Trojaner-Board - Software.Updater.ui.exe nun auf dem Rechner meiner Freundin nach dem Hochfahren

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - Software.Updater.ui.exe nun auf dem Rechner meiner Freundin nach dem Hochfahren (https://www.trojaner-board.de/139623-software-updater-ui-exe-rechner-meiner-freundin-hochfahren.html)

Software.Updater.ui.exe nun auf dem Rechner meiner Freundin nach dem Hochfahren

Geschätztes Trojaner Board Ream,

ich habe mithilfe von Schrauber dieses leidige Problem gearde gestern auf meinem eigenen PC wunderbar lösen/abschhließen können. Nun stellt sich leider dasselbe Problem auf dem PC meiner Freundin.
Kurz nach dem Hochfahren des PC's bekommen wir die Meldung, daß sich SoftwareUpdater.ui.exe ausführen möchte.
Wie gesagt habe ich gerade dasselbe Problem mit Eurer Hilfe gelöst, möchte aber trotzdem keine ersten Schritte zur Lösung selbst einleiten, sondern lieber auf Fachmänner wie Euch vertrauen.
Bitte um Hilfe und Anweisungen.
Vielen Dank,
Plekdemon und Freundin

hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Guten Morgen Schrauber,

hier die notwendigen Logs.

FRST:

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 09-08-2013

Ran by Andrea (administrator) on 11-08-2013 10:04:02

Running from C:\Users\Andrea\Desktop

Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: English(US)

Internet Explorer Version 9

Boot Mode: Normal
 

==================== Processes (Whitelisted) ===================
 

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe

(Microsoft Corporation) C:\Windows\system32\SLsvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe

(AVAST Software) C:\Program Files\Alwil Software\Avast5\AvastSvc.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe

(Cyberlink Corp.) C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe

(PixArt Imaging Incorporation) C:\Windows\PixArt\PAC207\Monitor.exe

(SEIKO EPSON CORPORATION) C:\Program Files\Epson Software\Event Manager\EEventManager.exe

(AVAST Software) C:\Program Files\Alwil Software\Avast5\AvastUI.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe

(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe

(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe

(Microsoft Corporation) C:\Windows\ehome\ehtray.exe

(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40ST7.EXE

(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\w32x86\3\E_FATIEME.EXE

(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe

(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE

(Dropbox, Inc.) C:\Users\Andrea\AppData\Roaming\Dropbox\bin\Dropbox.exe

(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe

(Curse) C:\Users\Andrea\AppData\Local\Apps\2.0\HY6EDQJW.EPN\MMXTTQPM.1ON\curs..tion_9e9e83ddf3ed3ead_0005.0001_181b5e0542e9eb6c\CurseClient.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe

() C:\Program Files\CyberLink\Shared Files\RichVideo.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe

() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Realsil Microelectronics Inc.) C:\Program Files\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\Windows\system32\conime.exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [Windows Defender] - C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-21] (Microsoft Corporation)

HKLM\...\Run: [RemoteControl] - C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [71216 2007-03-14] (Cyberlink Corp.)

HKLM\...\Run: [LanguageShortcut] - C:\Program Files\CyberLink\PowerDVD\Language\Language.exe [52256 2007-01-09] ()

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [11992792 2013-06-25] (Realtek Semiconductor)

HKLM\...\Run: [QuickTime Task] - C:\Program Files\QuickTime\QTTask.exe [413696 2008-05-27] (Apple Inc.)

HKLM\...\Run: [Cm106Sound] - RunDll32 cm106.cpl,CMICtrlWnd [x]

HKLM\...\Run: [PAC207_Monitor] - C:\Windows\PixArt\PAC207\Monitor.exe [319488 2006-11-03] (PixArt Imaging Incorporation)

HKLM\...\Run: [Skytel] - C:\Windows\Skytel.exe [1826816 2007-11-20] (Realtek Semiconductor Corp.)

HKLM\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [40368 2011-08-31] (Adobe Systems Incorporated)

HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [937920 2011-03-29] (Adobe Systems Incorporated)

HKLM\...\Run: [EEventManager] - C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe [591696 2008-05-07] (SEIKO EPSON CORPORATION)

HKLM\...\Run: [avast] - C:\Program Files\Alwil Software\Avast5\avastUI.exe [4858968 2013-05-09] (AVAST Software)

HKLM\...\Run: [Nvtmru] - C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1012000 2013-05-16] (NVIDIA Corporation)

HKLM\...\Run: [Kernel and Hardware Abstraction Layer] - C:\Windows\KHALMNPR.EXE [76304 2008-02-29] (Logicool, Inc.)

HKCU\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [2153472 2009-04-11] (Microsoft Corporation)

HKCU\...\Run: [LightScribe Control Panel] - C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [2289664 2008-01-24] (Hewlett-Packard Company)

HKCU\...\Run: [BullGuard] - "C:\Program Files\BullGuard Ltd\BullGuard\BullGuard.exe" [x]

HKCU\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [125952 2008-01-21] (Microsoft Corporation)

HKCU\...\Run: [Skype] - "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized [x]

HKCU\...\Run: [EPSON PX800FW Series] - C:\Windows\TEMP\E_S14A9.tmp [134 2011-08-18] ()

MountPoints2: {eb0cd0e6-2201-11dd-8541-806e6f6e6963} - D:\EPSETUP.EXE

HKU\Administrator\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [ 2009-04-11] (Microsoft Corporation)

HKU\Administrator\...\Run: [Power2GoExpress] - C:\Program Files\CyberLink\Power2Go\Power2GoExpress.exe [ 2007-07-12] (Cyberlink)

HKU\Administrator\...\Run: [BullGuard] - "C:\Program Files\BullGuard Ltd\BullGuard\bullguard.exe" [x]

HKU\Administrator\...\Run: [LightScribe Control Panel] - C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [ 2008-01-24] (Hewlett-Packard Company)

HKU\Administrator\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [ 2008-01-21] (Microsoft Corporation)

HKU\Administrator\...\Run: [Skype] - "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized [x]

HKU\Administrator\...\Run: [EPSON PX800FW Series] - C:\Windows\TEMP\E_S14A9.tmp [ 2011-08-18] ()

HKU\Default\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [ 2009-04-11] (Microsoft Corporation)

HKU\Default User\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [ 2009-04-11] (Microsoft Corporation)

HKU\Guest\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [ 2009-04-11] (Microsoft Corporation)

HKU\Guest\...\Run: [LightScribe Control Panel] - C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [ 2008-01-24] (Hewlett-Packard Company)

HKU\Guest\...\Run: [BullGuard] - "C:\Program Files\BullGuard Ltd\BullGuard\BullGuard.exe" [x]

HKU\Guest\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [ 2008-01-21] (Microsoft Corporation)

HKU\Guest\...\Run: [Skype] - "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized [x]

HKU\Guest\...\Run: [EPSON PX800FW Series] - C:\Windows\TEMP\E_S14A9.tmp [ 2011-08-18] ()

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk

ShortcutTarget: Microsoft Office.lnk -> C:\Program Files\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)

Startup: C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip ()

Startup: C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk -> C:\Users\Andrea\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.at/

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.meshcomputers.com

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.meshcomputers.com

SearchScopes: HKCU - {DECA3892-BA8F-44b8-A993-A466AD694AE4} URL = hxxp://search.yahoo.com/search?fr=mcafee&p={searchTerms}

BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)

BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll (Sun Microsystems, Inc.)

BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)

BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)

Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)

Toolbar: HKLM - avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)

Toolbar: HKCU -No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File

DPF: {6E718D87-6909-4FCE-92D4-EDCB2F725727} hxxp://www.navigram.com/engine/v1026/Navigram.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab

DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab

DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)

Handler: msdaipp - No CLSID Value - 

Winsock: Catalog9 01 C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll [258664] (NVIDIA)

Winsock: Catalog9 02 C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll [258664] (NVIDIA)

Winsock: Catalog9 03 C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll [258664] (NVIDIA)

Winsock: Catalog9 04 C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll [258664] (NVIDIA)

Winsock: Catalog9 05 C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll [258664] (NVIDIA)

Winsock: Catalog9 06 C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll [258664] (NVIDIA)

Winsock: Catalog9 25 C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll [258664] (NVIDIA)

Winsock: Catalog9 26 C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll [258664] (NVIDIA)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 192.168.2.1
 

Chrome: 

=======

CHR HomePage: hxxp://www.google.com/

CHR RestoreOnStartup: "hxxp://www.google.com/"

CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}

CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}sugkey={google:suggestAPIKeyParameter}

CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\28.0.1500.95\PepperFlash\pepflashplayer.dll ()

CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\28.0.1500.95\ppGoogleNaClPluginChrome.dll ()

CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\28.0.1500.95\pdf.dll ()

CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)

CHR Plugin: (QuickTime Plug-in 7.5 (861)) - C:\Program Files\QuickTime\plugins\npqtplugin.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.5 (861)) - C:\Program Files\QuickTime\plugins\npqtplugin2.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.5 (861)) - C:\Program Files\QuickTime\plugins\npqtplugin3.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.5 (861)) - C:\Program Files\QuickTime\plugins\npqtplugin4.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.5 (861)) - C:\Program Files\QuickTime\plugins\npqtplugin5.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.5 (861)) - C:\Program Files\QuickTime\plugins\npqtplugin6.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.5 (861)) - C:\Program Files\QuickTime\plugins\npqtplugin7.dll (Apple Inc.)

CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File

CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll No File

CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll No File

CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)

CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File

CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

CHR Extension: (YouTube) - C:\Users\Andrea\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0

CHR Extension: (Google Search) - C:\Users\Andrea\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0

CHR Extension: (avast! Online Security) - C:\Users\Andrea\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki\8.0.8_0

CHR Extension: (Gmail) - C:\Users\Andrea\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1

CHR StartMenuInternet: Google Chrome - C:\Program Files\Google\Chrome\Application\chrome.exe
 

========================== Services (Whitelisted) =================
 

R2 avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [46808 2013-05-09] (AVAST Software)

R2 EPSON_EB_RPCV4_01; C:\ProgramData\EPSON\EPW!3 SSRP\E_S40ST7.EXE [143872 2007-12-17] (SEIKO EPSON CORPORATION)

R2 EPSON_PM_RPCV4_01; C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE [113664 2007-01-11] (SEIKO EPSON CORPORATION)

R2 ForceWare Intelligent Application Manager (IAM); C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe [370792 2010-01-21] ()

S3 getPlusHelper; C:\Program Files\NOS\bin\getPlus_Helper.dll [68000 2010-03-22] (NOS Microsystems Ltd.)

R2 IconMan_R; C:\Program Files\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe [1828496 2012-09-07] (Realsil Microelectronics Inc.)

R2 nSvcIp; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe [167528 2010-01-21] ()

R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [272024 2006-12-19] ()

S2 SystemStoreService; C:\Program Files\SoftwareUpdater\SystemStore.exe [296448 2013-06-26] ()
 

==================== Drivers (Whitelisted) ====================
 

R2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [29816 2013-05-09] (AVAST Software)

R1 aswKbd; C:\Windows\System32\Drivers\aswKbd.sys [20624 2012-10-31] (AVAST Software)

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [66336 2013-05-09] (AVAST Software)

R1 aswRdr; C:\Windows\System32\Drivers\aswRdr.sys [49760 2013-05-09] (AVAST Software)

R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [49376 2013-05-09] ()

R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [770344 2013-07-29] (AVAST Software)

R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [369584 2013-07-29] (AVAST Software)

R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [56080 2013-05-09] (AVAST Software)

R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [175176 2013-07-29] ()

R0 JGOGO; C:\Windows\System32\DRIVERS\JGOGO.sys [6912 2006-02-08] (JMicron )

R0 JRAID; C:\Windows\System32\DRIVERS\jraid.sys [44416 2006-12-07] (JMicron Technology Corp.)

R3 LHidFilt; C:\Windows\System32\DRIVERS\LHidFilt.Sys [35472 2008-02-29] (Logicool, Inc.)

R3 LMouFilt; C:\Windows\System32\DRIVERS\LMouFilt.Sys [37008 2008-02-29] (Logicool, Inc.)

R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [7680 2006-10-19] ()

S3 PAC207; C:\Windows\System32\DRIVERS\PFC027.SYS [616064 2007-10-25] (PixArt Imaging Inc.)

S3 USBMULCD; C:\Windows\System32\drivers\CM106.sys [1499648 2008-12-19] (C-Media Electronics Inc)

S3 IpInIp; system32\DRIVERS\ipinip.sys [x]

S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]

S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-08-11 10:02 - 2013-08-11 10:03 - 01230570 _____ (Farbar) C:\Users\Andrea\Desktop\FRST.exe

2013-08-10 19:53 - 2013-08-10 19:53 - 00000000 ____D C:\Windows\system32\sda

2013-08-10 19:50 - 2013-08-10 19:50 - 00000000 ____D C:\Users\Andrea\{65241908-f7ce-4c91-8809-534ef6fe3c87}

2013-08-10 19:50 - 2012-08-29 17:47 - 00190976 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\Drivers\RtsUStor.sys

2013-08-10 19:50 - 2011-11-10 16:54 - 09881600 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtsUStoricon.dll

2013-08-10 19:50 - 2010-10-29 16:11 - 00313960 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtsUStor.dll

2013-08-10 19:44 - 2010-03-04 18:04 - 00758784 _____ (NVIDIA Corporation) C:\Windows\system32\cohelper.dll

2013-08-10 19:42 - 2013-08-10 19:42 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_LMouFilt_01005.Wdf

2013-08-10 19:42 - 2010-04-09 02:32 - 00372840 _____ (NVIDIA Corporation) C:\Windows\system32\nvraiins.dll

2013-08-10 19:42 - 2010-04-09 02:32 - 00372840 _____ (NVIDIA Corporation) C:\Windows\system32\nvraidco.dll

2013-08-10 19:42 - 2010-04-09 02:32 - 00215656 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvstor32.sys

2013-08-10 19:42 - 2010-04-09 02:32 - 00018024 _____ (NVIDIA Corporation) C:\Windows\system32\NvRCoPtb.dll

2013-08-10 19:42 - 2010-04-09 02:32 - 00018024 _____ (NVIDIA Corporation) C:\Windows\system32\NvRCoIt.dll

2013-08-10 19:42 - 2010-04-09 02:32 - 00018024 _____ (NVIDIA Corporation) C:\Windows\system32\NvRCoFr.dll

2013-08-10 19:42 - 2010-04-09 02:32 - 00018024 _____ (NVIDIA Corporation) C:\Windows\system32\NvRCoEsm.dll

2013-08-10 19:42 - 2010-04-09 02:32 - 00018024 _____ (NVIDIA Corporation) C:\Windows\system32\NvRCoEs.dll

2013-08-10 19:42 - 2010-04-09 02:32 - 00018024 _____ (NVIDIA Corporation) C:\Windows\system32\NvRCoDe.dll

2013-08-10 19:42 - 2010-04-09 02:32 - 00017512 _____ (NVIDIA Corporation) C:\Windows\system32\NvRCoSv.dll

2013-08-10 19:42 - 2010-04-09 02:32 - 00017512 _____ (NVIDIA Corporation) C:\Windows\system32\NvRCoRu.dll

2013-08-10 19:42 - 2010-04-09 02:32 - 00017512 _____ (NVIDIA Corporation) C:\Windows\system32\NvRCoNo.dll

2013-08-10 19:42 - 2010-04-09 02:32 - 00017512 _____ (NVIDIA Corporation) C:\Windows\system32\NvRCoNl.dll

2013-08-10 19:42 - 2010-04-09 02:32 - 00017512 _____ (NVIDIA Corporation) C:\Windows\system32\NvRCoFi.dll

2013-08-10 19:42 - 2010-04-09 02:32 - 00017512 _____ (NVIDIA Corporation) C:\Windows\system32\NvRCoDa.dll

2013-08-10 19:42 - 2010-04-09 02:32 - 00017000 _____ (NVIDIA Corporation) C:\Windows\system32\NvRCoENU.dll

2013-08-10 19:42 - 2010-04-09 02:32 - 00017000 _____ (NVIDIA Corporation) C:\Windows\system32\NvRCoEng.dll

2013-08-10 19:42 - 2010-04-09 02:32 - 00015464 _____ (NVIDIA Corporation) C:\Windows\system32\NvRCoKo.dll

2013-08-10 19:42 - 2010-04-09 02:32 - 00015464 _____ (NVIDIA Corporation) C:\Windows\system32\NvRCoJa.dll

2013-08-10 19:42 - 2010-04-09 02:32 - 00014952 _____ (NVIDIA Corporation) C:\Windows\system32\NvRCoZht.dll

