon        C:\Windows\system32\seclogon.dll
16:26:01.0501 0x052c  seclogon - ok
16:26:01.0517 0x052c  [ DCB7FCDCC97F87360F75D77425B81737, F8289AF2C458C167038EEFE613EE5E3D6D5B3308B8784168374BC81C47891CE5 ] SENS            C:\Windows\System32\sens.dll
16:26:01.0532 0x052c  SENS - ok
16:26:01.0548 0x052c  [ 50087FE1EE447009C9CC2997B90DE53F, B5E6CF1D991F87C29C5E28198E0962E31FFB499A46C3BD43FC20391693389959 ] SensrSvc        C:\Windows\system32\sensrsvc.dll
16:26:01.0579 0x052c  SensrSvc - ok
16:26:01.0610 0x052c  [ 9AD8B8B515E3DF6ACD4212EF465DE2D1, E2F019BCD1446236D078D46065DD151DD068778F33BE2F1E8A0CC1EA2F954E86 ] Serenum        C:\Windows\system32\DRIVERS\serenum.sys
16:26:01.0641 0x052c  Serenum - ok
16:26:01.0657 0x052c  [ 5FB7FCEA0490D821F26F39CC5EA3D1E2, A26DB2EB9F3E2509B4EBA949DB97595CC32332D9321DF68283BFC102E66D766F ] Serial          C:\Windows\system32\DRIVERS\serial.sys
16:26:01.0673 0x052c  Serial - ok
16:26:01.0704 0x052c  [ 79BFFB520327FF916A582DFEA17AA813, 7A2A9D69BE02228591186A9F4453D4B5FD98837CA422C873C48040170E8BD18C ] sermouse        C:\Windows\system32\DRIVERS\sermouse.sys
16:26:01.0719 0x052c  sermouse - ok
16:26:01.0735 0x052c  [ 4AE380F39A0032EAB7DD953030B26D28, C8F5F2DD59574E966FDF3057867BB959A554BAB6FD5DC6F1427094A6BC2B2809 ] SessionEnv      C:\Windows\system32\sessenv.dll
16:26:01.0766 0x052c  SessionEnv - ok
16:26:01.0797 0x052c  [ 9F976E1EB233DF46FCE808D9DEA3EB9C, 6A5C53F27F8BCA85CE206EE7D196176F67EC6FFA5D4830373A20792C149B5E75 ] sffdisk        C:\Windows\system32\drivers\sffdisk.sys
16:26:01.0797 0x052c  sffdisk - ok
16:26:01.0813 0x052c  [ 932A68EE27833CFD57C1639D375F2731, 11D6B98FBEEE2B9C7B06EF7091857BBD3B349077997D6261D66280668FD1B5C3 ] sffp_mmc        C:\Windows\system32\drivers\sffp_mmc.sys
16:26:01.0813 0x052c  sffp_mmc - ok
16:26:01.0829 0x052c  [ 6D4CCAEDC018F1CF52866BBBAA235982, AAC41F5C97B3FE5A3DC0838457EB8CC9BB71FCA16D3EDBB67D603F0A9D46C131 ] sffp_sd        C:\Windows\system32\drivers\sffp_sd.sys
16:26:01.0844 0x052c  sffp_sd - ok
16:26:01.0875 0x052c  [ DB96666CC8312EBC45032F30B007A547, C3AE60FC65A36E96E0D2CC6E184481D70F91A19DC3E2E17E2873DD670A592DD7 ] sfloppy        C:\Windows\system32\DRIVERS\sfloppy.sys
16:26:01.0891 0x052c  sfloppy - ok
16:26:01.0922 0x052c  [ D1A079A0DE2EA524513B6930C24527A2, E2BC16DBCF38841EECD49C6FA1A9AC89C17F332F12606CA826F058E995E1B83D ] SharedAccess    C:\Windows\System32\ipnathlp.dll
16:26:01.0953 0x052c  SharedAccess - ok
16:26:01.0969 0x052c  [ 414DA952A35BF5D50192E28263B40577, 9C9BAFB9880DA6CC728506A142BE124E186219610DCC3460657A3CA93C865DF1 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
16:26:02.0000 0x052c  ShellHWDetection - ok
16:26:02.0016 0x052c  [ 2565CAC0DC9FE0371BDCE60832582B2E, 1A775214E86B83C2F1799F12D71077D81C89AD32734A248BA88787B7F104B79D ] sisagp          C:\Windows\system32\drivers\sisagp.sys
16:26:02.0016 0x052c  sisagp - ok
16:26:02.0047 0x052c  [ A9F0486851BECB6DDA1D89D381E71055, 7E909538AB758C18AC2CCBFFEE17BA36FA6ED2E674AA70924AA87AC61375FF35 ] SiSRaid2        C:\Windows\system32\DRIVERS\SiSRaid2.sys
16:26:02.0047 0x052c  SiSRaid2 - ok
16:26:02.0063 0x052c  [ 3727097B55738E2F554972C3BE5BC1AA, 75D52A596A298C33EC79A3B0B80F25492C08A182ABC679401502DA9597687566 ] SiSRaid4        C:\Windows\system32\DRIVERS\sisraid4.sys
16:26:02.0078 0x052c  SiSRaid4 - ok
16:26:02.0125 0x052c  [ 704B4F81729F676BBF034529FC334D82, 1E50DAF97836807A500284385D99272780A8B69CA88761250451060B207824F8 ] SkypeUpdate    C:\Program Files\Skype\Updater\Updater.exe
16:26:02.0156 0x052c  SkypeUpdate - ok
16:26:02.0172 0x052c  [ 3E21C083B8A01CB70BA1F09303010FCE, 803F8F91299C387110F34A49340E7136AAE91B418E2977A36285EA8F432FF197 ] Smb            C:\Windows\system32\DRIVERS\smb.sys
16:26:02.0203 0x052c  Smb - ok
16:26:02.0234 0x052c  [ 6A984831644ECA1A33FFEAE4126F4F37, 753E23D2B33D47C52C05D892B052CFD96D93B97FB6E9FCB58EF1E4C4A125BF78 ] SNMPTRAP        C:\Windows\System32\snmptrap.exe
16:26:02.0250 0x052c  SNMPTRAP - ok
16:26:02.0265 0x052c  [ 95CF1AE7527FB70F7816563CBC09D942, CE8BACB91A5A86CBCE82619C6C1873B4D7593B00CED3B522E41B8F7F6258CC65 ] spldr          C:\Windows\system32\drivers\spldr.sys
16:26:02.0281 0x052c  spldr - ok
16:26:02.0312 0x052c  [ 866A43013535DC8587C258E43579C764, B2BE846B5167A2ECD1E30C69A81385FCC6EAE6033394D08458A5583D311C4D82 ] Spooler        C:\Windows\System32\spoolsv.exe
16:26:02.0343 0x052c  Spooler - ok
16:26:02.0437 0x052c  [ CF87A1DE791347E75B98885214CED2B8, 7AF4E03D751C951A4E5FBA28200DABFE6B3BF055490163EEEEA84EBA4D0F368A ] sppsvc          C:\Windows\system32\sppsvc.exe
16:26:02.0531 0x052c  sppsvc - ok
16:26:02.0577 0x052c  [ B0180B20B065D89232A78A40FE56EAA6, 4D045B23AD58A8822BE9F20119744A8D47455469D54494745CEB099951DA60FF ] sppuinotify    C:\Windows\system32\sppuinotify.dll
16:26:02.0593 0x052c  sppuinotify - ok
16:26:02.0624 0x052c  [ E4C2764065D66EA1D2D3EBC28FE99C46, 043AEF06A23069DD17675955C834690A5FD8F1948A05B3969F977E823C4E25F5 ] srv            C:\Windows\system32\DRIVERS\srv.sys
16:26:02.0655 0x052c  srv - ok
16:26:02.0687 0x052c  [ 03F0545BD8D4C77FA0AE1CEEDFCC71AB, 4DF31206DF8F33C2975E23C7257ED930C4EDA8BC4E246D8FDA130BB583083ED0 ] srv2            C:\Windows\system32\DRIVERS\srv2.sys
16:26:02.0702 0x052c  srv2 - ok
16:26:02.0733 0x052c  [ BE6BD660CAA6F291AE06A718A4FA8ABC, CD38939CFBA80B882D38099194FC1EBAE15A9D27A4D941DD03C55EC745E52E59 ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys
16:26:02.0749 0x052c  srvnet - ok
16:26:02.0765 0x052c  [ D887C9FD02AC9FA880F6E5027A43E118, F38BAD90EC791368C37C21090302708D2DFB83ECE9096609AD9AA667B2E5592E ] SSDPSRV        C:\Windows\System32\ssdpsrv.dll
16:26:02.0780 0x052c  SSDPSRV - ok
16:26:02.0811 0x052c  [ A36EE93698802CD899F98BFD553D8185, 224CFED921EA230FF8025D259E34968FD2C0FD34BB3A918FB4B9B8BA42BEA5D3 ] ssmdrv          C:\Windows\system32\DRIVERS\ssmdrv.sys
16:26:02.0827 0x052c  ssmdrv - ok
16:26:02.0843 0x052c  [ D318F23BE45D5E3A107469EB64815B50, D74355E6FF215AA8CE53BC9DF16AF2740F2FC2FD754939478A3608BDA8C6DDA0 ] SstpSvc        C:\Windows\system32\sstpsvc.dll
16:26:02.0858 0x052c  SstpSvc - ok
16:26:02.0889 0x052c  [ DB32D325C192B801DF274BFD12A7E72B, F089DBA719E22BC269720A6B840B873A4AF5639745DB0C3DBC8BD2F2839A1ABA ] stexstor        C:\Windows\system32\DRIVERS\stexstor.sys
16:26:02.0905 0x052c  stexstor - ok
16:26:02.0952 0x052c  [ E1FB3706030FB4578A0D72C2FC3689E4, A62EC9AA4514CAF2A10C0A3AEF7A36F593A7E7DA370A3F130C24E1B612E19427 ] StiSvc          C:\Windows\System32\wiaservc.dll
16:26:02.0983 0x052c  StiSvc - ok
16:26:03.0014 0x052c  [ 472AF0311073DCECEAA8FA18BA2BDF89, 089414057EB2047E42C96C1ACE79D509967461DC5A4D2836F63C04268637A3FC ] storflt        C:\Windows\system32\drivers\vmstorfl.sys
16:26:03.0030 0x052c  storflt - ok
16:26:03.0045 0x052c  [ 0BF669F0A910BEDA4A32258D363AF2A5, 83EEBACDE4F69A2866B69CAA633F5C8B3CB01D88CEDB01B6EA5988E0A25CEE47 ] StorSvc        C:\Windows\system32\storsvc.dll
16:26:03.0061 0x052c  StorSvc - ok
16:26:03.0092 0x052c  [ DCAFFD62259E0BDB433DD67B5BB37619, CBD12FF9BBF33D18B0F3D322B12EC62E7DF3BF45C6AD43D2E91FF4C4762E05D0 ] storvsc        C:\Windows\system32\drivers\storvsc.sys
16:26:03.0092 0x052c  storvsc - ok
16:26:03.0092 0x052c  [ E58C78A848ADD9610A4DB6D214AF5224, 1575A90EB22A4FB066459BDA00C6CAC10198C3C8C74493721EC6D34B51F50426 ] swenum          C:\Windows\system32\drivers\swenum.sys
16:26:03.0108 0x052c  swenum - ok
16:26:03.0123 0x052c  [ A28BD92DF340E57B024BA433165D34D7, 889CC7FF143C3549982128473FF927CD80CF36485A347EF399C1271C8CE12CE4 ] swprv          C:\Windows\System32\swprv.dll
16:26:03.0155 0x052c  swprv - ok
16:26:03.0155 0x052c  Synth3dVsc - ok
16:26:03.0201 0x052c  [ 36650D618CA34C9D357DFD3D89B2C56F, 7C3774E53DCF32CB3A4B3504E32D2A651E18467FA0A6AC4C7993C696741B704B ] SysMain        C:\Windows\system32\sysmain.dll
16:26:03.0248 0x052c  SysMain - ok
16:26:03.0279 0x052c  [ 763FECDC3D30C815FE72DD57936C6CD1, 1A62C7E63E426D56894F4121C75D9C60FC9A14469ADBD0D6F0B94B8DE48CDA3E ] TabletInputService C:\Windows\System32\TabSvc.dll
16:26:03.0295 0x052c  TabletInputService - ok
16:26:03.0326 0x052c  [ 613BF4820361543956909043A265C6AC, FCFF02E466D2501630B452627FB218C01E5245A0921EE3D2117E7FD63AC7E98E ] TapiSrv        C:\Windows\System32\tapisrv.dll
16:26:03.0357 0x052c  TapiSrv - ok
16:26:03.0373 0x052c  [ B799D9FDB26111737F58288D8DC172D9, 409A60819A4305699E2E492A6190637FAAEBD19E745A5DB2A5D6977106C86591 ] TBS            C:\Windows\System32\tbssvc.dll
16:26:03.0389 0x052c  TBS - ok
16:26:03.0451 0x052c  [ 7C0507D2391AF5933600CBCED799F277, DFDE97BA412CE8045BF091B42E648E422CD47419C5F2E01AA74D76B1E3112D07 ] Tcpip          C:\Windows\system32\drivers\tcpip.sys
16:26:03.0498 0x052c  Tcpip - ok
16:26:03.0529 0x052c  [ 7C0507D2391AF5933600CBCED799F277, DFDE97BA412CE8045BF091B42E648E422CD47419C5F2E01AA74D76B1E3112D07 ] TCPIP6          C:\Windows\system32\DRIVERS\tcpip.sys
16:26:03.0560 0x052c  TCPIP6 - ok
16:26:03.0591 0x052c  [ CCA24162E055C3714CE5A88B100C64ED, 9B7712E793B9478BA7A1EF71EA9CC03CCB9C4004C54EAA911F158958519EDCD9 ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys
16:26:03.0607 0x052c  tcpipreg - ok
16:26:03.0638 0x052c  [ 1CB91B2BD8F6DD367DFC2EF26FD751B2, 879E2827354BB21573AC6A7CCEB746D44214540687E6882FFCB4089546FBD954 ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys
16:26:03.0654 0x052c  TDPIPE - ok
16:26:03.0669 0x052c  [ 2C2C5AFE7EE4F620D69C23C0617651A8, E828D974C3F9D7004A030C3AD448096C736FDB4C4C1707D043E567D08C845103 ] TDTCP          C:\Windows\system32\drivers\tdtcp.sys
16:26:03.0685 0x052c  TDTCP - ok
16:26:03.0701 0x052c  [ B459575348C20E8121D6039DA063C704, 1B4328A9EA39FF5A57F258E02254D04B73455F1DF7C997C13702A8B2F12D0347 ] tdx            C:\Windows\system32\DRIVERS\tdx.sys
16:26:03.0716 0x052c  tdx - ok
16:26:03.0747 0x052c  [ 04DBF4B01EA4BF25A9A3E84AFFAC9B20, 0D81B427720637882077C5024D738191F858FC734ED040697872D906351EF663 ] TermDD          C:\Windows\system32\drivers\termdd.sys
16:26:03.0779 0x052c  TermDD - ok
16:26:03.0825 0x052c  [ 382C804C92811BE57829D8E550A900E2, 5F52C2E7902024CF1C9CC0069F411C3F19CCA3DB209F437FA0F3932D4898EB50 ] TermService    C:\Windows\System32\termsrv.dll
16:26:03.0857 0x052c  TermService - ok
16:26:03.0872 0x052c  [ 42FB6AFD6B79D9FE07381609172E7CA4, B57C85091209A2FAD19ED490B8FA7FC98F12911F9C9CACE9AF1E540780CE6700 ] Themes          C:\Windows\system32\themeservice.dll
16:26:03.0919 0x052c  Themes - ok
16:26:03.0935 0x052c  [ 146B6F43A673379A3C670E86D89BE5EA, C4412DCF80DE6B55466F399413271364F14BC0819C224AA161EDDC31A9775440 ] THREADORDER    C:\Windows\system32\mmcss.dll
16:26:03.0966 0x052c  THREADORDER - ok
16:26:03.0997 0x052c  [ 4792C0378DB99A9BC2AE2DE6CFFF0C3A, 532A3A812578B2DFD83001DE66FC73689D79EC729409EB572E07E6D65B281712 ] TrkWks          C:\Windows\System32\trkwks.dll
16:26:04.0013 0x052c  TrkWks - ok
16:26:04.0075 0x052c  [ 2C49B175AEE1D4364B91B531417FE583, 6C7995E18F84E465C376D1D5F153C15ACB66CDEA86EE5BF186677F572E7E129B ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
16:26:04.0106 0x052c  TrustedInstaller - ok
16:26:04.0122 0x052c  [ 254BB140EEE3C59D6114C1A86B636877, EE09D62E90407A40278F2136F640DAB16A4E2BF57D4FB6E05F92CA9CC9CF57C0 ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys
16:26:04.0137 0x052c  tssecsrv - ok
16:26:04.0169 0x052c  [ FD1D6C73E6333BE727CBCC6054247654, 6F7B9AE1A5986204DB3348D13B303F30FC17624939DA74D6BD114FAEED0FB30E ] TsUsbFlt        C:\Windows\system32\drivers\tsusbflt.sys
16:26:04.0200 0x052c  TsUsbFlt - ok
16:26:04.0200 0x052c  tsusbhub - ok
16:26:04.0231 0x052c  [ B2FA25D9B17A68BB93D58B0556E8C90D, 0146931B733CAB1CD87F94C35F97E110D6ED6C55EAFF03345400A29AEDE99BDE ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys
16:26:04.0262 0x052c  tunnel - ok
16:26:04.0278 0x052c  [ 750FBCB269F4D7DD2E420C56B795DB6D, E1A95C59148FE463539C34336FD0E74B31A33B8AB2B8E34AA10349C3347471D7 ] uagp35          C:\Windows\system32\DRIVERS\uagp35.sys
16:26:04.0293 0x052c  uagp35 - ok
16:26:04.0309 0x052c  [ EE43346C7E4B5E63E54F927BABBB32FF, BAD6FC3BEE45E644D5A6A0A31428F5B2AEC72A0AA0C74EF8177B1FE23EEF3AA9 ] udfs            C:\Windows\system32\DRIVERS\udfs.sys
16:26:04.0325 0x052c  udfs - ok
16:26:04.0340 0x052c  [ 8344FD4FCE927880AA1AA7681D4927E5, 1B54EFA60A221E2B9FFE59BB41C7E7D8B5AC6826F1C5577456D81371D464255A ] UI0Detect      C:\Windows\system32\UI0Detect.exe
16:26:04.0356 0x052c  UI0Detect - ok
16:26:04.0387 0x052c  [ 44E8048ACE47BEFBFDC2E9BE4CBC8880, 5D96D90FDF68AE470CC92CA9DF9DA2C05A53EF455A5A109DBBF7C96F3238257C ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys
16:26:04.0403 0x052c  uliagpkx - ok
16:26:04.0418 0x052c  [ D295BED4B898F0FD999FCFA9B32B071B, D4130DB4AE76EE6DC0B8E7A4FEF5CB8B26EBD822C21021F6FA78FD29C1E211C2 ] umbus          C:\Windows\system32\drivers\umbus.sys
16:26:04.0434 0x052c  umbus - ok
16:26:04.0449 0x052c  [ 7550AD0C6998BA1CB4843E920EE0FEAC, 24C001E422C3B3B920CDCF6003A3179CE464DE4284775403DD5122EF9780460D ] UmPass          C:\Windows\system32\DRIVERS\umpass.sys
16:26:04.0465 0x052c  UmPass - ok
16:26:04.0481 0x052c  [ 409994A8EACEEE4E328749C0353527A0, FFC57B647147DE2957A7DE4B330CC534DE7AC892A2FCE3BB164F7A516CAB1B56 ] UmRdpService    C:\Windows\System32\umrdp.dll
16:26:04.0496 0x052c  UmRdpService - ok
16:26:04.0543 0x052c  [ F76057596EF65049869098677AB72C30, 4EE9353243CB64D0A3AFE060924D93225FB2EB085212F3AEC7A862FFF449C82A ] UNS            C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
16:26:04.0574 0x052c  UNS - ok
16:26:04.0605 0x052c  [ 833FBB672460EFCE8011D262175FAD33, C0C3067A305993CBF056C229771CB0593DD60C9C7AC5130FF1CA610BCA812AB5 ] upnphost        C:\Windows\System32\upnphost.dll
16:26:04.0637 0x052c  upnphost - ok
16:26:04.0668 0x052c  [ 7E72E7D7E0757D59481D530FD2B0BFAE, 288CAC9F4AC09DEB2B30C6E3A6ACF8D62A75576F62F0EC159D5E1B257419E9DC ] usbccgp        C:\Windows\system32\DRIVERS\usbccgp.sys
16:26:04.0683 0x052c  usbccgp - ok
16:26:04.0699 0x052c  [ 04EC7CEC62EC3B6D9354EEE93327FC82, 6CB41D8644618A5F701F6CA91FB65BB94AA83EA48992133B5262DC539B334B2E ] usbcir          C:\Windows\system32\drivers\usbcir.sys
16:26:04.0715 0x052c  usbcir - ok
16:26:04.0730 0x052c  [ CFBCE999C057D78979A181C9C60F208E, D60698EAA8A085214D5945818B0863976CF116EBE523046C344AF4E9392FDF80 ] usbehci        C:\Windows\system32\drivers\usbehci.sys
16:26:04.0746 0x052c  usbehci - ok
16:26:04.0761 0x052c  [ 9D22AAD9AC6A07C691A1113E5F860868, AC34D36DBB5649650FCD873A792CA1387AE841D4C46781C63C0D29834F9B58E9 ] usbhub          C:\Windows\system32\drivers\usbhub.sys
16:26:04.0777 0x052c  usbhub - ok
16:26:04.0793 0x052c  [ A6FB7957EA7AFB1165991E54CE934B74, 1CE83D9E3276AE380F720C7700A17D58A37A2A77FD72DA69EE0C756B88DB3689 ] usbohci        C:\Windows\system32\drivers\usbohci.sys
16:26:04.0808 0x052c  usbohci - ok
16:26:04.0839 0x052c  [ 797D862FE0875E75C7CC4C1AD7B30252, 1BBE745E4C85F8911076F6032ACD7A35FAC048D3CB1500C64E08D8B2C70A1069 ] usbprint        C:\Windows\system32\DRIVERS\usbprint.sys
16:26:04.0839 0x052c  usbprint - ok
16:26:04.0871 0x052c  [ 576096CCBC07E7C4EA4F5E6686D6888F, 8C643F43BD0017979548389C4DB36A1EE872CCF19C86FAE3752A4989173E28ED ] usbscan        C:\Windows\system32\DRIVERS\usbscan.sys
16:26:04.0886 0x052c  usbscan - ok
16:26:04.0917 0x052c  [ BF63EBFC6979FEFB2BC03DF7989A0C1A, AFEF764A3E5D52CDBB5074F0E87F2B5EBCDF8D9B6E8F88EE235602B80145BE31 ] USBSTOR        C:\Windows\system32\DRIVERS\USBSTOR.SYS
16:26:04.0933 0x052c  USBSTOR - ok
16:26:04.0964 0x052c  [ 78780C3EBCE17405B1CCD07A3A8A7D72, FBFF3111E22EE0B4BCAFA81F89AAE985135BFF48EEFD130C09B49CCF8A9946B9 ] usbuhci        C:\Windows\system32\drivers\usbuhci.sys
16:26:04.0964 0x052c  usbuhci - ok
16:26:05.0011 0x052c  [ 45F4E7BF43DB40A6C6B4D92C76CBC3F2, F9B72DE82078FDB5551D48988190F46EECA9B99655C591B7865FEA1AFB31F637 ] usbvideo        C:\Windows\system32\Drivers\usbvideo.sys
16:26:05.0042 0x052c  usbvideo - ok
16:26:05.0058 0x052c  [ 081E6E1C91AEC36758902A9F727CD23C, 9FDAA17A3B99067E035E5D76305427F15FFDBC5D304B2BB78AFC6463EDDE1A75 ] UxSms          C:\Windows\System32\uxsms.dll
16:26:05.0089 0x052c  UxSms - ok
16:26:05.0089 0x052c  [ 81951F51E318AECC2D68559E47485CC4, ACF76395EF4A2ED03AB919A9DA04D3A4C03B4D0EDC60BE123B3BE1AFE78BC71B ] VaultSvc        C:\Windows\system32\lsass.exe
16:26:05.0105 0x052c  VaultSvc - ok
16:26:05.0105 0x052c  [ A059C4C3EDB09E07D21A8E5C0AABD3CB, BDD3729B49DF2E2FC72FFEF9D10235B481A671DE5A721B6B9A80873B7A343F07 ] vdrvroot        C:\Windows\system32\drivers\vdrvroot.sys
16:26:05.0120 0x052c  vdrvroot - ok
16:26:05.0151 0x052c  [ C3CD30495687C2A2F66A65CA6FD89BE9, 582E4706C1D6A151020D14B26C7BF166F4E42BDD6E410F30EC452469270C5E9B ] vds            C:\Windows\System32\vds.exe
16:26:05.0183 0x052c  vds - ok
16:26:05.0198 0x052c  [ 17C408214EA61696CEC9C66E388B14F3, 829C0416672E2B2DFABCFE641E7F281F41E8DBB3C0EF11C7784CB9BB94F87E97 ] vga            C:\Windows\system32\DRIVERS\vgapnp.sys
16:26:05.0229 0x052c  vga - ok
16:26:05.0245 0x052c  [ 8E38096AD5C8570A6F1570A61E251561, 4DBA3C1397A2203548F45F006E66D99F837903F601ABBCE2304754F783CA8A39 ] VgaSave        C:\Windows\System32\drivers\vga.sys
16:26:05.0276 0x052c  VgaSave - ok
16:26:05.0276 0x052c  VGPU - ok
16:26:05.0307 0x052c  [ 5461686CCA2FDA57B024547733AB42E3, 2721D0659AA890172FCAD4EC4D926B58ACD0EE4887DA51545DC7237420D5BF84 ] vhdmp          C:\Windows\system32\drivers\vhdmp.sys
16:26:05.0307 0x052c  vhdmp - ok
16:26:05.0323 0x052c  [ C829317A37B4BEA8F39735D4B076E923, 55D1796AE750071E1E05BD7702B6C355CCFFE27B4C00E93E7044C3184732B497 ] viaagp          C:\Windows\system32\drivers\viaagp.sys
16:26:05.0339 0x052c  viaagp - ok
16:26:05.0354 0x052c  [ E02F079A6AA107F06B16549C6E5C7B74, B530DCE3EE4F285B3D5F69F7148D17E016D54F04E6F93706B829A34567748788 ] ViaC7          C:\Windows\system32\DRIVERS\viac7.sys
16:26:05.0354 0x052c  ViaC7 - ok
16:26:05.0385 0x052c  [ E43574F6A56A0EE11809B48C09E4FD3C, 3687BF638E21C00E62ABFED70D728B91ADA08F7164CA898E654F31DA196589E9 ] viaide          C:\Windows\system32\drivers\viaide.sys
16:26:05.0385 0x052c  viaide - ok
16:26:05.0401 0x052c  [ C2F2911156FDC7817C52829C86DA494E, FE499F189B5016FCE0018AA3DE3970B72275B7B15F3D4D608117F6DDEC6B90DC ] vmbus          C:\Windows\system32\drivers\vmbus.sys
16:26:05.0417 0x052c  vmbus - ok
16:26:05.0432 0x052c  [ D4D77455211E204F370D08F4963063CE, 2018B2A84C73E0834200A594C02A9D28C74906F126DAD3CCDDFC9CD9A61669E2 ] VMBusHID        C:\Windows\system32\drivers\VMBusHID.sys
16:26:05.0432 0x052c  VMBusHID - ok
16:26:05.0448 0x052c  [ 4C63E00F2F4B5F86AB48A58CD990F212, 9796BD4B9CFEEEAF57C5E332A732EFC2770B21F9B35301A5D202F5FC52C1E035 ] volmgr          C:\Windows\system32\drivers\volmgr.sys
16:26:05.0463 0x052c  volmgr - ok
16:26:05.0479 0x052c  [ B5BB72067DDDDBBFB04B2F89FF8C3C87, 65B9AD55F43940A5FDD88B6EC5034A7E375DF8E6F5F1AE6519A4BD6B7E992EBC ] volmgrx        C:\Windows\system32\drivers\volmgrx.sys
16:26:05.0495 0x052c  volmgrx - ok
16:26:05.0510 0x052c  [ F497F67932C6FA693D7DE2780631CFE7, DAE544ED99D2CF570DA31343BD87D2F856D0D13529656D38E1BF854C77F017F6 ] volsnap        C:\Windows\system32\drivers\volsnap.sys
16:26:05.0526 0x052c  volsnap - ok
16:26:05.0557 0x052c  [ 9DFA0CC2F8855A04816729651175B631, 37FD9E43A2A3F125E94A315FB4CD8A1B5499A5FD74806EB2D1E5DA88C070D3A3 ] vsmraid        C:\Windows\system32\DRIVERS\vsmraid.sys
16:26:05.0557 0x052c  vsmraid - ok
16:26:05.0619 0x052c  [ 209A3B1901B83AEB8527ED211CCE9E4C, 1A431F6409F8E0531F600F8F988ECECECB902DA26BBAAF1DE74A5CAC29A7CB44 ] VSS            C:\Windows\system32\vssvc.exe
16:26:05.0666 0x052c  VSS - ok
16:26:05.0682 0x052c  [ 90567B1E658001E79D7C8BBD3DDE5AA6, EFC23BEEA7F54A2DC56CB523DAD1AF0358D904C5278BF08873910E2DB3F13557 ] vwifibus        C:\Windows\System32\drivers\vwifibus.sys
16:26:05.0713 0x052c  vwifibus - ok
16:26:05.0760 0x052c  [ 55187FD710E27D5095D10A472C8BAF1C, AE298E2D3BA366BCBDC092C717214C181E8843FA564A6DFB07FC3238A5A68DC3 ] W32Time        C:\Windows\system32\w32time.dll
16:26:05.0775 0x052c  W32Time - ok
16:26:05.0807 0x052c  [ DE3721E89C653AA281428C8A69745D90, 501C78056ED4295625D8A5412025FD2F0CA24077044D3A5800BA79DF3D946516 ] WacomPen        C:\Windows\system32\DRIVERS\wacompen.sys
16:26:05.0822 0x052c  WacomPen - ok
16:26:05.0853 0x052c  [ 3C3C78515F5AB448B022BDF5B8FFDD2E, 35284174A42039C3C1FF8A3C8BC187A5E067C7782FC62D19749C2CB28C4E36C7 ] WANARP          C:\Windows\system32\DRIVERS\wanarp.sys
16:26:05.0885 0x052c  WANARP - ok
16:26:05.0885 0x052c  [ 3C3C78515F5AB448B022BDF5B8FFDD2E, 35284174A42039C3C1FF8A3C8BC187A5E067C7782FC62D19749C2CB28C4E36C7 ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys
16:26:05.0900 0x052c  Wanarpv6 - ok
16:26:05.0947 0x052c  [ 691E3285E53DCA558E1A84667F13E15A, 12EDB66EF8FC100402BEA221F354D3BD5542F6DDF715B6E7D873D6BAE7E3D329 ] wbengine        C:\Windows\system32\wbengine.exe
16:26:05.0994 0x052c  wbengine - ok
16:26:06.0009 0x052c  [ 9614B5D29DC76AC3C29F6D2D3AA70E67, A2FFB92F0030B4CD771E862DA575ECCF2F3A5B4B85858C1241A0C59262C0EC88 ] WbioSrvc        C:\Windows\System32\wbiosrvc.dll
16:26:06.0025 0x052c  WbioSrvc - ok
16:26:06.0056 0x052c  [ 34EEE0DFAADB4F691D6D5308A51315DC, A040A03E25A0C78B9E26F86C2DF95BCAF8E7EC90183CEB295615D3265350EBEE ] wcncsvc        C:\Windows\System32\wcncsvc.dll
16:26:06.0087 0x052c  wcncsvc - ok
16:26:06.0087 0x052c  [ 5D930B6357A6D2AF4D7653BDABBF352F, 677FF2ED14EE0B0CAA710DA81556CC16D5971DAB10E7C7432D167A87CA6F0EAA ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
16:26:06.0103 0x052c  WcsPlugInService - ok
16:26:06.0119 0x052c  [ 1112A9BADACB47B7C0BB0392E3158DFF, 1AE2AFA125973571F91E6945FE8A735F63D76EBB250A0075D98C580167FD9ED4 ] Wd              C:\Windows\system32\DRIVERS\wd.sys
16:26:06.0134 0x052c  Wd - ok
16:26:06.0150 0x052c  [ 9950E3D0F08141C7E89E64456AE7DC73, DE4B96812B305A63F5874BBF2DC40354FB45B3D96C1D33436E677099760BA448 ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys
16:26:06.0165 0x052c  Wdf01000 - ok
16:26:06.0181 0x052c  [ 46EF9DC96265FD0B423DB72E7C38C2A5, 43801A51FB0E45CFFC73DF6441B54A75FC2FEAF5E0424DFE7AB04FC26CF6CD16 ] WdiServiceHost  C:\Windows\system32\wdi.dll
16:26:06.0197 0x052c  WdiServiceHost - ok
16:26:06.0197 0x052c  [ 46EF9DC96265FD0B423DB72E7C38C2A5, 43801A51FB0E45CFFC73DF6441B54A75FC2FEAF5E0424DFE7AB04FC26CF6CD16 ] WdiSystemHost  C:\Windows\system32\wdi.dll
16:26:06.0212 0x052c  WdiSystemHost - ok
16:26:06.0228 0x052c  [ A9D880F97530D5B8FEE278923349929D, 6A293E2DB9B7C434EA8B4CD4861E11905D46BD60E014AE27B74DC8C4B2DDF834 ] WebClient      C:\Windows\System32\webclnt.dll
16:26:06.0275 0x052c  WebClient - ok
16:26:06.0306 0x052c  [ 760F0AFE937A77CFF27153206534F275, A53940BA28854486FF18F16B98A3314B36322B0B6EFB54D08B921315BEB0ADD5 ] Wecsvc          C:\Windows\system32\wecsvc.dll
16:26:06.0337 0x052c  Wecsvc - ok
16:26:06.0353 0x052c  [ AC804569BB2364FB6017370258A4091B, 1856F354146A5946F3E7D0DD09726FC8A3502B0F0776FEADDF10669C81CC28E2 ] wercplsupport  C:\Windows\System32\wercplsupport.dll
16:26:06.0368 0x052c  wercplsupport - ok
16:26:06.0399 0x052c  [ 08E420D873E4FD85241EE2421B02C4A4, E1E9436EB096FF7DE9A76DA6217035257EF9FC7565DDB9016DCA3859E7F1EF0F ] WerSvc          C:\Windows\System32\WerSvc.dll
16:26:06.0415 0x052c  WerSvc - ok
16:26:06.0431 0x052c  [ 8B9A943F3B53861F2BFAF6C186168F79, 88E2F79F32AFBA17CB8377A508B83A1EC2315E9F3A365F591C87FE4525AA6713 ] WfpLwf          C:\Windows\system32\DRIVERS\wfplwf.sys
16:26:06.0446 0x052c  WfpLwf - ok
16:26:06.0462 0x052c  [ 5CF95B35E59E2A38023836FFF31BE64C, CEA21302B3E855EE592810D4E0DE10E47A47A393064C435463CD54598735CD8D ] WIMMount        C:\Windows\system32\drivers\wimmount.sys
16:26:06.0477 0x052c  WIMMount - ok
16:26:06.0540 0x052c  [ 3FAE8F94296001C32EAB62CD7D82E0FD, 180FAECC426CF8F46700C855022E5865D528B1A20686F96D11080AB2FE2E0430 ] WinDefend      C:\Program Files\Windows Defender\mpsvc.dll
16:26:06.0571 0x052c  WinDefend - ok
16:26:06.0571 0x052c  WinHttpAutoProxySvc - ok
16:26:06.0618 0x052c  [ F62E510B6AD4C21EB9FE8668ED251826, FA3E5CAC3E67E49377320CFBE4646585E6B62168292768FEA81E4623F9166890 ] Winmgmt        C:\Windows\system32\wbem\WMIsvc.dll
16:26:06.0649 0x052c  Winmgmt - ok
16:26:06.0711 0x052c  [ 1B91CD34EA3A90AB6A4EF0550174F4CC, 5B6618615EBFBA594C945AD35F5C68DA8C6053892B6D12D626BB6120910D80DC ] WinRM          C:\Windows\system32\WsmSvc.dll
16:26:06.0758 0x052c  WinRM - ok
16:26:06.0805 0x052c  [ A67E5F9A400F3BD1BE3D80613B45F708, E170A8BD31A779403DC9C43ED6483DA8E186512D3EE700B87F6BA292E284E367 ] WinUsb          C:\Windows\system32\DRIVERS\WinUsb.sys
16:26:06.0821 0x052c  WinUsb - ok
16:26:06.0867 0x052c  [ 16935C98FF639D185086A3529B1F2067, E9C6B73A572A04FCE9B1B0E6815F941B10332D9A6D55B92927C2B1275F119091 ] Wlansvc        C:\Windows\System32\wlansvc.dll
16:26:06.0914 0x052c  Wlansvc - ok
16:26:06.0961 0x052c  [ 0217679B8FCA58714C3BF2726D2CA84E, 4494984B922DCF24D37BCD0E6831CEBD07D1CA49235D04E821D17ED3DF84ED2A ] WmiAcpi        C:\Windows\system32\drivers\wmiacpi.sys
16:26:07.0008 0x052c  WmiAcpi - ok
16:26:07.0039 0x052c  [ 6EB6B66517B048D87DC1856DDF1F4C3F, EBB534C4829477C70062ADBB5626236B02FE563A544C53FA255E79F3CA170FE8 ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe
16:26:07.0055 0x052c  wmiApSrv - ok
16:26:07.0133 0x052c  [ 3B40D3A61AA8C21B88AE57C58AB3122E, 6C67DCB007C3CDF2EB0BBF5FD89C32CD7800C20F7166872F8C387BE262C5CD21 ] WMPNetworkSvc  C:\Program Files\Windows Media Player\wmpnetwk.exe
16:26:07.0179 0x052c  WMPNetworkSvc - ok
16:26:07.0195 0x052c  [ A2F0EC770A92F2B3F9DE6D518E11409C, 6838F2148B11285E00DC449D51F8AD85AAE57694E89BA2C607B87AC1C650D845 ] WPCSvc          C:\Windows\System32\wpcsvc.dll
16:26:07.0226 0x052c  WPCSvc - ok
16:26:07.0273 0x052c  [ AA53356D60AF47EACC85BC617A4F3F66, 155CB8112AA382D841C1891750FF29EF4F1BF716CD9CDF0F2243209E2CCCAC98 ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll
16:26:07.0304 0x052c  WPDBusEnum - ok
16:26:07.0320 0x052c  [ 6DB3276587B853BF886B69528FDB048C, 9972FF6DF0DF6F86D1E9BCEF4C29064748B217DA196B0633C30D3D580144951C ] ws2ifsl        C:\Windows\system32\drivers\ws2ifsl.sys
16:26:07.0367 0x052c  ws2ifsl - ok
16:26:07.0398 0x052c  [ 6F5D49EFE0E7164E03AE773A3FE25340, 15B6AFF7455538189A96F8863CC995A271E02C6FBDAC15B037D44DDA65E61339 ] wscsvc          C:\Windows\System32\wscsvc.dll
16:26:07.0413 0x052c  wscsvc - ok
16:26:07.0413 0x052c  WSearch - ok
16:26:07.0507 0x052c  [ D9B0134913E5EF007AF82A418C503322, 7418DD28C8E968674382F8352AAFFC4DE77887E2B71B8844D615F19432B4C55A ] wuauserv        C:\Windows\system32\wuaueng.dll
16:26:07.0554 0x052c  wuauserv - ok
16:26:07.0569 0x052c  [ E714A1C0354636837E20CCBF00888EE7, 0E31F0DB0AA318E3B0DACD26C0D3B11519B42F2A996AE580BE67FA8B3C42C436 ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys
16:26:07.0601 0x052c  WudfPf - ok
16:26:07.0632 0x052c  [ 1023EE888C9B47178C5293ED5336AB69, 62221C80C3F719A585266247482A64F7CB2F5EF69AFA8FA07D563CA2B0A37561 ] WUDFRd          C:\Windows\system32\DRIVERS\WUDFRd.sys
16:26:07.0647 0x052c  WUDFRd - ok
16:26:07.0679 0x052c  [ 8D1E1E529A2C9E9B6A85B55A345F7629, 64B637CFE2AF58A4F7CE6D8C3D603F8EFD527500F7137E0A37840313C712CA93 ] wudfsvc        C:\Windows\System32\WUDFSvc.dll
16:26:07.0710 0x052c  wudfsvc - ok
16:26:07.0725 0x052c  [ FF2D745B560F7C71B31F30F4D49F73D2, B2FBF7E5F58E34AC64FE6CF65800F1F07939279203BDE89375FAC92B884A4F37 ] WwanSvc        C:\Windows\System32\wwansvc.dll
16:26:07.0741 0x052c  WwanSvc - ok
16:26:07.0772 0x052c  ================ Scan global ===============================
16:26:07.0788 0x052c  [ DAB748AE0439955ED2FA22357533DDDB, 73EDD402C7479DDCE1998D0C7E99E1EC2974F64EFC33A851439CC85D09EDCDF9 ] C:\Windows\system32\basesrv.dll
16:26:07.0835 0x052c  [ 1F5F07091D50244F17DD8D5147A628CC, 2F2B84BD1C052F44662960953C0EC91F9233D4D8DD06512E3E3BE43CE216BCB6 ] C:\Windows\system32\winsrv.dll
16:26:07.0850 0x052c  [ 1F5F07091D50244F17DD8D5147A628CC, 2F2B84BD1C052F44662960953C0EC91F9233D4D8DD06512E3E3BE43CE216BCB6 ] C:\Windows\system32\winsrv.dll
16:26:07.0881 0x052c  [ 364455805E64882844EE9ACB72522830, 906561DBBB33F744844CF27E456226044C85DF0FCFD26DE1FD11E09E2CFA6F8F ] C:\Windows\system32\sxssrv.dll
16:26:07.0897 0x052c  [ 5F1B6A9C35D3D5CA72D6D6FDEF9747D6, D7BC4ED605B32274B45328FD9914FB0E7B90D869A38F0E6F94FB1BF4E9E2B407 ] C:\Windows\system32\services.exe
16:26:07.0913 0x052c  [ Global ] - ok
16:26:07.0913 0x052c  ================ Scan MBR ==================================
16:26:07.0913 0x052c  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
16:26:08.0459 0x052c  \Device\Harddisk0\DR0 - ok
16:26:08.0459 0x052c  ================ Scan VBR ==================================
16:26:08.0474 0x052c  [ 7EB6D42422E4D4750FB47F120E73EC8D ] \Device\Harddisk0\DR0\Partition1
16:26:08.0474 0x052c  \Device\Harddisk0\DR0\Partition1 - ok
16:26:08.0474 0x052c  [ ED3ACBC27E9ECE68348B80DC9B2C713C ] \Device\Harddisk0\DR0\Partition2
16:26:08.0505 0x052c  \Device\Harddisk0\DR0\Partition2 - ok
16:26:08.0505 0x052c  ================ Scan generic autorun ======================
16:26:08.0537 0x052c  [ A06F7F4CC1DE6B09D0F2AA2929F1C9C1, 36096B33D76D1CE0B0202353F61C518AA82AEF0154B432BE02B8407AD604E008 ] C:\Windows\system32\igfxtray.exe
16:26:08.0552 0x052c  IgfxTray - ok
16:26:08.0568 0x052c  [ 56D846CE0FCD717C1CAAD8CDA70C44A3, B4F572FD679C0A7214886304927E6088D94F16D1A1AE206EE5F25CDA5341FDA4 ] C:\Windows\system32\hkcmd.exe
16:26:08.0568 0x052c  HotKeysCmds - ok
16:26:08.0583 0x052c  [ 33EE3641326C7FAFFA433F64BDA3244E, 5FAD35BB0B49810FCF2426E846343DEC9EEA42694E8053CA50F44FD9C43422E8 ] C:\Windows\system32\igfxpers.exe
16:26:08.0599 0x052c  Persistence - ok
16:26:08.0677 0x052c  [ DCCA4B04AF87E52EF9EAA2190E06CBAC, 8858CFD159BB32AE9FCCA1A79EA83C876D481A286E914071D48F42FCA5B343D8 ] C:\Program Files\Windows Sidebar\Sidebar.exe
16:26:08.0724 0x052c  Sidebar - ok
16:26:08.0739 0x052c  [ BBA1A5B86134F496B926DDAF247DB871, 636990AE49C55189B7EF69C419787440B57EC0BAD98A9C280E1028F741BB222E ] C:\Windows\System32\mctadmin.exe
16:26:08.0755 0x052c  mctadmin - ok
16:26:08.0786 0x052c  [ DCCA4B04AF87E52EF9EAA2190E06CBAC, 8858CFD159BB32AE9FCCA1A79EA83C876D481A286E914071D48F42FCA5B343D8 ] C:\Program Files\Windows Sidebar\Sidebar.exe
16:26:08.0817 0x052c  Sidebar - ok
16:26:08.0817 0x052c  [ BBA1A5B86134F496B926DDAF247DB871, 636990AE49C55189B7EF69C419787440B57EC0BAD98A9C280E1028F741BB222E ] C:\Windows\System32\mctadmin.exe
16:26:08.0833 0x052c  mctadmin - ok
16:26:08.0833 0x052c  Waiting for KSN requests completion. In queue: 289
16:26:09.0847 0x052c  Waiting for KSN requests completion. In queue: 289
16:26:10.0861 0x052c  Waiting for KSN requests completion. In queue: 289
16:26:11.0875 0x052c  Waiting for KSN requests completion. In queue: 289
16:26:12.0951 0x052c  AV detected via SS2: AVG AntiVirus Free Edition 2015, C:\Program Files\AVG\AVG2015\avgwsc.exe ( 15.0.0.5941 ), 0x41000 ( enabled : updated )
16:26:12.0967 0x052c  Win FW state via NFP2: enabled
16:26:15.0588 0x052c  ============================================================
16:26:15.0588 0x052c  Scan finished
16:26:15.0588 0x052c  ============================================================
16:26:15.0588 0x0d04  Detected object count: 0
16:26:15.0588 0x0d04  Actual detected object count: 0
Bin kein Computerexperte.. Hoffe das war bisher so ok.. :-)