2013-08-10 19:42 - 2010-04-09 02:32 - 00014952 _____ (NVIDIA Corporation) C:\Windows\system32\NvRCoZhc.dll

2013-08-10 19:42 - 2010-03-22 12:28 - 00215656 _____ (NVIDIA Corporation) C:\Windows\system32\NVCOSMB.DLL

2013-08-10 19:42 - 2010-03-04 18:26 - 00291560 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvmfdx32.sys

2013-08-10 19:42 - 2010-03-04 18:04 - 00953856 _____ (NVIDIA Corporation) C:\Windows\system32\fdco9.dll

2013-08-10 19:41 - 2013-08-10 19:41 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_LHidFilt_01005.Wdf

2013-08-10 19:41 - 2008-02-29 12:00 - 01419232 _____ (Microsoft Corporation) C:\Windows\system32\WdfCoInstaller01005.dll

2013-08-10 19:41 - 2008-02-29 11:12 - 00076304 _____ (Logicool, Inc.) C:\Windows\KHALMNPR.Exe

2013-08-10 19:41 - 2008-02-29 11:12 - 00037008 _____ (Logicool, Inc.) C:\Windows\system32\Drivers\LMouFilt.Sys

2013-08-10 19:41 - 2008-02-29 11:12 - 00035472 _____ (Logicool, Inc.) C:\Windows\system32\Drivers\LHidFilt.Sys

2013-08-10 19:38 - 2013-08-10 19:50 - 00000000 ____D C:\Program Files\Realtek

2013-08-10 19:38 - 2013-06-25 18:42 - 02693144 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\Drivers\RTKVHDA.sys

2013-08-10 19:38 - 2013-06-25 16:25 - 00602901 _____ C:\Windows\system32\Drivers\RTAIODAT.DAT

2013-08-10 19:38 - 2013-06-25 11:40 - 27937792 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RCoRes.dat

2013-08-10 19:38 - 2013-06-25 10:48 - 00121048 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkCoInstII.dll

2013-08-10 19:38 - 2013-06-18 19:52 - 00769752 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkApoApi.dll

2013-08-10 19:38 - 2013-06-18 17:44 - 02388000 _____ (Fortemedia Corporation) C:\Windows\system32\FMAPO.dll

2013-08-10 19:38 - 2013-06-18 17:00 - 00912432 _____ (Sony Corporation) C:\Windows\system32\SFSS_APO.dll

2013-08-10 19:38 - 2013-06-18 13:54 - 02536152 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkPgExt.dll

2013-08-10 19:38 - 2013-06-17 20:20 - 00188696 _____ C:\Windows\system32\AcpiServiceVnA.dll

2013-08-10 19:38 - 2013-06-13 19:20 - 05448460 _____ C:\Windows\system32\Drivers\rtvienna.dat

2013-08-10 19:38 - 2013-06-05 21:42 - 00181960 _____ (Andrea Electronics Corporation) C:\Windows\system32\AERTACap.dll

2013-08-10 19:38 - 2013-05-30 13:58 - 04159768 _____ (ASUSTeKcomputer.Inc) C:\Windows\system32\RTKSMlfx.dll

2013-08-10 19:38 - 2013-05-30 13:56 - 00719704 _____ (A-Volute) C:\Windows\system32\RTKSMSettingsIPC.dll

2013-08-10 19:38 - 2013-05-02 12:01 - 01824000 _____ (Waves Audio Ltd.) C:\Windows\system32\WavesGUILib.dll

2013-08-10 19:38 - 2013-05-02 12:01 - 00788224 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPOShell.dll

2013-08-10 19:38 - 2013-05-02 12:00 - 01932032 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioEQ.dll

2013-08-10 19:38 - 2013-04-24 17:16 - 01596488 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RTSndMgr.cpl

2013-08-10 19:38 - 2013-04-18 13:48 - 13780736 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioRealtek.dll

2013-08-10 19:38 - 2013-04-18 13:48 - 02886400 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioVnN.dll

2013-08-10 19:38 - 2013-04-18 13:48 - 01661184 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioRealtek2.dll

2013-08-10 19:38 - 2013-04-16 06:23 - 00709400 _____ (SRS Labs, Inc.) C:\Windows\system32\slcnt32.dll

2013-08-10 19:38 - 2013-04-16 06:23 - 00548632 _____ (SRS Labs, Inc.) C:\Windows\system32\sltech32.dll

2013-08-10 19:38 - 2013-04-16 06:23 - 00341272 _____ (SRS Labs, Inc.) C:\Windows\system32\sl3apo32.dll

2013-08-10 19:38 - 2013-04-16 06:23 - 00186136 _____ (TODO: <Company name>) C:\Windows\system32\slprp32.dll

2013-08-10 19:38 - 2013-04-15 11:19 - 00642816 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO50.dll

2013-08-10 19:38 - 2013-04-03 14:12 - 00852016 _____ (Sony Corporation) C:\Windows\system32\MISS_APO.dll

2013-08-10 19:38 - 2013-03-20 13:17 - 08872216 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioVnA.dll

2013-08-10 19:38 - 2012-12-17 17:49 - 00437704 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxVoiceAPO20.dll

2013-08-10 19:38 - 2012-12-12 11:17 - 00350664 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO30.dll

2013-08-10 19:38 - 2012-10-02 14:39 - 00426952 _____ (DTS) C:\Windows\system32\DTSU2PLFX32.dll

2013-08-10 19:38 - 2012-10-02 14:39 - 00402888 _____ (DTS) C:\Windows\system32\DTSU2PGFX32.dll

2013-08-10 19:38 - 2012-10-02 14:39 - 00346056 _____ (DTS) C:\Windows\system32\DTSU2PREC32.dll

2013-08-10 19:38 - 2012-09-10 20:06 - 00549240 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO40.dll

2013-08-10 19:38 - 2012-08-31 19:17 - 07162128 _____ (Dolby Laboratories) C:\Windows\system32\R4EEP32A.dll

2013-08-10 19:38 - 2012-08-31 19:17 - 00352016 _____ (Dolby Laboratories) C:\Windows\system32\R4EED32A.dll

2013-08-10 19:38 - 2012-08-31 19:17 - 00106768 _____ (Dolby Laboratories) C:\Windows\system32\R4EEL32A.dll

2013-08-10 19:38 - 2012-08-31 19:17 - 00091920 _____ (Dolby Laboratories) C:\Windows\system32\R4EEA32A.dll

2013-08-10 19:38 - 2012-08-31 19:17 - 00062224 _____ (Dolby Laboratories) C:\Windows\system32\R4EEG32A.dll

2013-08-10 19:38 - 2012-07-15 21:13 - 00349048 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxVolumeSDAPO.dll

2013-08-10 19:38 - 2012-06-20 17:26 - 00090624 _____ (Real Sound Lab SIA) C:\Windows\system32\CONEQMSAPOGUILibrary.dll

2013-08-10 19:38 - 2012-03-08 11:47 - 00095840 _____ (Andrea Electronics Corporation) C:\Windows\system32\AERTARen.dll

2013-08-10 19:38 - 2012-01-30 11:42 - 00819648 _____ (TOSHIBA Corporation) C:\Windows\system32\tadefxapo2.dll

2013-08-10 19:38 - 2012-01-10 10:20 - 00058264 _____ (TOSHIBA CORPORATION.) C:\Windows\system32\TepeqAPO.dll

2013-08-10 19:38 - 2011-11-22 16:28 - 00013416 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkCoLDR.dll

2013-08-10 19:38 - 2011-09-02 14:21 - 00214368 _____ (Synopsys, Inc.) C:\Windows\system32\SFNHK.dll

2013-08-10 19:38 - 2011-09-02 14:21 - 00074080 _____ (Synopsys, Inc.) C:\Windows\system32\SFCOM.dll

2013-08-10 19:38 - 2011-09-02 14:21 - 00068960 _____ (Synopsys, Inc.) C:\Windows\system32\SFAPO.dll

2013-08-10 19:38 - 2011-08-23 17:00 - 00357712 _____ (Knowles Acoustics ) C:\Windows\system32\KAAPORT.dll

2013-08-10 19:38 - 2011-08-11 16:55 - 00001332 _____ C:\Windows\system32\Drivers\DTSU2P.DAT

2013-08-10 19:38 - 2011-05-31 09:42 - 01509480 _____ (DTS) C:\Windows\system32\DTSS2SpeakerDLL.dll

2013-08-10 19:38 - 2011-05-31 09:42 - 01292904 _____ (DTS) C:\Windows\system32\DTSS2HeadphoneDLL.dll

2013-08-10 19:38 - 2011-05-31 09:42 - 01220200 _____ (DTS) C:\Windows\system32\DTSBoostDLL.dll

2013-08-10 19:38 - 2011-05-31 09:42 - 00654952 _____ (DTS) C:\Windows\system32\DTSBassEnhancementDLL.dll

2013-08-10 19:38 - 2011-05-31 09:42 - 00631400 _____ (DTS) C:\Windows\system32\DTSSymmetryDLL.dll

2013-08-10 19:38 - 2011-05-31 09:42 - 00601704 _____ (DTS) C:\Windows\system32\DTSVoiceClarityDLL.dll

2013-08-10 19:38 - 2011-05-31 09:42 - 00458344 _____ (DTS) C:\Windows\system32\DTSNeoPCDLL.dll

2013-08-10 19:38 - 2011-05-31 09:42 - 00389736 _____ (DTS) C:\Windows\system32\DTSGainCompensatorDLL.dll

2013-08-10 19:38 - 2011-05-31 09:42 - 00375400 _____ (DTS) C:\Windows\system32\DTSLimiterDLL.dll

2013-08-10 19:38 - 2011-05-31 09:42 - 00218728 _____ (DTS) C:\Windows\system32\DTSGFXAPONS.dll

2013-08-10 19:38 - 2011-05-31 09:42 - 00218728 _____ (DTS) C:\Windows\system32\DTSGFXAPO.dll

2013-08-10 19:38 - 2011-05-31 09:42 - 00218216 _____ (DTS) C:\Windows\system32\DTSLFXAPO.dll

2013-08-10 19:38 - 2011-03-17 12:16 - 01379760 _____ (TOSHIBA Corporation) C:\Windows\system32\tosade.dll

2013-08-10 19:38 - 2011-03-07 17:03 - 00134584 _____ (TOSHIBA Corporation) C:\Windows\system32\tadefxapo.dll

2013-08-10 19:38 - 2010-11-08 07:31 - 00359768 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEP32A.dll

2013-08-10 19:38 - 2010-11-08 07:31 - 00295768 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RP3DHT32.dll

2013-08-10 19:38 - 2010-11-08 07:31 - 00295768 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RP3DAA32.dll

2013-08-10 19:38 - 2010-11-08 07:31 - 00170840 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEED32A.dll

2013-08-10 19:38 - 2010-11-08 07:31 - 00078680 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEL32A.dll

2013-08-10 19:38 - 2010-11-08 07:31 - 00064856 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEG32A.dll

2013-08-10 19:38 - 2010-09-27 09:34 - 00232792 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO20.dll

2013-08-10 19:38 - 2009-12-04 15:43 - 00132368 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO.dll

2013-08-10 19:38 - 2009-11-24 09:55 - 00345328 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSTSXT.dll

2013-08-10 19:38 - 2009-11-24 09:55 - 00185584 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSTSHD.dll

2013-08-10 19:38 - 2009-11-24 09:55 - 00173296 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSHP360.dll

2013-08-10 19:38 - 2009-11-24 09:55 - 00140528 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSWOW.dll

2013-08-10 19:38 - 2009-11-18 18:42 - 01783056 _____ (Waves Audio Ltd.) C:\Windows\system32\WavesLib.dll

2013-08-10 19:37 - 2013-06-10 15:44 - 02080472 _____ (Realtek Semiconductor Corp.) C:\Windows\RtlExUpd.dll

2013-08-10 19:06 - 2013-08-10 19:09 - 00000000 ____D C:\Users\Andrea\Desktop\Andrea While Fixing

2013-08-02 11:30 - 2013-08-02 11:30 - 10959998 _____ C:\Users\Andrea\Downloads\Unconfirmed 497121.crdownload

2013-07-29 17:13 - 2013-08-10 20:42 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2013-07-29 17:13 - 2013-07-29 17:13 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe

2013-07-29 13:10 - 2013-07-29 13:10 - 00000175 _____ C:\Windows\system32\Drivers\aswVmm.sys.sum

2013-07-29 13:10 - 2013-07-29 13:10 - 00000175 _____ C:\Windows\system32\Drivers\aswSP.sys.sum

2013-07-29 13:10 - 2013-07-29 13:10 - 00000175 _____ C:\Windows\system32\Drivers\aswSnx.sys.sum

2013-07-29 13:09 - 2013-07-29 13:10 - 00175176 _____ C:\Windows\system32\Drivers\aswVmm.sys

2013-07-29 13:09 - 2013-05-09 10:59 - 00049376 _____ C:\Windows\system32\Drivers\aswRvrt.sys

2013-07-12 12:54 - 2013-05-29 03:50 - 01800704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2013-07-12 12:54 - 2013-05-29 03:48 - 09738752 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2013-07-12 12:54 - 2013-05-29 03:41 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2013-07-12 12:54 - 2013-05-29 03:41 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2013-07-12 12:54 - 2013-05-29 03:41 - 01104384 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2013-07-12 12:54 - 2013-05-29 03:40 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll

2013-07-12 12:54 - 2013-05-29 03:38 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2013-07-12 12:54 - 2013-05-29 03:37 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2013-07-12 12:54 - 2013-05-29 03:36 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2013-07-12 12:54 - 2013-05-29 03:35 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2013-07-12 12:54 - 2013-05-29 03:35 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2013-07-12 12:54 - 2013-05-29 03:33 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2013-07-12 12:54 - 2013-05-29 03:33 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2013-07-12 12:54 - 2013-05-29 03:33 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2013-07-12 12:54 - 2013-05-29 03:29 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2013-07-12 12:53 - 2013-05-29 03:56 - 12333568 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2013-07-12 12:41 - 2013-06-04 03:50 - 02049024 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2013-07-12 12:41 - 2013-06-01 06:06 - 00505344 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll

2013-07-12 12:41 - 2013-04-17 13:28 - 01029120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll

2013-07-12 12:41 - 2013-04-17 13:28 - 00219648 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll

2013-07-12 12:41 - 2013-04-17 13:28 - 00189952 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll

2013-07-12 12:41 - 2013-04-17 13:28 - 00160768 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll

2013-07-12 12:41 - 2013-04-17 12:34 - 01172480 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll

2013-07-12 12:41 - 2013-04-17 12:33 - 00486400 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll

2013-07-12 12:41 - 2013-04-17 12:14 - 00683008 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll

2013-07-12 12:41 - 2013-04-17 12:10 - 01069056 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll

2013-07-12 12:41 - 2013-04-17 12:10 - 00798208 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll

2013-07-12 12:40 - 2013-05-08 06:04 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
 

==================== One Month Modified Files and Folders =======
 

2013-08-11 10:03 - 2013-08-11 10:03 - 00000000 ____D C:\FRST

2013-08-11 10:03 - 2013-08-11 10:02 - 01230570 _____ (Farbar) C:\Users\Andrea\Desktop\FRST.exe

2013-08-11 09:59 - 2010-07-25 17:44 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Dropbox

2013-08-11 09:58 - 2010-09-04 15:47 - 00000000 ____D C:\Users\Andrea\AppData\Local\Deployment

2013-08-11 09:58 - 2010-07-25 17:45 - 00000000 ___RD C:\Users\Andrea\Documents\My Dropbox

2013-08-11 09:57 - 2012-01-01 14:10 - 00000884 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2013-08-11 09:57 - 2006-11-02 15:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2013-08-11 09:57 - 2006-11-02 14:47 - 00003616 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

2013-08-11 09:57 - 2006-11-02 14:47 - 00003616 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

2013-08-10 21:33 - 2008-05-15 00:15 - 01160271 _____ C:\Windows\WindowsUpdate.log

2013-08-10 21:33 - 2006-11-02 15:01 - 00032620 _____ C:\Windows\Tasks\SCHEDLGU.TXT

2013-08-10 21:09 - 2012-01-01 14:10 - 00000888 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2013-08-10 20:42 - 2013-07-29 17:13 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2013-08-10 20:20 - 2008-05-15 11:58 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite

2013-08-10 20:19 - 2008-01-21 04:47 - 00127124 _____ C:\Windows\PFRO.log

2013-08-10 20:01 - 2011-09-07 14:51 - 00000000 ____D C:\Program Files\NVIDIA Corporation

2013-08-10 20:01 - 2008-03-15 01:36 - 00000000 ___HD C:\Program Files\InstallShield Installation Information

2013-08-10 19:55 - 2006-11-02 12:33 - 00800208 _____ C:\Windows\system32\PerfStringBackup.INI

2013-08-10 19:53 - 2013-08-10 19:53 - 00000000 ____D C:\Windows\system32\sda

2013-08-10 19:53 - 2008-05-09 15:00 - 00000000 ____D C:\ProgramData\NVIDIA

2013-08-10 19:52 - 2008-05-15 11:57 - 00000000 ____D C:\Users\Andrea

2013-08-10 19:50 - 2013-08-10 19:50 - 00000000 ____D C:\Users\Andrea\{65241908-f7ce-4c91-8809-534ef6fe3c87}

2013-08-10 19:50 - 2013-08-10 19:38 - 00000000 ____D C:\Program Files\Realtek

2013-08-10 19:42 - 2013-08-10 19:42 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_LMouFilt_01005.Wdf

2013-08-10 19:42 - 2006-11-02 14:52 - 00032295 _____ C:\Windows\setupact.log

2013-08-10 19:41 - 2013-08-10 19:41 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_LHidFilt_01005.Wdf

2013-08-10 19:39 - 2008-05-09 14:55 - 00000000 ____D C:\Windows\system32\RTCOM

2013-08-10 19:09 - 2013-08-10 19:06 - 00000000 ____D C:\Users\Andrea\Desktop\Andrea While Fixing

2013-08-02 11:30 - 2013-08-02 11:30 - 10959998 _____ C:\Users\Andrea\Downloads\Unconfirmed 497121.crdownload

2013-08-02 08:14 - 2012-03-02 21:16 - 00001979 _____ C:\Users\Public\Desktop\Google Chrome.lnk

2013-07-29 17:13 - 2013-07-29 17:13 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe

2013-07-29 17:13 - 2011-08-14 23:39 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl

2013-07-29 17:02 - 2012-04-12 18:35 - 00000680 _____ C:\Users\Andrea\AppData\Local\d3d9caps.dat

2013-07-29 13:10 - 2013-07-29 13:10 - 00000175 _____ C:\Windows\system32\Drivers\aswVmm.sys.sum

2013-07-29 13:10 - 2013-07-29 13:10 - 00000175 _____ C:\Windows\system32\Drivers\aswSP.sys.sum

2013-07-29 13:10 - 2013-07-29 13:10 - 00000175 _____ C:\Windows\system32\Drivers\aswSnx.sys.sum

2013-07-29 13:10 - 2013-07-29 13:09 - 00175176 _____ C:\Windows\system32\Drivers\aswVmm.sys

2013-07-29 13:10 - 2011-11-15 18:20 - 00770344 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys

2013-07-29 13:10 - 2010-09-14 11:00 - 00369584 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys

2013-07-29 13:09 - 2006-11-02 12:23 - 00002577 _____ C:\Windows\system32\config.nt

2013-07-14 17:59 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\Microsoft.NET

2013-07-13 09:48 - 2006-11-02 14:47 - 00299240 _____ C:\Windows\system32\FNTCACHE.DAT

2013-07-13 09:47 - 2011-09-07 14:55 - 00000000 ____D C:\Program Files\Microsoft Silverlight

2013-07-13 09:47 - 2006-11-02 14:37 - 00000000 ____D C:\Windows\system32\XPSViewer

2013-07-12 12:55 - 2006-11-02 12:24 - 75699896 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe

2013-07-12 12:47 - 2006-11-02 14:37 - 00000000 ____D C:\Program Files\Windows Journal
 

Files to move or delete:

====================

C:\ProgramData\nvModes.dat
 

==================== Bamital & volsnap Check =================
 

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-08-11 10:04
 

==================== End Of Log ============================

--- --- ---

--- --- ---

ADDITION:

Code:

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 09-08-2013

Ran by Andrea at 2013-08-11 10:04:52

Running from C:\Users\Andrea\Desktop

Boot Mode: Normal

==========================================================
 
 

==================== Installed Programs =======================
 

5.1 Surround Headset

Activation Assistant for the 2007 Microsoft Office suites

Activation Assistant for the 2007 Microsoft Office suites (Version: 1.0)

Adobe Download Manager (Version: 1.6.2.63)

Adobe Flash Player 11 ActiveX (Version: 11.8.800.94)

Adobe Reader 8.3.1 (Version: 8.3.1)

Adobe Shockwave Player (Version: 11)

avast! Free Antivirus (Version: 8.0.1489.0)

Curse Client (HKCU Version: 5.1.1.792)

D3DX10 (Version: 15.4.2368.0902)

Dropbox (HKCU Version: 2.0.22)

DVD Suite (Version: 5.0.1906)

Epson Easy Photo Print 2 (Version: 2.0.0.0)

Epson Event Manager (Version: 2.01.00)

Epson Print CD (Version: 2.00.00)

EPSON PX800FW Series Printer Uninstall

EPSON Scan

EPSON Stylus Photo PX700W_PX800FW_TX700W_TX800FW Manual

Free Driver Scout (Version: 1.0.0.101)

Google Chrome (Version: 28.0.1500.95)

Google Update Helper (Version: 1.3.21.153)

J2SE Runtime Environment 5.0 Update 10 (Version: 1.5.0.100)

LightScribe System Software  1.12.29.2 (Version: 1.12.29.2)

MediaShow (Version: 3.0.4325)

Mesh Runtime (Version: 15.4.5722.2)

Microsoft .NET Framework 1.1 (Version: 1.1.4322)

Microsoft .NET Framework 1.1 Security Update (KB2698023)

Microsoft .NET Framework 1.1 Security Update (KB2833941)

Microsoft .NET Framework 1.1 Security Update (KB979906)

Microsoft .NET Framework 3.5 SP1

Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729)

Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)

Microsoft .NET Framework 4 Extended (Version: 4.0.30319)

Microsoft Application Error Reporting (Version: 12.0.6012.5000)

Microsoft Office XP Professional mit FrontPage (Version: 10.0.6626.0)

Microsoft Silverlight (Version: 5.1.20513.0)

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (Version: 8.0.50727.4053)

Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)

Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (Version: 9.0.30729.4148)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)

Microsoft Works (Version: 08.05.0818)

MSVCRT (Version: 15.4.2862.0708)

MSXML 4.0 SP2 (KB936181) (Version: 4.20.9848.0)

MSXML 4.0 SP2 (KB941833) (Version: 4.20.9849.0)

MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)

MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)

NVIDIA 3D Vision Controller Driver 320.18 (Version: 320.18)

NVIDIA Control Panel 320.18 (Version: 320.18)

NVIDIA Drivers (Version: 1.10.57.35)

NVIDIA ForceWare Network Access Manager (Version: 1.00.7325.0)

NVIDIA GeForce Experience 1.5 (Version: 1.5)

NVIDIA Graphics Driver 320.18 (Version: 320.18)

NVIDIA Install Application (Version: 2.1002.124.810)

NVIDIA PhysX (Version: 9.12.1031)

NVIDIA PhysX System Software 9.12.1031 (Version: 9.12.1031)

NVIDIA Update 4.11.9 (Version: 4.11.9)

NVIDIA Update Components (Version: 4.11.9)

OGA Notifier 2.0.0048.0 (Version: 2.0.0048.0)

PC207 AIT DEMO DRIVER (Version: 1.0.414)

Power2Go 5.0

PowerBackup (Version: 2.5.2903)

PowerDirector Express

PowerDVD (Version: 7.0.3118.0)

PowerDVD Copy (Version: 1.0.3716a)

PowerProducer

QuickTime (Version: 7.50.61.0)

Realtek High Definition Audio Driver (Version: 6.0.1.6954)

Realtek USB 2.0 Card Reader (Version: 6.2.8400.30143)

Segoe UI (Version: 15.4.2271.0615)

TeamSpeak 3 Client (Version: 3.0.10.1)

Update for Microsoft .NET Framework 3.5 SP1 (KB2836940) (Version: 1)

Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (Version: 1)

Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)

Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)

Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (Version: 1)

Update for Microsoft .NET Framework 4 Extended (KB2468871) (Version: 1)

Update for Microsoft .NET Framework 4 Extended (KB2533523) (Version: 1)

Update for Microsoft .NET Framework 4 Extended (KB2600217) (Version: 1)

Update for Microsoft .NET Framework 4 Extended (KB2836939) (Version: 1)

Windows Live Communications Platform (Version: 15.4.3502.0922)

Windows Live Essentials (Version: 15.4.3502.0922)

Windows Live Essentials (Version: 15.4.3555.0308)

Windows Live ID Sign-in Assistant (Version: 7.250.4232.0)

Windows Live Installer (Version: 15.4.3502.0922)

Windows Live Mesh (Version: 15.4.3502.0922)

Windows Live Mesh ActiveX Control for Remote Connections (Version: 15.4.5722.2)

Windows Live PIMT Platform (Version: 15.4.3508.1109)

Windows Live Remote Client (Version: 15.4.5722.2)

Windows Live Remote Client Resources (Version: 15.4.5722.2)

Windows Live Remote Service (Version: 15.4.5722.2)

Windows Live Remote Service Resources (Version: 15.4.5722.2)

Windows Live SOXE (Version: 15.4.3502.0922)

Windows Live SOXE Definitions (Version: 15.4.3502.0922)

Windows Live UX Platform (Version: 15.4.3502.0922)

Windows Live UX Platform Language Pack (Version: 15.4.3508.1109)

World of Warcraft (Version: 5.3.0.17128)

 
 

==================== Restore Points  =========================
 

29-05-2013 19:23:00 Scheduled Checkpoint

31-05-2013 17:54:40 Windows Update

01-06-2013 21:12:45 Scheduled Checkpoint

04-06-2013 15:20:24 Windows Update

08-06-2013 09:34:58 Windows Update

12-06-2013 13:20:50 Windows Update

16-06-2013 12:31:21 Windows Update

22-06-2013 06:27:36 Windows Update

22-06-2013 07:11:28 Device Driver Package Install: NVIDIA Display adapters

22-06-2013 07:16:37 Device Driver Package Install: NVIDIA Universal Serial Bus controllers

22-06-2013 08:27:57 Windows Update

23-06-2013 14:40:52 Windows Update

26-06-2013 15:18:05 Free Driver Scout

26-06-2013 16:31:59 Windows Update

26-06-2013 16:43:45 Windows Update

30-06-2013 16:44:39 Windows Update

05-07-2013 14:49:08 Windows Update

12-07-2013 10:39:21 Windows Update

12-07-2013 10:46:49 Windows Update

16-07-2013 15:37:02 Windows Update

20-07-2013 10:03:51 Scheduled Checkpoint

26-07-2013 17:17:39 Windows Update

30-07-2013 14:54:31 Windows Update

31-07-2013 10:07:08 Scheduled Checkpoint

03-08-2013 09:36:54 Windows Update

06-08-2013 17:17:28 Windows Update

10-08-2013 05:07:50 Windows Update

10-08-2013 17:32:01 DriverUtilities

10-08-2013 17:38:39 Device Driver Package Install: Realtek Semiconductor Corp. Sound, video and game controllers

10-08-2013 17:41:11 Device Driver Package Install: Logicool Keyboards

10-08-2013 17:41:49 Device Driver Package Install: Logicool Mice and other pointing devices

10-08-2013 17:44:13 Device Driver Package Install: NVIDIA System devices

10-08-2013 17:44:41 Device Driver Package Install: NVIDIA Network adapters

10-08-2013 17:47:03 Device Driver Package Install: NVIDIA Corporation IDE ATA/ATAPI controllers

10-08-2013 17:50:59 Installed Realtek USB 2.0 Card Reader

10-08-2013 17:51:12 Device Driver Package Install: Realtek Universal Serial Bus controllers

10-08-2013 18:00:55 Installed NVIDIA ForceWare Network Access Manager
 

==================== Hosts content: ==========================
 

2006-11-02 12:23 - 2006-09-18 23:41 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts

127.0.0.1       localhost

::1             localhost
 

==================== Scheduled Tasks (whitelisted) =============
 

Task: {1B2A84EC-2EE9-4182-93E9-61B77B0264E4} - System32\Tasks\avast! Emergency Update => C:\Program Files\Alwil Software\Avast5\AvastEmUpdate.exe [2013-05-09] (AVAST Software)

Task: {1CC81347-6204-4B83-900C-01E02F50F067} - System32\Tasks\Microsoft\Windows\MobilePC\TMM

Task: {244BC537-1321-4875-96BA-C05915ACAA96} - System32\Tasks\FreeDriverScout => C:\Program Files\Covus Freemium\Free Driver Scout\1Click.exe [2013-05-21] ()

Task: {320124A7-D70F-41DE-A9D1-D5E8E19D5D91} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI

Task: {3BCDF251-CA5C-4045-A1FC-8FCEF9FBDC93} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages

Task: {44980BEE-7809-44A9-AC24-D6E578A3B7DF} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-21] (Microsoft Corporation)

Task: {4684823B-49EB-4606-8C59-79EB5D22E767} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => c:\program files\windows defender\MpCmdRun.exe [2008-01-21] (Microsoft Corporation)

Task: {48E537CA-5457-433F-AE02-CEEF01A3A028} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task

Task: {5158ACB4-1254-4F11-ACD0-EB5C75280D51} - System32\Tasks\Microsoft\Windows\Defrag\ManualDefrag => C:\Windows\system32\defrag.exe [2008-01-21] (Microsoft Corp.)

Task: {5E135264-DED3-44E9-931F-D3C5116C3F98} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2012-01-01] (Google Inc.)

Task: {63EBA035-F00D-4BD2-B9C3-0E40FEDEEEA5} - System32\Tasks\User_Feed_Synchronization-{06BA5FA8-D023-4654-883D-2B1079C0EAF4} => C:\Windows\system32\msfeedssync.exe [2011-09-07] (Microsoft Corporation)

Task: {69FE4590-EDDC-4098-A933-1E0D288FEBA5} - System32\Tasks\Microsoft\Windows\WindowsCalendar\Reminders - Andrea => C:\Program Files\Windows Calendar\WinCal.exe [2009-04-11] (Microsoft Corporation)

Task: {80A3A9D0-5577-4A0D-9A08-C4D4FBCF276A} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2012-01-01] (Google Inc.)

Task: {9515DBD6-A30E-497F-8712-31662FF1515E} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Signature Update => c:\program files\windows defender\MpCmdRun.exe [2008-01-21] (Microsoft Corporation)

Task: {A2170BA1-F3AC-40F8-ABF2-1B4E4A2907C1} - System32\Tasks\User_Feed_Synchronization-{AB4436E2-0F6F-41C1-9B8F-BF0D32D6D779} => C:\Windows\system32\msfeedssync.exe [2011-09-07] (Microsoft Corporation)

Task: {A4DDE2EA-0532-4C18-A484-2A8ED4DA6BDD} - System32\Tasks\Software Updater => C:\Program Files\SoftwareUpdater\SoftwareUpdater.Bootstrapper.exe [2013-07-12] ()

Task: {A61555D3-7840-45C1-A5A9-0D49851DE37A} - System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\OptinNotification => C:\Windows\System32\wsqmcons.exe [2008-01-21] (Microsoft Corporation)

Task: {BAA03FB2-AA57-453F-B2D0-4A820B1B448F} - System32\Tasks\{24D23949-2DFB-422A-965E-094B36F368CF} => C:\Program Files\Skype\Phone\Skype.exe No File

Task: {E0EE6C68-10E2-44CE-BE32-07346108C713} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\schtasks.exe [2008-01-21] (Microsoft Corporation)

Task: {E5150B95-F9B4-4D5D-95A2-7EC1ACBA95F8} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-21] ()

Task: {EC35CEAB-A601-41DE-82E7-4ED0C27236FA} - System32\Tasks\Software Updater Ui => C:\Program Files\SoftwareUpdater\SoftwareUpdater.Ui.exe [2013-07-13] ()

Task: {EE4B0C41-24EE-458E-AFE2-5C38282F5542} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-07-29] (Adobe Systems Incorporated)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
 

==================== Faulty Device Manager Devices =============
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (08/11/2013 09:59:17 AM) (Source: WinMgmt) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (08/11/2013 09:59:15 AM) (Source: Perflib) (User: )

Description: WmiApRplC:\Windows\system32\wbem\wmiaprpl.dll4
 

Error: (08/11/2013 09:59:13 AM) (Source: Perflib) (User: )

Description: PolicyAgent
 

Error: (08/11/2013 09:59:13 AM) (Source: Perflib) (User: )

Description: OpenIPSecPerformanceDataC:\Windows\System32\ipsecsvc.dllPolicyAgent4
 

Error: (08/11/2013 09:59:13 AM) (Source: Perflib) (User: )

Description: PNRPsvcC:\Windows\system32\pnrpperf.dll4
 

Error: (08/11/2013 09:59:10 AM) (Source: Perflib) (User: )

Description: MSDTCC:\Windows\system32\msdtcuiu.DLL4
 

Error: (08/11/2013 09:59:05 AM) (Source: Perflib) (User: )

Description: LsaC:\Windows\system32\Secur32.dll4
 

Error: (08/11/2013 09:59:05 AM) (Source: Perflib) (User: )

Description: ESENTC:\Windows\system32\esentprf.dll4
 

Error: (08/11/2013 09:59:03 AM) (Source: Perflib) (User: )

Description: EmdCacheC:\Windows\system32\emdmgmt.dll4
 

Error: (08/11/2013 09:59:03 AM) (Source: Perflib) (User: )

Description: BITSC:\Windows\system32\bitsperf.dll4
 
 

System errors:

=============

Error: (08/10/2013 08:01:29 PM) (Source: Service Control Manager) (User: )

Description: ForceWare Intelligent Application Manager (IAM)
 

Error: (08/10/2013 08:01:23 PM) (Source: Service Control Manager) (User: )

Description: ForceWare IP service
 

Error: (08/08/2013 02:30:22 PM) (Source: Service Control Manager) (User: )

Description: System Store%%1053
 

Error: (08/08/2013 02:30:22 PM) (Source: Service Control Manager) (User: )

Description: 30000System Store
 

Error: (08/03/2013 06:48:49 PM) (Source: Service Control Manager) (User: )

Description: System Store%%1053
 

Error: (08/03/2013 06:48:49 PM) (Source: Service Control Manager) (User: )

Description: 30000System Store
 

Error: (08/02/2013 11:36:05 AM) (Source: Service Control Manager) (User: )

Description: Windows Update
 

Error: (07/14/2013 05:48:59 PM) (Source: Print) (User: NT AUTHORITY)

Description: The print spooler failed to share printer EPSON PX800FW Series with shared resource name EPSON PX800FW Series. Error 2114. The printer cannot be used by others on the network.
 