AVG hat gerade ein Programm gefunden.. TojanInject2.CCSJ

Von Programme/Windows Search 5.3.10/5mk1owasew99.exe

schrauber 14.05.2015 09:33
Bevor wir jetzt irgendwas weiter machen:

Hast Du Probleme damit dass deine Daten verschlüsselt sind und nicht mehr nutzbar? Laut ESET Log tummelt sich da auch ein Verschlüsselungstrojaner.

chrischl 14.05.2015 14:22
Moin Moin. Weltweiter Support :-) Thx erstmal dafuer und Nein... Mit den Daten hatte ich bisher keine Probleme, die Kiste war nur unglaublich lahm geworden in den letzten Tagen und die Tuere stand halt sperrangelweit offen fuer alles was reinwollte :-)
C

Der Help_Decrypt ist erst kuerzlich aufgetaucht und muss ueber Dropbox reingekommen sein... Bisher geht noch alles und die Daten sind auch noch ok..
Gruss
C

mhhmm.. Habe gerade nochmal im Startprogramm von Windows geschaut. Metasploit ist natuerlich nicht mehr drin.. Das Programm wurde wahrscheinlich genutzt, um mir den Virus auf den Rechner zu laden.
Nachdem ich nun den ersten Trojaner vom System geloescht habe, der sich in Sys32 vergraben hatte, funktioniert auch der Virenscanner und das Windwos Update wieder. Windows Update laesst sich nicht komplett durchfuehren.. aber die Kiste ist ja auch noch nicht sauber...

Deutsche Behörden nutzen Metasploit für Penetration-Tests | heise Security

Metasploit ? Wikipedia

schrauber 14.05.2015 20:55
Sichere trotzdem mal die Daten.


Scan mit Combofix
WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link
  • WICHTIG: Speichere Combofix auf deinem Desktop.
  • Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
  • Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
  • Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
  • Wenn Combofix fertig ist, wird es ein Logfile erstellen.
  • Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).
Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

chrischl 14.05.2015 22:29
Hi.
So.
Das ist das LogFile von Combofix

Code:
ComboFix 15-05-13.01 - shaka 14/05/2015  18:10:44.1.2 - x86
Microsoft Windows 7 Enterprise  6.1.7601.1.1252.54.3082.18.3495.2542 [GMT -3:00]
Running from: c:\users\shaka\Desktop\ComboFix.exe
AV: AVG AntiVirus Free Edition 2015 *Disabled/Updated* {4D41356F-32AD-7C42-C820-63775EE4F413}
SP: AVG AntiVirus Free Edition 2015 *Disabled/Updated* {F620D48B-1497-73CC-F290-58052563BEAE}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((((((  Other Deletions  )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\shaka\AppData\Roaming\Setup.exe
c:\windows\system32\suf519C.tmp
c:\windows\system32\suf5259.tmp
c:\windows\system32\sufAD41.tmp
c:\windows\system32\sufAD51.tmp
c:\windows\system32\sufE87C.tmp
c:\windows\system32\sufE89C.tmp
.
.
(((((((((((((((((((((((((  Files Created from 2015-04-14 to 2015-05-14  )))))))))))))))))))))))))))))))
.
.
2015-05-14 21:16 . 2015-05-14 21:16        --------        d-----w-        c:\users\shaka\AppData\Local\temp
2015-05-14 21:16 . 2015-05-14 21:16        --------        d-----w-        c:\users\Default\AppData\Local\temp
2015-05-14 13:48 . 2013-12-24 23:09        1987584        ----a-w-        c:\windows\system32\d3d10warp.dll
2015-05-14 13:48 . 2013-11-26 08:16        3419136        ----a-w-        c:\windows\system32\d2d1.dll
2015-05-14 12:10 . 2015-02-03 03:12        1230848        ----a-w-        c:\windows\system32\WindowsCodecs.dll
2015-05-14 12:10 . 2015-04-20 02:56        909312        ----a-w-        c:\windows\system32\FntCache.dll
2015-05-14 12:10 . 2015-04-20 02:56        1250816        ----a-w-        c:\windows\system32\DWrite.dll
2015-05-14 12:10 . 2015-04-20 02:03        2382336        ----a-w-        c:\windows\system32\win32k.sys
2015-05-14 12:10 . 2015-02-04 02:54        417792        ----a-w-        c:\windows\system32\WMPhoto.dll
2015-05-13 20:27 . 2015-05-01 13:16        102608        ----a-w-        c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 20:11 . 2015-05-13 20:15        --------        d-----w-        c:\windows\system32\MRT
2015-05-13 20:04 . 2014-03-09 21:47        99480        ----a-w-        c:\windows\system32\infocardapi.dll
2015-05-13 20:04 . 2014-06-30 22:14        8856        ----a-w-        c:\windows\system32\icardres.dll
2015-05-13 20:04 . 2014-03-09 21:47        619672        ----a-w-        c:\windows\system32\icardagt.exe
2015-05-13 20:04 . 2014-06-06 06:16        35480        ----a-w-        c:\windows\system32\TsWpfWrp.exe
2015-05-13 19:51 . 2015-05-13 19:51        97880        ----a-w-        c:\program files\Internet Explorer\pdmproxy100.dll
2015-05-13 19:50 . 2015-05-13 19:50        9728        ---ha-w-        c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2015-05-13 19:49 . 2015-05-13 19:49        1505280        ----a-w-        c:\windows\system32\d3d11.dll
2015-05-13 19:15 . 2014-07-14 01:42        654336        ----a-w-        c:\windows\system32\rpcrt4.dll
2015-05-13 19:15 . 2014-11-11 02:44        186880        ----a-w-        c:\windows\system32\pku2u.dll
2015-05-13 19:15 . 2013-10-19 01:36        159232        ----a-w-        c:\windows\system32\imagehlp.dll
2015-05-13 19:15 . 2014-06-16 01:44        730048        ----a-w-        c:\windows\system32\drivers\dxgkrnl.sys
2015-05-13 19:15 . 2014-06-16 01:44        219072        ----a-w-        c:\windows\system32\drivers\dxgmms1.sys
2015-05-13 19:15 . 2014-06-16 01:40        107520        ----a-w-        c:\windows\system32\cdd.dll
2015-05-13 19:13 . 2014-09-04 05:04        372736        ----a-w-        c:\windows\system32\rastls.dll
2015-05-13 19:13 . 2015-03-04 04:16        249784        ----a-w-        c:\windows\system32\clfs.sys
2015-05-13 19:13 . 2015-03-04 04:10        58880        ----a-w-        c:\windows\system32\clfsw32.dll
2015-05-13 19:13 . 2013-04-26 04:55        492544        ----a-w-        c:\windows\system32\win32spl.dll
2015-05-13 19:13 . 2013-05-13 03:08        903168        ----a-w-        c:\windows\system32\certutil.exe
2015-05-13 19:13 . 2013-05-13 03:08        43008        ----a-w-        c:\windows\system32\certenc.dll
2015-05-13 19:12 . 2015-01-17 02:30        828928        ----a-w-        c:\windows\system32\msctf.dll
2015-05-13 19:12 . 2015-03-17 05:01        3976632        ----a-w-        c:\windows\system32\ntkrnlpa.exe
2015-05-13 19:12 . 2015-03-17 05:01        3920824        ----a-w-        c:\windows\system32\ntoskrnl.exe
2015-05-13 19:12 . 2015-03-17 04:59        1306112        ----a-w-        c:\windows\system32\ntdll.dll
2015-05-13 19:12 . 2015-03-17 04:57        43008        ----a-w-        c:\windows\system32\srclient.dll
2015-05-13 19:12 . 2015-03-17 04:57        400896        ----a-w-        c:\windows\system32\srcore.dll
2015-05-13 19:12 . 2015-03-17 04:56        38912        ----a-w-        c:\windows\system32\csrsrv.dll
2015-05-13 19:12 . 2015-03-17 04:56        69632        ----a-w-        c:\windows\system32\smss.exe
2015-05-13 19:12 . 2015-03-17 04:56        262656        ----a-w-        c:\windows\system32\rstrui.exe
2015-05-13 19:12 . 2015-03-17 04:50        6656        ----a-w-        c:\windows\system32\apisetschema.dll
2015-05-13 19:08 . 2014-10-25 01:32        67584        ----a-w-        c:\windows\system32\packager.dll
2015-05-13 19:07 . 2013-07-12 10:08        146816        ----a-w-        c:\windows\system32\drivers\usbvideo.sys
2015-05-13 19:06 . 2013-11-27 01:14        258560        ----a-w-        c:\windows\system32\drivers\usbhub.sys
2015-05-13 19:06 . 2013-11-27 01:13        284672        ----a-w-        c:\windows\system32\drivers\usbport.sys
2015-05-13 19:06 . 2013-11-27 01:13        76288        ----a-w-        c:\windows\system32\drivers\usbccgp.sys
2015-05-13 19:06 . 2013-11-27 01:13        43520        ----a-w-        c:\windows\system32\drivers\usbehci.sys
2015-05-13 19:06 . 2013-11-27 01:13        20480        ----a-w-        c:\windows\system32\drivers\usbohci.sys
2015-05-13 19:06 . 2013-11-27 01:13        24064        ----a-w-        c:\windows\system32\drivers\usbuhci.sys
2015-05-13 19:06 . 2013-11-27 01:13        6016        ----a-w-        c:\windows\system32\drivers\usbd.sys
2015-05-13 19:06 . 2014-12-08 02:46        308224        ----a-w-        c:\windows\system32\scesrv.dll
2015-05-13 19:06 . 2014-10-14 01:50        523776        ----a-w-        c:\windows\system32\termsrv.dll
2015-05-13 19:06 . 2013-02-27 04:49        47104        ----a-w-        c:\windows\system32\appinfo.dll
2015-05-13 19:05 . 2015-03-10 03:08        1237504        ----a-w-        c:\windows\system32\msxml3.dll
2015-05-13 19:05 . 2015-03-10 03:05        2048        ----a-w-        c:\windows\system32\msxml3r.dll
2015-05-13 18:29 . 2015-05-14 11:58        --------        d-----w-        c:\programdata\Malwarebytes' Anti-Malware (portable)
2015-05-13 17:00 . 2015-05-13 17:01        --------        d-----w-        C:\FRST
2015-05-13 16:54 . 2015-05-13 16:54        --------        d-----w-        c:\program files\ESET
2015-05-13 14:36 . 2015-05-13 14:36        --------        d-----w-        c:\users\shaka\AppData\Roaming\AVG2015
2015-05-13 14:35 . 2015-05-13 14:36        --------        d-----w-        c:\programdata\AVG2015
2015-05-13 14:35 . 2015-05-13 14:35        --------        d-----w-        C:\$AVG
2015-05-13 14:34 . 2015-05-13 14:34        --------        d-----w-        c:\program files\AVG
2015-05-13 14:33 . 2015-05-14 13:02        --------        d-----w-        c:\users\shaka\AppData\Local\Avg2015
2015-05-13 13:41 . 2015-05-14 21:02        119512        ----a-w-        c:\windows\system32\drivers\MBAMSwissArmy.sys
2015-05-13 13:40 . 2015-05-13 18:49        92888        ----a-w-        c:\windows\system32\drivers\mbamchameleon.sys
2015-05-13 13:40 . 2015-05-13 13:41        --------        d-----w-        c:\program files\Malwarebytes Anti-Malware
2015-05-13 13:40 . 2015-05-13 13:40        --------        d-----w-        c:\programdata\Malwarebytes
2015-05-13 13:40 . 2015-04-14 12:37        51928        ----a-w-        c:\windows\system32\drivers\mwac.sys
2015-05-13 13:40 . 2015-04-14 12:37        23256        ----a-w-        c:\windows\system32\drivers\mbam.sys
2015-05-13 13:40 . 2015-05-13 13:40        --------        d-----w-        c:\users\shaka\AppData\Local\Programs
2015-05-13 12:47 . 2015-05-13 15:38        --------        d-----w-        C:\AdwCleaner
2015-05-13 02:00 . 2015-05-13 14:06        --------        d-----w-        c:\programdata\AVAST Software
2015-05-12 23:37 . 2015-05-14 13:07        --------        d-sh--w-        c:\programdata\Windows Search 5.3.10
2015-05-12 16:53 . 2015-05-12 16:53        --------        d-----w-        c:\users\shaka\AppData\Roaming\Avira
2015-05-12 16:52 . 2015-03-27 17:21        37896        ----a-w-        c:\windows\system32\drivers\avnetflt.sys
2015-05-12 16:52 . 2015-03-27 17:21        37352        ----a-w-        c:\windows\system32\drivers\avkmgr.sys
2015-05-12 16:52 . 2015-03-27 17:21        136216        ----a-w-        c:\windows\system32\drivers\avipbb.sys
2015-05-12 16:52 . 2015-03-27 17:21        105864        ----a-w-        c:\windows\system32\drivers\avgntflt.sys
2015-05-12 16:43 . 2015-05-13 01:53        --------        d-----w-        c:\programdata\Avira
2015-05-11 14:13 . 2015-05-13 16:00        --------        d--h--w-        c:\programdata\{D9E629DC-CB1C-4A97-9900-81922B4EFFD4}
2015-04-15 16:05 . 2015-04-15 16:05        206816        ----a-w-        c:\windows\system32\drivers\avgldx86.sys
.
.
.
((((((((((((((((((((((((((((((((((((((((  Find3M Report  ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-04-09 17:12 . 2015-04-09 17:12        226784        ----a-w-        c:\windows\system32\drivers\avgidsdriverx.sys
2015-04-07 15:45 . 2015-04-07 15:45        213984        ----a-w-        c:\windows\system32\drivers\avgtdix.sys
2015-04-03 12:37 . 2015-04-03 12:37        110048        ----a-w-        c:\windows\system32\drivers\avgmfx86.sys
2015-03-20 15:18 . 2015-03-20 15:18        35808        ----a-w-        c:\windows\system32\drivers\avgrkx86.sys
2015-03-11 15:13 . 2015-03-11 15:13        269792        ----a-w-        c:\windows\system32\drivers\avglogx.sys
2015-03-11 15:13 . 2015-03-11 15:13        166880        ----a-w-        c:\windows\system32\drivers\avgidshx.sys
2015-03-11 15:13 . 2015-03-11 15:13        132576        ----a-w-        c:\windows\system32\drivers\avgdiskx.sys
2015-03-11 15:08 . 2015-03-11 15:08        29664        ----a-w-        c:\windows\system32\drivers\avgidsshimx.sys
.
.
(((((((((((((((((((((((((((((((((((((  Reg Loading Points  ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-03-06 144664]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-03-06 180504]
"Persistence"="c:\windows\system32\igfxpers.exe" [2012-03-06 188184]
"AVG_UI"="c:\program files\AVG\AVG2015\avgui.exe" [2015-04-15 3745232]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"SPReview"="c:\windows\System32\SPReview\SPReview.exe" [2013-04-15 280576]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"SoftwareSASGeneration"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKLM\~\startupfolder\C:^Users^shaka^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^HELP_DECRYPT.HTML]
path=c:\users\shaka\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HELP_DECRYPT.HTML
backup=c:\windows\pss\HELP_DECRYPT.HTML.Startup
backupExtension=.Startup
.
[HKLM\~\startupfolder\C:^Users^shaka^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^HELP_DECRYPT.PNG]
path=c:\users\shaka\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HELP_DECRYPT.PNG
backup=c:\windows\pss\HELP_DECRYPT.PNG.Startup
backupExtension=.Startup
.
[HKLM\~\startupfolder\C:^Users^shaka^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^HELP_DECRYPT.TXT]
path=c:\users\shaka\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HELP_DECRYPT.TXT
backup=c:\windows\pss\HELP_DECRYPT.TXT.Startup
backupExtension=.Startup
.
[HKLM\~\startupfolder\C:^Users^shaka^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^HELP_DECRYPT.URL]
path=c:\users\shaka\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HELP_DECRYPT.URL
backup=c:\windows\pss\HELP_DECRYPT.URL.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCSSync]
2010-03-13 17:54        91520        ----a-w-        c:\program files\Microsoft Office\Office14\BCSSync.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2011-10-28 15:18        49208        ----a-w-        c:\program files\HP\HP Software Update\hpwuschd2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpqSRMon]
2008-08-20 13:54        150016        ----a-w-        c:\program files\HP\Digital Imaging\bin\HpqSRmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAStorIcon]
2011-11-29 23:04        284440        ----a-w-        c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDVCPL]
2011-12-05 10:12        11487848        ------w-        c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2015-04-17 17:49        31282304        ----a-r-        c:\program files\Skype\Phone\Skype.exe
.
R2 AntiVirMailService;Avira Mail Protection;c:\program files\Avira\Antivirus\avmailc7.exe [x]
R2 AntiVirSchedulerService;Avira Programador;c:\program files\Avira\Antivirus\sched.exe [x]
R2 AntiVirWebService;Avira Web Protection;c:\program files\Avira\Antivirus\avwebg7.exe [x]
R2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2015\avgidsagent.exe [2015-04-15 3438032]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes Anti-Malware\mbamservice.exe [2015-04-14 1080120]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2015-04-21 102912]
R3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys [2015-04-14 51928]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2015-01-31 15872]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R4 c2cautoupdatesvc;Skype Click to Call Updater;c:\program files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [2014-07-14 1390176]
R4 c2cpnrsvc;Skype Click to Call PNR Service;c:\program files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [2014-07-14 1767520]
R4 KMService;KMService;c:\windows\system32\srvany.exe [2013-04-13 8192]
R4 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2015-02-18 315488]
S0 AVGIDSHX;AVGIDSHX;c:\windows\system32\DRIVERS\avgidshx.sys [2015-03-11 166880]
S0 Avglogx;AVG Logging Driver;c:\windows\system32\DRIVERS\avglogx.sys [2015-03-11 269792]
S0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx86.sys [2015-03-20 35808]
S1 Avgdiskx;AVG Disk Driver;c:\windows\system32\DRIVERS\avgdiskx.sys [2015-03-11 132576]
S1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdriverx.sys [2015-04-09 226784]
S1 AVGIDSShim;AVGIDSShim;c:\windows\system32\DRIVERS\avgidsshimx.sys [2015-03-11 29664]
S1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx86.sys [2015-04-15 206816]
S1 Avgtdix;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdix.sys [2015-04-07 213984]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2015-03-27 37352]
S2 avgwd;WatchDog de AVG;c:\program files\AVG\AVG2015\avgwdsvc.exe [2015-04-15 311792]
S2 avnetflt;avnetflt;c:\windows\system32\DRIVERS\avnetflt.sys [2015-03-27 37896]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-11-29 13592]
S2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe [2012-02-03 458464]
S2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;c:\program files\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [2012-03-15 162648]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2012-03-15 362840]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2015-04-14 23256]
S3 MEI;Intel(R) Management Engine Interface ;c:\windows\system32\DRIVERS\HECI.sys [2011-11-09 46080]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2011-09-29 490088]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt        REG_MULTI_SZ          hpqcxs08
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2015-05-13 13:32        988488        ----a-w-        c:\program files\Google\Chrome\Application\42.0.2311.152\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2015-05-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2013-06-27 17:13]
.
2015-05-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2013-06-27 17:13]
.
.
------- Supplementary Scan -------
.
IE: &Enviar a OneNote - c:\progra~1\MICROS~1\Office14\ONBttnIE.dll/105
IE: E&xportar a Microsoft Excel - c:\progra~1\MICROS~1\Office14\EXCEL.EXE/3000
TCP: DhcpNameServer = 200.49.130.47 200.42.4.210
.
- - - - ORPHANS REMOVED - - - -
.
ShellIconOverlayIdentifiers-{472083B0-C522-11CF-8763-00608CC02F24} - (no file)
MSConfigStartUp-Adobe ARM - c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
MSConfigStartUp-avgnt - c:\program files\Avira\Antivirus\avgnt.exe
MSConfigStartUp-Windows Search 5.3 - c:\programdata\Windows Search 5.3.10\5mk1owasew99.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2015-05-14  18:17:39
ComboFix-quarantined-files.txt  2015-05-14 21:17
.
Pre-Run: 458.569.613.312 bytes libres
Post-Run: 460.065.853.440 bytes libres
.
- - End Of File - - F621F7FC662EA4DF3131732D803C3368
A36C5E4F47E84449FF07ED3517B43A31
Danke nochmal! Alleine ist man wirklich manchmal aufgeschmissen..

schrauber 15.05.2015 18:52
Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.


Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


und ein frisches FRST log bitte.

chrischl 15.05.2015 20:26
Hi. Hier der MalwareB Scan

Code:
Malwarebytes Anti-Malware
www.malwarebytes.org

Suchlauf Datum: 15/05/2015
Suchlauf-Zeit: 03:55:33 p.m.
Logdatei: mbar Scan 15.5.15.txt
Administrator: Ja

Version: 2.01.6.1022
Malware Datenbank: v2015.05.15.04
Rootkit Datenbank: v2015.05.14.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x86
Dateisystem: NTFS
Benutzer: shaka

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 312069
Verstrichene Zeit: 12 Min, 1 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente gefunden)

Module: 0
(Keine schädliche Elemente gefunden)

Registrierungsschlüssel: 0
(Keine schädliche Elemente gefunden)

Registrierungswerte: 0
(Keine schädliche Elemente gefunden)

Registrierungsdaten: 0
(Keine schädliche Elemente gefunden)

Ordner: 0
(Keine schädliche Elemente gefunden)

Dateien: 0
(Keine schädliche Elemente gefunden)

Physische Sektoren: 0
(Keine schädliche Elemente gefunden)


(end)
Hier AdwCleaner

Code:
# AdwCleaner v4.204 - Registro generado 15/05/2015 en 16:10:53
# Actualizado 12/05/2015 por Xplode
# Base de datos : 2015-05-12.2 [Servidor]
# Sistema operativo : Windows 7 Enterprise Service Pack 1 (x86)
# Nombre de usuario : shaka - OFICINA
# Ejecutado desde : C:\Users\shaka\Desktop\AdwCleaner_4.204.exe
# Opción : Limpiar

***** [ Servicios ] *****


***** [ Archivos / Carpetas ] *****


***** [ Tareas programadas... ] *****


***** [ Accesos directos ] *****


***** [ Registro ] *****


***** [ Navegadores Web ] *****

-\\ Internet Explorer v11.0.9600.17801


-\\ Mozilla Firefox v


-\\ Google Chrome v42.0.2311.152


*************************

AdwCleaner[R0].txt - [2602 bytes] - [13/05/2015 09:48:42]
AdwCleaner[R1].txt - [1012 bytes] - [13/05/2015 10:17:47]
AdwCleaner[R2].txt - [1131 bytes] - [13/05/2015 11:47:51]
AdwCleaner[R3].txt - [1249 bytes] - [13/05/2015 12:37:33]
AdwCleaner[R4].txt - [1301 bytes] - [15/05/2015 16:09:35]
AdwCleaner[S0].txt - [2624 bytes] - [13/05/2015 09:53:31]
AdwCleaner[S1].txt - [1070 bytes] - [13/05/2015 10:18:46]
AdwCleaner[S2].txt - [1190 bytes] - [13/05/2015 11:48:46]
AdwCleaner[S3].txt - [1308 bytes] - [13/05/2015 12:38:14]
AdwCleaner[S4].txt - [1222 bytes] - [15/05/2015 16:10:53]

########## EOF - C:\AdwCleaner\AdwCleaner[S4].txt - [1281  bytes] ##########
Hier JRT

Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.7.1 (05.14.2015:1)
OS: Windows 7 Enterprise x64
Ran by shaka on 15/05/2015 at 16:15:52,38
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Tasks



~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL
Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Start Page



~~~ Registry Keys