Error: (07/02/2013 07:59:53 PM) (Source: Service Control Manager) (User: )

Description: System Store%%1053
 

Error: (07/02/2013 07:59:53 PM) (Source: Service Control Manager) (User: )

Description: 30000System Store
 
 

Microsoft Office Sessions:

=========================

Error: (08/11/2013 09:59:17 AM) (Source: WinMgmt)(User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (08/11/2013 09:59:15 AM) (Source: Perflib)(User: )

Description: WmiApRplC:\Windows\system32\wbem\wmiaprpl.dll4
 

Error: (08/11/2013 09:59:13 AM) (Source: Perflib)(User: )

Description: PolicyAgent
 

Error: (08/11/2013 09:59:13 AM) (Source: Perflib)(User: )

Description: OpenIPSecPerformanceDataC:\Windows\System32\ipsecsvc.dllPolicyAgent4
 

Error: (08/11/2013 09:59:13 AM) (Source: Perflib)(User: )

Description: PNRPsvcC:\Windows\system32\pnrpperf.dll4
 

Error: (08/11/2013 09:59:10 AM) (Source: Perflib)(User: )

Description: MSDTCC:\Windows\system32\msdtcuiu.DLL4
 

Error: (08/11/2013 09:59:05 AM) (Source: Perflib)(User: )

Description: LsaC:\Windows\system32\Secur32.dll4
 

Error: (08/11/2013 09:59:05 AM) (Source: Perflib)(User: )

Description: ESENTC:\Windows\system32\esentprf.dll4
 

Error: (08/11/2013 09:59:03 AM) (Source: Perflib)(User: )

Description: EmdCacheC:\Windows\system32\emdmgmt.dll4
 

Error: (08/11/2013 09:59:03 AM) (Source: Perflib)(User: )

Description: BITSC:\Windows\system32\bitsperf.dll4
 
 

CodeIntegrity Errors:

===================================

  Date: 2011-04-19 22:18:16.322

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\aswSP.sys because the set of per-page image hashes could not be found on the system.
 

  Date: 2011-04-19 22:18:16.230

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\aswSP.sys because the set of per-page image hashes could not be found on the system.
 

  Date: 2011-04-19 22:18:16.086

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\aswSP.sys because the set of per-page image hashes could not be found on the system.
 

  Date: 2011-04-19 22:18:15.957

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\aswSP.sys because the set of per-page image hashes could not be found on the system.
 

  Date: 2010-09-14 17:43:02.286

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys because the set of per-page image hashes could not be found on the system.
 

  Date: 2010-09-14 17:43:02.239

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys because the set of per-page image hashes could not be found on the system.
 

  Date: 2010-09-14 17:43:02.192

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys because the set of per-page image hashes could not be found on the system.
 

  Date: 2010-09-14 17:43:02.130

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys because the set of per-page image hashes could not be found on the system.
 

  Date: 2010-09-14 17:43:02.036

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys because the set of per-page image hashes could not be found on the system.
 

  Date: 2010-05-05 16:59:43.093

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys because the set of per-page image hashes could not be found on the system.
 
 

==================== Memory info =========================== 
 

Percentage of memory in use: 59%

Total physical RAM: 2045.82 MB

Available physical RAM: 822.86 MB

Total Pagefile: 4334.59 MB

Available Pagefile: 2799.77 MB

Total Virtual: 2047.88 MB

Available Virtual: 1924.66 MB
 

==================== Drives ================================
 

Drive c: (WINVISTA) (Fixed) (Total:459.26 GB) (Free:201.32 GB) NTFS ==>[Drive with boot components (obtained from BCD)]

Drive d: (EPSON) (CDROM) (Total:0.28 GB) (Free:0 GB) CDFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 466 GB) (Disk ID: 94279419)

Partition 1: (Not Active) - (Size=7 GB) - (Type=27)

Partition 2: (Active) - (Size=459 GB) - (Type=07 NTFS)
 

==================== End Of Log ============================

Besten Dank und einen sonnigen Sonntag :daumenhoc
lg, Plekdemon

Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel

Link 1

WICHTIG - Speichere Combofix auf deinem Desktop

Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

Hallo Schrauber,

Bitteschön, hier das Combofix Log:

Code:

ComboFix 13-08-12.01 - Andrea 12/08/2013  17:14:19.1.2 - x86

Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.44.1033.18.2046.1117 [GMT 2:00]

Running from: c:\users\Andrea\Desktop\ComboFix.exe

AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}

SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

(((((((((((((((((((((((((   Files Created from 2013-07-12 to 2013-08-12  )))))))))))))))))))))))))))))))

.

.

2013-08-11 08:03 . 2013-08-11 08:03        --------        d-----w-        C:\FRST

2013-08-10 17:53 . 2013-08-10 17:53        --------        d-----w-        c:\windows\system32\sda

2013-08-10 17:50 . 2012-08-29 15:47        190976        ----a-w-        c:\windows\system32\drivers\RtsUStor.sys

2013-08-10 17:50 . 2011-11-10 14:54        9881600        ----a-w-        c:\windows\system32\RtsUStoricon.dll

2013-08-10 17:50 . 2010-10-29 14:11        313960        ----a-w-        c:\windows\system32\RtsUStor.dll

2013-08-10 17:50 . 2013-08-10 17:50        --------        d-----w-        c:\users\Andrea\{65241908-f7ce-4c91-8809-534ef6fe3c87}

2013-08-10 17:44 . 2010-03-04 16:04        758784        ----a-w-        c:\windows\system32\cohelper.dll

2013-08-10 17:41 . 2008-02-29 09:12        37008        ----a-w-        c:\windows\system32\drivers\LMouFilt.Sys

2013-08-10 17:41 . 2008-02-29 09:12        76304        ----a-w-        c:\windows\KHALMNPR.Exe

2013-08-10 17:41 . 2008-02-29 10:00        1419232        ----a-w-        c:\windows\system32\WdfCoInstaller01005.dll

2013-08-10 17:41 . 2008-02-29 09:12        35472        ----a-w-        c:\windows\system32\drivers\LHidFilt.Sys

2013-08-10 17:37 . 2013-08-10 17:40        --------        d--h--w-        c:\program files\Temp

2013-08-10 17:37 . 2013-06-10 13:44        2080472        ----a-w-        c:\windows\RtlExUpd.dll

2013-08-10 17:32 . 2013-08-10 17:54        --------        d-----w-        C:\temp

2013-08-10 05:09 . 2013-07-02 06:54        7143960        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{9ADCDD4C-1BA2-4CBB-BC90-3301E0FA5A60}\mpengine.dll

2013-07-29 15:13 . 2013-07-29 15:13        692104        ----a-w-        c:\windows\system32\FlashPlayerApp.exe

2013-07-29 11:09 . 2013-07-29 11:10        175176        ----a-w-        c:\windows\system32\drivers\aswVmm.sys

2013-07-29 11:09 . 2013-05-09 08:59        49376        ----a-w-        c:\windows\system32\drivers\aswRvrt.sys

.

.

.

((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-07-29 15:13 . 2011-08-14 21:39        71048        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl

2013-07-29 11:10 . 2011-11-15 16:20        770344        ----a-w-        c:\windows\system32\drivers\aswSnx.sys

2013-07-29 11:10 . 2010-09-14 09:00        369584        ----a-w-        c:\windows\system32\drivers\aswSP.sys

2013-06-26 18:12 . 2011-03-28 16:36        22240        ----a-w-        c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll

2013-06-18 13:40 . 2008-03-15 07:27        3289816        ----a-w-        c:\windows\system32\RtkAPO.dll

2013-06-04 01:50 . 2013-07-12 10:41        2049024        ----a-w-        c:\windows\system32\win32k.sys

2013-06-01 04:06 . 2013-07-12 10:41        505344        ----a-w-        c:\windows\system32\qedit.dll

2013-05-29 01:50 . 2013-07-12 10:54        1800704        ----a-w-        c:\windows\system32\jscript9.dll

2013-05-29 01:41 . 2013-07-12 10:54        1427968        ----a-w-        c:\windows\system32\inetcpl.cpl

2013-05-29 01:41 . 2013-07-12 10:54        1129472        ----a-w-        c:\windows\system32\wininet.dll

2013-05-29 01:37 . 2013-07-12 10:54        142848        ----a-w-        c:\windows\system32\ieUnatt.exe

2013-05-29 01:36 . 2013-07-12 10:54        420864        ----a-w-        c:\windows\system32\vbscript.dll

2013-05-29 01:33 . 2013-07-12 10:54        2382848        ----a-w-        c:\windows\system32\mshtml.tlb

2007-03-12 16:59 . 2007-03-12 16:59        299008        ----a-w-        c:\program files\navigram_register.exe

.

.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]

@="{472083B0-C522-11CF-8763-00608CC02F24}"

[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]

2013-05-09 08:58        121968        ----a-w-        c:\program files\Alwil Software\Avast5\ashShell.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2013-05-25 00:36        130736        ----a-w-        c:\users\Andrea\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2013-05-25 00:36        130736        ----a-w-        c:\users\Andrea\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2013-05-25 00:36        130736        ----a-w-        c:\users\Andrea\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]

"WindowsWelcomeCenter"="oobefldr.dll" [2009-04-11 2153472]

"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-01-24 2289664]

"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2007-03-14 71216]

"LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2007-01-08 52256]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2013-06-25 11992792]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-05-27 413696]

"PAC207_Monitor"="c:\windows\PixArt\PAC207\Monitor.exe" [2006-11-03 319488]

"Skytel"="Skytel.exe" [2007-11-20 1826816]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2011-08-31 40368]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-29 937920]

"EEventManager"="c:\progra~1\EPSONS~1\EVENTM~1\EEventManager.exe" [2008-05-07 591696]

"avast"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2013-05-09 4858968]

"Nvtmru"="c:\program files\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe" [2013-05-16 1012000]

"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-02-29 76304]

.

c:\users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

CurseClientStartup.ccip [2013-5-18 0]

Dropbox.lnk - c:\users\Andrea\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2013-5-25 27776968]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE -b -l [2001-2-13 83360]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]

@="Service"

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

getPlusHelper        REG_MULTI_SZ           getPlusHelper

LocalServiceAndNoImpersonation        REG_MULTI_SZ           FontCache

.

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]

2008-01-24 12:30        451872        ----a-w-        c:\program files\Common Files\LightScribe\LSRunOnce.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]

2013-08-02 06:09        1173456        ----a-w-        c:\program files\Google\Chrome\Application\28.0.1500.95\Installer\chrmstp.exe

.

Contents of the 'Scheduled Tasks' folder

.

2013-08-11 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-07-29 15:13]

.

2013-08-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2012-01-01 12:10]

.

2013-08-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2012-01-01 12:10]

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.at/

uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%s

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000

LSP: c:\program files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll

TCP: DhcpNameServer = 192.168.2.1 192.168.2.1

.

- - - - ORPHANS REMOVED - - - -

.

HKCU-Run-BullGuard - c:\program files\BullGuard Ltd\BullGuard\BullGuard.exe

HKCU-Run-Skype - c:\program files\Skype\Phone\Skype.exe

HKLM-Run-Cm106Sound - cm106.cpl

SafeBoot-WudfPf

SafeBoot-WudfRd

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net

Rootkit scan 2013-08-12 17:21

Windows 6.0.6002 Service Pack 2 NTFS

.

scanning hidden processes ...  

.

scanning hidden autostart entries ... 

.

scanning hidden files ...  

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ChromeHTML"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ChromeHTML"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ChromeHTML"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ChromeHTML"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ChromeHTML"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_8_800_94_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_8_800_94_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'Explorer.exe'(6592)

c:\users\Andrea\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll

.

Completion time: 2013-08-12  17:23:29

ComboFix-quarantined-files.txt  2013-08-12 15:23

.

Pre-Run: 218,556,219,392 bytes free

Post-Run: 218,040,926,208 bytes free

.

- - End Of File - - 7F662793CC9AA829149AF13D316A71C7

5C616939100B85E558DA92B899A0FC36

Vielen Dank und einen schönen Montag noch,
lg Plekdemon:daumenhoc

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

Guten Abend Schrauber,

hier die Logs in angeforderter Reihenfolge:

Code:

Malwarebytes Anti-Malware (Trial) 1.75.0.1300

www.malwarebytes.org
 

Database version: v2013.08.13.03
 

Windows Vista Service Pack 2 x86 NTFS

Internet Explorer 9.0.8112.16421

Andrea :: ANDREA-PC [administrator]
 

Protection: Enabled
 

13/08/2013 17:51:27

mbam-log-2013-08-13 (17-51-27).txt
 

Scan type: Quick scan

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

Scan options disabled: P2P

Objects scanned: 297249

Time elapsed: 6 minute(s), 10 second(s)
 

Memory Processes Detected: 0

(No malicious items detected)
 

Memory Modules Detected: 0

(No malicious items detected)
 

Registry Keys Detected: 0

(No malicious items detected)
 

Registry Values Detected: 0

(No malicious items detected)
 

Registry Data Items Detected: 0

(No malicious items detected)
 

Folders Detected: 0

(No malicious items detected)
 

Files Detected: 0

(No malicious items detected)
 

(end)

Code:

# AdwCleaner v2.306 - Logfile created 08/13/2013 at 20:13:10

# Updated 19/07/2013 by Xplode

# Operating system : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)

# User : Andrea - ANDREA-PC

# Boot Mode : Normal

# Running from : C:\Users\Andrea\Desktop\adwcleaner.exe

# Option [Delete]
 
 

***** [Services] *****
 

Stopped & Deleted : SystemStoreService
 

***** [Files / Folders] *****
 

Folder Deleted : C:\Program Files\Covus Freemium

Folder Deleted : C:\Program Files\SoftwareUpdater

Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Covus Freemium

Folder Deleted : C:\Users\Andrea\AppData\Local\DownloadGuide
 

***** [Registry] *****
 

Key Deleted : HKLM\SOFTWARE\Software
 

***** [Internet Browsers] *****
 

-\\ Internet Explorer v9.0.8112.16496
 

[OK] Registry is clean.
 

-\\ Google Chrome v28.0.1500.95
 

File : C:\Users\Andrea\AppData\Local\Google\Chrome\User Data\Default\Preferences
 

[OK] File is clean.
 

*************************
 

AdwCleaner[S1].txt - [996 octets] - [13/08/2013 20:13:10]
 

########## EOF - C:\AdwCleaner[S1].txt - [1055 octets] ##########

Code:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 5.4.4 (08.12.2013:1)

OS: Windows Vista (TM) Home Premium x86

Ran by Andrea on 13/08/2013 at 20:33:12.69

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 

~~~ Services
 
 
 

~~~ Registry Values
 
 
 

~~~ Registry Keys
 
 
 

~~~ Files
 
 
 

~~~ Folders
 
 
 

~~~ Event Viewer Logs were cleared
 
 
 
 
 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 13/08/2013 at 20:35:17.05

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 09-08-2013

Ran by Andrea (administrator) on 13-08-2013 20:46:58

Running from C:\Users\Andrea\Desktop

Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: English(US)

Internet Explorer Version 9

Boot Mode: Normal
 

==================== Processes (Whitelisted) ===================
 

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe

(Microsoft Corporation) C:\Windows\system32\SLsvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe

(AVAST Software) C:\Program Files\Alwil Software\Avast5\AvastSvc.exe

(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40ST7.EXE

(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE

(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe

(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe

() C:\Program Files\CyberLink\Shared Files\RichVideo.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe

() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe

(Cyberlink Corp.) C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe

(PixArt Imaging Incorporation) C:\Windows\PixArt\PAC207\Monitor.exe

(SEIKO EPSON CORPORATION) C:\Program Files\Epson Software\Event Manager\EEventManager.exe

(AVAST Software) C:\Program Files\Alwil Software\Avast5\AvastUI.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe

(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe

(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe

(Microsoft Corporation) C:\Windows\ehome\ehtray.exe

(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe

(Dropbox, Inc.) C:\Users\Andrea\AppData\Roaming\Dropbox\bin\Dropbox.exe

(Realsil Microelectronics Inc.) C:\Program Files\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe

(Microsoft Corporation) C:\Windows\system32\conime.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RemoteControl] - C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [71216 2007-03-14] (Cyberlink Corp.)

HKLM\...\Run: [LanguageShortcut] - C:\Program Files\CyberLink\PowerDVD\Language\Language.exe [52256 2007-01-09] ()

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [11992792 2013-06-25] (Realtek Semiconductor)

HKLM\...\Run: [QuickTime Task] - C:\Program Files\QuickTime\QTTask.exe [413696 2008-05-27] (Apple Inc.)

HKLM\...\Run: [PAC207_Monitor] - C:\Windows\PixArt\PAC207\Monitor.exe [319488 2006-11-03] (PixArt Imaging Incorporation)

HKLM\...\Run: [Skytel] - C:\Windows\Skytel.exe [1826816 2007-11-20] (Realtek Semiconductor Corp.)

HKLM\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [40368 2011-08-31] (Adobe Systems Incorporated)

HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [937920 2011-03-29] (Adobe Systems Incorporated)

HKLM\...\Run: [EEventManager] - C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe [591696 2008-05-07] (SEIKO EPSON CORPORATION)

HKLM\...\Run: [avast] - C:\Program Files\Alwil Software\Avast5\avastUI.exe [4858968 2013-05-09] (AVAST Software)

HKLM\...\Run: [Nvtmru] - C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1012000 2013-05-16] (NVIDIA Corporation)

HKLM\...\Run: [Kernel and Hardware Abstraction Layer] - C:\Windows\KHALMNPR.EXE [76304 2008-02-29] (Logicool, Inc.)

HKCU\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [2153472 2009-04-11] (Microsoft Corporation)

HKCU\...\Run: [LightScribe Control Panel] - C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [2289664 2008-01-24] (Hewlett-Packard Company)

HKCU\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [125952 2008-01-21] (Microsoft Corporation)

HKU\Administrator\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [ 2009-04-11] (Microsoft Corporation)

HKU\Administrator\...\Run: [Power2GoExpress] - C:\Program Files\CyberLink\Power2Go\Power2GoExpress.exe [ 2007-07-12] (Cyberlink)

HKU\Administrator\...\Run: [BullGuard] - "C:\Program Files\BullGuard Ltd\BullGuard\bullguard.exe" [x]

HKU\Administrator\...\Run: [LightScribe Control Panel] - C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [ 2008-01-24] (Hewlett-Packard Company)

HKU\Administrator\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [ 2008-01-21] (Microsoft Corporation)

HKU\Administrator\...\Run: [Skype] - "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized [x]

HKU\Administrator\...\Run: [EPSON PX800FW Series] - C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIEME.EXE /FU "C:\Windows\TEMP\E_S14A9.tmp" /EF "HKCU" [x]

HKU\Default\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [ 2009-04-11] (Microsoft Corporation)

HKU\Default User\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [ 2009-04-11] (Microsoft Corporation)

HKU\Guest\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [ 2009-04-11] (Microsoft Corporation)

HKU\Guest\...\Run: [LightScribe Control Panel] - C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [ 2008-01-24] (Hewlett-Packard Company)

HKU\Guest\...\Run: [BullGuard] - "C:\Program Files\BullGuard Ltd\BullGuard\BullGuard.exe" [x]

HKU\Guest\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [ 2008-01-21] (Microsoft Corporation)

HKU\Guest\...\Run: [Skype] - "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized [x]

HKU\Guest\...\Run: [EPSON PX800FW Series] - C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIEME.EXE /FU "C:\Windows\TEMP\E_S14A9.tmp" /EF "HKCU" [x]

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk

ShortcutTarget: Microsoft Office.lnk -> C:\Program Files\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)

Startup: C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip ()

Startup: C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk -> C:\Users\Andrea\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.at/

SearchScopes: HKLM - DefaultScope value is missing.

SearchScopes: HKCU - {DECA3892-BA8F-44b8-A993-A466AD694AE4} URL = hxxp://search.yahoo.com/search?fr=mcafee&p={searchTerms}

BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)

BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll (Sun Microsystems, Inc.)

BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)

BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)

Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)

Toolbar: HKLM - avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)

Toolbar: HKCU -No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File

DPF: {6E718D87-6909-4FCE-92D4-EDCB2F725727} hxxp://www.navigram.com/engine/v1026/Navigram.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab

DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab

DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)

Handler: msdaipp - No CLSID Value - 

Winsock: Catalog9 01 C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll [258664] (NVIDIA)

Winsock: Catalog9 02 C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll [258664] (NVIDIA)

Winsock: Catalog9 03 C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll [258664] (NVIDIA)

Winsock: Catalog9 04 C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll [258664] (NVIDIA)

Winsock: Catalog9 05 C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll [258664] (NVIDIA)

Winsock: Catalog9 06 C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll [258664] (NVIDIA)

Winsock: Catalog9 25 C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll [258664] (NVIDIA)

Winsock: Catalog9 26 C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll [258664] (NVIDIA)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 192.168.2.1
 

Chrome: 

=======

CHR HomePage: hxxp://www.google.com/

CHR RestoreOnStartup: "hxxp://www.google.com/"

CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}

CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}sugkey={google:suggestAPIKeyParameter}

CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\28.0.1500.95\PepperFlash\pepflashplayer.dll ()

CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\28.0.1500.95\ppGoogleNaClPluginChrome.dll ()

CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\28.0.1500.95\pdf.dll ()

CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)

CHR Plugin: (QuickTime Plug-in 7.5 (861)) - C:\Program Files\QuickTime\plugins\npqtplugin.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.5 (861)) - C:\Program Files\QuickTime\plugins\npqtplugin2.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.5 (861)) - C:\Program Files\QuickTime\plugins\npqtplugin3.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.5 (861)) - C:\Program Files\QuickTime\plugins\npqtplugin4.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.5 (861)) - C:\Program Files\QuickTime\plugins\npqtplugin5.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.5 (861)) - C:\Program Files\QuickTime\plugins\npqtplugin6.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.5 (861)) - C:\Program Files\QuickTime\plugins\npqtplugin7.dll (Apple Inc.)

CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File

CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll No File

CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll No File

CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)

CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File

CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

CHR Extension: (YouTube) - C:\Users\Andrea\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0

CHR Extension: (Google Search) - C:\Users\Andrea\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0

CHR Extension: (avast! Online Security) - C:\Users\Andrea\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki\8.0.8_0

CHR Extension: (Gmail) - C:\Users\Andrea\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1

CHR StartMenuInternet: Google Chrome - C:\Program Files\Google\Chrome\Application\chrome.exe
 

========================== Services (Whitelisted) =================
 

R2 avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [46808 2013-05-09] (AVAST Software)

R2 EPSON_EB_RPCV4_01; C:\ProgramData\EPSON\EPW!3 SSRP\E_S40ST7.EXE [143872 2007-12-17] (SEIKO EPSON CORPORATION)

R2 EPSON_PM_RPCV4_01; C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE [113664 2007-01-11] (SEIKO EPSON CORPORATION)

R2 ForceWare Intelligent Application Manager (IAM); C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe [370792 2010-01-21] ()

S3 getPlusHelper; C:\Program Files\NOS\bin\getPlus_Helper.dll [68000 2010-03-22] (NOS Microsystems Ltd.)

R2 IconMan_R; C:\Program Files\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe [1828496 2012-09-07] (Realsil Microelectronics Inc.)

R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)

R2 nSvcIp; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe [167528 2010-01-21] ()

R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [272024 2006-12-19] ()
 

==================== Drivers (Whitelisted) ====================
 

R2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [29816 2013-05-09] (AVAST Software)

R1 aswKbd; C:\Windows\System32\Drivers\aswKbd.sys [20624 2012-10-31] (AVAST Software)

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [66336 2013-05-09] (AVAST Software)

R1 aswRdr; C:\Windows\System32\Drivers\aswRdr.sys [49760 2013-05-09] (AVAST Software)

R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [49376 2013-05-09] ()

R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [770344 2013-07-29] (AVAST Software)

R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [369584 2013-07-29] (AVAST Software)

R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [56080 2013-05-09] (AVAST Software)

R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [175176 2013-07-29] ()

R0 JGOGO; C:\Windows\System32\DRIVERS\JGOGO.sys [6912 2006-02-08] (JMicron )

R0 JRAID; C:\Windows\System32\DRIVERS\jraid.sys [44416 2006-12-07] (JMicron Technology Corp.)

R3 LHidFilt; C:\Windows\System32\DRIVERS\LHidFilt.Sys [35472 2008-02-29] (Logicool, Inc.)

R3 LMouFilt; C:\Windows\System32\DRIVERS\LMouFilt.Sys [37008 2008-02-29] (Logicool, Inc.)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)

R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [7680 2006-10-19] ()

S3 PAC207; C:\Windows\System32\DRIVERS\PFC027.SYS [616064 2007-10-25] (PixArt Imaging Inc.)

S3 USBMULCD; C:\Windows\System32\drivers\CM106.sys [1499648 2008-12-19] (C-Media Electronics Inc)

S3 catchme; \??\C:\Users\Andrea\AppData\Local\Temp\catchme.sys [x]

S3 IpInIp; system32\DRIVERS\ipinip.sys [x]

S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]

S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-08-13 20:33 - 2013-08-13 20:33 - 00000000 ____D C:\Windows\ERUNT

2013-08-13 20:32 - 2013-08-13 20:32 - 01158722 _____ (Thisisu) C:\Users\Andrea\Desktop\JRT.exe

2013-08-13 20:13 - 2013-08-13 20:13 - 00001124 _____ C:\AdwCleaner[S1].txt

2013-08-13 20:11 - 2013-08-13 20:11 - 00666633 _____ C:\Users\Andrea\Desktop\adwcleaner.exe

2013-08-13 17:50 - 2013-08-13 17:50 - 00000914 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-08-13 17:50 - 2013-08-13 17:50 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Malwarebytes

2013-08-13 17:50 - 2013-08-13 17:50 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-08-13 17:50 - 2013-08-13 17:50 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware

2013-08-13 17:50 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2013-08-13 17:49 - 2013-08-13 17:49 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Andrea\Desktop\mbam-setup-1.75.0.1300.exe

2013-08-12 17:23 - 2013-08-12 17:23 - 00011795 _____ C:\ComboFix.txt

2013-08-12 17:09 - 2013-08-12 17:23 - 00000000 ____D C:\Qoobox

2013-08-12 17:09 - 2013-08-12 17:23 - 00000000 ____D C:\ComboFix

2013-08-12 17:09 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe

2013-08-12 17:09 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe

2013-08-12 17:09 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2013-08-12 17:09 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2013-08-12 17:09 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2013-08-12 17:09 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe

2013-08-12 17:09 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe

2013-08-12 17:09 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe

2013-08-12 17:08 - 2013-08-12 17:22 - 00000000 ____D C:\Windows\erdnt

2013-08-12 17:07 - 2013-08-12 17:07 - 05102975 ____R (Swearware) C:\Users\Andrea\Desktop\ComboFix.exe

2013-08-11 10:03 - 2013-08-11 10:03 - 00000000 ____D C:\FRST

2013-08-11 10:02 - 2013-08-11 10:03 - 01230570 _____ (Farbar) C:\Users\Andrea\Desktop\FRST.exe

2013-08-10 19:53 - 2013-08-10 19:53 - 00000000 ____D C:\Windows\system32\sda

2013-08-10 19:50 - 2013-08-10 19:50 - 00000000 ____D C:\Users\Andrea\{65241908-f7ce-4c91-8809-534ef6fe3c87}

2013-08-10 19:50 - 2012-08-29 17:47 - 00190976 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\Drivers\RtsUStor.sys

2013-08-10 19:50 - 2011-11-10 16:54 - 09881600 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtsUStoricon.dll

2013-08-10 19:50 - 2010-10-29 16:11 - 00313960 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtsUStor.dll

2013-08-10 19:44 - 2010-03-04 18:04 - 00758784 _____ (NVIDIA Corporation) C:\Windows\system32\cohelper.dll

2013-08-10 19:42 - 2013-08-10 19:42 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_LMouFilt_01005.Wdf

2013-08-10 19:42 - 2010-04-09 02:32 - 00372840 _____ (NVIDIA Corporation) C:\Windows\system32\nvraiins.dll

2013-08-10 19:42 - 2010-04-09 02:32 - 00372840 _____ (NVIDIA Corporation) C:\Windows\system32\nvraidco.dll

2013-08-10 19:42 - 2010-04-09 02:32 - 00215656 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvstor32.sys

2013-08-10 19:42 - 2010-04-09 02:32 - 00018024 _____ (NVIDIA Corporation) C:\Windows\system32\NvRCoPtb.dll

2013-08-10 19:42 - 2010-04-09 02:32 - 00018024 _____ (NVIDIA Corporation) C:\Windows\system32\NvRCoIt.dll

2013-08-10 19:42 - 2010-04-09 02:32 - 00018024 _____ (NVIDIA Corporation) C:\Windows\system32\NvRCoFr.dll

2013-08-10 19:42 - 2010-04-09 02:32 - 00018024 _____ (NVIDIA Corporation) C:\Windows\system32\NvRCoEsm.dll

2013-08-10 19:42 - 2010-04-09 02:32 - 00018024 _____ (NVIDIA Corporation) C:\Windows\system32\NvRCoEs.dll

2013-08-10 19:42 - 2010-04-09 02:32 - 00018024 _____ (NVIDIA Corporation) C:\Windows\system32\NvRCoDe.dll

2013-08-10 19:42 - 2010-04-09 02:32 - 00017512 _____ (NVIDIA Corporation) C:\Windows\system32\NvRCoSv.dll

2013-08-10 19:42 - 2010-04-09 02:32 - 00017512 _____ (NVIDIA Corporation) C:\Windows\system32\NvRCoRu.dll

2013-08-10 19:42 - 2010-04-09 02:32 - 00017512 _____ (NVIDIA Corporation) C:\Windows\system32\NvRCoNo.dll

2013-08-10 19:42 - 2010-04-09 02:32 - 00017512 _____ (NVIDIA Corporation) C:\Windows\system32\NvRCoNl.dll

2013-08-10 19:42 - 2010-04-09 02:32 - 00017512 _____ (NVIDIA Corporation) C:\Windows\system32\NvRCoFi.dll

2013-08-10 19:42 - 2010-04-09 02:32 - 00017512 _____ (NVIDIA Corporation) C:\Windows\system32\NvRCoDa.dll

2013-08-10 19:42 - 2010-04-09 02:32 - 00017000 _____ (NVIDIA Corporation) C:\Windows\system32\NvRCoENU.dll

2013-08-10 19:42 - 2010-04-09 02:32 - 00017000 _____ (NVIDIA Corporation) C:\Windows\system32\NvRCoEng.dll

2013-08-10 19:42 - 2010-04-09 02:32 - 00015464 _____ (NVIDIA Corporation) C:\Windows\system32\NvRCoKo.dll

2013-08-10 19:42 - 2010-04-09 02:32 - 00015464 _____ (NVIDIA Corporation) C:\Windows\system32\NvRCoJa.dll