~~~ Files



~~~ Folders





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 15/05/2015 at 16:17:17,14
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
und last but not least.. Die FRST logs


FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 14-05-2015 02
Ran by shaka (administrator) on OFICINA on 15-05-2015 16:20:46
Running from C:\Users\shaka\Desktop
Loaded Profiles: shaka (Available profiles: shaka)
Platform: Microsoft Windows 7 Enterprise  Service Pack 1 (X86) OS Language: Español (España, internacional)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgwdsvc.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgnsx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgemcx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgrsx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgcsrvx.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgui.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgidsagent.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [AVG_UI] => C:\Program Files\AVG\AVG2015\avgui.exe [3745232 2015-04-15] (AVG Technologies CZ, s.r.o.)
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [280576 2013-04-15] (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-248733116-1412973945-2583540736-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-248733116-1412973945-2583540736-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-248733116-1412973945-2583540736-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/?pc=SKY2&ocid=SKY2DHP&osmkt=es-ar
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-248733116-1412973945-2583540736-1000 -> {B6846C33-43CE-41CD-BB51-F754E8F8D9C0} URL = https://www.google.com/search?q={searchTerms}
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2010-03-25] (Microsoft Corporation)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-07-14] (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2010-02-28] (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-07-14] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 200.49.130.47 200.42.4.210

FireFox:
========
FF ProfilePath: C:\Users\shaka\AppData\Roaming\Mozilla\Firefox\Profiles\3UZSzQhi.default
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 -> C:\Program Files\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-01-06] (Intel Corporation)
FF Plugin: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-01-06] (Intel Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-09] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-09] (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.6 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2013-04-10] (VideoLAN)
FF Extension: Avira Browser Safety - C:\Users\shaka\AppData\Roaming\Mozilla\Firefox\Profiles\3UZSzQhi.default\Extensions\abs@avira.com [2015-05-12]

Chrome:
=======
CHR HomePage: Default -> hxxp://avg.nation.com/avgtbavg/search/home?cid={E208873C-885A-4286-B6F4-317872DB511A}&mid=491fcc7d9a9147d3b0823de12d909e84-0762da72d5c59cee9c9f5a280d2b05848fe8dcff&lang=es-es&ds=AVG&coid=avgtbavg&pr=fr&d=2013-10-01 13:49:47&v=18.1.0.443&pid=nation&sg=0&sap=hp&cmpid=0913b
CHR StartupUrls: Default -> "hxxp://avg.nation.com/avgtbavg/search/home?cid={E208873C-885A-4286-B6F4-317872DB511A}&mid=491fcc7d9a9147d3b0823de12d909e84-0762da72d5c59cee9c9f5a280d2b05848fe8dcff&lang=es-es&ds=AVG&coid=avgtbavg&pr=fr&d=2013-10-01 13:49:47&v=18.1.0.443&pid=nation&sg=0&sap=hp&cmpid=0913b"
CHR DefaultSearchKeyword: Default -> avg.nation.com
CHR DefaultSearchURL: Default -> hxxp://avg.nation.com/avgtbavg/search/web?cid={E208873C-885A-4286-B6F4-317872DB511A}&mid=491fcc7d9a9147d3b0823de12d909e84-0762da72d5c59cee9c9f5a280d2b05848fe8dcff&lang=es-es&ds=AVG&coid=avgtbavg&pr=fr&d=2013-10-01 13:49:47&v=17.0.1.12&pid=nation&sg=0&sap=dsp&q={searchTerms}&cmpid=0913b
CHR DefaultNewTabURL: Default -> https://avg.nation.com/chroment?espv=2&cid={E208873C-885A-4286-B6F4-317872DB511A}&mid=491fcc7d9a9147d3b0823de12d909e84-0762da72d5c59cee9c9f5a280d2b05848fe8dcff&lang=es-es&ds=AVG&pr=fr&d=2013-10-01 13:49:47&v=18.1.0.443&pid=nation&sg=0
CHR DefaultSuggestURL: Default -> hxxp://toolbar.avg.com/acp?q={searchTerms}&o=1
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\42.0.2311.152\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\42.0.2311.152\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\42.0.2311.152\pdf.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 11.0\Reader\Browser\nppdf32.dll No File
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll No File
CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
CHR Plugin: (VLC Web Plugin) - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
CHR Profile: C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (YouTube) - C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-06-27]
CHR Extension: (Google Search) - C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-06-27]
CHR Extension: (Bookmark Manager) - C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2015-04-27]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-04-21]
CHR Extension: (Google Wallet) - C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-24]
CHR Extension: (Gmail) - C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-06-27]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AVGIDSAgent; C:\Program Files\AVG\AVG2015\avgidsagent.exe [3438032 2015-04-15] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files\AVG\AVG2015\avgwdsvc.exe [311792 2015-04-15] (AVG Technologies CZ, s.r.o.)
S4 c2cautoupdatesvc; C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
S4 c2cpnrsvc; C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
S3 cphs; C:\Windows\system32\IntelCpHeciSvc.exe [276248 2012-03-06] (Intel Corporation)
S3 hpqcxs08; C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll [248832 2009-05-18] (Hewlett-Packard Co.) [File not signed]
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [458464 2012-02-02] (Intel(R) Corporation)
S2 jhi_service; C:\Program Files\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [162648 2012-03-15] (Intel Corporation)
S4 KMService; C:\Windows\system32\srvany.exe [8192 2013-04-13] () [File not signed]
S2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)
S2 AntiVirMailService; "C:\Program Files\Avira\Antivirus\avmailc7.exe" [X]
S2 AntiVirSchedulerService; "C:\Program Files\Avira\Antivirus\sched.exe" [X]
S2 AntiVirService; "C:\Program Files\Avira\Antivirus\avguard.exe" [X]
S2 AntiVirWebService; "C:\Program Files\Avira\Antivirus\avwebg7.exe" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 Avgdiskx; C:\Windows\System32\DRIVERS\avgdiskx.sys [132576 2015-03-11] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdriverx.sys [226784 2015-04-09] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHX; C:\Windows\System32\DRIVERS\avgidshx.sys [166880 2015-03-11] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSShim; C:\Windows\System32\DRIVERS\avgidsshimx.sys [29664 2015-03-11] (AVG Technologies CZ, s.r.o.)
R1 Avgldx86; C:\Windows\System32\DRIVERS\avgldx86.sys [206816 2015-04-15] (AVG Technologies CZ, s.r.o.)
R0 Avglogx; C:\Windows\System32\DRIVERS\avglogx.sys [269792 2015-03-11] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx86; C:\Windows\System32\DRIVERS\avgmfx86.sys [110048 2015-04-03] (AVG Technologies CZ, s.r.o.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105864 2015-03-27] (Avira Operations GmbH & Co. KG)
R0 Avgrkx86; C:\Windows\System32\DRIVERS\avgrkx86.sys [35808 2015-03-20] (AVG Technologies CZ, s.r.o.)
R1 Avgtdix; C:\Windows\System32\DRIVERS\avgtdix.sys [213984 2015-04-07] (AVG Technologies CZ, s.r.o.)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2015-03-27] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2015-03-27] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [37896 2015-03-27] (Avira Operations GmbH & Co. KG)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2015-04-14] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2015-04-14] (Malwarebytes Corporation)
R3 MEI; C:\Windows\System32\DRIVERS\HECI.sys [46080 2011-11-09] (Intel Corporation)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2015-03-27] (Avira GmbH)
S3 catchme; \??\C:\Users\shaka\AppData\Local\Temp\catchme.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-05-15 16:20 - 2015-05-15 16:21 - 00014079 _____ () C:\Users\shaka\Desktop\FRST.txt
2015-05-15 16:19 - 2015-05-15 16:19 - 00000000 ____D () C:\Users\shaka\Desktop\FRST-OlderVersion
2015-05-15 16:17 - 2015-05-15 16:17 - 00000858 _____ () C:\Users\shaka\Desktop\JRT.txt
2015-05-15 16:15 - 2015-05-15 16:15 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-OFICINA-Windows-7-Enterprise-(32-bit).dat
2015-05-15 16:15 - 2015-05-15 16:15 - 00000000 ____D () C:\RegBackup
2015-05-15 16:14 - 2015-05-15 16:14 - 00001361 _____ () C:\Users\shaka\Desktop\AdwCleaner[S4] 15.5.15.txt
2015-05-15 16:08 - 2015-05-15 16:08 - 00001228 _____ () C:\Users\shaka\Desktop\mbar Scan 15.5.15.txt
2015-05-15 15:57 - 2015-05-15 15:57 - 02721175 _____ (Thisisu) C:\Users\shaka\Desktop\JRT.exe
2015-05-15 15:55 - 2015-05-15 15:56 - 00000000 ____D () C:\Users\shaka\Desktop\Alte Suchlaeufe
2015-05-14 18:17 - 2015-05-14 18:17 - 00017285 _____ () C:\ComboFix.txt
2015-05-14 18:10 - 2011-06-26 03:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-05-14 18:10 - 2010-11-07 14:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-05-14 18:10 - 2009-04-20 01:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-05-14 18:10 - 2000-08-30 21:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-05-14 18:10 - 2000-08-30 21:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-05-14 18:10 - 2000-08-30 21:00 - 00098816 _____ () C:\Windows\sed.exe
2015-05-14 18:10 - 2000-08-30 21:00 - 00080412 _____ () C:\Windows\grep.exe
2015-05-14 18:10 - 2000-08-30 21:00 - 00068096 _____ () C:\Windows\zip.exe
2015-05-14 18:09 - 2015-05-14 18:17 - 00000000 ____D () C:\Windows\erdnt
2015-05-14 18:09 - 2015-05-14 18:17 - 00000000 ____D () C:\Qoobox
2015-05-14 18:07 - 2015-05-14 18:07 - 05623645 ____R (Swearware) C:\Users\shaka\Desktop\ComboFix.exe
2015-05-14 10:55 - 2015-04-21 22:48 - 00342736 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-05-14 10:55 - 2015-04-21 13:25 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-05-14 10:55 - 2015-04-21 13:25 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-05-14 10:55 - 2015-04-21 13:24 - 19691008 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-05-14 10:55 - 2015-04-21 13:11 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-05-14 10:55 - 2015-04-21 13:11 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-05-14 10:55 - 2015-04-21 13:10 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-05-14 10:55 - 2015-04-21 13:09 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-05-14 10:55 - 2015-04-21 13:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-05-14 10:55 - 2015-04-21 13:04 - 02278400 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-05-14 10:55 - 2015-04-21 13:03 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-05-14 10:55 - 2015-04-21 13:02 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-05-14 10:55 - 2015-04-21 13:00 - 00478208 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-05-14 10:55 - 2015-04-21 12:58 - 00664576 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-05-14 10:55 - 2015-04-21 12:58 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-05-14 10:55 - 2015-04-21 12:58 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-05-14 10:55 - 2015-04-21 12:57 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-05-14 10:55 - 2015-04-21 12:51 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-05-14 10:55 - 2015-04-21 12:48 - 00418304 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-05-14 10:55 - 2015-04-21 12:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-05-14 10:55 - 2015-04-21 12:39 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-05-14 10:55 - 2015-04-21 12:38 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-05-14 10:55 - 2015-04-21 12:36 - 00285696 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-05-14 10:55 - 2015-04-21 12:31 - 04305920 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-05-14 10:55 - 2015-04-21 12:26 - 00688640 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-05-14 10:55 - 2015-04-21 12:26 - 00685568 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-05-14 10:55 - 2015-04-21 12:25 - 02052608 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-05-14 10:55 - 2015-04-21 12:24 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-05-14 10:55 - 2015-04-21 12:17 - 12828672 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-05-14 10:55 - 2015-04-21 12:02 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-05-14 10:55 - 2015-04-21 11:58 - 01310208 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-05-14 10:55 - 2015-04-21 11:56 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-05-14 10:48 - 2013-12-24 20:09 - 01987584 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2015-05-14 10:48 - 2013-11-26 05:16 - 03419136 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2015-05-14 09:10 - 2015-04-19 23:56 - 01250816 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-05-14 09:10 - 2015-04-19 23:56 - 00909312 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-05-14 09:10 - 2015-04-19 23:03 - 02382336 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-05-14 09:10 - 2015-02-03 23:54 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2015-05-14 09:10 - 2015-02-03 00:12 - 01230848 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-05-14 09:01 - 2015-05-14 09:01 - 00001397 _____ () C:\Users\shaka\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-05-13 17:27 - 2015-05-01 10:16 - 00102608 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 17:11 - 2015-05-13 17:15 - 00000000 ____D () C:\Windows\system32\MRT
2015-05-13 17:04 - 2014-06-30 19:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2015-05-13 17:04 - 2014-06-06 03:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2015-05-13 17:04 - 2014-03-09 18:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2015-05-13 17:04 - 2014-03-09 18:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2015-05-13 16:52 - 2015-05-13 16:52 - 00645120 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2015-05-13 16:52 - 2015-05-13 16:52 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2015-05-13 16:52 - 2015-05-13 16:52 - 00233472 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2015-05-13 16:52 - 2015-05-13 16:52 - 00208384 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2015-05-13 16:52 - 2015-05-13 16:52 - 00194048 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2015-05-13 16:52 - 2015-05-13 16:52 - 00182272 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2015-05-13 16:52 - 2015-05-13 16:52 - 00151552 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2015-05-13 16:52 - 2015-05-13 16:52 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2015-05-13 16:52 - 2015-05-13 16:52 - 00083456 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2015-05-13 16:52 - 2015-05-13 16:52 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2015-05-13 16:52 - 2015-05-13 16:52 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2015-05-13 16:52 - 2015-05-13 16:52 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2015-05-13 16:52 - 2015-05-13 16:52 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2015-05-13 16:51 - 2015-05-13 16:51 - 00640512 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2015-05-13 16:51 - 2015-05-13 16:51 - 00619520 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2015-05-13 16:51 - 2015-05-13 16:51 - 00231424 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2015-05-13 16:51 - 2015-05-13 16:51 - 00127488 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2015-05-13 16:51 - 2015-05-13 16:51 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2015-05-13 16:51 - 2015-05-13 16:51 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2015-05-13 16:51 - 2015-05-13 16:51 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2015-05-13 16:51 - 2015-05-13 16:51 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2015-05-13 16:51 - 2015-05-13 16:51 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2015-05-13 16:51 - 2015-05-13 16:51 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2015-05-13 16:51 - 2015-05-13 16:51 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2015-05-13 16:51 - 2015-05-13 16:51 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2015-05-13 16:51 - 2015-05-13 16:51 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2015-05-13 16:51 - 2015-05-13 16:51 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2015-05-13 16:50 - 2015-05-13 16:50 - 02284544 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2015-05-13 16:50 - 2015-05-13 16:50 - 01158144 _____ (Microsoft Corporation) C:\Windows\system32\XpsPrint.dll
2015-05-13 16:50 - 2015-05-13 16:50 - 01080832 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll
2015-05-13 16:50 - 2015-05-13 16:50 - 00604160 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2015-05-13 16:50 - 2015-05-13 16:50 - 00364544 _____ (Microsoft Corporation) C:\Windows\system32\XpsGdiConverter.dll
2015-05-13 16:50 - 2015-05-13 16:50 - 00293376 _____ (Microsoft Corporation) C:\Windows\system32\dxgi.dll
2015-05-13 16:50 - 2015-05-13 16:50 - 00249856 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll
2015-05-13 16:50 - 2015-05-13 16:50 - 00220160 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll
2015-05-13 16:50 - 2015-05-13 16:50 - 00207872 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecsExt.dll
2015-05-13 16:50 - 2015-05-13 16:50 - 00187392 _____ (Microsoft Corporation) C:\Windows\system32\UIAnimation.dll
2015-05-13 16:50 - 2015-05-13 16:50 - 00161792 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll
2015-05-13 16:50 - 2015-05-13 16:50 - 00010752 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
2015-05-13 16:50 - 2015-05-13 16:50 - 00009728 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2015-05-13 16:50 - 2015-05-13 16:50 - 00005632 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2015-05-13 16:50 - 2015-05-13 16:50 - 00005632 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
2015-05-13 16:50 - 2015-05-13 16:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2015-05-13 16:50 - 2015-05-13 16:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
2015-05-13 16:50 - 2015-05-13 16:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2015-05-13 16:50 - 2015-05-13 16:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
2015-05-13 16:50 - 2015-05-13 16:50 - 00002560 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
2015-05-13 16:49 - 2015-05-13 16:49 - 01505280 _____ (Microsoft Corporation) C:\Windows\system32\d3d11.dll
2015-05-13 16:48 - 2015-05-13 16:54 - 00013590 _____ () C:\Windows\IE11_main.log
2015-05-13 16:16 - 2015-05-04 22:12 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-05-13 16:16 - 2015-04-17 23:56 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-05-13 16:16 - 2015-04-13 00:19 - 00259072 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2015-05-13 16:16 - 2015-04-08 00:14 - 00216064 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2015-05-13 16:16 - 2015-04-08 00:14 - 00019968 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll
2015-05-13 16:16 - 2015-04-04 00:10 - 00137656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-05-13 16:16 - 2015-04-04 00:10 - 00067512 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-05-13 16:16 - 2015-04-04 00:05 - 01061376 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-05-13 16:16 - 2015-04-04 00:05 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-05-13 16:16 - 2015-04-04 00:05 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-05-13 16:16 - 2015-04-04 00:05 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-05-13 16:16 - 2015-04-04 00:05 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-05-13 16:16 - 2015-04-04 00:05 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-05-13 16:16 - 2015-04-04 00:05 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-05-13 16:16 - 2015-04-04 00:05 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-05-13 16:16 - 2015-04-04 00:05 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-05-13 16:16 - 2015-04-04 00:05 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-05-13 16:16 - 2015-04-04 00:04 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-05-13 16:16 - 2015-04-04 00:04 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-05-13 16:16 - 2015-04-04 00:01 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-05-13 16:16 - 2015-04-04 00:01 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-05-13 16:16 - 2015-04-03 23:59 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-05-13 16:16 - 2015-02-18 04:06 - 00123904 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2015-05-13 16:16 - 2014-10-17 22:33 - 00571904 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2015-05-13 16:16 - 2013-07-04 08:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2015-05-13 16:16 - 2013-07-03 01:02 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbscan.sys
2015-05-13 16:16 - 2013-07-03 00:36 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
2015-05-13 16:16 - 2013-07-03 00:36 - 00025728 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2015-05-13 16:16 - 2013-04-12 10:45 - 01211752 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2015-05-13 16:16 - 2013-02-12 00:32 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usb8023.sys
2015-05-13 16:15 - 2014-11-10 23:44 - 00186880 _____ (Microsoft Corporation) C:\Windows\system32\pku2u.dll
2015-05-13 16:15 - 2014-07-13 22:42 - 00654336 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2015-05-13 16:15 - 2014-06-15 22:44 - 00730048 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2015-05-13 16:15 - 2014-06-15 22:44 - 00219072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms1.sys
2015-05-13 16:15 - 2014-06-15 22:40 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2015-05-13 16:15 - 2013-10-18 22:36 - 00159232 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2015-05-13 16:14 - 2014-08-11 22:36 - 00701440 _____ (Microsoft Corporation) C:\Windows\system32\IMJP10K.DLL
2015-05-13 16:14 - 2014-03-26 11:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2015-05-13 16:14 - 2014-03-26 11:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2015-05-13 16:14 - 2014-03-04 06:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll
2015-05-13 16:14 - 2014-03-04 06:17 - 00293376 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-05-13 16:14 - 2014-03-04 06:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll
2015-05-13 16:14 - 2014-03-04 06:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll
2015-05-13 16:14 - 2014-03-04 06:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll
2015-05-13 16:14 - 2014-03-04 06:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll
2015-05-13 16:14 - 2014-03-04 06:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll
2015-05-13 16:14 - 2014-03-04 06:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll
2015-05-13 16:14 - 2013-10-11 23:04 - 00121856 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx
2015-05-13 16:14 - 2013-10-11 23:03 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2015-05-13 16:14 - 2013-10-11 22:15 - 00141824 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe
2015-05-13 16:14 - 2013-10-11 22:15 - 00126976 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe
2015-05-13 16:13 - 2015-03-04 01:16 - 00249784 _____ (Microsoft Corporation) C:\Windows\system32\clfs.sys
2015-05-13 16:13 - 2015-03-04 01:10 - 00058880 _____ (Microsoft Corporation) C:\Windows\system32\clfsw32.dll
2015-05-13 16:13 - 2014-09-04 02:04 - 00372736 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll
2015-05-13 16:13 - 2013-05-13 00:08 - 00903168 _____ (Microsoft Corporation) C:\Windows\system32\certutil.exe
2015-05-13 16:13 - 2013-05-13 00:08 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\certenc.dll
2015-05-13 16:13 - 2013-04-26 01:55 - 00492544 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2015-05-13 16:12 - 2015-03-17 02:01 - 03976632 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2015-05-13 16:12 - 2015-03-17 02:01 - 03920824 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-05-13 16:12 - 2015-03-17 01:59 - 01306112 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-05-13 16:12 - 2015-03-17 01:57 - 00400896 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-05-13 16:12 - 2015-03-17 01:57 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-05-13 16:12 - 2015-03-17 01:56 - 00262656 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-05-13 16:12 - 2015-03-17 01:56 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-05-13 16:12 - 2015-03-17 01:56 - 00038912 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-05-13 16:12 - 2015-03-17 01:50 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-05-13 16:12 - 2015-01-16 23:30 - 00828928 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
2015-05-13 16:09 - 2015-03-05 01:06 - 00305152 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2015-05-13 16:09 - 2015-02-13 02:26 - 12875264 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2015-05-13 16:09 - 2015-01-31 00:32 - 00919552 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2015-05-13 16:09 - 2015-01-30 23:52 - 00134656 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2015-05-13 16:09 - 2015-01-30 23:51 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpvideominiport.sys
2015-05-13 16:09 - 2014-06-18 19:23 - 01131664 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll
2015-05-13 16:09 - 2014-06-18 19:23 - 00156824 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll
2015-05-13 16:09 - 2014-06-18 19:23 - 00081560 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll
2015-05-13 16:09 - 2014-06-17 22:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2015-05-13 16:09 - 2014-06-06 06:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2015-05-13 16:09 - 2014-06-03 06:30 - 00101824 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2015-05-13 16:09 - 2014-06-03 06:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2015-05-13 16:09 - 2014-06-03 06:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2015-05-13 16:09 - 2014-06-03 06:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2015-05-13 16:09 - 2014-05-30 03:36 - 00338944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2015-05-13 16:09 - 2014-04-04 23:25 - 01294272 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2015-05-13 16:09 - 2014-04-04 23:24 - 00187840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2015-05-13 16:09 - 2013-11-26 08:11 - 00240576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2015-05-13 16:09 - 2013-10-03 22:49 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmk.sys
2015-05-13 16:09 - 2013-10-03 22:17 - 00177152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys
2015-05-13 16:09 - 2013-07-25 05:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2015-05-13 16:08 - 2015-03-25 00:00 - 03088384 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-05-13 16:08 - 2015-03-25 00:00 - 02020864 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-05-13 16:08 - 2015-03-25 00:00 - 00566784 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-05-13 16:08 - 2015-03-25 00:00 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-05-13 16:08 - 2015-03-25 00:00 - 00131584 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-05-13 16:08 - 2015-03-25 00:00 - 00092672 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-05-13 16:08 - 2015-03-25 00:00 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-05-13 16:08 - 2015-03-25 00:00 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-05-13 16:08 - 2015-03-25 00:00 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-05-13 16:08 - 2015-03-25 00:00 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-05-13 16:08 - 2015-03-25 00:00 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2015-05-13 16:08 - 2015-02-20 01:13 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2015-05-13 16:08 - 2015-02-20 01:13 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-05-13 16:08 - 2015-02-20 01:13 - 00026624 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2015-05-13 16:08 - 2015-02-20 01:13 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2015-05-13 16:08 - 2015-02-20 00:09 - 00299008 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-05-13 16:08 - 2015-02-03 00:12 - 00171520 _____ (Microsoft Corporation) C:\Windows\system32\ubpm.dll
2015-05-13 16:08 - 2014-12-18 23:43 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-05-13 16:08 - 2014-12-11 14:47 - 00046592 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-05-13 16:08 - 2014-10-24 22:32 - 00067584 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2015-05-13 16:08 - 2014-07-16 22:40 - 00157696 _____ (Microsoft Corporation) C:\Windows\system32\winsta.dll
2015-05-13 16:08 - 2014-07-16 22:39 - 03221504 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2015-05-13 16:08 - 2014-07-16 22:39 - 01051136 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2015-05-13 16:08 - 2014-07-16 22:39 - 00304128 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2015-05-13 16:08 - 2014-07-16 22:39 - 00131584 _____ (Microsoft Corporation) C:\Windows\system32\aaclient.dll
2015-05-13 16:08 - 2014-07-16 22:39 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorekmts.dll
2015-05-13 16:08 - 2014-07-16 22:03 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys
2015-05-13 16:08 - 2014-07-16 22:02 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2015-05-13 16:08 - 2013-10-11 23:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2015-05-13 16:08 - 2013-10-11 23:01 - 00679424 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2015-05-13 16:08 - 2013-10-11 23:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2015-05-13 16:08 - 2013-07-25 22:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2015-05-13 16:07 - 2015-02-25 00:03 - 00514560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys
2015-05-13 16:07 - 2015-02-03 00:16 - 00078784 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys
2015-05-13 16:07 - 2015-02-03 00:12 - 11411968 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2015-05-13 16:07 - 2015-02-03 00:12 - 03209728 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2015-05-13 16:07 - 2015-02-03 00:12 - 01329664 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
2015-05-13 16:07 - 2015-02-03 00:12 - 01174528 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-05-13 16:07 - 2015-02-03 00:12 - 01005056 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll
2015-05-13 16:07 - 2015-02-03 00:12 - 00988160 _____ (Microsoft Corporation) C:\Windows\system32\drmv2clt.dll
2015-05-13 16:07 - 2015-02-03 00:12 - 00744960 _____ (Microsoft Corporation) C:\Windows\system32\blackbox.dll
2015-05-13 16:07 - 2015-02-03 00:12 - 00617984 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmsdk.dll
2015-05-13 16:07 - 2015-02-03 00:12 - 00519680 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2015-05-13 16:07 - 2015-02-03 00:12 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msscp.dll
2015-05-13 16:07 - 2015-02-03 00:12 - 00489984 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll
2015-05-13 16:07 - 2015-02-03 00:12 - 00475136 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2015-05-13 16:07 - 2015-02-03 00:12 - 00442880 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2015-05-13 16:07 - 2015-02-03 00:12 - 00406016 _____ (Microsoft Corporation) C:\Windows\system32\drmmgrtn.dll
2015-05-13 16:07 - 2015-02-03 00:12 - 00374784 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2015-05-13 16:07 - 2015-02-03 00:12 - 00354816 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll
2015-05-13 16:07 - 2015-02-03 00:12 - 00275968 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2015-05-13 16:07 - 2015-02-03 00:12 - 00265216 _____ (Microsoft Corporation) C:\Windows\system32\msnetobj.dll
2015-05-13 16:07 - 2015-02-03 00:12 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2015-05-13 16:07 - 2015-02-03 00:12 - 00179200 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2015-05-13 16:07 - 2015-02-03 00:12 - 00157184 _____ (Microsoft Corporation) C:\Windows\system32\pcasvc.dll
2015-05-13 16:07 - 2015-02-03 00:12 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2015-05-13 16:07 - 2015-02-03 00:12 - 00103936 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2015-05-13 16:07 - 2015-02-03 00:12 - 00103424 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2015-05-13 16:07 - 2015-02-03 00:12 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\cryptsp.dll
2015-05-13 16:07 - 2015-02-03 00:12 - 00050688 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2015-05-13 16:07 - 2015-02-03 00:12 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2015-05-13 16:07 - 2015-02-03 00:12 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\pcadm.dll
2015-05-13 16:07 - 2015-02-03 00:12 - 00027648 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2015-05-13 16:07 - 2015-02-03 00:12 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msmmsp.dll
2015-05-13 16:07 - 2015-02-03 00:12 - 00008192 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2015-05-13 16:07 - 2015-02-03 00:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2015-05-13 16:07 - 2015-02-03 00:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2015-05-13 16:07 - 2015-02-03 00:11 - 12625408 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2015-05-13 16:07 - 2015-02-03 00:11 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
2015-05-13 16:07 - 2015-02-03 00:11 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2015-05-13 16:07 - 2015-02-03 00:11 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
2015-05-13 16:07 - 2015-02-03 00:11 - 00023040 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
2015-05-13 16:07 - 2015-02-03 00:11 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2015-05-13 16:07 - 2015-02-03 00:11 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\pcawrk.exe
2015-05-13 16:07 - 2015-02-03 00:11 - 00008192 _____ (Microsoft Corporation) C:\Windows\system32\pcalua.exe
2015-05-13 16:07 - 2015-02-03 00:10 - 00008704 _____ (Microsoft Corporation) C:\Windows\system32\pcaevts.dll
2015-05-13 16:07 - 2015-02-03 00:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
2015-05-13 16:07 - 2015-02-03 00:00 - 00593920 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\PEAuth.sys
2015-05-13 16:07 - 2015-02-02 23:26 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2015-05-13 16:07 - 2015-01-30 20:56 - 00370488 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-05-13 16:07 - 2014-12-18 22:34 - 00116224 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-05-13 16:07 - 2014-12-06 00:50 - 00242688 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-05-13 16:07 - 2014-10-31 19:22 - 00521384 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2015-05-13 16:07 - 2014-06-27 21:21 - 00455752 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
2015-05-13 16:07 - 2014-06-27 21:21 - 00409272 _____ (Microsoft Corporation) C:\Windows\system32\ci.dll
2015-05-13 16:07 - 2014-04-24 23:06 - 00626688 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2015-05-13 16:07 - 2014-03-04 06:17 - 00868352 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-05-13 16:07 - 2014-01-28 23:06 - 00381440 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