2013-08-10 19:42 - 2010-04-09 02:32 - 00014952 _____ (NVIDIA Corporation) C:\Windows\system32\NvRCoZht.dll

2013-08-10 19:42 - 2010-04-09 02:32 - 00014952 _____ (NVIDIA Corporation) C:\Windows\system32\NvRCoZhc.dll

2013-08-10 19:42 - 2010-03-22 12:28 - 00215656 _____ (NVIDIA Corporation) C:\Windows\system32\NVCOSMB.DLL

2013-08-10 19:42 - 2010-03-04 18:26 - 00291560 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvmfdx32.sys

2013-08-10 19:42 - 2010-03-04 18:04 - 00953856 _____ (NVIDIA Corporation) C:\Windows\system32\fdco9.dll

2013-08-10 19:41 - 2013-08-10 19:41 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_LHidFilt_01005.Wdf

2013-08-10 19:41 - 2008-02-29 12:00 - 01419232 _____ (Microsoft Corporation) C:\Windows\system32\WdfCoInstaller01005.dll

2013-08-10 19:41 - 2008-02-29 11:12 - 00076304 _____ (Logicool, Inc.) C:\Windows\KHALMNPR.Exe

2013-08-10 19:41 - 2008-02-29 11:12 - 00037008 _____ (Logicool, Inc.) C:\Windows\system32\Drivers\LMouFilt.Sys

2013-08-10 19:41 - 2008-02-29 11:12 - 00035472 _____ (Logicool, Inc.) C:\Windows\system32\Drivers\LHidFilt.Sys

2013-08-10 19:38 - 2013-08-10 19:50 - 00000000 ____D C:\Program Files\Realtek

2013-08-10 19:38 - 2013-06-25 18:42 - 02693144 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\Drivers\RTKVHDA.sys

2013-08-10 19:38 - 2013-06-25 16:25 - 00602901 _____ C:\Windows\system32\Drivers\RTAIODAT.DAT

2013-08-10 19:38 - 2013-06-25 11:40 - 27937792 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RCoRes.dat

2013-08-10 19:38 - 2013-06-25 10:48 - 00121048 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkCoInstII.dll

2013-08-10 19:38 - 2013-06-18 19:52 - 00769752 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkApoApi.dll

2013-08-10 19:38 - 2013-06-18 17:44 - 02388000 _____ (Fortemedia Corporation) C:\Windows\system32\FMAPO.dll

2013-08-10 19:38 - 2013-06-18 17:00 - 00912432 _____ (Sony Corporation) C:\Windows\system32\SFSS_APO.dll

2013-08-10 19:38 - 2013-06-18 13:54 - 02536152 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkPgExt.dll

2013-08-10 19:38 - 2013-06-17 20:20 - 00188696 _____ C:\Windows\system32\AcpiServiceVnA.dll

2013-08-10 19:38 - 2013-06-13 19:20 - 05448460 _____ C:\Windows\system32\Drivers\rtvienna.dat

2013-08-10 19:38 - 2013-06-05 21:42 - 00181960 _____ (Andrea Electronics Corporation) C:\Windows\system32\AERTACap.dll

2013-08-10 19:38 - 2013-05-30 13:58 - 04159768 _____ (ASUSTeKcomputer.Inc) C:\Windows\system32\RTKSMlfx.dll

2013-08-10 19:38 - 2013-05-30 13:56 - 00719704 _____ (A-Volute) C:\Windows\system32\RTKSMSettingsIPC.dll

2013-08-10 19:38 - 2013-05-02 12:01 - 01824000 _____ (Waves Audio Ltd.) C:\Windows\system32\WavesGUILib.dll

2013-08-10 19:38 - 2013-05-02 12:01 - 00788224 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPOShell.dll

2013-08-10 19:38 - 2013-05-02 12:00 - 01932032 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioEQ.dll

2013-08-10 19:38 - 2013-04-24 17:16 - 01596488 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RTSndMgr.cpl

2013-08-10 19:38 - 2013-04-18 13:48 - 13780736 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioRealtek.dll

2013-08-10 19:38 - 2013-04-18 13:48 - 02886400 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioVnN.dll

2013-08-10 19:38 - 2013-04-18 13:48 - 01661184 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioRealtek2.dll

2013-08-10 19:38 - 2013-04-16 06:23 - 00709400 _____ (SRS Labs, Inc.) C:\Windows\system32\slcnt32.dll

2013-08-10 19:38 - 2013-04-16 06:23 - 00548632 _____ (SRS Labs, Inc.) C:\Windows\system32\sltech32.dll

2013-08-10 19:38 - 2013-04-16 06:23 - 00341272 _____ (SRS Labs, Inc.) C:\Windows\system32\sl3apo32.dll

2013-08-10 19:38 - 2013-04-16 06:23 - 00186136 _____ (TODO: <Company name>) C:\Windows\system32\slprp32.dll

2013-08-10 19:38 - 2013-04-15 11:19 - 00642816 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO50.dll

2013-08-10 19:38 - 2013-04-03 14:12 - 00852016 _____ (Sony Corporation) C:\Windows\system32\MISS_APO.dll

2013-08-10 19:38 - 2013-03-20 13:17 - 08872216 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioVnA.dll

2013-08-10 19:38 - 2012-12-17 17:49 - 00437704 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxVoiceAPO20.dll

2013-08-10 19:38 - 2012-12-12 11:17 - 00350664 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO30.dll

2013-08-10 19:38 - 2012-10-02 14:39 - 00426952 _____ (DTS) C:\Windows\system32\DTSU2PLFX32.dll

2013-08-10 19:38 - 2012-10-02 14:39 - 00402888 _____ (DTS) C:\Windows\system32\DTSU2PGFX32.dll

2013-08-10 19:38 - 2012-10-02 14:39 - 00346056 _____ (DTS) C:\Windows\system32\DTSU2PREC32.dll

2013-08-10 19:38 - 2012-09-10 20:06 - 00549240 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO40.dll

2013-08-10 19:38 - 2012-08-31 19:17 - 07162128 _____ (Dolby Laboratories) C:\Windows\system32\R4EEP32A.dll

2013-08-10 19:38 - 2012-08-31 19:17 - 00352016 _____ (Dolby Laboratories) C:\Windows\system32\R4EED32A.dll

2013-08-10 19:38 - 2012-08-31 19:17 - 00106768 _____ (Dolby Laboratories) C:\Windows\system32\R4EEL32A.dll

2013-08-10 19:38 - 2012-08-31 19:17 - 00091920 _____ (Dolby Laboratories) C:\Windows\system32\R4EEA32A.dll

2013-08-10 19:38 - 2012-08-31 19:17 - 00062224 _____ (Dolby Laboratories) C:\Windows\system32\R4EEG32A.dll

2013-08-10 19:38 - 2012-07-15 21:13 - 00349048 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxVolumeSDAPO.dll

2013-08-10 19:38 - 2012-06-20 17:26 - 00090624 _____ (Real Sound Lab SIA) C:\Windows\system32\CONEQMSAPOGUILibrary.dll

2013-08-10 19:38 - 2012-03-08 11:47 - 00095840 _____ (Andrea Electronics Corporation) C:\Windows\system32\AERTARen.dll

2013-08-10 19:38 - 2012-01-30 11:42 - 00819648 _____ (TOSHIBA Corporation) C:\Windows\system32\tadefxapo2.dll

2013-08-10 19:38 - 2012-01-10 10:20 - 00058264 _____ (TOSHIBA CORPORATION.) C:\Windows\system32\TepeqAPO.dll

2013-08-10 19:38 - 2011-11-22 16:28 - 00013416 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkCoLDR.dll

2013-08-10 19:38 - 2011-09-02 14:21 - 00214368 _____ (Synopsys, Inc.) C:\Windows\system32\SFNHK.dll

2013-08-10 19:38 - 2011-09-02 14:21 - 00074080 _____ (Synopsys, Inc.) C:\Windows\system32\SFCOM.dll

2013-08-10 19:38 - 2011-09-02 14:21 - 00068960 _____ (Synopsys, Inc.) C:\Windows\system32\SFAPO.dll

2013-08-10 19:38 - 2011-08-23 17:00 - 00357712 _____ (Knowles Acoustics ) C:\Windows\system32\KAAPORT.dll

2013-08-10 19:38 - 2011-08-11 16:55 - 00001332 _____ C:\Windows\system32\Drivers\DTSU2P.DAT

2013-08-10 19:38 - 2011-05-31 09:42 - 01509480 _____ (DTS) C:\Windows\system32\DTSS2SpeakerDLL.dll

2013-08-10 19:38 - 2011-05-31 09:42 - 01292904 _____ (DTS) C:\Windows\system32\DTSS2HeadphoneDLL.dll

2013-08-10 19:38 - 2011-05-31 09:42 - 01220200 _____ (DTS) C:\Windows\system32\DTSBoostDLL.dll

2013-08-10 19:38 - 2011-05-31 09:42 - 00654952 _____ (DTS) C:\Windows\system32\DTSBassEnhancementDLL.dll

2013-08-10 19:38 - 2011-05-31 09:42 - 00631400 _____ (DTS) C:\Windows\system32\DTSSymmetryDLL.dll

2013-08-10 19:38 - 2011-05-31 09:42 - 00601704 _____ (DTS) C:\Windows\system32\DTSVoiceClarityDLL.dll

2013-08-10 19:38 - 2011-05-31 09:42 - 00458344 _____ (DTS) C:\Windows\system32\DTSNeoPCDLL.dll

2013-08-10 19:38 - 2011-05-31 09:42 - 00389736 _____ (DTS) C:\Windows\system32\DTSGainCompensatorDLL.dll

2013-08-10 19:38 - 2011-05-31 09:42 - 00375400 _____ (DTS) C:\Windows\system32\DTSLimiterDLL.dll

2013-08-10 19:38 - 2011-05-31 09:42 - 00218728 _____ (DTS) C:\Windows\system32\DTSGFXAPONS.dll

2013-08-10 19:38 - 2011-05-31 09:42 - 00218728 _____ (DTS) C:\Windows\system32\DTSGFXAPO.dll

2013-08-10 19:38 - 2011-05-31 09:42 - 00218216 _____ (DTS) C:\Windows\system32\DTSLFXAPO.dll

2013-08-10 19:38 - 2011-03-17 12:16 - 01379760 _____ (TOSHIBA Corporation) C:\Windows\system32\tosade.dll

2013-08-10 19:38 - 2011-03-07 17:03 - 00134584 _____ (TOSHIBA Corporation) C:\Windows\system32\tadefxapo.dll

2013-08-10 19:38 - 2010-11-08 07:31 - 00359768 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEP32A.dll

2013-08-10 19:38 - 2010-11-08 07:31 - 00295768 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RP3DHT32.dll

2013-08-10 19:38 - 2010-11-08 07:31 - 00295768 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RP3DAA32.dll

2013-08-10 19:38 - 2010-11-08 07:31 - 00170840 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEED32A.dll

2013-08-10 19:38 - 2010-11-08 07:31 - 00078680 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEL32A.dll

2013-08-10 19:38 - 2010-11-08 07:31 - 00064856 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEG32A.dll

2013-08-10 19:38 - 2010-09-27 09:34 - 00232792 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO20.dll

2013-08-10 19:38 - 2009-12-04 15:43 - 00132368 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO.dll

2013-08-10 19:38 - 2009-11-24 09:55 - 00345328 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSTSXT.dll

2013-08-10 19:38 - 2009-11-24 09:55 - 00185584 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSTSHD.dll

2013-08-10 19:38 - 2009-11-24 09:55 - 00173296 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSHP360.dll

2013-08-10 19:38 - 2009-11-24 09:55 - 00140528 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSWOW.dll

2013-08-10 19:38 - 2009-11-18 18:42 - 01783056 _____ (Waves Audio Ltd.) C:\Windows\system32\WavesLib.dll

2013-08-10 19:37 - 2013-06-10 15:44 - 02080472 _____ (Realtek Semiconductor Corp.) C:\Windows\RtlExUpd.dll

2013-08-10 19:06 - 2013-08-10 19:09 - 00000000 ____D C:\Users\Andrea\Desktop\Andrea While Fixing

2013-08-02 11:30 - 2013-08-02 11:30 - 10959998 _____ C:\Users\Andrea\Downloads\Unconfirmed 497121.crdownload

2013-07-29 17:13 - 2013-08-13 20:42 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2013-07-29 17:13 - 2013-07-29 17:13 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe

2013-07-29 13:10 - 2013-07-29 13:10 - 00000175 _____ C:\Windows\system32\Drivers\aswVmm.sys.sum

2013-07-29 13:10 - 2013-07-29 13:10 - 00000175 _____ C:\Windows\system32\Drivers\aswSP.sys.sum

2013-07-29 13:10 - 2013-07-29 13:10 - 00000175 _____ C:\Windows\system32\Drivers\aswSnx.sys.sum

2013-07-29 13:09 - 2013-07-29 13:10 - 00175176 _____ C:\Windows\system32\Drivers\aswVmm.sys

2013-07-29 13:09 - 2013-05-09 10:59 - 00049376 _____ C:\Windows\system32\Drivers\aswRvrt.sys
 

==================== One Month Modified Files and Folders =======
 

2013-08-13 20:42 - 2013-07-29 17:13 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2013-08-13 20:35 - 2013-08-13 20:35 - 00000635 _____ C:\Users\Andrea\Desktop\JRT.txt

2013-08-13 20:33 - 2013-08-13 20:33 - 00000000 ____D C:\Windows\ERUNT

2013-08-13 20:32 - 2013-08-13 20:32 - 01158722 _____ (Thisisu) C:\Users\Andrea\Desktop\JRT.exe

2013-08-13 20:32 - 2008-05-15 00:15 - 01250180 _____ C:\Windows\WindowsUpdate.log

2013-08-13 20:29 - 2010-07-25 17:45 - 00000000 ___RD C:\Users\Andrea\Documents\My Dropbox

2013-08-13 20:29 - 2010-07-25 17:44 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Dropbox

2013-08-13 20:27 - 2008-05-15 11:58 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite

2013-08-13 20:26 - 2012-01-01 14:10 - 00000884 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2013-08-13 20:26 - 2006-11-02 15:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2013-08-13 20:26 - 2006-11-02 14:47 - 00003616 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

2013-08-13 20:26 - 2006-11-02 14:47 - 00003616 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

2013-08-13 20:25 - 2006-11-02 15:01 - 00032620 _____ C:\Windows\Tasks\SCHEDLGU.TXT

2013-08-13 20:13 - 2013-08-13 20:13 - 00001124 _____ C:\AdwCleaner[S1].txt

2013-08-13 20:11 - 2013-08-13 20:11 - 00666633 _____ C:\Users\Andrea\Desktop\adwcleaner.exe

2013-08-13 20:09 - 2012-01-01 14:10 - 00000888 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2013-08-13 17:50 - 2013-08-13 17:50 - 00000914 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-08-13 17:50 - 2013-08-13 17:50 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Malwarebytes

2013-08-13 17:50 - 2013-08-13 17:50 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-08-13 17:50 - 2013-08-13 17:50 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware

2013-08-13 17:49 - 2013-08-13 17:49 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Andrea\Desktop\mbam-setup-1.75.0.1300.exe

2013-08-12 19:26 - 2010-09-04 15:47 - 00000000 ____D C:\Users\Andrea\AppData\Local\Apps\2.0

2013-08-12 19:26 - 2008-01-21 04:47 - 00127676 _____ C:\Windows\PFRO.log

2013-08-12 17:23 - 2013-08-12 17:23 - 00011795 _____ C:\ComboFix.txt

2013-08-12 17:23 - 2013-08-12 17:09 - 00000000 ____D C:\Qoobox

2013-08-12 17:23 - 2013-08-12 17:09 - 00000000 ____D C:\ComboFix

2013-08-12 17:23 - 2006-11-02 13:18 - 00000000 __RHD C:\Users\Default

2013-08-12 17:23 - 2006-11-02 13:18 - 00000000 ___RD C:\Users\Public

2013-08-12 17:22 - 2013-08-12 17:08 - 00000000 ____D C:\Windows\erdnt

2013-08-12 17:21 - 2006-11-02 12:23 - 00000215 _____ C:\Windows\system.ini

2013-08-12 17:07 - 2013-08-12 17:07 - 05102975 ____R (Swearware) C:\Users\Andrea\Desktop\ComboFix.exe

2013-08-12 16:52 - 2010-09-04 15:47 - 00000000 ____D C:\Users\Andrea\AppData\Local\Deployment