2015-05-13 16:07 - 2013-08-01 22:50 - 00169984 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-05-13 16:07 - 2013-08-01 22:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-05-13 16:07 - 2013-08-01 22:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-05-13 16:07 - 2013-08-01 22:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-05-13 16:07 - 2013-08-01 22:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-05-13 16:07 - 2013-08-01 22:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-05-13 16:07 - 2013-08-01 22:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-05-13 16:07 - 2013-08-01 22:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-05-13 16:07 - 2013-08-01 22:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-05-13 16:07 - 2013-08-01 22:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-05-13 16:07 - 2013-08-01 22:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-05-13 16:07 - 2013-08-01 22:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-05-13 16:07 - 2013-08-01 22:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-05-13 16:07 - 2013-08-01 22:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-05-13 16:07 - 2013-08-01 22:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-05-13 16:07 - 2013-08-01 22:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-05-13 16:07 - 2013-08-01 22:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-05-13 16:07 - 2013-08-01 22:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-05-13 16:07 - 2013-08-01 22:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-05-13 16:07 - 2013-08-01 22:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-05-13 16:07 - 2013-08-01 22:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-05-13 16:07 - 2013-08-01 22:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-05-13 16:07 - 2013-08-01 22:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-05-13 16:07 - 2013-08-01 22:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-05-13 16:07 - 2013-08-01 22:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-05-13 16:07 - 2013-08-01 21:52 - 00271360 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-05-13 16:07 - 2013-08-01 21:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-05-13 16:07 - 2013-08-01 21:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-05-13 16:07 - 2013-08-01 21:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-05-13 16:07 - 2013-08-01 21:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-05-13 16:07 - 2013-07-12 07:08 - 00146816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbvideo.sys
2015-05-13 16:07 - 2013-07-12 07:07 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys
2015-05-13 16:07 - 2013-06-25 19:56 - 00527064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2015-05-13 16:07 - 2012-11-28 19:57 - 00047720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdfLdr.sys
2015-05-13 16:07 - 2012-11-28 19:57 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\Wdfres.dll
2015-05-13 16:07 - 2012-11-28 19:57 - 00000003 _____ () C:\Windows\system32\Drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf
2015-05-13 16:07 - 2012-10-03 13:42 - 00156672 _____ (Microsoft Corporation) C:\Windows\system32\ncsi.dll
2015-05-13 16:07 - 2012-10-03 13:42 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\nlaapi.dll
2015-05-13 16:06 - 2014-12-07 23:46 - 00308224 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2015-05-13 16:06 - 2014-10-13 22:50 - 00523776 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2015-05-13 16:06 - 2013-11-26 22:14 - 00258560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2015-05-13 16:06 - 2013-11-26 22:13 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2015-05-13 16:06 - 2013-11-26 22:13 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2015-05-13 16:06 - 2013-11-26 22:13 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2015-05-13 16:06 - 2013-11-26 22:13 - 00024064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2015-05-13 16:06 - 2013-11-26 22:13 - 00020480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2015-05-13 16:06 - 2013-11-26 22:13 - 00006016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2015-05-13 16:06 - 2013-02-27 01:49 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2015-05-13 16:05 - 2015-03-10 00:08 - 01237504 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2015-05-13 16:05 - 2015-03-10 00:05 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2015-05-13 15:29 - 2015-05-14 08:58 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-05-13 15:20 - 2015-05-15 16:08 - 00000000 ____D () C:\Users\shaka\Desktop\mbar
2015-05-13 15:19 - 2015-05-13 15:20 - 04197016 _____ (Kaspersky Lab ZAO) C:\Users\shaka\Desktop\tdsskiller.exe
2015-05-13 15:16 - 2015-05-13 15:18 - 16502728 _____ (Malwarebytes Corp.) C:\Users\shaka\Desktop\mbar-1.09.1.1004.exe
2015-05-13 14:04 - 2015-05-13 14:04 - 00380416 _____ () C:\Users\shaka\Desktop\Gmer-19357.exe
2015-05-13 14:00 - 2015-05-15 16:20 - 00000000 ____D () C:\FRST
2015-05-13 14:00 - 2015-05-13 14:01 - 00049868 _____ () C:\Users\shaka\Downloads\FRST.txt
2015-05-13 14:00 - 2015-05-13 14:01 - 00026913 _____ () C:\Users\shaka\Downloads\Addition.txt
2015-05-13 13:59 - 2015-05-15 16:19 - 01145856 _____ (Farbar) C:\Users\shaka\Desktop\FRST.exe
2015-05-13 13:59 - 2015-05-13 13:59 - 00000000 _____ () C:\Users\shaka\defogger_reenable
2015-05-13 13:58 - 2015-05-13 13:58 - 00050477 _____ () C:\Users\shaka\Desktop\Defogger.exe
2015-05-13 13:54 - 2015-05-13 13:54 - 00000000 ____D () C:\Program Files\ESET
2015-05-13 13:51 - 2015-05-13 13:51 - 02347384 _____ (ESET) C:\Users\shaka\Downloads\esetsmartinstaller_deu.exe
2015-05-13 13:16 - 2015-05-13 13:16 - 00000000 ____D () C:\Windows\system32\appmgmt
2015-05-13 11:36 - 2015-05-13 11:36 - 00000951 _____ () C:\Users\Public\Desktop\AVG 2015.lnk
2015-05-13 11:36 - 2015-05-13 11:36 - 00000000 ____D () C:\Users\shaka\AppData\Roaming\AVG2015
2015-05-13 11:36 - 2015-05-13 11:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
2015-05-13 11:35 - 2015-05-13 11:36 - 00000000 ____D () C:\ProgramData\AVG2015
2015-05-13 11:35 - 2015-05-13 11:35 - 00000000 ____D () C:\$AVG
2015-05-13 11:34 - 2015-05-13 11:34 - 00000000 ____D () C:\Program Files\AVG
2015-05-13 11:33 - 2015-05-14 10:02 - 00000000 ____D () C:\Users\shaka\AppData\Local\Avg2015
2015-05-13 11:23 - 2015-05-13 11:33 - 171931928 _____ (AVG Technologies) C:\Users\shaka\Downloads\avg_free_x86_all_2015_ltst_222_5941 (1).exe
2015-05-13 10:41 - 2015-05-15 15:54 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-05-13 10:41 - 2015-05-13 10:41 - 00001060 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-05-13 10:41 - 2015-05-13 10:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-05-13 10:40 - 2015-05-13 15:49 - 00092888 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-05-13 10:40 - 2015-05-13 10:41 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2015-05-13 10:40 - 2015-05-13 10:40 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-05-13 10:40 - 2015-04-14 09:37 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-05-13 10:40 - 2015-04-14 09:37 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-05-13 10:34 - 2015-05-13 10:35 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\shaka\Desktop\mbam-setup-2.1.6.1022.exe
2015-05-13 10:13 - 2015-05-13 10:13 - 00000000 ____D () C:\Windows\pss
2015-05-13 09:47 - 2015-05-15 16:10 - 00000000 ____D () C:\AdwCleaner
2015-05-13 09:44 - 2015-05-13 09:45 - 02209792 _____ () C:\Users\shaka\Desktop\AdwCleaner_4.204.exe
2015-05-12 23:00 - 2015-05-13 11:06 - 00000000 ____D () C:\ProgramData\AVAST Software
2015-05-12 22:59 - 2015-05-12 23:00 - 05499960 _____ (Avast Software s.r.o.) C:\Users\shaka\Downloads\avast_free_antivirus_setup_online.exe
2015-05-12 20:37 - 2015-05-14 10:07 - 00000000 __SHD () C:\ProgramData\Windows Search 5.3.10
2015-05-12 17:58 - 2015-05-12 17:58 - 00008646 _____ () C:\Users\shaka\HELP_DECRYPT.HTML
2015-05-12 17:58 - 2015-05-12 17:58 - 00008646 _____ () C:\Users\shaka\Documents\HELP_DECRYPT.HTML
2015-05-12 17:58 - 2015-05-12 17:58 - 00004266 _____ () C:\Users\shaka\HELP_DECRYPT.TXT
2015-05-12 17:58 - 2015-05-12 17:58 - 00004266 _____ () C:\Users\shaka\Documents\HELP_DECRYPT.TXT
2015-05-12 17:58 - 2015-05-12 17:58 - 00000296 _____ () C:\Users\shaka\HELP_DECRYPT.URL
2015-05-12 17:58 - 2015-05-12 17:58 - 00000296 _____ () C:\Users\shaka\Documents\HELP_DECRYPT.URL
2015-05-12 13:53 - 2015-05-12 13:53 - 00000000 ____D () C:\Users\shaka\AppData\Roaming\Mozilla
2015-05-12 13:53 - 2015-05-12 13:53 - 00000000 ____D () C:\Users\shaka\AppData\Roaming\Avira
2015-05-12 13:52 - 2015-03-27 14:22 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys
2015-05-12 13:52 - 2015-03-27 14:21 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2015-05-12 13:52 - 2015-03-27 14:21 - 00105864 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2015-05-12 13:52 - 2015-03-27 14:21 - 00037896 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2015-05-12 13:52 - 2015-03-27 14:21 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2015-05-12 13:43 - 2015-05-12 22:53 - 00000000 ____D () C:\ProgramData\Avira
2015-05-12 13:41 - 2015-05-12 13:41 - 04734040 _____ (Avira Operations GmbH & Co. KG) C:\Users\shaka\Downloads\avira_es_av_55522e78a06f2__ws1.exe
2015-05-12 13:39 - 2015-05-12 13:39 - 00000293 _____ () C:\Users\shaka\AppData\Roaming\8178audayu1bjiao
2015-05-12 10:53 - 2015-05-12 10:53 - 00008646 _____ () C:\Users\shaka\AppData\Roaming\HELP_DECRYPT.HTML
2015-05-12 10:53 - 2015-05-12 10:53 - 00008646 _____ () C:\Users\shaka\AppData\Local\HELP_DECRYPT.HTML
2015-05-12 10:53 - 2015-05-12 10:53 - 00008646 _____ () C:\Users\shaka\AppData\HELP_DECRYPT.HTML
2015-05-12 10:53 - 2015-05-12 10:53 - 00004266 _____ () C:\Users\shaka\AppData\Roaming\HELP_DECRYPT.TXT
2015-05-12 10:53 - 2015-05-12 10:53 - 00004266 _____ () C:\Users\shaka\AppData\Local\HELP_DECRYPT.TXT
2015-05-12 10:53 - 2015-05-12 10:53 - 00004266 _____ () C:\Users\shaka\AppData\HELP_DECRYPT.TXT
2015-05-12 10:53 - 2015-05-12 10:53 - 00000296 _____ () C:\Users\shaka\AppData\Roaming\HELP_DECRYPT.URL
2015-05-12 10:53 - 2015-05-12 10:53 - 00000296 _____ () C:\Users\shaka\AppData\Local\HELP_DECRYPT.URL
2015-05-12 10:53 - 2015-05-12 10:53 - 00000296 _____ () C:\Users\shaka\AppData\HELP_DECRYPT.URL
2015-05-12 10:52 - 2015-05-12 10:52 - 00008646 _____ () C:\ProgramData\HELP_DECRYPT.HTML
2015-05-12 10:52 - 2015-05-12 10:52 - 00004266 _____ () C:\ProgramData\HELP_DECRYPT.TXT
2015-05-12 10:52 - 2015-05-12 10:52 - 00000296 _____ () C:\ProgramData\HELP_DECRYPT.URL
2015-05-11 11:13 - 2015-05-13 13:00 - 00000000 ___HD () C:\ProgramData\{D9E629DC-CB1C-4A97-9900-81922B4EFFD4}
2015-04-15 13:05 - 2015-04-15 13:05 - 00206816 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgldx86.sys

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-05-15 16:16 - 2013-04-13 12:01 - 01862948 _____ () C:\Windows\WindowsUpdate.log
2015-05-15 16:16 - 2009-07-14 01:34 - 00014720 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-05-15 16:16 - 2009-07-14 01:34 - 00014720 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-05-15 16:12 - 2013-06-27 17:24 - 00001020 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-05-15 16:12 - 2009-07-14 01:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-05-15 16:12 - 2009-07-14 01:39 - 00065030 _____ () C:\Windows\setupact.log
2015-05-15 15:51 - 2013-06-27 17:24 - 00001024 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-05-15 09:53 - 2013-04-13 20:37 - 00000000 ____D () C:\ProgramData\MFAData
2015-05-15 09:47 - 2013-04-13 19:52 - 00749516 _____ () C:\Windows\PFRO.log
2015-05-14 18:17 - 2009-07-13 23:37 - 00000000 __RHD () C:\Users\Default
2015-05-14 18:17 - 2009-07-13 23:37 - 00000000 ___RD () C:\Users\Public
2015-05-14 18:16 - 2009-07-13 23:04 - 00000215 _____ () C:\Windows\system.ini
2015-05-14 18:00 - 2009-07-14 01:33 - 00407616 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-05-14 10:51 - 2009-07-13 23:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2015-05-14 09:05 - 2013-04-13 12:03 - 01530242 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-05-13 17:41 - 2009-07-14 05:57 - 00000000 ____D () C:\Program Files\Windows Journal
2015-05-13 17:41 - 2009-07-14 01:52 - 00000000 ____D () C:\Program Files\Windows Defender
2015-05-13 17:40 - 2009-07-13 23:37 - 00000000 ____D () C:\Windows\system32\zh-TW
2015-05-13 17:40 - 2009-07-13 23:37 - 00000000 ____D () C:\Windows\system32\zh-HK
2015-05-13 17:40 - 2009-07-13 23:37 - 00000000 ____D () C:\Windows\system32\zh-CN
2015-05-13 17:40 - 2009-07-13 23:37 - 00000000 ____D () C:\Windows\system32\tr-TR
2015-05-13 17:40 - 2009-07-13 23:37 - 00000000 ____D () C:\Windows\system32\sv-SE
2015-05-13 17:40 - 2009-07-13 23:37 - 00000000 ____D () C:\Windows\system32\ru-RU
2015-05-13 17:40 - 2009-07-13 23:37 - 00000000 ____D () C:\Windows\system32\pt-PT
2015-05-13 17:40 - 2009-07-13 23:37 - 00000000 ____D () C:\Windows\system32\pt-BR
2015-05-13 17:40 - 2009-07-13 23:37 - 00000000 ____D () C:\Windows\system32\pl-PL
2015-05-13 17:40 - 2009-07-13 23:37 - 00000000 ____D () C:\Windows\system32\nl-NL
2015-05-13 17:40 - 2009-07-13 23:37 - 00000000 ____D () C:\Windows\system32\nb-NO
2015-05-13 17:40 - 2009-07-13 23:37 - 00000000 ____D () C:\Windows\system32\ko-KR
2015-05-13 17:40 - 2009-07-13 23:37 - 00000000 ____D () C:\Windows\system32\ja-JP
2015-05-13 17:40 - 2009-07-13 23:37 - 00000000 ____D () C:\Windows\system32\it-IT
2015-05-13 17:40 - 2009-07-13 23:37 - 00000000 ____D () C:\Windows\system32\hu-HU
2015-05-13 17:40 - 2009-07-13 23:37 - 00000000 ____D () C:\Windows\system32\fr-FR
2015-05-13 17:40 - 2009-07-13 23:37 - 00000000 ____D () C:\Windows\system32\fi-FI
2015-05-13 17:40 - 2009-07-13 23:37 - 00000000 ____D () C:\Windows\system32\el-GR
2015-05-13 17:40 - 2009-07-13 23:37 - 00000000 ____D () C:\Windows\system32\de-DE
2015-05-13 15:47 - 2009-07-14 01:52 - 00000000 ____D () C:\Windows\addins
2015-05-13 15:11 - 2013-06-27 17:24 - 00000000 ____D () C:\Program Files\Google
2015-05-13 13:59 - 2013-04-13 12:00 - 00000000 ____D () C:\Users\shaka
2015-05-13 13:17 - 2013-06-27 17:24 - 00000000 ____D () C:\Users\shaka\AppData\Local\Google
2015-05-13 13:16 - 2013-04-13 20:48 - 00000000 ____D () C:\ProgramData\Adobe
2015-05-13 11:46 - 2009-07-14 05:57 - 00000000 ____D () C:\Windows\ShellNew
2015-05-13 11:33 - 2013-04-13 21:24 - 00000000 ____D () C:\Users\shaka\AppData\Roaming\Skype
2015-05-13 11:01 - 2009-07-14 05:43 - 00000000 ____D () C:\Windows\DigitalLocker
2015-05-13 10:49 - 2009-07-13 23:37 - 00000000 ____D () C:\Windows\tracing
2015-05-12 21:32 - 2013-04-13 19:34 - 00000000 ____D () C:\TempEI4
2015-05-12 20:18 - 2013-08-20 14:23 - 00000000 ____D () C:\Users\shaka\AppData\Roaming\Dropbox
2015-05-12 18:20 - 2013-04-22 15:19 - 00000000 ____D () C:\SRII
2015-05-12 18:17 - 2013-04-22 15:18 - 00000000 ____D () C:\Delta del Paraná
2015-05-12 18:03 - 2013-08-20 14:26 - 00000000 ___RD () C:\Users\shaka\Dropbox
2015-05-12 17:58 - 2013-04-17 11:01 - 00000000 ____D () C:\Users\shaka\Documents\Mis escaneos
2015-05-12 17:32 - 2015-03-16 09:55 - 00000000 ____D () C:\Users\shaka\Tracing
2015-05-12 15:33 - 2009-07-14 01:52 - 00000000 ____D () C:\Windows\system32\FxsTmp
2015-05-12 10:53 - 2014-02-27 13:52 - 00000000 ____D () C:\Users\shaka\AppData\Local\Skype
2015-05-12 10:53 - 2013-04-16 10:38 - 00000000 ____D () C:\Users\shaka\AppData\Local\HP
2015-05-12 10:53 - 2013-04-16 10:29 - 00000000 ____D () C:\Users\shaka\AppData\Roaming\Adobe
2015-05-12 10:53 - 2013-04-16 10:28 - 00000000 ____D () C:\Users\shaka\AppData\Roaming\HP
2015-05-12 10:52 - 2013-04-22 15:19 - 00000000 ____D () C:\Shaka
2015-05-12 10:52 - 2013-04-22 15:18 - 00000000 ____D () C:\Fuska
2015-05-01 09:32 - 2013-04-13 21:24 - 00000000 ____D () C:\ProgramData\Skype
2015-04-30 10:07 - 2013-04-13 21:29 - 137310008 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

==================== Files in the root of some directories =======

2015-05-12 13:39 - 2015-05-12 13:39 - 0000293 _____ () C:\Users\shaka\AppData\Roaming\8178audayu1bjiao
2015-05-12 10:53 - 2015-05-12 10:53 - 0008646 _____ () C:\Users\shaka\AppData\Roaming\HELP_DECRYPT.HTML
2015-05-12 10:53 - 2015-05-12 10:53 - 0045436 _____ () C:\Users\shaka\AppData\Roaming\HELP_DECRYPT.PNG
2015-05-12 10:53 - 2015-05-12 10:53 - 0004266 _____ () C:\Users\shaka\AppData\Roaming\HELP_DECRYPT.TXT
2015-05-12 10:53 - 2015-05-12 10:53 - 0000296 _____ () C:\Users\shaka\AppData\Roaming\HELP_DECRYPT.URL
2015-02-06 16:39 - 2015-02-06 16:39 - 0000824 _____ () C:\Users\shaka\AppData\Roaming\my_stuff.gif
2015-02-06 16:40 - 2015-02-06 16:40 - 0000554 _____ () C:\Users\shaka\AppData\Roaming\re.gif
2015-05-12 10:53 - 2015-05-12 10:53 - 0008646 _____ () C:\Users\shaka\AppData\Local\HELP_DECRYPT.HTML
2015-05-12 10:53 - 2015-05-12 10:53 - 0045436 _____ () C:\Users\shaka\AppData\Local\HELP_DECRYPT.PNG
2015-05-12 10:53 - 2015-05-12 10:53 - 0004266 _____ () C:\Users\shaka\AppData\Local\HELP_DECRYPT.TXT
2015-05-12 10:53 - 2015-05-12 10:53 - 0000296 _____ () C:\Users\shaka\AppData\Local\HELP_DECRYPT.URL
2015-05-12 10:52 - 2015-05-12 10:52 - 0008646 _____ () C:\ProgramData\HELP_DECRYPT.HTML
2015-05-12 10:52 - 2015-05-12 10:52 - 0045436 _____ () C:\ProgramData\HELP_DECRYPT.PNG
2015-05-12 10:52 - 2015-05-12 10:52 - 0004266 _____ () C:\ProgramData\HELP_DECRYPT.TXT
2015-05-12 10:52 - 2015-05-12 10:52 - 0000296 _____ () C:\ProgramData\HELP_DECRYPT.URL
2013-04-16 10:17 - 2013-04-16 10:28 - 0000357 _____ () C:\ProgramData\hpzinstall.log

Some content of TEMP:
====================
C:\Users\shaka\AppData\Local\temp\Quarantine.exe
C:\Users\shaka\AppData\Local\temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-05-05 12:12

==================== End Of Log ============================
--- --- ---


..und Additional

Code:
Additional scan result of Farbar Recovery Scan Tool (x86) Version: 14-05-2015 02
Ran by shaka at 2015-05-15 16:21:18
Running from C:\Users\shaka\Desktop
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrador (S-1-5-21-248733116-1412973945-2583540736-500 - Administrator - Disabled)
Invitado (S-1-5-21-248733116-1412973945-2583540736-501 - Limited - Disabled)
shaka (S-1-5-21-248733116-1412973945-2583540736-1000 - Administrator - Enabled) => C:\Users\shaka

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: AVG AntiVirus Free Edition 2015 (Enabled - Up to date) {4D41356F-32AD-7C42-C820-63775EE4F413}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: AVG AntiVirus Free Edition 2015 (Enabled - Up to date) {F620D48B-1497-73CC-F290-58052563BEAE}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

AVG 2015 (HKLM\...\AVG) (Version: 2015.0.5941 - AVG Technologies)
AVG 2015 (Version: 15.0.4342 - AVG Technologies) Hidden
AVG 2015 (Version: 15.0.5941 - AVG Technologies) Hidden
BufferChm (Version: 130.0.327.000 - Hewlett-Packard) Hidden
Crystal Reports (HKLM\...\CrystalReports) (Version:  - )
Destinations (Version: 130.0.0.0 - Hewlett-Packard) Hidden
DocProc (Version: 13.0.0.0 - Hewlett-Packard) Hidden
ESET Online Scanner v3 (HKLM\...\ESET Online Scanner) (Version:  - )
Google Chrome (HKLM\...\Google Chrome) (Version: 42.0.2311.152 - Google Inc.)
Google Earth (HKLM\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (Version: 1.3.26.9 - Google Inc.) Hidden
GPBaseService2 (Version: 130.0.367.000 - Hewlett-Packard) Hidden
HP Imaging Device Functions 13.0 (HKLM\...\HP Imaging Device Functions) (Version: 13.0 - HP)
HP Photosmart Essential 3.5 (HKLM\...\HP Photosmart Essential) (Version: 3.5 - HP)
HP Scanjet 2400 (HKLM\...\{D3A65B0A-403B-4C20-A488-BFED2BC5D2EF}) (Version: 13.0 - HP)
HP Solution Center 13.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 13.0 - HP)
HP Update (HKLM\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
HPDiagnosticAlert (Version: 1.00.0000 - Microsoft) Hidden
hpg2410 (Version: 14.0.0.0 - Nombre de su organización) Hidden
HPPhotosmartEssential (Version: 2.04.0000 - Hewlett-Packard) Hidden
HPProductAssistant (Version: 130.0.367.000 - Hewlett-Packard) Hidden
Intel(R) Management Engine Components (HKLM\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.0.4.1441 - Intel Corporation)
Intel(R) OpenCL CPU Runtime (HKLM\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version:  - Intel Corporation)
Intel(R) Processor Graphics (HKLM\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2669 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.0.0.1032 - Intel Corporation)
Intel® Trusted Connect Service Client (HKLM\...\{51A66ED3-200E-4147-8D1E-E8D30936FD26}) (Version: 1.23.605.1 - Intel Corporation)
Malwarebytes Anti-Malware Version 2.1.6.1022 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)
Markey (HKLM\...\Markey1.0) (Version: 1.0 - Markey)
Markey (HKLM\...\Markey3.5) (Version: 3.5 - Prevención Tecnológica S.A.)
Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUS) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP2 Parser and SDK (HKLM\...\{716E0306-8318-4364-8B8F-0CC4E9376BAC}) (Version: 4.20.9818.0 - Microsoft Corporation)
OCR Software by I.R.I.S. 13.0 (HKLM\...\HPOCR) (Version: 13.0 - HP)
Realtek Ethernet Controller Driver (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.49.927.2011 - Realtek)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6521 - Realtek Semiconductor Corp.)
Scan (Version: 13.0.0.0 - Hewlett-Packard) Hidden
Skype Click to Call (HKLM\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)
Skype™ 7.4 (HKLM\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.4.102 - Skype Technologies S.A.)
SolutionCenter (Version: 130.0.369.000 - Hewlett-Packard) Hidden
Visual Studio 2012 x86 Redistributables (HKLM\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VLC media player 2.0.6 (HKLM\...\VLC media player) (Version: 2.0.6 - VideoLAN)
WebReg (Version: 130.0.128.017 - Hewlett-Packard) Hidden
WinRAR 4.20 (32-bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-248733116-1412973945-2583540736-1000_Classes\CLSID\{0B4AA204-AB61-47E3-B5B4-27DCF375EBAC}\localserver32 -> "CDStart.exe" No File

==================== Restore Points  =========================

30-04-2015 09:38:29 Punto de control programado
08-05-2015 09:25:26 Punto de control programado
12-05-2015 23:01:57 avast! antivirus system restore point
13-05-2015 11:03:38 avast! antivirus system restore point
13-05-2015 11:34:36 Installed AVG 2015
13-05-2015 11:34:52 Installed AVG 2015
13-05-2015 13:15:40 Removed Adobe Reader XI (11.0.02) - Español.
13-05-2015 15:46:58 Malwarebytes Anti-Rootkit Restore Point
13-05-2015 16:45:46 Windows Update
14-05-2015 11:20:00 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 23:04 - 2015-05-14 18:16 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1      localhost

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {26333F52-395A-40AF-85EB-62866E3A9FD2} - System32\Tasks\{7862002D-768C-4093-A780-26FFE95CA295} => Chrome.exe hxxp://ui.skype.com/ui/0/6.6.0.106/es/abandoninstall?page=tsPlugin
Task: {39492BFD-1022-4CCB-8342-FBEFE6A28FAF} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-24] (Google Inc.)
Task: {BD9C3C2F-475C-46F2-882C-97DAD8F857B9} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-24] (Google Inc.)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (Whitelisted) ==============

2010-01-30 02:41 - 2010-01-30 02:41 - 04254560 _____ () C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2013-04-16 10:29 - 2012-09-18 15:26 - 00169472 _____ () C:\Windows\System32\zlhp1020.dll
2013-04-16 10:30 - 2012-09-18 15:26 - 00059904 _____ () C:\Windows\system32\spool\PRTPROCS\W32X86\pphp1020.dll
2015-05-13 10:32 - 2015-05-05 01:06 - 01252680 _____ () C:\Program Files\Google\Chrome\Application\42.0.2311.152\libglesv2.dll
2015-05-13 10:32 - 2015-05-05 01:06 - 00080712 _____ () C:\Program Files\Google\Chrome\Application\42.0.2311.152\libegl.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, the associated entry will be removed from the registry.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-248733116-1412973945-2583540736-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\shaka\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 200.49.130.47 - 200.42.4.210

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: AdobeARMservice => 2
MSCONFIG\Services: AdobeFlashPlayerUpdateSvc => 3
MSCONFIG\Services: c2cautoupdatesvc => 2
MSCONFIG\Services: c2cpnrsvc => 2
MSCONFIG\Services: gupdate => 2
MSCONFIG\Services: gupdatem => 3
MSCONFIG\Services: gusvc => 3
MSCONFIG\Services: KMService => 2
MSCONFIG\Services: SkypeUpdate => 2
MSCONFIG\startupfolder: C:^Users^shaka^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^HELP_DECRYPT.HTML => C:\Windows\pss\HELP_DECRYPT.HTML.Startup
MSCONFIG\startupfolder: C:^Users^shaka^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^HELP_DECRYPT.PNG => C:\Windows\pss\HELP_DECRYPT.PNG.Startup
MSCONFIG\startupfolder: C:^Users^shaka^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^HELP_DECRYPT.TXT => C:\Windows\pss\HELP_DECRYPT.TXT.Startup
MSCONFIG\startupfolder: C:^Users^shaka^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^HELP_DECRYPT.URL => C:\Windows\pss\HELP_DECRYPT.URL.Startup
MSCONFIG\startupreg: BCSSync => "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices
MSCONFIG\startupreg: HP Software Update => C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
MSCONFIG\startupreg: hpqSRMon => C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
MSCONFIG\startupreg: IAStorIcon => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
MSCONFIG\startupreg: RTHDVCPL => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
MSCONFIG\startupreg: Skype => "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [{43EA46D2-576A-4D49-87F0-CB599B1A9F9C}] => (Allow) C:\Program Files\AVG\AVG2013\avgmfapx.exe
FirewallRules: [{889A193B-0CF9-4617-ACAB-CDC78B719F8E}] => (Allow) C:\Program Files\AVG\AVG2013\avgmfapx.exe
FirewallRules: [{9C5BA8F1-12DF-4316-8BEC-4FFEE95297A8}] => (Allow) C:\Program Files\Skype\Phone\Skype.exe
FirewallRules: [{1F6799A7-3655-46B2-A8BD-DD3A1E998BE4}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe
FirewallRules: [{37FE0C1C-F4F8-460F-BFBC-A69ABA0607FA}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe
FirewallRules: [{1AF2A179-93CB-41A1-897C-0F4C97EE35FB}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe
FirewallRules: [{387476B0-3580-4F27-A229-469E5222F2AC}] => (Allow) C:\Program Files\common files\hp\digital imaging\bin\hpqphotocrm.exe
FirewallRules: [{B282551C-C29C-43D9-9F1E-C3579876C643}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqsudi.exe
FirewallRules: [{2E2B045C-B6A5-4F0D-B272-838EF219E7AC}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqpsapp.exe
FirewallRules: [{381B57EF-4C70-4B1E-8EC1-16C80BC3CD95}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqpse.exe
FirewallRules: [{1CCD67C9-35AF-415A-975B-0B42DC531DF5}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqgplgtupl.exe
FirewallRules: [{8FDF4CBE-6D1A-4053-B6DE-B07E4344078F}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
FirewallRules: [{42BFC7E9-9F1D-4062-BF03-F8758434D5AC}] => (Allow) C:\Program Files\HP\hp software update\hpwucli.exe
FirewallRules: [TCP Query User{695A6352-C713-4E93-B73C-0D91FAAD09FA}C:\users\shaka\appdata\roaming\dropbox\bin\dropbox.exe] => (Allow) C:\users\shaka\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [UDP Query User{3B58EFB0-4B90-4D15-A134-12562EE5B357}C:\users\shaka\appdata\roaming\dropbox\bin\dropbox.exe] => (Allow) C:\users\shaka\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [{0D4C6489-4111-4FA2-A261-CD582DC318D5}] => (Allow) C:\Program Files\Google\Chrome\Application\chrome.exe
FirewallRules: [{912D1AF4-FD65-4852-8C06-82DF132EE1BB}] => (Allow) C:\Program Files\AVG\AVG2015\avgnsx.exe
FirewallRules: [{15A0BC5E-EB73-467D-86B0-6EF1DF41E623}] => (Allow) C:\Program Files\AVG\AVG2015\avgnsx.exe
FirewallRules: [{C1586590-AC4C-4155-8A93-8C0D1CECB3B9}] => (Allow) C:\Program Files\AVG\AVG2015\avgdiagex.exe
FirewallRules: [{8860B64F-93EB-415E-A78F-5BB71196526C}] => (Allow) C:\Program Files\AVG\AVG2015\avgdiagex.exe
FirewallRules: [{50206D38-EBD5-4011-9FBB-3061A19B73BE}] => (Allow) C:\Program Files\AVG\AVG2015\avgmfapx.exe
FirewallRules: [{B4770506-583E-48B9-8DE5-447CE81EBF39}] => (Allow) C:\Program Files\AVG\AVG2015\avgmfapx.exe
FirewallRules: [{1D3BD8A4-4675-4F8D-85D7-0D675030892B}] => (Allow) C:\Program Files\AVG\AVG2015\avgemcx.exe
FirewallRules: [{236C3B48-1BB4-46A7-B850-775A521863F8}] => (Allow) C:\Program Files\AVG\AVG2015\avgemcx.exe

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (05/13/2015 03:46:57 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Error del Servicio de instantáneas de volumen: error inesperado al consultar la interfaz IVssWriterCallback. HR = 0x80070005, Acceso denegado.
.
A menudo ocurre por una configuración de seguridad incorrecta en el proceso de escritura o de solicitud.


Operación:
  Recopilando datos del escritor

Contexto:
  Id. de clase del escritor: {e8132975-6f93-4464-a53e-1050253ae220}
  Nombre del escritor: System Writer
  Id. de instancia del escritor: {45830ae4-1abe-4139-90f9-a73fcf797e08}

Error: (05/13/2015 03:30:40 PM) (Source: Software Protection Platform Service) (EventID: 1001) (User: )
Description: No se pudo iniciar el servicio de protección de software. 0xD0000022
6.1.7601.17514

Error: (05/13/2015 11:03:37 AM) (Source: VSS) (EventID: 8194) (User: )
Description: Error del Servicio de instantáneas de volumen: error inesperado al consultar la interfaz IVssWriterCallback. HR = 0x80070005, Acceso denegado.
.
A menudo ocurre por una configuración de seguridad incorrecta en el proceso de escritura o de solicitud.


Operación:
  Recopilando datos del escritor

Contexto:
  Id. de clase del escritor: {e8132975-6f93-4464-a53e-1050253ae220}
  Nombre del escritor: System Writer
  Id. de instancia del escritor: {e4c47749-9679-4d3a-915e-4bd4a36a802c}

Error: (05/13/2015 10:30:38 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Nombre de la aplicación con errores: taskhost.exe, versión: 6.1.7601.18010, marca de tiempo: 0x50aee407
Nombre del módulo con errores: ntdll.dll, versión: 6.1.7601.17725, marca de tiempo: 0x4ec49b60
Código de excepción: 0x80000003
Desplazamiento de errores: 0x0006374e
Id. del proceso con errores: 0x738
Hora de inicio de la aplicación con errores: 0xtaskhost.exe0
Ruta de acceso de la aplicación con errores: taskhost.exe1
Ruta de acceso del módulo con errores: taskhost.exe2
Id. del informe: taskhost.exe3

Error: (05/13/2015 10:30:35 AM) (Source: VSS) (EventID: 13) (User: )
Description: Información del Servicio de instantáneas de volumen: el servidor COM con CLSID {e579ab5f-1cc4-44b4-bed9-de0991ff0623} y el nombre Coordinator no puede iniciarse. [0x80070005, Acceso denegado.
]

Error: (05/13/2015 09:24:00 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Nombre de la aplicación con errores: AvastUI.exe, versión: 10.2.2218.942, marca de tiempo: 0x55364e82
Nombre del módulo con errores: ntdll.dll, versión: 6.1.7601.17725, marca de tiempo: 0x4ec49b60
Código de excepción: 0xc000070a
Desplazamiento de errores: 0x0009bdec
Id. del proceso con errores: 0xb74
Hora de inicio de la aplicación con errores: 0xAvastUI.exe0
Ruta de acceso de la aplicación con errores: AvastUI.exe1
Ruta de acceso del módulo con errores: AvastUI.exe2
Id. del informe: AvastUI.exe3

Error: (05/12/2015 11:30:16 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: El programa Explorer.EXE, versión 6.1.7601.17514, dejó de interactuar con Windows y se cerró. Para ver si hay más información disponible acerca del problema, compruebe el historial de problemas en el panel de control Centro de actividades.

Identificador de proceso: 868

Hora de inicio: 01d08d22fe2cd795

Hora de finalización: 31

Ruta de acceso de la aplicación: C:\Windows\Explorer.EXE

Identificador de informe: fb53a5b0-f917-11e4-a81f-eca86b747777

Error: (05/12/2015 11:01:57 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Error del Servicio de instantáneas de volumen: error inesperado al consultar la interfaz IVssWriterCallback. HR = 0x80070005, Acceso denegado.
.
A menudo ocurre por una configuración de seguridad incorrecta en el proceso de escritura o de solicitud.


Operación:
  Recopilando datos del escritor

Contexto:
  Id. de clase del escritor: {e8132975-6f93-4464-a53e-1050253ae220}
  Nombre del escritor: System Writer
  Id. de instancia del escritor: {9980a6b2-78b8-445c-8265-5e61a92e039f}

Error: (05/12/2015 10:58:11 PM) (Source: VSS) (EventID: 13) (User: )
Description: Información del Servicio de instantáneas de volumen: el servidor COM con CLSID {e579ab5f-1cc4-44b4-bed9-de0991ff0623} y el nombre Coordinator no puede iniciarse. [0x80070005, Acceso denegado.
]

Error: (05/12/2015 10:58:06 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Nombre de la aplicación con errores: taskhost.exe, versión: 6.1.7601.18010, marca de tiempo: 0x50aee407
Nombre del módulo con errores: ntdll.dll, versión: 6.1.7601.17725, marca de tiempo: 0x4ec49b60
Código de excepción: 0x80000003
Desplazamiento de errores: 0x0006374e
Id. del proceso con errores: 0x80c
Hora de inicio de la aplicación con errores: 0xtaskhost.exe0
Ruta de acceso de la aplicación con errores: taskhost.exe1
Ruta de acceso del módulo con errores: taskhost.exe2
Id. del informe: taskhost.exe3


System errors:
=============
Error: (05/15/2015 04:16:11 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: El servicio Intel(R) Management and Security Application User Notification Service se terminó de manera inesperada. Esto ha sucedido 1 veces.

Error: (05/15/2015 04:16:11 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: El servicio Protección de software terminó inesperadamente. Esto se ha repetido 1 veces. Se realizará la siguiente acción correctora en 120000 milisegundos: Reiniciar el servicio.

Error: (05/15/2015 04:16:11 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: El servicio Intel(R) Rapid Storage Technology se terminó de manera inesperada. Esto ha sucedido 1 veces.

Error: (05/15/2015 04:16:11 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: El servicio Servicio de uso compartido de red del Reproductor de Windows Media terminó inesperadamente. Esto se ha repetido 1 veces. Se realizará la siguiente acción correctora en 30000 milisegundos: Reiniciar el servicio.

Error: (05/15/2015 04:16:10 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: El servicio Intel(R) Dynamic Application Loader Host Interface Service se terminó de manera inesperada. Esto ha sucedido 1 veces.

Error: (05/15/2015 04:16:10 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: El servicio Intel(R) Capability Licensing Service Interface terminó inesperadamente. Esto se ha repetido 1 veces. Se realizará la siguiente acción correctora en 0 milisegundos: Reiniciar el servicio.

Error: (05/15/2015 04:16:09 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: El servicio WatchDog de AVG terminó inesperadamente. Esto se ha repetido 1 veces. Se realizará la siguiente acción correctora en 0 milisegundos: Reiniciar el servicio.

Error: (05/15/2015 04:16:09 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: El servicio Cola de impresión terminó inesperadamente. Esto se ha repetido 1 veces. Se realizará la siguiente acción correctora en 60000 milisegundos: Reiniciar el servicio.

Error: (05/15/2015 04:12:11 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: El servicio Avira Mail Protection depende del servicio Avira Real-Time Protection, el cual no pudo iniciarse debido al siguiente error:
%%2

Error: (05/15/2015 04:12:09 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: El servicio Avira Web Protection depende del servicio Avira Real-Time Protection, el cual no pudo iniciarse debido al siguiente error:
%%2


Microsoft Office Sessions:
=========================
Error: (05/13/2015 03:46:57 PM) (Source: VSS) (EventID: 8194) (User: )
Description: 0x80070005, Acceso denegado.


Operación:
  Recopilando datos del escritor

Contexto:
  Id. de clase del escritor: {e8132975-6f93-4464-a53e-1050253ae220}
  Nombre del escritor: System Writer
  Id. de instancia del escritor: {45830ae4-1abe-4139-90f9-a73fcf797e08}

Error: (05/13/2015 03:30:40 PM) (Source: Software Protection Platform Service) (EventID: 1001) (User: )
Description: 0xD00000226.1.7601.17514

Error: (05/13/2015 11:03:37 AM) (Source: VSS) (EventID: 8194) (User: )
Description: 0x80070005, Acceso denegado.


Operación:
  Recopilando datos del escritor

Contexto:
  Id. de clase del escritor: {e8132975-6f93-4464-a53e-1050253ae220}
  Nombre del escritor: System Writer
  Id. de instancia del escritor: {e4c47749-9679-4d3a-915e-4bd4a36a802c}

Error: (05/13/2015 10:30:38 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: taskhost.exe6.1.7601.1801050aee407ntdll.dll6.1.7601.177254ec49b60800000030006374e73801d08d7faa64a4e1C:\Windows\system32\taskhost.exeC:\Windows\SYSTEM32\ntdll.dll3dfc7cde-f974-11e4-b8f9-eca86b747777

Error: (05/13/2015 10:30:35 AM) (Source: VSS) (EventID: 13) (User: )
Description: {e579ab5f-1cc4-44b4-bed9-de0991ff0623}Coordinator0x80070005, Acceso denegado.

Error: (05/13/2015 09:24:00 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: AvastUI.exe10.2.2218.94255364e82ntdll.dll6.1.7601.177254ec49b60c000070a0009bdecb7401d08d777c55c59fC:\Program Files\AVAST Software\Avast\AvastUI.exeC:\Windows\SYSTEM32\ntdll.dlleeec3b61-f96a-11e4-a7a9-eca86b747777

Error: (05/12/2015 11:30:16 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Explorer.EXE6.1.7601.1751486801d08d22fe2cd79531C:\Windows\Explorer.EXEfb53a5b0-f917-11e4-a81f-eca86b747777

Error: (05/12/2015 11:01:57 PM) (Source: VSS) (EventID: 8194) (User: )
Description: 0x80070005, Acceso denegado.


Operación:
  Recopilando datos del escritor

Contexto:
  Id. de clase del escritor: {e8132975-6f93-4464-a53e-1050253ae220}
  Nombre del escritor: System Writer
  Id. de instancia del escritor: {9980a6b2-78b8-445c-8265-5e61a92e039f}

Error: (05/12/2015 10:58:11 PM) (Source: VSS) (EventID: 13) (User: )
Description: {e579ab5f-1cc4-44b4-bed9-de0991ff0623}Coordinator0x80070005, Acceso denegado.

Error: (05/12/2015 10:58:06 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: taskhost.exe6.1.7601.1801050aee407ntdll.dll6.1.7601.177254ec49b60800000030006374e80c01d08d0c2286d8dbC:\Windows\system32\taskhost.exeC:\Windows\SYSTEM32\ntdll.dll7f0061d9-f913-11e4-bc6f-eca86b747777


==================== Memory info ===========================

Processor: Intel(R) Pentium(R) CPU G2020 @ 2.90GHz
Percentage of memory in use: 36%
Total physical RAM: 3494.59 MB
Available physical RAM: 2213.35 MB
Total Pagefile: 6987.48 MB
Available Pagefile: 5593.45 MB
Total Virtual: 2047.88 MB
Available Virtual: 1915.35 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:465.66 GB) (Free:427.92 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 5DC69892)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=465.7 GB) - (Type=07 NTFS)

==================== End Of Log ============================
Gruss
C

schrauber 16.05.2015 13:27

ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

chrischl 18.05.2015 14:01
Moin Schrauber.
Hier sind die Logs. Keine gravierenden Probleme mehr auf der Kiste aktuell und laeuft auch wieder einigermassen rund... Haben den Schlawinern anscheinend gerade noch frueh genug den Gar ausmachen koennen...:-) So ganz trau ich dem Frieden aber noch nicht.. Hier fehlt noch eine firewall.. Irgendwelche Vorschlaege?
Thx
C

ESET Scan (mmhmm.. so wies aussieht ist der filecoder wieder oder immer noch da...)

Code:
ESETSmartInstaller@High as downloader log:
all ok
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=a79c92b35fafac48a561db3ab97d71b8
# engine=23900
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-05-18 12:51:09
# local_time=2015-05-18 09:51:09 (-0300, Hora estándar de Argentina)
# country="Argentina"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='AVG AntiVirus Free Edition 2015'
# compatibility_mode=1055 16777213 100 100 0 118147853 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 66 85 0 183498260 0 0
# scanned=124530
# found=181
# cleaned=0
# scan_time=1514
sh=05BBF923EFFC0CEAC46F97D7A4338AE75A00C02D ft=1 fh=bf0cf04aa4aad68d vn="MSIL/AdvancedSystemProtector.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Advanced System Protector\Troubleshooter\asp-fixer.scr.vir"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\shaka\AppData\Roaming\Systweak\HELP_DECRYPT.HTML.vir"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\shaka\AppData\Roaming\Systweak\HELP_DECRYPT.TXT.vir"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\shaka\AppData\Roaming\Systweak\Advanced System Protector\HELP_DECRYPT.HTML.vir"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\shaka\AppData\Roaming\Systweak\Advanced System Protector\HELP_DECRYPT.TXT.vir"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\shaka\AppData\Roaming\Systweak\Advanced System Protector\2.1.1000.10843\HELP_DECRYPT.HTML.vir"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\shaka\AppData\Roaming\Systweak\Advanced System Protector\2.1.1000.10843\HELP_DECRYPT.TXT.vir"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\shaka\AppData\Roaming\Systweak\Advanced System Protector\2.1.1000.10844\HELP_DECRYPT.HTML.vir"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\shaka\AppData\Roaming\Systweak\Advanced System Protector\2.1.1000.10844\HELP_DECRYPT.TXT.vir"
sh=4D02516E5ACE56387898DD5EEA8DA2A2D1C147DF ft=1 fh=16b7d4b433d0db89 vn="Variante von Win32/Systweak.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Windows\system32\roboot.exe.vir"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Fuska\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Fuska\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Fuska\Senasa\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Fuska\Senasa\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\ProgramData\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\ProgramData\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\ProgramData\Microsoft\RAC\PublishedData\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\ProgramData\Microsoft\RAC\PublishedData\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Shaka\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Shaka\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Shaka\Rivera\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Shaka\Rivera\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Shaka\Trabajos\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Shaka\Trabajos\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Shaka\Trabajos\Eugenio\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Shaka\Trabajos\Eugenio\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Shaka\Trabajos\JGF\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Shaka\Trabajos\JGF\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Shaka\Trabajos\JGF\La Salamandra\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Shaka\Trabajos\JGF\La Salamandra\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\All Users\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\All Users\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\All Users\Microsoft\RAC\PublishedData\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\All Users\Microsoft\RAC\PublishedData\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Google\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Google\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Google\Chrome\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Google\Chrome\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Google\Chrome\User Data\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Google\Chrome\User Data\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg\0.3.0.2_0\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg\0.3.0.2_0\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg\0.3.0.2_0\audio\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg\0.3.0.2_0\audio\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\HP\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\HP\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\HP\Digital Imaging\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\HP\Digital Imaging\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\HP\Digital Imaging\cache2\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\HP\Digital Imaging\cache2\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\HP\Digital Imaging\db2\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\HP\Digital Imaging\db2\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\HP\Digital Imaging\vault\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\HP\Digital Imaging\vault\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Microsoft\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Microsoft\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Microsoft\Device Metadata\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Microsoft\Device Metadata\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Microsoft\Internet Explorer\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Microsoft\Internet Explorer\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Microsoft\Media Player\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Microsoft\Media Player\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Microsoft\Media Player\Caché de imágenes\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Microsoft\Media Player\Caché de imágenes\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Microsoft\Media Player\Caché de imágenes\LocalMLS\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Microsoft\Media Player\Caché de imágenes\LocalMLS\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Microsoft\Windows Mail\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Microsoft\Windows Mail\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Microsoft\Windows Mail\Backup\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Microsoft\Windows Mail\Backup\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Microsoft\Windows Mail\Backup\old\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Microsoft\Windows Mail\Backup\old\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Microsoft\Windows Mail\Stationery\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Microsoft\Windows Mail\Stationery\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Microsoft\Windows Media\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Microsoft\Windows Media\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Microsoft\Windows Media\12.0\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Microsoft\Windows Media\12.0\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Skype\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Skype\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Skype\Apps\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Local\Skype\Apps\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\LocalLow\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\LocalLow\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\LocalLow\Google\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\LocalLow\Google\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\LocalLow\Google\GoogleEarth\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\LocalLow\Google\GoogleEarth\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\LocalLow\Google\GoogleEarth\unified_cache_leveldb_leveldb2\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\LocalLow\Google\GoogleEarth\unified_cache_leveldb_leveldb2\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Adobe\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Adobe\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Adobe\Flash Player\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Adobe\Flash Player\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Adobe\Flash Player\AssetCache\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Adobe\Flash Player\AssetCache\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Adobe\Flash Player\AssetCache\N4DTGKAY\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Adobe\Flash Player\AssetCache\N4DTGKAY\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Dropbox\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Dropbox\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Dropbox\bin\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Dropbox\bin\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Dropbox\instance1\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Dropbox\instance1\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\HP\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\HP\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\HP\WebRegLogs\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\HP\WebRegLogs\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Microsoft\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Microsoft\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Microsoft\Document Building Blocks\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Microsoft\Document Building Blocks\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Microsoft\Document Building Blocks\3082\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Microsoft\Document Building Blocks\3082\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Microsoft\Document Building Blocks\3082\14\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Microsoft\Document Building Blocks\3082\14\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\emo_cache\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\emo_cache\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\emo_cache\asyncdb\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\emo_cache\asyncdb\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\media_cache\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\media_cache\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\media_cache\asyncdb\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\media_cache\asyncdb\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\storage_db\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\storage_db\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\storage_db\asyncdb\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\storage_db\asyncdb\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\qikdb\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\qikdb\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\cadopa\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\cadopa\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\emo_cache\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\emo_cache\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\emo_cache\asyncdb\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\emo_cache\asyncdb\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\media_cache\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\media_cache\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\media_cache\asyncdb\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\media_cache\asyncdb\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\storage_db\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\storage_db\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\storage_db\asyncdb\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\storage_db\asyncdb\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\cadopa\qikdb\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\cadopa\qikdb\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\patricia.guimaraens\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\patricia.guimaraens\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\shared_httpfe\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\AppData\Roaming\Skype\shared_httpfe\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\Documents\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\Documents\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\Documents\Mis escaneos\HELP_DECRYPT.HTML"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Users\shaka\Documents\Mis escaneos\HELP_DECRYPT.TXT"
sh=F91AEF93844C08755E91A911B2EAA313E2F34FDF ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Windows\pss\HELP_DECRYPT.HTML.Startup"
sh=E50FC2ED8D331FF4CBFAEE9305F658C8E2BFA025 ft=0 fh=0000000000000000 vn="Win32/Filecoder.CR Trojaner" ac=I fn="C:\Windows\pss\HELP_DECRYPT.TXT.Startup"
sh=7F29C65D27184E6C1E65253A19154568335D994C ft=1 fh=8dfecc9f0b4d34d4 vn="Win32/AdvancedSystemProtector.A evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\System32\sasnative32.exe"
Hier der Security Check

Code:
Results of screen317's Security Check version 1.001 
 Windows 7 Service Pack 1 x86 (UAC is enabled) 
 Internet Explorer 11 
``````````````Antivirus/Firewall Check:``````````````
AVG AntiVirus Free Edition 2015 
 Antivirus up to date! 
`````````Anti-malware/Other Utilities Check:`````````
 Google Chrome (42.0.2311.135)
 Google Chrome (42.0.2311.152)
````````Process Check: objlist.exe by Laurent```````` 
 AVG avgwdsvc.exe
 AVG avgrsx.exe
 AVG avgnsx.exe
 AVG avgemc.exe
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C: 
````````````````````End of Log``````````````````````
FRST log


FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 16-05-2015 02
Ran by shaka (administrator) on OFICINA on 18-05-2015 09:59:33
Running from C:\Users\shaka\Desktop
Loaded Profiles: shaka (Available profiles: shaka)
Platform: Microsoft Windows 7 Enterprise  Service Pack 1 (X86) OS Language: Español (España, internacional)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgwdsvc.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Google Inc.) C:\Program Files\Google\Update\1.3.26.9\GoogleCrashHandler.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgui.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\taskmgr.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgemcx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgnsx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgrsx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgcsrvx.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [AVG_UI] => C:\Program Files\AVG\AVG2015\avgui.exe [3745232 2015-04-15] (AVG Technologies CZ, s.r.o.)
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [280576 2013-04-15] (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-248733116-1412973945-2583540736-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-248733116-1412973945-2583540736-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-248733116-1412973945-2583540736-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/?pc=SKY2&ocid=SKY2DHP&osmkt=es-ar
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-248733116-1412973945-2583540736-1000 -> {B6846C33-43CE-41CD-BB51-F754E8F8D9C0} URL = https://www.google.com/search?q={searchTerms}
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2010-03-25] (Microsoft Corporation)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-07-14] (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2010-02-28] (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-07-14] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 200.49.130.47 200.42.4.210

FireFox:
========
FF ProfilePath: C:\Users\shaka\AppData\Roaming\Mozilla\Firefox\Profiles\3UZSzQhi.default
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 -> C:\Program Files\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-01-06] (Intel Corporation)
FF Plugin: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-01-06] (Intel Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-09] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-09] (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.6 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2013-04-10] (VideoLAN)
FF Extension: Avira Browser Safety - C:\Users\shaka\AppData\Roaming\Mozilla\Firefox\Profiles\3UZSzQhi.default\Extensions\abs@avira.com [2015-05-12]

Chrome:
=======
CHR HomePage: Default -> hxxp://avg.nation.com/avgtbavg/search/home?cid={E208873C-885A-4286-B6F4-317872DB511A}&mid=491fcc7d9a9147d3b0823de12d909e84-0762da72d5c59cee9c9f5a280d2b05848fe8dcff&lang=es-es&ds=AVG&coid=avgtbavg&pr=fr&d=2013-10-01 13:49:47&v=18.1.0.443&pid=nation&sg=0&sap=hp&cmpid=0913b
CHR StartupUrls: Default -> "https://www.google.com.ar/"
CHR DefaultSearchKeyword: Default -> avg.nation.com
CHR DefaultSearchURL: Default -> hxxp://avg.nation.com/avgtbavg/search/web?cid={E208873C-885A-4286-B6F4-317872DB511A}&mid=491fcc7d9a9147d3b0823de12d909e84-0762da72d5c59cee9c9f5a280d2b05848fe8dcff&lang=es-es&ds=AVG&coid=avgtbavg&pr=fr&d=2013-10-01 13:49:47&v=17.0.1.12&pid=nation&sg=0&sap=dsp&q={searchTerms}&cmpid=0913b
CHR DefaultNewTabURL: Default -> https://avg.nation.com/chroment?espv=2&cid={E208873C-885A-4286-B6F4-317872DB511A}&mid=491fcc7d9a9147d3b0823de12d909e84-0762da72d5c59cee9c9f5a280d2b05848fe8dcff&lang=es-es&ds=AVG&pr=fr&d=2013-10-01 13:49:47&v=18.1.0.443&pid=nation&sg=0
CHR DefaultSuggestURL: Default -> hxxp://toolbar.avg.com/acp?q={searchTerms}&o=1
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\42.0.2311.152\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\42.0.2311.152\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\42.0.2311.152\pdf.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 11.0\Reader\Browser\nppdf32.dll No File
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll No File
CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
CHR Plugin: (VLC Web Plugin) - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
CHR Profile: C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (YouTube) - C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-06-27]
CHR Extension: (Google Search) - C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-06-27]
CHR Extension: (Bookmark Manager) - C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2015-04-27]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-04-21]
CHR Extension: (Google Wallet) - C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-24]
CHR Extension: (Gmail) - C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-06-27]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AVGIDSAgent; C:\Program Files\AVG\AVG2015\avgidsagent.exe [3438032 2015-04-15] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files\AVG\AVG2015\avgwdsvc.exe [311792 2015-04-15] (AVG Technologies CZ, s.r.o.)
S4 c2cautoupdatesvc; C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
S4 c2cpnrsvc; C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
S3 cphs; C:\Windows\system32\IntelCpHeciSvc.exe [276248 2012-03-06] (Intel Corporation)
S3 hpqcxs08; C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll [248832 2009-05-18] (Hewlett-Packard Co.) [File not signed]
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [458464 2012-02-02] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [162648 2012-03-15] (Intel Corporation)
S4 KMService; C:\Windows\system32\srvany.exe [8192 2013-04-13] () [File not signed]
S2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)
S2 AntiVirMailService; "C:\Program Files\Avira\Antivirus\avmailc7.exe" [X]
S2 AntiVirSchedulerService; "C:\Program Files\Avira\Antivirus\sched.exe" [X]
S2 AntiVirService; "C:\Program Files\Avira\Antivirus\avguard.exe" [X]
S2 AntiVirWebService; "C:\Program Files\Avira\Antivirus\avwebg7.exe" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 Avgdiskx; C:\Windows\System32\DRIVERS\avgdiskx.sys [132576 2015-03-11] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdriverx.sys [226784 2015-04-09] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHX; C:\Windows\System32\DRIVERS\avgidshx.sys [166880 2015-03-11] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSShim; C:\Windows\System32\DRIVERS\avgidsshimx.sys [29664 2015-03-11] (AVG Technologies CZ, s.r.o.)
R1 Avgldx86; C:\Windows\System32\DRIVERS\avgldx86.sys [206816 2015-04-15] (AVG Technologies CZ, s.r.o.)
R0 Avglogx; C:\Windows\System32\DRIVERS\avglogx.sys [269792 2015-03-11] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx86; C:\Windows\System32\DRIVERS\avgmfx86.sys [110048 2015-04-03] (AVG Technologies CZ, s.r.o.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105864 2015-03-27] (Avira Operations GmbH & Co. KG)
R0 Avgrkx86; C:\Windows\System32\DRIVERS\avgrkx86.sys [35808 2015-03-20] (AVG Technologies CZ, s.r.o.)
R1 Avgtdix; C:\Windows\System32\DRIVERS\avgtdix.sys [213984 2015-04-07] (AVG Technologies CZ, s.r.o.)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2015-03-27] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2015-03-27] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [37896 2015-03-27] (Avira Operations GmbH & Co. KG)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2015-04-14] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2015-04-14] (Malwarebytes Corporation)
R3 MEI; C:\Windows\System32\DRIVERS\HECI.sys [46080 2011-11-09] (Intel Corporation)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2015-03-27] (Avira GmbH)
S3 catchme; \??\C:\Users\shaka\AppData\Local\Temp\catchme.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-05-18 09:58 - 2015-05-18 09:58 - 00000720 _____ () C:\Users\shaka\Desktop\Security Check.txt
2015-05-18 08:17 - 2015-05-18 08:17 - 00852630 _____ () C:\Users\shaka\Desktop\SecurityCheck.exe
2015-05-18 08:14 - 2015-05-18 08:15 - 02347384 _____ (ESET) C:\Users\shaka\Downloads\esetsmartinstaller_deu (1).exe
2015-05-15 16:21 - 2015-05-15 16:21 - 00025766 _____ () C:\Users\shaka\Desktop\Addition.txt
2015-05-15 16:20 - 2015-05-18 09:59 - 00014315 _____ () C:\Users\shaka\Desktop\FRST.txt
2015-05-15 16:19 - 2015-05-18 09:59 - 00000000 ____D () C:\Users\shaka\Desktop\FRST-OlderVersion
2015-05-15 16:17 - 2015-05-15 16:17 - 00000858 _____ () C:\Users\shaka\Desktop\JRT.txt
2015-05-15 16:15 - 2015-05-15 16:15 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-OFICINA-Windows-7-Enterprise-(32-bit).dat
2015-05-15 16:15 - 2015-05-15 16:15 - 00000000 ____D () C:\RegBackup
2015-05-15 16:14 - 2015-05-15 16:14 - 00001361 _____ () C:\Users\shaka\Desktop\AdwCleaner[S4] 15.5.15.txt
2015-05-15 16:08 - 2015-05-15 16:08 - 00001228 _____ () C:\Users\shaka\Desktop\mbar Scan 15.5.15.txt
2015-05-15 15:57 - 2015-05-15 15:57 - 02721175 _____ (Thisisu) C:\Users\shaka\Desktop\JRT.exe
2015-05-15 15:55 - 2015-05-15 15:56 - 00000000 ____D () C:\Users\shaka\Desktop\Alte Suchlaeufe
2015-05-14 18:17 - 2015-05-14 18:17 - 00017285 _____ () C:\ComboFix.txt
2015-05-14 18:10 - 2011-06-26 03:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-05-14 18:10 - 2010-11-07 14:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-05-14 18:10 - 2009-04-20 01:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-05-14 18:10 - 2000-08-30 21:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-05-14 18:10 - 2000-08-30 21:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-05-14 18:10 - 2000-08-30 21:00 - 00098816 _____ () C:\Windows\sed.exe
2015-05-14 18:10 - 2000-08-30 21:00 - 00080412 _____ () C:\Windows\grep.exe
2015-05-14 18:10 - 2000-08-30 21:00 - 00068096 _____ () C:\Windows\zip.exe
2015-05-14 18:09 - 2015-05-14 18:17 - 00000000 ____D () C:\Windows\erdnt
2015-05-14 18:09 - 2015-05-14 18:17 - 00000000 ____D () C:\Qoobox
2015-05-14 18:07 - 2015-05-14 18:07 - 05623645 ____R (Swearware) C:\Users\shaka\Desktop\ComboFix.exe
2015-05-14 10:55 - 2015-04-21 22:48 - 00342736 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-05-14 10:55 - 2015-04-21 13:25 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-05-14 10:55 - 2015-04-21 13:25 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-05-14 10:55 - 2015-04-21 13:24 - 19691008 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-05-14 10:55 - 2015-04-21 13:11 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-05-14 10:55 - 2015-04-21 13:11 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-05-14 10:55 - 2015-04-21 13:10 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-05-14 10:55 - 2015-04-21 13:09 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-05-14 10:55 - 2015-04-21 13:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-05-14 10:55 - 2015-04-21 13:04 - 02278400 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-05-14 10:55 - 2015-04-21 13:03 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-05-14 10:55 - 2015-04-21 13:02 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-05-14 10:55 - 2015-04-21 13:00 - 00478208 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-05-14 10:55 - 2015-04-21 12:58 - 00664576 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-05-14 10:55 - 2015-04-21 12:58 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-05-14 10:55 - 2015-04-21 12:58 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-05-14 10:55 - 2015-04-21 12:57 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-05-14 10:55 - 2015-04-21 12:51 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-05-14 10:55 - 2015-04-21 12:48 - 00418304 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-05-14 10:55 - 2015-04-21 12:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-05-14 10:55 - 2015-04-21 12:39 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-05-14 10:55 - 2015-04-21 12:38 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-05-14 10:55 - 2015-04-21 12:36 - 00285696 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-05-14 10:55 - 2015-04-21 12:31 - 04305920 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-05-14 10:55 - 2015-04-21 12:26 - 00688640 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-05-14 10:55 - 2015-04-21 12:26 - 00685568 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-05-14 10:55 - 2015-04-21 12:25 - 02052608 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-05-14 10:55 - 2015-04-21 12:24 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-05-14 10:55 - 2015-04-21 12:17 - 12828672 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-05-14 10:55 - 2015-04-21 12:02 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-05-14 10:55 - 2015-04-21 11:58 - 01310208 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-05-14 10:55 - 2015-04-21 11:56 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-05-14 10:48 - 2013-12-24 20:09 - 01987584 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2015-05-14 10:48 - 2013-11-26 05:16 - 03419136 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2015-05-14 09:10 - 2015-04-19 23:56 - 01250816 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-05-14 09:10 - 2015-04-19 23:56 - 00909312 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-05-14 09:10 - 2015-04-19 23:03 - 02382336 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-05-14 09:10 - 2015-02-03 23:54 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2015-05-14 09:10 - 2015-02-03 00:12 - 01230848 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-05-14 09:01 - 2015-05-14 09:01 - 00001397 _____ () C:\Users\shaka\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-05-13 17:27 - 2015-05-01 10:16 - 00102608 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 17:11 - 2015-05-13 17:15 - 00000000 ____D () C:\Windows\system32\MRT
2015-05-13 17:04 - 2014-06-30 19:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2015-05-13 17:04 - 2014-06-06 03:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2015-05-13 17:04 - 2014-03-09 18:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2015-05-13 17:04 - 2014-03-09 18:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2015-05-13 16:52 - 2015-05-13 16:52 - 00645120 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2015-05-13 16:52 - 2015-05-13 16:52 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2015-05-13 16:52 - 2015-05-13 16:52 - 00233472 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2015-05-13 16:52 - 2015-05-13 16:52 - 00208384 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2015-05-13 16:52 - 2015-05-13 16:52 - 00194048 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2015-05-13 16:52 - 2015-05-13 16:52 - 00182272 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2015-05-13 16:52 - 2015-05-13 16:52 - 00151552 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2015-05-13 16:52 - 2015-05-13 16:52 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2015-05-13 16:52 - 2015-05-13 16:52 - 00083456 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2015-05-13 16:52 - 2015-05-13 16:52 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2015-05-13 16:52 - 2015-05-13 16:52 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2015-05-13 16:52 - 2015-05-13 16:52 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2015-05-13 16:52 - 2015-05-13 16:52 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2015-05-13 16:51 - 2015-05-13 16:51 - 00640512 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2015-05-13 16:51 - 2015-05-13 16:51 - 00619520 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2015-05-13 16:51 - 2015-05-13 16:51 - 00231424 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2015-05-13 16:51 - 2015-05-13 16:51 - 00127488 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2015-05-13 16:51 - 2015-05-13 16:51 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2015-05-13 16:51 - 2015-05-13 16:51 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2015-05-13 16:51 - 2015-05-13 16:51 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2015-05-13 16:51 - 2015-05-13 16:51 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2015-05-13 16:51 - 2015-05-13 16:51 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2015-05-13 16:51 - 2015-05-13 16:51 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2015-05-13 16:51 - 2015-05-13 16:51 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2015-05-13 16:51 - 2015-05-13 16:51 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2015-05-13 16:51 - 2015-05-13 16:51 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2015-05-13 16:51 - 2015-05-13 16:51 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2015-05-13 16:50 - 2015-05-13 16:50 - 02284544 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2015-05-13 16:50 - 2015-05-13 16:50 - 01158144 _____ (Microsoft Corporation) C:\Windows\system32\XpsPrint.dll
2015-05-13 16:50 - 2015-05-13 16:50 - 01080832 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll
2015-05-13 16:50 - 2015-05-13 16:50 - 00604160 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2015-05-13 16:50 - 2015-05-13 16:50 - 00364544 _____ (Microsoft Corporation) C:\Windows\system32\XpsGdiConverter.dll
2015-05-13 16:50 - 2015-05-13 16:50 - 00293376 _____ (Microsoft Corporation) C:\Windows\system32\dxgi.dll
2015-05-13 16:50 - 2015-05-13 16:50 - 00249856 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll
2015-05-13 16:50 - 2015-05-13 16:50 - 00220160 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll
2015-05-13 16:50 - 2015-05-13 16:50 - 00207872 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecsExt.dll
2015-05-13 16:50 - 2015-05-13 16:50 - 00187392 _____ (Microsoft Corporation) C:\Windows\system32\UIAnimation.dll
2015-05-13 16:50 - 2015-05-13 16:50 - 00161792 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll
2015-05-13 16:50 - 2015-05-13 16:50 - 00010752 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
2015-05-13 16:50 - 2015-05-13 16:50 - 00009728 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2015-05-13 16:50 - 2015-05-13 16:50 - 00005632 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2015-05-13 16:50 - 2015-05-13 16:50 - 00005632 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
2015-05-13 16:50 - 2015-05-13 16:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2015-05-13 16:50 - 2015-05-13 16:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
2015-05-13 16:50 - 2015-05-13 16:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2015-05-13 16:50 - 2015-05-13 16:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
2015-05-13 16:50 - 2015-05-13 16:50 - 00002560 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
2015-05-13 16:49 - 2015-05-13 16:49 - 01505280 _____ (Microsoft Corporation) C:\Windows\system32\d3d11.dll
2015-05-13 16:48 - 2015-05-13 16:54 - 00013590 _____ () C:\Windows\IE11_main.log
2015-05-13 16:16 - 2015-05-04 22:12 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-05-13 16:16 - 2015-04-17 23:56 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-05-13 16:16 - 2015-04-13 00:19 - 00259072 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2015-05-13 16:16 - 2015-04-08 00:14 - 00216064 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2015-05-13 16:16 - 2015-04-08 00:14 - 00019968 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll
2015-05-13 16:16 - 2015-04-04 00:10 - 00137656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-05-13 16:16 - 2015-04-04 00:10 - 00067512 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-05-13 16:16 - 2015-04-04 00:05 - 01061376 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-05-13 16:16 - 2015-04-04 00:05 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-05-13 16:16 - 2015-04-04 00:05 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-05-13 16:16 - 2015-04-04 00:05 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-05-13 16:16 - 2015-04-04 00:05 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-05-13 16:16 - 2015-04-04 00:05 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-05-13 16:16 - 2015-04-04 00:05 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-05-13 16:16 - 2015-04-04 00:05 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-05-13 16:16 - 2015-04-04 00:05 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-05-13 16:16 - 2015-04-04 00:05 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-05-13 16:16 - 2015-04-04 00:04 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-05-13 16:16 - 2015-04-04 00:04 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-05-13 16:16 - 2015-04-04 00:01 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-05-13 16:16 - 2015-04-04 00:01 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-05-13 16:16 - 2015-04-03 23:59 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-05-13 16:16 - 2015-02-18 04:06 - 00123904 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2015-05-13 16:16 - 2014-10-17 22:33 - 00571904 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2015-05-13 16:16 - 2013-07-04 08:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2015-05-13 16:16 - 2013-07-03 01:02 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbscan.sys
2015-05-13 16:16 - 2013-07-03 00:36 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
2015-05-13 16:16 - 2013-07-03 00:36 - 00025728 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2015-05-13 16:16 - 2013-04-12 10:45 - 01211752 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2015-05-13 16:16 - 2013-02-12 00:32 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usb8023.sys
2015-05-13 16:15 - 2014-11-10 23:44 - 00186880 _____ (Microsoft Corporation) C:\Windows\system32\pku2u.dll
2015-05-13 16:15 - 2014-07-13 22:42 - 00654336 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2015-05-13 16:15 - 2014-06-15 22:44 - 00730048 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2015-05-13 16:15 - 2014-06-15 22:44 - 00219072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms1.sys
2015-05-13 16:15 - 2014-06-15 22:40 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2015-05-13 16:15 - 2013-10-18 22:36 - 00159232 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2015-05-13 16:14 - 2014-08-11 22:36 - 00701440 _____ (Microsoft Corporation) C:\Windows\system32\IMJP10K.DLL
2015-05-13 16:14 - 2014-03-26 11:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2015-05-13 16:14 - 2014-03-26 11:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2015-05-13 16:14 - 2014-03-04 06:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll
2015-05-13 16:14 - 2014-03-04 06:17 - 00293376 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-05-13 16:14 - 2014-03-04 06:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll
2015-05-13 16:14 - 2014-03-04 06:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll
2015-05-13 16:14 - 2014-03-04 06:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll
2015-05-13 16:14 - 2014-03-04 06:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll
2015-05-13 16:14 - 2014-03-04 06:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll
2015-05-13 16:14 - 2014-03-04 06:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll
2015-05-13 16:14 - 2013-10-11 23:04 - 00121856 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx
2015-05-13 16:14 - 2013-10-11 23:03 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2015-05-13 16:14 - 2013-10-11 22:15 - 00141824 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe
2015-05-13 16:14 - 2013-10-11 22:15 - 00126976 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe
2015-05-13 16:13 - 2015-03-04 01:16 - 00249784 _____ (Microsoft Corporation) C:\Windows\system32\clfs.sys
2015-05-13 16:13 - 2015-03-04 01:10 - 00058880 _____ (Microsoft Corporation) C:\Windows\system32\clfsw32.dll
2015-05-13 16:13 - 2014-09-04 02:04 - 00372736 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll
2015-05-13 16:13 - 2013-05-13 00:08 - 00903168 _____ (Microsoft Corporation) C:\Windows\system32\certutil.exe
2015-05-13 16:13 - 2013-05-13 00:08 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\certenc.dll
2015-05-13 16:13 - 2013-04-26 01:55 - 00492544 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2015-05-13 16:12 - 2015-03-17 02:01 - 03976632 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2015-05-13 16:12 - 2015-03-17 02:01 - 03920824 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-05-13 16:12 - 2015-03-17 01:59 - 01306112 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-05-13 16:12 - 2015-03-17 01:57 - 00400896 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-05-13 16:12 - 2015-03-17 01:57 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-05-13 16:12 - 2015-03-17 01:56 - 00262656 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-05-13 16:12 - 2015-03-17 01:56 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-05-13 16:12 - 2015-03-17 01:56 - 00038912 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-05-13 16:12 - 2015-03-17 01:50 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-05-13 16:12 - 2015-01-16 23:30 - 00828928 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
2015-05-13 16:09 - 2015-03-05 01:06 - 00305152 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2015-05-13 16:09 - 2015-02-13 02:26 - 12875264 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2015-05-13 16:09 - 2015-01-31 00:32 - 00919552 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2015-05-13 16:09 - 2015-01-30 23:52 - 00134656 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2015-05-13 16:09 - 2015-01-30 23:51 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpvideominiport.sys
2015-05-13 16:09 - 2014-06-18 19:23 - 01131664 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll
2015-05-13 16:09 - 2014-06-18 19:23 - 00156824 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll
2015-05-13 16:09 - 2014-06-18 19:23 - 00081560 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll
2015-05-13 16:09 - 2014-06-17 22:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2015-05-13 16:09 - 2014-06-06 06:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2015-05-13 16:09 - 2014-06-03 06:30 - 00101824 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2015-05-13 16:09 - 2014-06-03 06:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2015-05-13 16:09 - 2014-06-03 06:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2015-05-13 16:09 - 2014-06-03 06:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2015-05-13 16:09 - 2014-05-30 03:36 - 00338944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2015-05-13 16:09 - 2014-04-04 23:25 - 01294272 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2015-05-13 16:09 - 2014-04-04 23:24 - 00187840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2015-05-13 16:09 - 2013-11-26 08:11 - 00240576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2015-05-13 16:09 - 2013-10-03 22:49 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmk.sys
2015-05-13 16:09 - 2013-10-03 22:17 - 00177152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys
2015-05-13 16:09 - 2013-07-25 05:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2015-05-13 16:08 - 2015-03-25 00:00 - 03088384 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-05-13 16:08 - 2015-03-25 00:00 - 02020864 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-05-13 16:08 - 2015-03-25 00:00 - 00566784 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-05-13 16:08 - 2015-03-25 00:00 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-05-13 16:08 - 2015-03-25 00:00 - 00131584 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-05-13 16:08 - 2015-03-25 00:00 - 00092672 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-05-13 16:08 - 2015-03-25 00:00 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-05-13 16:08 - 2015-03-25 00:00 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-05-13 16:08 - 2015-03-25 00:00 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-05-13 16:08 - 2015-03-25 00:00 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-05-13 16:08 - 2015-03-25 00:00 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2015-05-13 16:08 - 2015-02-20 01:13 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2015-05-13 16:08 - 2015-02-20 01:13 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-05-13 16:08 - 2015-02-20 01:13 - 00026624 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2015-05-13 16:08 - 2015-02-20 01:13 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2015-05-13 16:08 - 2015-02-20 00:09 - 00299008 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-05-13 16:08 - 2015-02-03 00:12 - 00171520 _____ (Microsoft Corporation) C:\Windows\system32\ubpm.dll
2015-05-13 16:08 - 2014-12-18 23:43 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-05-13 16:08 - 2014-12-11 14:47 - 00046592 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-05-13 16:08 - 2014-10-24 22:32 - 00067584 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2015-05-13 16:08 - 2014-07-16 22:40 - 00157696 _____ (Microsoft Corporation) C:\Windows\system32\winsta.dll
2015-05-13 16:08 - 2014-07-16 22:39 - 03221504 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2015-05-13 16:08 - 2014-07-16 22:39 - 01051136 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2015-05-13 16:08 - 2014-07-16 22:39 - 00304128 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2015-05-13 16:08 - 2014-07-16 22:39 - 00131584 _____ (Microsoft Corporation) C:\Windows\system32\aaclient.dll
2015-05-13 16:08 - 2014-07-16 22:39 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorekmts.dll
2015-05-13 16:08 - 2014-07-16 22:03 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys
2015-05-13 16:08 - 2014-07-16 22:02 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2015-05-13 16:08 - 2013-10-11 23:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2015-05-13 16:08 - 2013-10-11 23:01 - 00679424 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2015-05-13 16:08 - 2013-10-11 23:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2015-05-13 16:08 - 2013-07-25 22:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2015-05-13 16:07 - 2015-02-25 00:03 - 00514560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys
2015-05-13 16:07 - 2015-02-03 00:16 - 00078784 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys
2015-05-13 16:07 - 2015-02-03 00:12 - 11411968 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2015-05-13 16:07 - 2015-02-03 00:12 - 03209728 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2015-05-13 16:07 - 2015-02-03 00:12 - 01329664 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
2015-05-13 16:07 - 2015-02-03 00:12 - 01174528 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-05-13 16:07 - 2015-02-03 00:12 - 01005056 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll
2015-05-13 16:07 - 2015-02-03 00:12 - 00988160 _____ (Microsoft Corporation) C:\Windows\system32\drmv2clt.dll
2015-05-13 16:07 - 2015-02-03 00:12 - 00744960 _____ (Microsoft Corporation) C:\Windows\system32\blackbox.dll
2015-05-13 16:07 - 2015-02-03 00:12 - 00617984 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmsdk.dll
2015-05-13 16:07 - 2015-02-03 00:12 - 00519680 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2015-05-13 16:07 - 2015-02-03 00:12 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msscp.dll
2015-05-13 16:07 - 2015-02-03 00:12 - 00489984 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll
2015-05-13 16:07 - 2015-02-03 00:12 - 00475136 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2015-05-13 16:07 - 2015-02-03 00:12 - 00442880 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2015-05-13 16:07 - 2015-02-03 00:12 - 00406016 _____ (Microsoft Corporation) C:\Windows\system32\drmmgrtn.dll
2015-05-13 16:07 - 2015-02-03 00:12 - 00374784 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2015-05-13 16:07 - 2015-02-03 00:12 - 00354816 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll
2015-05-13 16:07 - 2015-02-03 00:12 - 00275968 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2015-05-13 16:07 - 2015-02-03 00:12 - 00265216 _____ (Microsoft Corporation) C:\Windows\system32\msnetobj.dll
2015-05-13 16:07 - 2015-02-03 00:12 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2015-05-13 16:07 - 2015-02-03 00:12 - 00179200 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2015-05-13 16:07 - 2015-02-03 00:12 - 00157184 _____ (Microsoft Corporation) C:\Windows\system32\pcasvc.dll
2015-05-13 16:07 - 2015-02-03 00:12 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2015-05-13 16:07 - 2015-02-03 00:12 - 00103936 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2015-05-13 16:07 - 2015-02-03 00:12 - 00103424 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2015-05-13 16:07 - 2015-02-03 00:12 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\cryptsp.dll
2015-05-13 16:07 - 2015-02-03 00:12 - 00050688 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2015-05-13 16:07 - 2015-02-03 00:12 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2015-05-13 16:07 - 2015-02-03 00:12 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\pcadm.dll
2015-05-13 16:07 - 2015-02-03 00:12 - 00027648 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2015-05-13 16:07 - 2015-02-03 00:12 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msmmsp.dll
2015-05-13 16:07 - 2015-02-03 00:12 - 00008192 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2015-05-13 16:07 - 2015-02-03 00:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2015-05-13 16:07 - 2015-02-03 00:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2015-05-13 16:07 - 2015-02-03 00:11 - 12625408 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2015-05-13 16:07 - 2015-02-03 00:11 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
2015-05-13 16:07 - 2015-02-03 00:11 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2015-05-13 16:07 - 2015-02-03 00:11 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
2015-05-13 16:07 - 2015-02-03 00:11 - 00023040 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
2015-05-13 16:07 - 2015-02-03 00:11 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2015-05-13 16:07 - 2015-02-03 00:11 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\pcawrk.exe
2015-05-13 16:07 - 2015-02-03 00:11 - 00008192 _____ (Microsoft Corporation) C:\Windows\system32\pcalua.exe
2015-05-13 16:07 - 2015-02-03 00:10 - 00008704 _____ (Microsoft Corporation) C:\Windows\system32\pcaevts.dll
2015-05-13 16:07 - 2015-02-03 00:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
2015-05-13 16:07 - 2015-02-03 00:00 - 00593920 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\PEAuth.sys
2015-05-13 16:07 - 2015-02-02 23:26 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2015-05-13 16:07 - 2015-01-30 20:56 - 00370488 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-05-13 16:07 - 2014-12-18 22:34 - 00116224 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-05-13 16:07 - 2014-12-06 00:50 - 00242688 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-05-13 16:07 - 2014-10-31 19:22 - 00521384 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2015-05-13 16:07 - 2014-06-27 21:21 - 00455752 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
2015-05-13 16:07 - 2014-06-27 21:21 - 00409272 _____ (Microsoft Corporation) C:\Windows\system32\ci.dll
2015-05-13 16:07 - 2014-04-24 23:06 - 00626688 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2015-05-13 16:07 - 2014-03-04 06:17 - 00868352 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-05-13 16:07 - 2014-01-28 23:06 - 00381440 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
2015-05-13 16:07 - 2013-08-01 22:50 - 00169984 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-05-13 16:07 - 2013-08-01 22:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-05-13 16:07 - 2013-08-01 22:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-05-13 16:07 - 2013-08-01 22:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-05-13 16:07 - 2013-08-01 22:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-05-13 16:07 - 2013-08-01 22:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-05-13 16:07 - 2013-08-01 22:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-05-13 16:07 - 2013-08-01 22:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-05-13 16:07 - 2013-08-01 22:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-05-13 16:07 - 2013-08-01 22:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-05-13 16:07 - 2013-08-01 22:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-05-13 16:07 - 2013-08-01 22:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-05-13 16:07 - 2013-08-01 22:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-05-13 16:07 - 2013-08-01 22:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-05-13 16:07 - 2013-08-01 22:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-05-13 16:07 - 2013-08-01 22:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-05-13 16:07 - 2013-08-01 22:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-05-13 16:07 - 2013-08-01 22:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-05-13 16:07 - 2013-08-01 22:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-05-13 16:07 - 2013-08-01 22:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-05-13 16:07 - 2013-08-01 22:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-05-13 16:07 - 2013-08-01 22:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-05-13 16:07 - 2013-08-01 22:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-05-13 16:07 - 2013-08-01 22:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-05-13 16:07 - 2013-08-01 22:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-05-13 16:07 - 2013-08-01 21:52 - 00271360 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-05-13 16:07 - 2013-08-01 21:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-05-13 16:07 - 2013-08-01 21:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-05-13 16:07 - 2013-08-01 21:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-05-13 16:07 - 2013-08-01 21:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-05-13 16:07 - 2013-07-12 07:08 - 00146816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbvideo.sys
2015-05-13 16:07 - 2013-07-12 07:07 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys
2015-05-13 16:07 - 2013-06-25 19:56 - 00527064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2015-05-13 16:07 - 2012-11-28 19:57 - 00047720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdfLdr.sys
2015-05-13 16:07 - 2012-11-28 19:57 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\Wdfres.dll
2015-05-13 16:07 - 2012-11-28 19:57 - 00000003 _____ () C:\Windows\system32\Drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf
2015-05-13 16:07 - 2012-10-03 13:42 - 00156672 _____ (Microsoft Corporation) C:\Windows\system32\ncsi.dll
2015-05-13 16:07 - 2012-10-03 13:42 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\nlaapi.dll
2015-05-13 16:06 - 2014-12-07 23:46 - 00308224 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2015-05-13 16:06 - 2014-10-13 22:50 - 00523776 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2015-05-13 16:06 - 2013-11-26 22:14 - 00258560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2015-05-13 16:06 - 2013-11-26 22:13 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2015-05-13 16:06 - 2013-11-26 22:13 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2015-05-13 16:06 - 2013-11-26 22:13 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2015-05-13 16:06 - 2013-11-26 22:13 - 00024064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2015-05-13 16:06 - 2013-11-26 22:13 - 00020480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2015-05-13 16:06 - 2013-11-26 22:13 - 00006016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2015-05-13 16:06 - 2013-02-27 01:49 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2015-05-13 16:05 - 2015-03-10 00:08 - 01237504 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2015-05-13 16:05 - 2015-03-10 00:05 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2015-05-13 15:29 - 2015-05-14 08:58 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-05-13 15:20 - 2015-05-15 16:08 - 00000000 ____D () C:\Users\shaka\Desktop\mbar
2015-05-13 15:19 - 2015-05-13 15:20 - 04197016 _____ (Kaspersky Lab ZAO) C:\Users\shaka\Desktop\tdsskiller.exe
2015-05-13 15:16 - 2015-05-13 15:18 - 16502728 _____ (Malwarebytes Corp.) C:\Users\shaka\Desktop\mbar-1.09.1.1004.exe
2015-05-13 14:04 - 2015-05-13 14:04 - 00380416 _____ () C:\Users\shaka\Desktop\Gmer-19357.exe
2015-05-13 14:00 - 2015-05-18 09:59 - 00000000 ____D () C:\FRST
2015-05-13 14:00 - 2015-05-13 14:01 - 00049868 _____ () C:\Users\shaka\Downloads\FRST.txt
2015-05-13 14:00 - 2015-05-13 14:01 - 00026913 _____ () C:\Users\shaka\Downloads\Addition.txt
2015-05-13 13:59 - 2015-05-18 09:59 - 01146368 _____ (Farbar) C:\Users\shaka\Desktop\FRST.exe
2015-05-13 13:59 - 2015-05-13 13:59 - 00000000 _____ () C:\Users\shaka\defogger_reenable
2015-05-13 13:58 - 2015-05-13 13:58 - 00050477 _____ () C:\Users\shaka\Desktop\Defogger.exe
2015-05-13 13:16 - 2015-05-13 13:16 - 00000000 ____D () C:\Windows\system32\appmgmt
2015-05-13 11:36 - 2015-05-13 11:36 - 00000951 _____ () C:\Users\Public\Desktop\AVG 2015.lnk
2015-05-13 11:36 - 2015-05-13 11:36 - 00000000 ____D () C:\Users\shaka\AppData\Roaming\AVG2015
2015-05-13 11:36 - 2015-05-13 11:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
2015-05-13 11:35 - 2015-05-13 11:36 - 00000000 ____D () C:\ProgramData\AVG2015
2015-05-13 11:35 - 2015-05-13 11:35 - 00000000 ____D () C:\$AVG
2015-05-13 11:34 - 2015-05-13 11:34 - 00000000 ____D () C:\Program Files\AVG
2015-05-13 11:33 - 2015-05-14 10:02 - 00000000 ____D () C:\Users\shaka\AppData\Local\Avg2015
2015-05-13 11:23 - 2015-05-13 11:33 - 171931928 _____ (AVG Technologies) C:\Users\shaka\Downloads\avg_free_x86_all_2015_ltst_222_5941 (1).exe
2015-05-13 10:41 - 2015-05-15 15:54 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-05-13 10:41 - 2015-05-13 10:41 - 00001060 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-05-13 10:41 - 2015-05-13 10:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-05-13 10:40 - 2015-05-13 15:49 - 00092888 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-05-13 10:40 - 2015-05-13 10:41 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2015-05-13 10:40 - 2015-05-13 10:40 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-05-13 10:40 - 2015-04-14 09:37 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-05-13 10:40 - 2015-04-14 09:37 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-05-13 10:34 - 2015-05-13 10:35 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\shaka\Desktop\mbam-setup-2.1.6.1022.exe
2015-05-13 10:13 - 2015-05-13 10:13 - 00000000 ____D () C:\Windows\pss
2015-05-13 09:47 - 2015-05-15 16:10 - 00000000 ____D () C:\AdwCleaner
2015-05-13 09:44 - 2015-05-13 09:45 - 02209792 _____ () C:\Users\shaka\Desktop\AdwCleaner_4.204.exe
2015-05-12 23:00 - 2015-05-13 11:06 - 00000000 ____D () C:\ProgramData\AVAST Software
2015-05-12 22:59 - 2015-05-12 23:00 - 05499960 _____ (Avast Software s.r.o.) C:\Users\shaka\Downloads\avast_free_antivirus_setup_online.exe
2015-05-12 20:37 - 2015-05-14 10:07 - 00000000 __SHD () C:\ProgramData\Windows Search 5.3.10
2015-05-12 17:58 - 2015-05-12 17:58 - 00008646 _____ () C:\Users\shaka\HELP_DECRYPT.HTML
2015-05-12 17:58 - 2015-05-12 17:58 - 00008646 _____ () C:\Users\shaka\Documents\HELP_DECRYPT.HTML
2015-05-12 17:58 - 2015-05-12 17:58 - 00004266 _____ () C:\Users\shaka\HELP_DECRYPT.TXT
2015-05-12 17:58 - 2015-05-12 17:58 - 00004266 _____ () C:\Users\shaka\Documents\HELP_DECRYPT.TXT
2015-05-12 17:58 - 2015-05-12 17:58 - 00000296 _____ () C:\Users\shaka\HELP_DECRYPT.URL
2015-05-12 17:58 - 2015-05-12 17:58 - 00000296 _____ () C:\Users\shaka\Documents\HELP_DECRYPT.URL
2015-05-12 13:53 - 2015-05-12 13:53 - 00000000 ____D () C:\Users\shaka\AppData\Roaming\Mozilla
2015-05-12 13:53 - 2015-05-12 13:53 - 00000000 ____D () C:\Users\shaka\AppData\Roaming\Avira
2015-05-12 13:52 - 2015-03-27 14:22 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys
2015-05-12 13:52 - 2015-03-27 14:21 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2015-05-12 13:52 - 2015-03-27 14:21 - 00105864 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2015-05-12 13:52 - 2015-03-27 14:21 - 00037896 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2015-05-12 13:52 - 2015-03-27 14:21 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2015-05-12 13:43 - 2015-05-12 22:53 - 00000000 ____D () C:\ProgramData\Avira
2015-05-12 13:41 - 2015-05-12 13:41 - 04734040 _____ (Avira Operations GmbH & Co. KG) C:\Users\shaka\Downloads\avira_es_av_55522e78a06f2__ws1.exe
2015-05-12 13:39 - 2015-05-12 13:39 - 00000293 _____ () C:\Users\shaka\AppData\Roaming\8178audayu1bjiao
2015-05-12 10:53 - 2015-05-12 10:53 - 00008646 _____ () C:\Users\shaka\AppData\Roaming\HELP_DECRYPT.HTML
2015-05-12 10:53 - 2015-05-12 10:53 - 00008646 _____ () C:\Users\shaka\AppData\Local\HELP_DECRYPT.HTML
2015-05-12 10:53 - 2015-05-12 10:53 - 00008646 _____ () C:\Users\shaka\AppData\HELP_DECRYPT.HTML
2015-05-12 10:53 - 2015-05-12 10:53 - 00004266 _____ () C:\Users\shaka\AppData\Roaming\HELP_DECRYPT.TXT
2015-05-12 10:53 - 2015-05-12 10:53 - 00004266 _____ () C:\Users\shaka\AppData\Local\HELP_DECRYPT.TXT
2015-05-12 10:53 - 2015-05-12 10:53 - 00004266 _____ () C:\Users\shaka\AppData\HELP_DECRYPT.TXT
2015-05-12 10:53 - 2015-05-12 10:53 - 00000296 _____ () C:\Users\shaka\AppData\Roaming\HELP_DECRYPT.URL
2015-05-12 10:53 - 2015-05-12 10:53 - 00000296 _____ () C:\Users\shaka\AppData\Local\HELP_DECRYPT.URL
2015-05-12 10:53 - 2015-05-12 10:53 - 00000296 _____ () C:\Users\shaka\AppData\HELP_DECRYPT.URL
2015-05-12 10:52 - 2015-05-12 10:52 - 00008646 _____ () C:\ProgramData\HELP_DECRYPT.HTML
2015-05-12 10:52 - 2015-05-12 10:52 - 00004266 _____ () C:\ProgramData\HELP_DECRYPT.TXT
2015-05-12 10:52 - 2015-05-12 10:52 - 00000296 _____ () C:\ProgramData\HELP_DECRYPT.URL
2015-05-11 11:13 - 2015-05-13 13:00 - 00000000 ___HD () C:\ProgramData\{D9E629DC-CB1C-4A97-9900-81922B4EFFD4}

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-05-18 09:31 - 2013-06-27 17:24 - 00001024 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-05-18 08:19 - 2009-07-14 01:34 - 00014720 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-05-18 08:19 - 2009-07-14 01:34 - 00014720 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-05-18 08:16 - 2013-04-13 20:37 - 00000000 ____D () C:\ProgramData\MFAData
2015-05-18 08:16 - 2013-04-13 12:01 - 01925089 _____ () C:\Windows\WindowsUpdate.log
2015-05-18 08:11 - 2013-06-27 17:24 - 00001020 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-05-18 08:10 - 2009-07-14 01:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-05-18 08:10 - 2009-07-14 01:39 - 00065086 _____ () C:\Windows\setupact.log
2015-05-15 09:47 - 2013-04-13 19:52 - 00749516 _____ () C:\Windows\PFRO.log
2015-05-14 18:17 - 2009-07-13 23:37 - 00000000 __RHD () C:\Users\Default
2015-05-14 18:17 - 2009-07-13 23:37 - 00000000 ___RD () C:\Users\Public
2015-05-14 18:16 - 2009-07-13 23:04 - 00000215 _____ () C:\Windows\system.ini
2015-05-14 18:00 - 2009-07-14 01:33 - 00407616 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-05-14 10:51 - 2009-07-13 23:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2015-05-14 09:05 - 2013-04-13 12:03 - 01530242 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-05-13 17:41 - 2009-07-14 05:57 - 00000000 ____D () C:\Program Files\Windows Journal
2015-05-13 17:41 - 2009-07-14 01:52 - 00000000 ____D () C:\Program Files\Windows Defender
2015-05-13 17:40 - 2009-07-13 23:37 - 00000000 ____D () C:\Windows\system32\zh-TW
2015-05-13 17:40 - 2009-07-13 23:37 - 00000000 ____D () C:\Windows\system32\zh-HK
2015-05-13 17:40 - 2009-07-13 23:37 - 00000000 ____D () C:\Windows\system32\zh-CN
2015-05-13 17:40 - 2009-07-13 23:37 - 00000000 ____D () C:\Windows\system32\tr-TR
2015-05-13 17:40 - 2009-07-13 23:37 - 00000000 ____D () C:\Windows\system32\sv-SE
2015-05-13 17:40 - 2009-07-13 23:37 - 00000000 ____D () C:\Windows\system32\ru-RU
2015-05-13 17:40 - 2009-07-13 23:37 - 00000000 ____D () C:\Windows\system32\pt-PT
2015-05-13 17:40 - 2009-07-13 23:37 - 00000000 ____D () C:\Windows\system32\pt-BR
2015-05-13 17:40 - 2009-07-13 23:37 - 00000000 ____D () C:\Windows\system32\pl-PL
2015-05-13 17:40 - 2009-07-13 23:37 - 00000000 ____D () C:\Windows\system32\nl-NL
2015-05-13 17:40 - 2009-07-13 23:37 - 00000000 ____D () C:\Windows\system32\nb-NO
2015-05-13 17:40 - 2009-07-13 23:37 - 00000000 ____D () C:\Windows\system32\ko-KR
2015-05-13 17:40 - 2009-07-13 23:37 - 00000000 ____D () C:\Windows\system32\ja-JP
2015-05-13 17:40 - 2009-07-13 23:37 - 00000000 ____D () C:\Windows\system32\it-IT
2015-05-13 17:40 - 2009-07-13 23:37 - 00000000 ____D () C:\Windows\system32\hu-HU
2015-05-13 17:40 - 2009-07-13 23:37 - 00000000 ____D () C:\Windows\system32\fr-FR
2015-05-13 17:40 - 2009-07-13 23:37 - 00000000 ____D () C:\Windows\system32\fi-FI
2015-05-13 17:40 - 2009-07-13 23:37 - 00000000 ____D () C:\Windows\system32\el-GR
2015-05-13 17:40 - 2009-07-13 23:37 - 00000000 ____D () C:\Windows\system32\de-DE
2015-05-13 15:47 - 2009-07-14 01:52 - 00000000 ____D () C:\Windows\addins
2015-05-13 15:11 - 2013-06-27 17:24 - 00000000 ____D () C:\Program Files\Google
2015-05-13 13:59 - 2013-04-13 12:00 - 00000000 ____D () C:\Users\shaka
2015-05-13 13:17 - 2013-06-27 17:24 - 00000000 ____D () C:\Users\shaka\AppData\Local\Google
2015-05-13 13:16 - 2013-04-13 20:48 - 00000000 ____D () C:\ProgramData\Adobe
2015-05-13 11:46 - 2009-07-14 05:57 - 00000000 ____D () C:\Windows\ShellNew
2015-05-13 11:33 - 2013-04-13 21:24 - 00000000 ____D () C:\Users\shaka\AppData\Roaming\Skype
2015-05-13 11:01 - 2009-07-14 05:43 - 00000000 ____D () C:\Windows\DigitalLocker
2015-05-13 10:49 - 2009-07-13 23:37 - 00000000 ____D () C:\Windows\tracing
2015-05-12 21:32 - 2013-04-13 19:34 - 00000000 ____D () C:\TempEI4
2015-05-12 20:18 - 2013-08-20 14:23 - 00000000 ____D () C:\Users\shaka\AppData\Roaming\Dropbox
2015-05-12 18:20 - 2013-04-22 15:19 - 00000000 ____D () C:\SRII
2015-05-12 18:17 - 2013-04-22 15:18 - 00000000 ____D () C:\Delta del Paraná
2015-05-12 18:03 - 2013-08-20 14:26 - 00000000 ___RD () C:\Users\shaka\Dropbox
2015-05-12 17:58 - 2013-04-17 11:01 - 00000000 ____D () C:\Users\shaka\Documents\Mis escaneos
2015-05-12 17:32 - 2015-03-16 09:55 - 00000000 ____D () C:\Users\shaka\Tracing
2015-05-12 15:33 - 2009-07-14 01:52 - 00000000 ____D () C:\Windows\system32\FxsTmp
2015-05-12 10:53 - 2014-02-27 13:52 - 00000000 ____D () C:\Users\shaka\AppData\Local\Skype
2015-05-12 10:53 - 2013-04-16 10:38 - 00000000 ____D () C:\Users\shaka\AppData\Local\HP
2015-05-12 10:53 - 2013-04-16 10:29 - 00000000 ____D () C:\Users\shaka\AppData\Roaming\Adobe
2015-05-12 10:53 - 2013-04-16 10:28 - 00000000 ____D () C:\Users\shaka\AppData\Roaming\HP
2015-05-12 10:52 - 2013-04-22 15:19 - 00000000 ____D () C:\Shaka
2015-05-12 10:52 - 2013-04-22 15:18 - 00000000 ____D () C:\Fuska
2015-05-01 09:32 - 2013-04-13 21:24 - 00000000 ____D () C:\ProgramData\Skype
2015-04-30 10:07 - 2013-04-13 21:29 - 137310008 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

==================== Files in the root of some directories =======

2015-05-12 13:39 - 2015-05-12 13:39 - 0000293 _____ () C:\Users\shaka\AppData\Roaming\8178audayu1bjiao
2015-05-12 10:53 - 2015-05-12 10:53 - 0008646 _____ () C:\Users\shaka\AppData\Roaming\HELP_DECRYPT.HTML
2015-05-12 10:53 - 2015-05-12 10:53 - 0045436 _____ () C:\Users\shaka\AppData\Roaming\HELP_DECRYPT.PNG
2015-05-12 10:53 - 2015-05-12 10:53 - 0004266 _____ () C:\Users\shaka\AppData\Roaming\HELP_DECRYPT.TXT
2015-05-12 10:53 - 2015-05-12 10:53 - 0000296 _____ () C:\Users\shaka\AppData\Roaming\HELP_DECRYPT.URL
2015-02-06 16:39 - 2015-02-06 16:39 - 0000824 _____ () C:\Users\shaka\AppData\Roaming\my_stuff.gif
2015-02-06 16:40 - 2015-02-06 16:40 - 0000554 _____ () C:\Users\shaka\AppData\Roaming\re.gif
2015-05-12 10:53 - 2015-05-12 10:53 - 0008646 _____ () C:\Users\shaka\AppData\Local\HELP_DECRYPT.HTML
2015-05-12 10:53 - 2015-05-12 10:53 - 0045436 _____ () C:\Users\shaka\AppData\Local\HELP_DECRYPT.PNG
2015-05-12 10:53 - 2015-05-12 10:53 - 0004266 _____ () C:\Users\shaka\AppData\Local\HELP_DECRYPT.TXT
2015-05-12 10:53 - 2015-05-12 10:53 - 0000296 _____ () C:\Users\shaka\AppData\Local\HELP_DECRYPT.URL
2015-05-12 10:52 - 2015-05-12 10:52 - 0008646 _____ () C:\ProgramData\HELP_DECRYPT.HTML
2015-05-12 10:52 - 2015-05-12 10:52 - 0045436 _____ () C:\ProgramData\HELP_DECRYPT.PNG
2015-05-12 10:52 - 2015-05-12 10:52 - 0004266 _____ () C:\ProgramData\HELP_DECRYPT.TXT
2015-05-12 10:52 - 2015-05-12 10:52 - 0000296 _____ () C:\ProgramData\HELP_DECRYPT.URL
2013-04-16 10:17 - 2013-04-16 10:28 - 0000357 _____ () C:\ProgramData\hpzinstall.log

Some content of TEMP:
====================
C:\Users\shaka\AppData\Local\temp\Quarantine.exe
C:\Users\shaka\AppData\Local\temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-05-18 09:22

==================== End Of Log ============================
--- --- ---

schrauber 19.05.2015 07:12
Windows Firewall, oder ein AV mit eigener Firewall. Schau mal nach Emsisoft Internet Security :)


Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
C:\Fuska\HELP_DECRYPT.HTML

C:\Fuska\HELP_DECRYPT.TXT

C:\Fuska\Senasa\HELP_DECRYPT.HTML

C:\Fuska\Senasa\HELP_DECRYPT.TXT

C:\ProgramData\HELP_DECRYPT.HTML

C:\ProgramData\HELP_DECRYPT.TXT

C:\ProgramData\Microsoft\RAC\PublishedData\HELP_DECRYPT.HTML

C:\ProgramData\Microsoft\RAC\PublishedData\HELP_DECRYPT.TXT

C:\Shaka\HELP_DECRYPT.HTML

C:\Shaka\HELP_DECRYPT.TXT

C:\Shaka\Rivera\HELP_DECRYPT.HTML

C:\Shaka\Rivera\HELP_DECRYPT.TXT

C:\Shaka\Trabajos\HELP_DECRYPT.HTML

C:\Shaka\Trabajos\HELP_DECRYPT.TXT

C:\Shaka\Trabajos\Eugenio\HELP_DECRYPT.HTML

C:\Shaka\Trabajos\Eugenio\HELP_DECRYPT.TXT

C:\Shaka\Trabajos\JGF\HELP_DECRYPT.HTML

C:\Shaka\Trabajos\JGF\HELP_DECRYPT.TXT

C:\Shaka\Trabajos\JGF\La Salamandra\HELP_DECRYPT.HTML

C:\Shaka\Trabajos\JGF\La Salamandra\HELP_DECRYPT.TXT

C:\Users\All Users\HELP_DECRYPT.HTML

C:\Users\All Users\HELP_DECRYPT.TXT

C:\Users\All Users\Microsoft\RAC\PublishedData\HELP_DECRYPT.HTML

C:\Users\All Users\Microsoft\RAC\PublishedData\HELP_DECRYPT.TXT

C:\Users\shaka\HELP_DECRYPT.HTML