2013-08-11 10:03 - 2013-08-11 10:03 - 00000000 ____D C:\FRST

2013-08-11 10:03 - 2013-08-11 10:02 - 01230570 _____ (Farbar) C:\Users\Andrea\Desktop\FRST.exe

2013-08-10 20:01 - 2011-09-07 14:51 - 00000000 ____D C:\Program Files\NVIDIA Corporation

2013-08-10 20:01 - 2008-03-15 01:36 - 00000000 ___HD C:\Program Files\InstallShield Installation Information

2013-08-10 19:55 - 2006-11-02 12:33 - 00800208 _____ C:\Windows\system32\PerfStringBackup.INI

2013-08-10 19:53 - 2013-08-10 19:53 - 00000000 ____D C:\Windows\system32\sda

2013-08-10 19:53 - 2008-05-09 15:00 - 00000000 ____D C:\ProgramData\NVIDIA

2013-08-10 19:52 - 2008-05-15 11:57 - 00000000 ____D C:\Users\Andrea

2013-08-10 19:50 - 2013-08-10 19:50 - 00000000 ____D C:\Users\Andrea\{65241908-f7ce-4c91-8809-534ef6fe3c87}

2013-08-10 19:50 - 2013-08-10 19:38 - 00000000 ____D C:\Program Files\Realtek

2013-08-10 19:42 - 2013-08-10 19:42 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_LMouFilt_01005.Wdf

2013-08-10 19:42 - 2006-11-02 14:52 - 00032295 _____ C:\Windows\setupact.log

2013-08-10 19:41 - 2013-08-10 19:41 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_LHidFilt_01005.Wdf

2013-08-10 19:39 - 2008-05-09 14:55 - 00000000 ____D C:\Windows\system32\RTCOM

2013-08-10 19:09 - 2013-08-10 19:06 - 00000000 ____D C:\Users\Andrea\Desktop\Andrea While Fixing

2013-08-02 11:30 - 2013-08-02 11:30 - 10959998 _____ C:\Users\Andrea\Downloads\Unconfirmed 497121.crdownload

2013-08-02 08:14 - 2012-03-02 21:16 - 00001979 _____ C:\Users\Public\Desktop\Google Chrome.lnk

2013-07-29 17:13 - 2013-07-29 17:13 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe

2013-07-29 17:13 - 2011-08-14 23:39 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl

2013-07-29 17:02 - 2012-04-12 18:35 - 00000680 _____ C:\Users\Andrea\AppData\Local\d3d9caps.dat

2013-07-29 13:10 - 2013-07-29 13:10 - 00000175 _____ C:\Windows\system32\Drivers\aswVmm.sys.sum

2013-07-29 13:10 - 2013-07-29 13:10 - 00000175 _____ C:\Windows\system32\Drivers\aswSP.sys.sum

2013-07-29 13:10 - 2013-07-29 13:10 - 00000175 _____ C:\Windows\system32\Drivers\aswSnx.sys.sum

2013-07-29 13:10 - 2013-07-29 13:09 - 00175176 _____ C:\Windows\system32\Drivers\aswVmm.sys

2013-07-29 13:10 - 2011-11-15 18:20 - 00770344 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys

2013-07-29 13:10 - 2010-09-14 11:00 - 00369584 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys

2013-07-29 13:09 - 2006-11-02 12:23 - 00002577 _____ C:\Windows\system32\config.nt

2013-07-14 17:59 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\Microsoft.NET
 

Files to move or delete:

====================

C:\ProgramData\nvModes.dat
 

==================== Bamital & volsnap Check =================
 

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-08-13 20:34
 

==================== End Of Log ============================

--- --- ---

--- --- ---

Hoffe, passt alles so, dankeschön.
Wünsche noch einen schönen Abend, :daumenhoc
lg, Plekdemon

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

Hallo Schrauber,

keine Probleme mehr, vielen Dank.:taenzer:

Folgend die Logs:

Code:

ESETSmartInstaller@High as downloader log:

all ok

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6920

# api_version=3.0.2

# EOSSerial=2a32a28206d1b64a90ca5015069fe126

# engine=14776

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=false

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2013-08-15 07:48:07

# local_time=2013-08-15 09:48:07 (+0100, W. Europe Daylight Time)

# country="United Kingdom"

# lang=1033

# osver=6.0.6002 NT Service Pack 2

# compatibility_mode=770 16774141 100 95 1442848 153262759 0 0

# compatibility_mode=5892 16776574 100 100 134559 214085615 0 0

# scanned=160299

# found=0

# cleaned=0

# scan_time=3494

Code:

 Results of screen317's Security Check version 0.99.72  

 Windows Vista Service Pack 2 x86 (UAC is enabled)  

 Internet Explorer 9  

 Internet Explorer 8  
 ``````````````Antivirus/Firewall Check:`````````````` 

 Windows Firewall Enabled!  

 Windows Firewall Disabled!  

avast! Antivirus   

 Antivirus out of date!  
 `````````Anti-malware/Other Utilities Check:````````` 

 Malwarebytes Anti-Malware version 1.75.0.1300  

 Adobe Reader 8 Adobe Reader out of Date! 

 Google Chrome 28.0.1500.72  

 Google Chrome 28.0.1500.95  
 ````````Process Check: objlist.exe by Laurent````````  

 Malwarebytes Anti-Malware mbamservice.exe  

 Malwarebytes Anti-Malware mbamgui.exe  

 Malwarebytes' Anti-Malware mbamscheduler.exe   

 Alwil Software Avast5 AvastSvc.exe  

 Alwil Software Avast5 AvastUI.exe  
 `````````````````System Health check````````````````` 