C:\Users\shaka\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Local\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Local\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Local\Google\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Local\Google\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Local\Google\Chrome\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Local\Google\Chrome\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Local\Google\Chrome\User Data\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Local\Google\Chrome\User Data\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg\0.3.0.2_0\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg\0.3.0.2_0\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg\0.3.0.2_0\audio\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg\0.3.0.2_0\audio\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Local\HP\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Local\HP\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Local\HP\Digital Imaging\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Local\HP\Digital Imaging\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Local\HP\Digital Imaging\cache2\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Local\HP\Digital Imaging\cache2\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Local\HP\Digital Imaging\db2\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Local\HP\Digital Imaging\db2\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Local\HP\Digital Imaging\vault\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Local\HP\Digital Imaging\vault\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Local\Microsoft\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Local\Microsoft\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Local\Microsoft\Device Metadata\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Local\Microsoft\Device Metadata\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Local\Microsoft\Internet Explorer\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Local\Microsoft\Internet Explorer\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Local\Microsoft\Media Player\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Local\Microsoft\Media Player\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Local\Microsoft\Media Player\Caché de imágenes\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Local\Microsoft\Media Player\Caché de imágenes\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Local\Microsoft\Media Player\Caché de imágenes\LocalMLS\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Local\Microsoft\Media Player\Caché de imágenes\LocalMLS\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Local\Microsoft\Windows Mail\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Local\Microsoft\Windows Mail\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Local\Microsoft\Windows Mail\Backup\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Local\Microsoft\Windows Mail\Backup\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Local\Microsoft\Windows Mail\Backup\old\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Local\Microsoft\Windows Mail\Backup\old\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Local\Microsoft\Windows Mail\Stationery\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Local\Microsoft\Windows Mail\Stationery\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Local\Microsoft\Windows Media\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Local\Microsoft\Windows Media\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Local\Microsoft\Windows Media\12.0\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Local\Microsoft\Windows Media\12.0\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Local\Skype\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Local\Skype\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Local\Skype\Apps\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Local\Skype\Apps\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\LocalLow\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\LocalLow\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\LocalLow\Google\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\LocalLow\Google\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\LocalLow\Google\GoogleEarth\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\LocalLow\Google\GoogleEarth\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\LocalLow\Google\GoogleEarth\unified_cache_leveldb_leveldb2\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\LocalLow\Google\GoogleEarth\unified_cache_leveldb_leveldb2\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Adobe\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Adobe\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Adobe\Flash Player\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Adobe\Flash Player\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Adobe\Flash Player\AssetCache\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Adobe\Flash Player\AssetCache\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Adobe\Flash Player\AssetCache\N4DTGKAY\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Adobe\Flash Player\AssetCache\N4DTGKAY\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Dropbox\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Dropbox\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Dropbox\bin\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Dropbox\bin\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Dropbox\instance1\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Dropbox\instance1\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\HP\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\HP\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\HP\WebRegLogs\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\HP\WebRegLogs\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Microsoft\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Microsoft\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Microsoft\Document Building Blocks\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Microsoft\Document Building Blocks\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Microsoft\Document Building Blocks\3082\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Microsoft\Document Building Blocks\3082\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Microsoft\Document Building Blocks\3082\14\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Microsoft\Document Building Blocks\3082\14\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Skype\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Skype\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\emo_cache\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\emo_cache\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\emo_cache\asyncdb\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\emo_cache\asyncdb\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\media_cache\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\media_cache\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\media_cache\asyncdb\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\media_cache\asyncdb\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\storage_db\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\storage_db\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\storage_db\asyncdb\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\storage_db\asyncdb\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\qikdb\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\qikdb\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Skype\cadopa\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Skype\cadopa\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\emo_cache\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\emo_cache\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\emo_cache\asyncdb\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\emo_cache\asyncdb\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\media_cache\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\media_cache\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\media_cache\asyncdb\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\media_cache\asyncdb\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\storage_db\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\storage_db\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\storage_db\asyncdb\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\storage_db\asyncdb\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Skype\cadopa\qikdb\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Skype\cadopa\qikdb\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Skype\patricia.guimaraens\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Skype\patricia.guimaraens\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Skype\shared_httpfe\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Skype\shared_httpfe\HELP_DECRYPT.TXT

C:\Users\shaka\Documents\HELP_DECRYPT.HTML

C:\Users\shaka\Documents\HELP_DECRYPT.TXT

C:\Users\shaka\Documents\Mis escaneos\HELP_DECRYPT.HTML

C:\Users\shaka\Documents\Mis escaneos\HELP_DECRYPT.TXT

C:\Windows\pss\HELP_DECRYPT.HTML.Startup

C:\Windows\pss\HELP_DECRYPT.TXT.Startup

C:\Windows\System32\sasnative32.exe
Emptytemp:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.





Cleanup:
(Die Reihenfolge ist hier entscheidend)

Falls Defogger verwendet wurde: Erneut starten und auf Re-enable klicken.

Falls Combofix verwendet wurde:
http://deeprybka.trojaner-board.de/b.../combofix2.pngCombofix deinstallieren .
  • Wichtig: Bitte Antivirus-Programm, evtl. vorhandenes Skript-Blocking und Anti-Malware Programme deaktivieren.
  • Drücke bitte die http://deeprybka.trojaner-board.de/b...ne/revo/w7.png + R Taste und schreibe Combofix /Uninstall in das Ausführen-Fenster.
  • Klicke auf OK.
    Damit wird Combofix komplett entfernt und der Cache der Systemwiederherstellung geleert.
  • Nun die eben deaktivierten Programme wieder aktivieren.

Alle Logs gepostet? Dann lade Dir bitte http://filepony.de/icon/tiny/delfix.pngDelFix herunter.
  • Schließe alle offenen Programme.
  • Starte die delfix.exe mit einem Doppelklick.
  • Setze vor jede Funktion ein Häkchen.
  • Klicke auf Start.

Hinweis: DelFix entfernt u.a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
Starte Deinen Rechner abschließend neu. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein, kannst Du diese bedenkenlos löschen.

Wenn Du möchtest, kannst Du hier sagen, ob Du mit mir und meiner Hilfe zufrieden warst...:dankeschoen:und/oder das Forum mit einer kleinen Spende http://www.trojaner-board.de/extra/spende.png unterstützen. :applaus:

http://deeprybka.trojaner-board.de/b...ast/schild.pngAbsicherung:
Beim Betriebsystem Windows die automatischen Updates aktivieren. Auch die sicherheitsrelevante Software sollte immer nur in der aktuellsten Version vorliegen:

Browser
Java
 Flash-Player
PDF-Reader

Sicherheitslücken in deren alten Versionen werden dazu ausgenutzt, um beim einfachen Besuch einer manipulierten Website per "Drive-by" Malware zu installieren.
Ich empfehle z.B. die Verwendung von Mozilla Firefox statt des Internet Explorers. Zudem lassen sich mit dem Firefox auch PDF-Dokumente öffnen.

Aktiviere eine Firewall. Die in Windows integrierte genügt im Normalfall völlig.

Verwende ein Antivirusprogramm mit Echtzeitscanner und stets aktueller Signaturendatenbank.
Meine Empfehlung:
http://filepony.de/icon/emsisoft_anti_malware.png
Emsisoft

Zusätzlich kannst Du Deinen PC regelmäßig mit Malwarebytes Anti-Malware und ESET scannen.

Optional:
http://filepony.de/icon/noscript.png NoScript verhindert das Ausführen von aktiven Inhalten (Java, JavaScript, Flash,...) für sämtliche Websites. Man kann aber nach dem Prinzip einer Whitelist festlegen, auf welchen Seiten Scripts erlaubt werden sollen.
http://filepony.de/icon/malwarebytes_anti_exploit.pngMalwarebytes Anti Exploit: Schützt die Anwendungen des Computers vor der Ausnutzung bekannter Schwachstellen.


Lade Software von einem sauberen Portal wie http://filepony.de/images/microbanner.gif.
Wähle beim Installieren von Software immer die benutzerdefinierte Option und entferne den Haken bei allen optional angebotenen Toolbars oder sonstigen, fürs Programm, irrelevanten Ergänzungen.
Um Adware wieder los zu werden, empfiehlt sich zunächst die Deinstallation sowie die anschließende Resteentfernung mit Adwarecleaner .


Abschließend noch ein paar grundsätzliche Bemerkungen:
Ändere regelmäßig Deine wichtigen Online-Passwörter und erstelle regelmäßig Backups Deiner wichtigen Dateien oder des Systems.
Der Nutzen von Registry-Cleanern, Optimizern usw. zur Performancesteigerung ist umstritten. Ich empfehle deshalb, die Finger von der Registry zu lassen und lieber die windowseigene Datenträgerbereinigung zu verwenden.

chrischl 19.05.2015 14:29
Moin Moin aus Buenos Aires.
Hier das LogFile. 3 kleine Sch..serchen hat er anscheinend nicht gefunden.. in der Mitte des Scans ist auch der Antivirus angesprungen und hat rumgemeckert..

Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 16-05-2015 02
Ran by shaka at 2015-05-19 09:08:37 Run:1
Running from C:\Users\shaka\Desktop
Loaded Profiles: shaka (Available profiles: shaka)
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
C:\Fuska\HELP_DECRYPT.HTML

C:\Fuska\HELP_DECRYPT.TXT

C:\Fuska\Senasa\HELP_DECRYPT.HTML

C:\Fuska\Senasa\HELP_DECRYPT.TXT

C:\ProgramData\HELP_DECRYPT.HTML

C:\ProgramData\HELP_DECRYPT.TXT

C:\ProgramData\Microsoft\RAC\PublishedData\HELP_DECRYPT.HTML

C:\ProgramData\Microsoft\RAC\PublishedData\HELP_DECRYPT.TXT

C:\Shaka\HELP_DECRYPT.HTML

C:\Shaka\HELP_DECRYPT.TXT

C:\Shaka\Rivera\HELP_DECRYPT.HTML

C:\Shaka\Rivera\HELP_DECRYPT.TXT

C:\Shaka\Trabajos\HELP_DECRYPT.HTML

C:\Shaka\Trabajos\HELP_DECRYPT.TXT

C:\Shaka\Trabajos\Eugenio\HELP_DECRYPT.HTML

C:\Shaka\Trabajos\Eugenio\HELP_DECRYPT.TXT

C:\Shaka\Trabajos\JGF\HELP_DECRYPT.HTML

C:\Shaka\Trabajos\JGF\HELP_DECRYPT.TXT

C:\Shaka\Trabajos\JGF\La Salamandra\HELP_DECRYPT.HTML

C:\Shaka\Trabajos\JGF\La Salamandra\HELP_DECRYPT.TXT

C:\Users\All Users\HELP_DECRYPT.HTML

C:\Users\All Users\HELP_DECRYPT.TXT

C:\Users\All Users\Microsoft\RAC\PublishedData\HELP_DECRYPT.HTML

C:\Users\All Users\Microsoft\RAC\PublishedData\HELP_DECRYPT.TXT

C:\Users\shaka\HELP_DECRYPT.HTML

C:\Users\shaka\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Local\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Local\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Local\Google\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Local\Google\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Local\Google\Chrome\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Local\Google\Chrome\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Local\Google\Chrome\User Data\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Local\Google\Chrome\User Data\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg\0.3.0.2_0\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg\0.3.0.2_0\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg\0.3.0.2_0\audio\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg\0.3.0.2_0\audio\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Local\HP\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Local\HP\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Local\HP\Digital Imaging\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Local\HP\Digital Imaging\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Local\HP\Digital Imaging\cache2\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Local\HP\Digital Imaging\cache2\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Local\HP\Digital Imaging\db2\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Local\HP\Digital Imaging\db2\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Local\HP\Digital Imaging\vault\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Local\HP\Digital Imaging\vault\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Local\Microsoft\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Local\Microsoft\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Local\Microsoft\Device Metadata\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Local\Microsoft\Device Metadata\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Local\Microsoft\Internet Explorer\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Local\Microsoft\Internet Explorer\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Local\Microsoft\Media Player\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Local\Microsoft\Media Player\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Local\Microsoft\Media Player\Caché de imágenes\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Local\Microsoft\Media Player\Caché de imágenes\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Local\Microsoft\Media Player\Caché de imágenes\LocalMLS\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Local\Microsoft\Media Player\Caché de imágenes\LocalMLS\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Local\Microsoft\Windows Mail\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Local\Microsoft\Windows Mail\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Local\Microsoft\Windows Mail\Backup\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Local\Microsoft\Windows Mail\Backup\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Local\Microsoft\Windows Mail\Backup\old\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Local\Microsoft\Windows Mail\Backup\old\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Local\Microsoft\Windows Mail\Stationery\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Local\Microsoft\Windows Mail\Stationery\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Local\Microsoft\Windows Media\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Local\Microsoft\Windows Media\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Local\Microsoft\Windows Media\12.0\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Local\Microsoft\Windows Media\12.0\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Local\Skype\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Local\Skype\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Local\Skype\Apps\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Local\Skype\Apps\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\LocalLow\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\LocalLow\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\LocalLow\Google\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\LocalLow\Google\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\LocalLow\Google\GoogleEarth\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\LocalLow\Google\GoogleEarth\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\LocalLow\Google\GoogleEarth\unified_cache_leveldb_leveldb2\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\LocalLow\Google\GoogleEarth\unified_cache_leveldb_leveldb2\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Adobe\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Adobe\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Adobe\Flash Player\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Adobe\Flash Player\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Adobe\Flash Player\AssetCache\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Adobe\Flash Player\AssetCache\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Adobe\Flash Player\AssetCache\N4DTGKAY\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Adobe\Flash Player\AssetCache\N4DTGKAY\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Dropbox\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Dropbox\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Dropbox\bin\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Dropbox\bin\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Dropbox\instance1\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Dropbox\instance1\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\HP\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\HP\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\HP\WebRegLogs\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\HP\WebRegLogs\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Microsoft\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Microsoft\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Microsoft\Document Building Blocks\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Microsoft\Document Building Blocks\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Microsoft\Document Building Blocks\3082\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Microsoft\Document Building Blocks\3082\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Microsoft\Document Building Blocks\3082\14\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Microsoft\Document Building Blocks\3082\14\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Skype\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Skype\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\emo_cache\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\emo_cache\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\emo_cache\asyncdb\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\emo_cache\asyncdb\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\media_cache\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\media_cache\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\media_cache\asyncdb\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\media_cache\asyncdb\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\storage_db\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\storage_db\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\storage_db\asyncdb\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\storage_db\asyncdb\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\qikdb\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\qikdb\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Skype\cadopa\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Skype\cadopa\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\emo_cache\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\emo_cache\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\emo_cache\asyncdb\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\emo_cache\asyncdb\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\media_cache\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\media_cache\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\media_cache\asyncdb\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\media_cache\asyncdb\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\storage_db\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\storage_db\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\storage_db\asyncdb\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\storage_db\asyncdb\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Skype\cadopa\qikdb\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Skype\cadopa\qikdb\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Skype\patricia.guimaraens\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Skype\patricia.guimaraens\HELP_DECRYPT.TXT

C:\Users\shaka\AppData\Roaming\Skype\shared_httpfe\HELP_DECRYPT.HTML

C:\Users\shaka\AppData\Roaming\Skype\shared_httpfe\HELP_DECRYPT.TXT

C:\Users\shaka\Documents\HELP_DECRYPT.HTML

C:\Users\shaka\Documents\HELP_DECRYPT.TXT

C:\Users\shaka\Documents\Mis escaneos\HELP_DECRYPT.HTML

C:\Users\shaka\Documents\Mis escaneos\HELP_DECRYPT.TXT

C:\Windows\pss\HELP_DECRYPT.HTML.Startup

C:\Windows\pss\HELP_DECRYPT.TXT.Startup

C:\Windows\System32\sasnative32.exe
Emptytemp:
       
*****************

C:\Fuska\HELP_DECRYPT.HTML => Moved successfully.
C:\Fuska\HELP_DECRYPT.TXT => Moved successfully.
C:\Fuska\Senasa\HELP_DECRYPT.HTML => Moved successfully.
C:\Fuska\Senasa\HELP_DECRYPT.TXT => Moved successfully.
C:\ProgramData\HELP_DECRYPT.HTML => Moved successfully.
C:\ProgramData\HELP_DECRYPT.TXT => Moved successfully.
C:\ProgramData\Microsoft\RAC\PublishedData\HELP_DECRYPT.HTML => Moved successfully.
C:\ProgramData\Microsoft\RAC\PublishedData\HELP_DECRYPT.TXT => Moved successfully.
C:\Shaka\HELP_DECRYPT.HTML => Moved successfully.
C:\Shaka\HELP_DECRYPT.TXT => Moved successfully.
C:\Shaka\Rivera\HELP_DECRYPT.HTML => Moved successfully.
C:\Shaka\Rivera\HELP_DECRYPT.TXT => Moved successfully.
C:\Shaka\Trabajos\HELP_DECRYPT.HTML => Moved successfully.
C:\Shaka\Trabajos\HELP_DECRYPT.TXT => Moved successfully.
C:\Shaka\Trabajos\Eugenio\HELP_DECRYPT.HTML => Moved successfully.
C:\Shaka\Trabajos\Eugenio\HELP_DECRYPT.TXT => Moved successfully.
C:\Shaka\Trabajos\JGF\HELP_DECRYPT.HTML => Moved successfully.
C:\Shaka\Trabajos\JGF\HELP_DECRYPT.TXT => Moved successfully.
C:\Shaka\Trabajos\JGF\La Salamandra\HELP_DECRYPT.HTML => Moved successfully.
C:\Shaka\Trabajos\JGF\La Salamandra\HELP_DECRYPT.TXT => Moved successfully.
"C:\Users\All Users\HELP_DECRYPT.HTML" => File/Directory not found.
"C:\Users\All Users\HELP_DECRYPT.TXT" => File/Directory not found.
"C:\Users\All Users\Microsoft\RAC\PublishedData\HELP_DECRYPT.HTML" => File/Directory not found.
"C:\Users\All Users\Microsoft\RAC\PublishedData\HELP_DECRYPT.TXT" => File/Directory not found.
C:\Users\shaka\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Local\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Local\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Local\Google\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Local\Google\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Local\Google\Chrome\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Local\Google\Chrome\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Local\Google\Chrome\User Data\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Local\Google\Chrome\User Data\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg\0.3.0.2_0\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg\0.3.0.2_0\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg\0.3.0.2_0\audio\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg\0.3.0.2_0\audio\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Local\HP\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Local\HP\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Local\HP\Digital Imaging\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Local\HP\Digital Imaging\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Local\HP\Digital Imaging\cache2\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Local\HP\Digital Imaging\cache2\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Local\HP\Digital Imaging\db2\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Local\HP\Digital Imaging\db2\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Local\HP\Digital Imaging\vault\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Local\HP\Digital Imaging\vault\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Local\Microsoft\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Local\Microsoft\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Local\Microsoft\Device Metadata\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Local\Microsoft\Device Metadata\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Local\Microsoft\Internet Explorer\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Local\Microsoft\Internet Explorer\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Local\Microsoft\Media Player\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Local\Microsoft\Media Player\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Local\Microsoft\Media Player\Caché de imágenes\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Local\Microsoft\Media Player\Caché de imágenes\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Local\Microsoft\Media Player\Caché de imágenes\LocalMLS\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Local\Microsoft\Media Player\Caché de imágenes\LocalMLS\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Local\Microsoft\Windows Mail\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Local\Microsoft\Windows Mail\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Local\Microsoft\Windows Mail\Backup\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Local\Microsoft\Windows Mail\Backup\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Local\Microsoft\Windows Mail\Backup\old\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Local\Microsoft\Windows Mail\Backup\old\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Local\Microsoft\Windows Mail\Stationery\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Local\Microsoft\Windows Mail\Stationery\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Local\Microsoft\Windows Media\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Local\Microsoft\Windows Media\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Local\Microsoft\Windows Media\12.0\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Local\Microsoft\Windows Media\12.0\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Local\Skype\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Local\Skype\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Local\Skype\Apps\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Local\Skype\Apps\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\LocalLow\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\LocalLow\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\LocalLow\Google\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\LocalLow\Google\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\LocalLow\Google\GoogleEarth\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\LocalLow\Google\GoogleEarth\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\LocalLow\Google\GoogleEarth\unified_cache_leveldb_leveldb2\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\LocalLow\Google\GoogleEarth\unified_cache_leveldb_leveldb2\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Roaming\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Roaming\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Roaming\Adobe\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Roaming\Adobe\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Roaming\Adobe\Flash Player\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Roaming\Adobe\Flash Player\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Roaming\Adobe\Flash Player\AssetCache\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Roaming\Adobe\Flash Player\AssetCache\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Roaming\Adobe\Flash Player\AssetCache\N4DTGKAY\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Roaming\Adobe\Flash Player\AssetCache\N4DTGKAY\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Roaming\Dropbox\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Roaming\Dropbox\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Roaming\Dropbox\bin\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Roaming\Dropbox\bin\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Roaming\Dropbox\instance1\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Roaming\Dropbox\instance1\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Roaming\HP\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Roaming\HP\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Roaming\HP\WebRegLogs\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Roaming\HP\WebRegLogs\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Roaming\Microsoft\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Roaming\Microsoft\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Roaming\Microsoft\Document Building Blocks\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Roaming\Microsoft\Document Building Blocks\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Roaming\Microsoft\Document Building Blocks\3082\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Roaming\Microsoft\Document Building Blocks\3082\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Roaming\Microsoft\Document Building Blocks\3082\14\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Roaming\Microsoft\Document Building Blocks\3082\14\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Roaming\Skype\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Roaming\Skype\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\emo_cache\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\emo_cache\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\emo_cache\asyncdb\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\emo_cache\asyncdb\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\media_cache\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\media_cache\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\media_cache\asyncdb\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\media_cache\asyncdb\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\storage_db\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\storage_db\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\storage_db\asyncdb\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\media_messaging\storage_db\asyncdb\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\qikdb\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Roaming\Skype\armandocadoppi\qikdb\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Roaming\Skype\cadopa\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Roaming\Skype\cadopa\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\emo_cache\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\emo_cache\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\emo_cache\asyncdb\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\emo_cache\asyncdb\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\media_cache\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\media_cache\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\media_cache\asyncdb\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\media_cache\asyncdb\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\storage_db\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\storage_db\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\storage_db\asyncdb\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Roaming\Skype\cadopa\media_messaging\storage_db\asyncdb\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Roaming\Skype\cadopa\qikdb\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Roaming\Skype\cadopa\qikdb\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Roaming\Skype\patricia.guimaraens\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Roaming\Skype\patricia.guimaraens\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\AppData\Roaming\Skype\shared_httpfe\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\AppData\Roaming\Skype\shared_httpfe\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\Documents\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\Documents\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\shaka\Documents\Mis escaneos\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\shaka\Documents\Mis escaneos\HELP_DECRYPT.TXT => Moved successfully.
C:\Windows\pss\HELP_DECRYPT.HTML.Startup => Moved successfully.
C:\Windows\pss\HELP_DECRYPT.TXT.Startup => Moved successfully.
C:\Windows\System32\sasnative32.exe => Moved successfully.
EmptyTemp: => Removed 564.4 MB temporary data.


The system needed a reboot.

==== End of Fixlog 09:09:12 ====
Mhmm...eine Sache noch.. Komisch ist, jedes mal wenn ich Google Chrome oeffne und die Startseite aendere (auf Google.com) erscheint eine Fehlermeldung beim neuen Oeffnen, dass das Surfen nicht privat sei... und ich werde auf diese Seite geleitet, wobei das https durchgestrichen ist.

h**ps://avg.nation.com/chroment?espv=2&cid={E208873C-885A-4286-B6F4-317872DB511A}&mid=491fcc7d9a9147d3b0823de12d909e84-0762da72d5c59cee9c9f5a280d2b05848fe8dcff&lang=es-es&ds=AVG&pr=fr&d=2013-10-01%2013:49:47&v=18.1.0.443&pid=nation&sg=0

Habe Google Chrome deinstalliert und jetzt laeuft Firefox :-)

..und noch ne Frage.. Nachdem ganz am Anfang die Kiste gesponnen hat, habe ich im Startmenue das Decrypt Programm deaktiviert, dieses ist aber immer noch im Startmenue vorhanden..nur eben deaktiviert.. hab gerade nachgeschaut und zwar unter C://User/AppData/Roaming/Microsoft/Windows/Startmenu/Programs/Startup/HelpDecryp txt, png, html und url

Wollte gerade mal kurz in IPConfig reinschauen, aber das Programm laesst sich nicht oeffnen.. Erscheint nur ganz kurz und ist dann schon wieder weg.. Weiterer Virus??

schrauber 20.05.2015 06:43
Kannste aus dem Startmenü löschen. Gibst Du ipconfig in CMD ein oder im Ausführen Fenster?


Alle Zeitangaben in WEZ +1. Es ist jetzt 08:45 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131