 Total Fragmentation on Drive C: 0 % 
 ````````````````````End of Log``````````````````````

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 09-08-2013 (ATTENTION: ====> FRST version is 6 days old and could be outdated)

Ran by Andrea (administrator) on 15-08-2013 09:58:02

Running from C:\Users\Andrea\Desktop

Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: English(US)

Internet Explorer Version 9

Boot Mode: Normal
 

==================== Processes (Whitelisted) ===================
 

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe

(Microsoft Corporation) C:\Windows\system32\SLsvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe

(AVAST Software) C:\Program Files\Alwil Software\Avast5\AvastSvc.exe

(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40ST7.EXE

(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE

(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe

(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe

() C:\Program Files\CyberLink\Shared Files\RichVideo.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe

() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe

(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(Cyberlink Corp.) C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe

(PixArt Imaging Incorporation) C:\Windows\PixArt\PAC207\Monitor.exe

(SEIKO EPSON CORPORATION) C:\Program Files\Epson Software\Event Manager\EEventManager.exe

(AVAST Software) C:\Program Files\Alwil Software\Avast5\AvastUI.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe

(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe

(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe

(Microsoft Corporation) C:\Windows\ehome\ehtray.exe

(Dropbox, Inc.) C:\Users\Andrea\AppData\Roaming\Dropbox\bin\Dropbox.exe

(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe

(Realsil Microelectronics Inc.) C:\Program Files\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\Windows\system32\conime.exe

() C:\Users\Andrea\Desktop\SecurityCheck.exe

(Microsoft Corporation) C:\Windows\system32\cmd.exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RemoteControl] - C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [71216 2007-03-14] (Cyberlink Corp.)

HKLM\...\Run: [LanguageShortcut] - C:\Program Files\CyberLink\PowerDVD\Language\Language.exe [52256 2007-01-09] ()

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [11992792 2013-06-25] (Realtek Semiconductor)

HKLM\...\Run: [QuickTime Task] - C:\Program Files\QuickTime\QTTask.exe [413696 2008-05-27] (Apple Inc.)

HKLM\...\Run: [PAC207_Monitor] - C:\Windows\PixArt\PAC207\Monitor.exe [319488 2006-11-03] (PixArt Imaging Incorporation)

HKLM\...\Run: [Skytel] - C:\Windows\Skytel.exe [1826816 2007-11-20] (Realtek Semiconductor Corp.)

HKLM\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [40368 2011-08-31] (Adobe Systems Incorporated)

HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [937920 2011-03-29] (Adobe Systems Incorporated)

HKLM\...\Run: [EEventManager] - C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe [591696 2008-05-07] (SEIKO EPSON CORPORATION)

HKLM\...\Run: [avast] - C:\Program Files\Alwil Software\Avast5\avastUI.exe [4858968 2013-05-09] (AVAST Software)

HKLM\...\Run: [Nvtmru] - C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1012000 2013-05-16] (NVIDIA Corporation)

HKLM\...\Run: [Kernel and Hardware Abstraction Layer] - C:\Windows\KHALMNPR.EXE [76304 2008-02-29] (Logicool, Inc.)

HKCU\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [2153472 2009-04-11] (Microsoft Corporation)

HKCU\...\Run: [LightScribe Control Panel] - C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [2289664 2008-01-24] (Hewlett-Packard Company)

HKCU\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [125952 2008-01-21] (Microsoft Corporation)

HKU\Administrator\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [ 2009-04-11] (Microsoft Corporation)

HKU\Administrator\...\Run: [Power2GoExpress] - C:\Program Files\CyberLink\Power2Go\Power2GoExpress.exe [ 2007-07-12] (Cyberlink)

HKU\Administrator\...\Run: [BullGuard] - "C:\Program Files\BullGuard Ltd\BullGuard\bullguard.exe" [x]

HKU\Administrator\...\Run: [LightScribe Control Panel] - C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [ 2008-01-24] (Hewlett-Packard Company)

HKU\Administrator\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [ 2008-01-21] (Microsoft Corporation)

HKU\Administrator\...\Run: [Skype] - "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized [x]

HKU\Administrator\...\Run: [EPSON PX800FW Series] - C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIEME.EXE /FU "C:\Windows\TEMP\E_S14A9.tmp" /EF "HKCU" [x]

HKU\Default\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [ 2009-04-11] (Microsoft Corporation)

HKU\Default User\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [ 2009-04-11] (Microsoft Corporation)

HKU\Guest\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [ 2009-04-11] (Microsoft Corporation)

HKU\Guest\...\Run: [LightScribe Control Panel] - C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [ 2008-01-24] (Hewlett-Packard Company)

HKU\Guest\...\Run: [BullGuard] - "C:\Program Files\BullGuard Ltd\BullGuard\BullGuard.exe" [x]

HKU\Guest\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [ 2008-01-21] (Microsoft Corporation)

HKU\Guest\...\Run: [Skype] - "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized [x]

HKU\Guest\...\Run: [EPSON PX800FW Series] - C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIEME.EXE /FU "C:\Windows\TEMP\E_S14A9.tmp" /EF "HKCU" [x]

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk

ShortcutTarget: Microsoft Office.lnk -> C:\Program Files\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)

Startup: C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip ()

Startup: C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk -> C:\Users\Andrea\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.at/

SearchScopes: HKLM - DefaultScope value is missing.

SearchScopes: HKCU - {DECA3892-BA8F-44b8-A993-A466AD694AE4} URL = hxxp://search.yahoo.com/search?fr=mcafee&p={searchTerms}

BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)

BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll (Sun Microsystems, Inc.)

BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)

BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)

Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)

Toolbar: HKLM - avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)

Toolbar: HKCU -No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File

DPF: {6E718D87-6909-4FCE-92D4-EDCB2F725727} hxxp://www.navigram.com/engine/v1026/Navigram.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab

DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab

DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)

Handler: msdaipp - No CLSID Value - 

Winsock: Catalog9 01 C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll [258664] (NVIDIA)

Winsock: Catalog9 02 C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll [258664] (NVIDIA)

Winsock: Catalog9 03 C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll [258664] (NVIDIA)

Winsock: Catalog9 04 C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll [258664] (NVIDIA)

Winsock: Catalog9 05 C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll [258664] (NVIDIA)

Winsock: Catalog9 06 C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll [258664] (NVIDIA)

Winsock: Catalog9 25 C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll [258664] (NVIDIA)

Winsock: Catalog9 26 C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll [258664] (NVIDIA)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 192.168.2.1
 

Chrome: 

=======

CHR HomePage: hxxp://www.google.com/

CHR RestoreOnStartup: "hxxp://www.google.com/"

CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}

CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}sugkey={google:suggestAPIKeyParameter}

CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\28.0.1500.95\PepperFlash\pepflashplayer.dll ()

CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\28.0.1500.95\ppGoogleNaClPluginChrome.dll ()

CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\28.0.1500.95\pdf.dll ()

CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)

CHR Plugin: (QuickTime Plug-in 7.5 (861)) - C:\Program Files\QuickTime\plugins\npqtplugin.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.5 (861)) - C:\Program Files\QuickTime\plugins\npqtplugin2.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.5 (861)) - C:\Program Files\QuickTime\plugins\npqtplugin3.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.5 (861)) - C:\Program Files\QuickTime\plugins\npqtplugin4.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.5 (861)) - C:\Program Files\QuickTime\plugins\npqtplugin5.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.5 (861)) - C:\Program Files\QuickTime\plugins\npqtplugin6.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.5 (861)) - C:\Program Files\QuickTime\plugins\npqtplugin7.dll (Apple Inc.)

CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File

CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll No File

CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll No File

CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)

CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File

CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

CHR Extension: (YouTube) - C:\Users\Andrea\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0

CHR Extension: (Google Search) - C:\Users\Andrea\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0

CHR Extension: (avast! Online Security) - C:\Users\Andrea\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki\8.0.8_0

CHR Extension: (Gmail) - C:\Users\Andrea\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1

CHR StartMenuInternet: Google Chrome - C:\Program Files\Google\Chrome\Application\chrome.exe
 

========================== Services (Whitelisted) =================
 

R2 avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [46808 2013-05-09] (AVAST Software)

R2 EPSON_EB_RPCV4_01; C:\ProgramData\EPSON\EPW!3 SSRP\E_S40ST7.EXE [143872 2007-12-17] (SEIKO EPSON CORPORATION)

R2 EPSON_PM_RPCV4_01; C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE [113664 2007-01-11] (SEIKO EPSON CORPORATION)

R2 ForceWare Intelligent Application Manager (IAM); C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe [370792 2010-01-21] ()

S3 getPlusHelper; C:\Program Files\NOS\bin\getPlus_Helper.dll [68000 2010-03-22] (NOS Microsystems Ltd.)

R2 IconMan_R; C:\Program Files\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe [1828496 2012-09-07] (Realsil Microelectronics Inc.)

R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)

R2 nSvcIp; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe [167528 2010-01-21] ()

R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [272024 2006-12-19] ()
 

==================== Drivers (Whitelisted) ====================
 

R2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [29816 2013-05-09] (AVAST Software)

R1 aswKbd; C:\Windows\System32\Drivers\aswKbd.sys [20624 2012-10-31] (AVAST Software)

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [66336 2013-05-09] (AVAST Software)

R1 aswRdr; C:\Windows\System32\Drivers\aswRdr.sys [49760 2013-05-09] (AVAST Software)

R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [49376 2013-05-09] ()

R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [770344 2013-07-29] (AVAST Software)

R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [369584 2013-07-29] (AVAST Software)

R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [56080 2013-05-09] (AVAST Software)

R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [175176 2013-07-29] ()

R0 JGOGO; C:\Windows\System32\DRIVERS\JGOGO.sys [6912 2006-02-08] (JMicron )

R0 JRAID; C:\Windows\System32\DRIVERS\jraid.sys [44416 2006-12-07] (JMicron Technology Corp.)

R3 LHidFilt; C:\Windows\System32\DRIVERS\LHidFilt.Sys [35472 2008-02-29] (Logicool, Inc.)

R3 LMouFilt; C:\Windows\System32\DRIVERS\LMouFilt.Sys [37008 2008-02-29] (Logicool, Inc.)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)

R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [7680 2006-10-19] ()

S3 PAC207; C:\Windows\System32\DRIVERS\PFC027.SYS [616064 2007-10-25] (PixArt Imaging Inc.)

S3 USBMULCD; C:\Windows\System32\drivers\CM106.sys [1499648 2008-12-19] (C-Media Electronics Inc)

S3 catchme; \??\C:\Users\Andrea\AppData\Local\Temp\catchme.sys [x]

S3 IpInIp; system32\DRIVERS\ipinip.sys [x]

S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]

S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-08-15 08:48 - 2013-08-15 08:48 - 00000000 ____D C:\Program Files\ESET

2013-08-15 08:47 - 2013-08-15 08:47 - 02347384 _____ (ESET) C:\Users\Andrea\Desktop\esetsmartinstaller_enu.exe

2013-08-15 00:53 - 2013-08-15 00:55 - 00000000 ____D C:\Windows\system32\MRT

2013-08-15 00:47 - 2013-07-25 04:40 - 12334080 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2013-08-15 00:47 - 2013-07-25 04:32 - 01800704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2013-08-15 00:47 - 2013-07-25 04:30 - 09738752 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2013-08-15 00:47 - 2013-07-25 04:26 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2013-08-15 00:47 - 2013-07-25 04:26 - 01104384 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2013-08-15 00:47 - 2013-07-25 04:25 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2013-08-15 00:47 - 2013-07-25 04:24 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll

2013-08-15 00:47 - 2013-07-25 04:24 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2013-08-15 00:47 - 2013-07-25 04:23 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2013-08-15 00:47 - 2013-07-25 04:23 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2013-08-15 00:47 - 2013-07-25 04:23 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2013-08-15 00:47 - 2013-07-25 04:23 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2013-08-15 00:47 - 2013-07-25 04:23 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2013-08-15 00:47 - 2013-07-25 04:22 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2013-08-15 00:47 - 2013-07-25 04:22 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2013-08-15 00:47 - 2013-07-25 04:22 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2013-08-14 22:52 - 2013-06-15 15:22 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\icaapi.dll

2013-08-14 22:52 - 2013-06-15 13:23 - 00024064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys

2013-08-14 22:51 - 2013-07-17 21:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll

2013-08-14 22:51 - 2013-07-10 11:47 - 00783360 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll

2013-08-14 22:51 - 2013-07-09 14:10 - 01205168 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll

2013-08-14 22:51 - 2013-07-08 06:55 - 03603904 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe

2013-08-14 22:51 - 2013-07-08 06:55 - 03551680 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2013-08-14 22:51 - 2013-07-08 06:20 - 00172544 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll

2013-08-14 22:51 - 2013-07-08 06:16 - 00992768 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll

2013-08-14 22:51 - 2013-07-08 06:16 - 00133120 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll

2013-08-14 22:51 - 2013-07-08 06:16 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll

2013-08-14 22:51 - 2013-07-05 06:53 - 00905664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys

2013-08-13 20:35 - 2013-08-13 20:35 - 00000635 _____ C:\Users\Andrea\Desktop\JRT.txt

2013-08-13 20:33 - 2013-08-13 20:33 - 00000000 ____D C:\Windows\ERUNT

2013-08-13 20:32 - 2013-08-13 20:32 - 01158722 _____ (Thisisu) C:\Users\Andrea\Desktop\JRT.exe

2013-08-13 20:13 - 2013-08-13 20:13 - 00001124 _____ C:\AdwCleaner[S1].txt

2013-08-13 20:11 - 2013-08-13 20:11 - 00666633 _____ C:\Users\Andrea\Desktop\adwcleaner.exe

2013-08-13 17:50 - 2013-08-13 17:50 - 00000914 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-08-13 17:50 - 2013-08-13 17:50 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Malwarebytes

2013-08-13 17:50 - 2013-08-13 17:50 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-08-13 17:50 - 2013-08-13 17:50 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware

2013-08-13 17:50 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2013-08-13 17:49 - 2013-08-13 17:49 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Andrea\Desktop\mbam-setup-1.75.0.1300.exe

2013-08-12 17:23 - 2013-08-12 17:23 - 00011795 _____ C:\ComboFix.txt

2013-08-12 17:09 - 2013-08-12 17:23 - 00000000 ____D C:\Qoobox

2013-08-12 17:09 - 2013-08-12 17:23 - 00000000 ____D C:\ComboFix

2013-08-12 17:09 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe

2013-08-12 17:09 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe

2013-08-12 17:09 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2013-08-12 17:09 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2013-08-12 17:09 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2013-08-12 17:09 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe

2013-08-12 17:09 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe

2013-08-12 17:09 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe

2013-08-12 17:08 - 2013-08-12 17:22 - 00000000 ____D C:\Windows\erdnt

2013-08-12 17:07 - 2013-08-12 17:07 - 05102975 ____R (Swearware) C:\Users\Andrea\Desktop\ComboFix.exe

2013-08-11 10:03 - 2013-08-11 10:03 - 00000000 ____D C:\FRST

2013-08-11 10:02 - 2013-08-11 10:03 - 01230570 _____ (Farbar) C:\Users\Andrea\Desktop\FRST.exe

2013-08-10 19:53 - 2013-08-10 19:53 - 00000000 ____D C:\Windows\system32\sda

2013-08-10 19:50 - 2013-08-10 19:50 - 00000000 ____D C:\Users\Andrea\{65241908-f7ce-4c91-8809-534ef6fe3c87}

2013-08-10 19:50 - 2012-08-29 17:47 - 00190976 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\Drivers\RtsUStor.sys

2013-08-10 19:50 - 2011-11-10 16:54 - 09881600 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtsUStoricon.dll

2013-08-10 19:50 - 2010-10-29 16:11 - 00313960 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtsUStor.dll

2013-08-10 19:44 - 2010-03-04 18:04 - 00758784 _____ (NVIDIA Corporation) C:\Windows\system32\cohelper.dll

2013-08-10 19:42 - 2013-08-10 19:42 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_LMouFilt_01005.Wdf

2013-08-10 19:42 - 2010-04-09 02:32 - 00372840 _____ (NVIDIA Corporation) C:\Windows\system32\nvraiins.dll

2013-08-10 19:42 - 2010-04-09 02:32 - 00372840 _____ (NVIDIA Corporation) C:\Windows\system32\nvraidco.dll

2013-08-10 19:42 - 2010-04-09 02:32 - 00215656 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvstor32.sys

2013-08-10 19:42 - 2010-04-09 02:32 - 00018024 _____ (NVIDIA Corporation) C:\Windows\system32\NvRCoPtb.dll

2013-08-10 19:42 - 2010-04-09 02:32 - 00018024 _____ (NVIDIA Corporation) C:\Windows\system32\NvRCoIt.dll

2013-08-10 19:42 - 2010-04-09 02:32 - 00018024 _____ (NVIDIA Corporation) C:\Windows\system32\NvRCoFr.dll

2013-08-10 19:42 - 2010-04-09 02:32 - 00018024 _____ (NVIDIA Corporation) C:\Windows\system32\NvRCoEsm.dll

2013-08-10 19:42 - 2010-04-09 02:32 - 00018024 _____ (NVIDIA Corporation) C:\Windows\system32\NvRCoEs.dll

2013-08-10 19:42 - 2010-04-09 02:32 - 00018024 _____ (NVIDIA Corporation) C:\Windows\system32\NvRCoDe.dll

2013-08-10 19:42 - 2010-04-09 02:32 - 00017512 _____ (NVIDIA Corporation) C:\Windows\system32\NvRCoSv.dll

2013-08-10 19:42 - 2010-04-09 02:32 - 00017512 _____ (NVIDIA Corporation) C:\Windows\system32\NvRCoRu.dll

2013-08-10 19:42 - 2010-04-09 02:32 - 00017512 _____ (NVIDIA Corporation) C:\Windows\system32\NvRCoNo.dll

2013-08-10 19:42 - 2010-04-09 02:32 - 00017512 _____ (NVIDIA Corporation) C:\Windows\system32\NvRCoNl.dll

2013-08-10 19:42 - 2010-04-09 02:32 - 00017512 _____ (NVIDIA Corporation) C:\Windows\system32\NvRCoFi.dll

2013-08-10 19:42 - 2010-04-09 02:32 - 00017512 _____ (NVIDIA Corporation) C:\Windows\system32\NvRCoDa.dll

2013-08-10 19:42 - 2010-04-09 02:32 - 00017000 _____ (NVIDIA Corporation) C:\Windows\system32\NvRCoENU.dll

2013-08-10 19:42 - 2010-04-09 02:32 - 00017000 _____ (NVIDIA Corporation) C:\Windows\system32\NvRCoEng.dll

2013-08-10 19:42 - 2010-04-09 02:32 - 00015464 _____ (NVIDIA Corporation) C:\Windows\system32\NvRCoKo.dll

2013-08-10 19:42 - 2010-04-09 02:32 - 00015464 _____ (NVIDIA Corporation) C:\Windows\system32\NvRCoJa.dll

2013-08-10 19:42 - 2010-04-09 02:32 - 00014952 _____ (NVIDIA Corporation) C:\Windows\system32\NvRCoZht.dll

2013-08-10 19:42 - 2010-04-09 02:32 - 00014952 _____ (NVIDIA Corporation) C:\Windows\system32\NvRCoZhc.dll

2013-08-10 19:42 - 2010-03-22 12:28 - 00215656 _____ (NVIDIA Corporation) C:\Windows\system32\NVCOSMB.DLL

2013-08-10 19:42 - 2010-03-04 18:26 - 00291560 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvmfdx32.sys

2013-08-10 19:42 - 2010-03-04 18:04 - 00953856 _____ (NVIDIA Corporation) C:\Windows\system32\fdco9.dll

2013-08-10 19:41 - 2013-08-10 19:41 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_LHidFilt_01005.Wdf

2013-08-10 19:41 - 2008-02-29 12:00 - 01419232 _____ (Microsoft Corporation) C:\Windows\system32\WdfCoInstaller01005.dll

2013-08-10 19:41 - 2008-02-29 11:12 - 00076304 _____ (Logicool, Inc.) C:\Windows\KHALMNPR.Exe

2013-08-10 19:41 - 2008-02-29 11:12 - 00037008 _____ (Logicool, Inc.) C:\Windows\system32\Drivers\LMouFilt.Sys

2013-08-10 19:41 - 2008-02-29 11:12 - 00035472 _____ (Logicool, Inc.) C:\Windows\system32\Drivers\LHidFilt.Sys

2013-08-10 19:38 - 2013-08-10 19:50 - 00000000 ____D C:\Program Files\Realtek

2013-08-10 19:38 - 2013-06-25 18:42 - 02693144 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\Drivers\RTKVHDA.sys

2013-08-10 19:38 - 2013-06-25 16:25 - 00602901 _____ C:\Windows\system32\Drivers\RTAIODAT.DAT

2013-08-10 19:38 - 2013-06-25 11:40 - 27937792 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RCoRes.dat

2013-08-10 19:38 - 2013-06-25 10:48 - 00121048 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkCoInstII.dll

2013-08-10 19:38 - 2013-06-18 19:52 - 00769752 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkApoApi.dll

2013-08-10 19:38 - 2013-06-18 17:44 - 02388000 _____ (Fortemedia Corporation) C:\Windows\system32\FMAPO.dll

2013-08-10 19:38 - 2013-06-18 17:00 - 00912432 _____ (Sony Corporation) C:\Windows\system32\SFSS_APO.dll

2013-08-10 19:38 - 2013-06-18 13:54 - 02536152 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkPgExt.dll

2013-08-10 19:38 - 2013-06-17 20:20 - 00188696 _____ C:\Windows\system32\AcpiServiceVnA.dll

2013-08-10 19:38 - 2013-06-13 19:20 - 05448460 _____ C:\Windows\system32\Drivers\rtvienna.dat

2013-08-10 19:38 - 2013-06-05 21:42 - 00181960 _____ (Andrea Electronics Corporation) C:\Windows\system32\AERTACap.dll

2013-08-10 19:38 - 2013-05-30 13:58 - 04159768 _____ (ASUSTeKcomputer.Inc) C:\Windows\system32\RTKSMlfx.dll

2013-08-10 19:38 - 2013-05-30 13:56 - 00719704 _____ (A-Volute) C:\Windows\system32\RTKSMSettingsIPC.dll

2013-08-10 19:38 - 2013-05-02 12:01 - 01824000 _____ (Waves Audio Ltd.) C:\Windows\system32\WavesGUILib.dll

2013-08-10 19:38 - 2013-05-02 12:01 - 00788224 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPOShell.dll

2013-08-10 19:38 - 2013-05-02 12:00 - 01932032 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioEQ.dll

2013-08-10 19:38 - 2013-04-24 17:16 - 01596488 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RTSndMgr.cpl

2013-08-10 19:38 - 2013-04-18 13:48 - 13780736 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioRealtek.dll

2013-08-10 19:38 - 2013-04-18 13:48 - 02886400 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioVnN.dll

2013-08-10 19:38 - 2013-04-18 13:48 - 01661184 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioRealtek2.dll

2013-08-10 19:38 - 2013-04-16 06:23 - 00709400 _____ (SRS Labs, Inc.) C:\Windows\system32\slcnt32.dll

2013-08-10 19:38 - 2013-04-16 06:23 - 00548632 _____ (SRS Labs, Inc.) C:\Windows\system32\sltech32.dll

2013-08-10 19:38 - 2013-04-16 06:23 - 00341272 _____ (SRS Labs, Inc.) C:\Windows\system32\sl3apo32.dll

2013-08-10 19:38 - 2013-04-16 06:23 - 00186136 _____ (TODO: <Company name>) C:\Windows\system32\slprp32.dll

2013-08-10 19:38 - 2013-04-15 11:19 - 00642816 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO50.dll

2013-08-10 19:38 - 2013-04-03 14:12 - 00852016 _____ (Sony Corporation) C:\Windows\system32\MISS_APO.dll

2013-08-10 19:38 - 2013-03-20 13:17 - 08872216 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioVnA.dll

2013-08-10 19:38 - 2012-12-17 17:49 - 00437704 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxVoiceAPO20.dll

2013-08-10 19:38 - 2012-12-12 11:17 - 00350664 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO30.dll

2013-08-10 19:38 - 2012-10-02 14:39 - 00426952 _____ (DTS) C:\Windows\system32\DTSU2PLFX32.dll

2013-08-10 19:38 - 2012-10-02 14:39 - 00402888 _____ (DTS) C:\Windows\system32\DTSU2PGFX32.dll

2013-08-10 19:38 - 2012-10-02 14:39 - 00346056 _____ (DTS) C:\Windows\system32\DTSU2PREC32.dll

2013-08-10 19:38 - 2012-09-10 20:06 - 00549240 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO40.dll

2013-08-10 19:38 - 2012-08-31 19:17 - 07162128 _____ (Dolby Laboratories) C:\Windows\system32\R4EEP32A.dll

2013-08-10 19:38 - 2012-08-31 19:17 - 00352016 _____ (Dolby Laboratories) C:\Windows\system32\R4EED32A.dll

2013-08-10 19:38 - 2012-08-31 19:17 - 00106768 _____ (Dolby Laboratories) C:\Windows\system32\R4EEL32A.dll

2013-08-10 19:38 - 2012-08-31 19:17 - 00091920 _____ (Dolby Laboratories) C:\Windows\system32\R4EEA32A.dll

2013-08-10 19:38 - 2012-08-31 19:17 - 00062224 _____ (Dolby Laboratories) C:\Windows\system32\R4EEG32A.dll

2013-08-10 19:38 - 2012-07-15 21:13 - 00349048 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxVolumeSDAPO.dll

2013-08-10 19:38 - 2012-06-20 17:26 - 00090624 _____ (Real Sound Lab SIA) C:\Windows\system32\CONEQMSAPOGUILibrary.dll

2013-08-10 19:38 - 2012-03-08 11:47 - 00095840 _____ (Andrea Electronics Corporation) C:\Windows\system32\AERTARen.dll

2013-08-10 19:38 - 2012-01-30 11:42 - 00819648 _____ (TOSHIBA Corporation) C:\Windows\system32\tadefxapo2.dll

2013-08-10 19:38 - 2012-01-10 10:20 - 00058264 _____ (TOSHIBA CORPORATION.) C:\Windows\system32\TepeqAPO.dll

2013-08-10 19:38 - 2011-11-22 16:28 - 00013416 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkCoLDR.dll

2013-08-10 19:38 - 2011-09-02 14:21 - 00214368 _____ (Synopsys, Inc.) C:\Windows\system32\SFNHK.dll

2013-08-10 19:38 - 2011-09-02 14:21 - 00074080 _____ (Synopsys, Inc.) C:\Windows\system32\SFCOM.dll

2013-08-10 19:38 - 2011-09-02 14:21 - 00068960 _____ (Synopsys, Inc.) C:\Windows\system32\SFAPO.dll

2013-08-10 19:38 - 2011-08-23 17:00 - 00357712 _____ (Knowles Acoustics ) C:\Windows\system32\KAAPORT.dll

2013-08-10 19:38 - 2011-08-11 16:55 - 00001332 _____ C:\Windows\system32\Drivers\DTSU2P.DAT

2013-08-10 19:38 - 2011-05-31 09:42 - 01509480 _____ (DTS) C:\Windows\system32\DTSS2SpeakerDLL.dll

2013-08-10 19:38 - 2011-05-31 09:42 - 01292904 _____ (DTS) C:\Windows\system32\DTSS2HeadphoneDLL.dll

2013-08-10 19:38 - 2011-05-31 09:42 - 01220200 _____ (DTS) C:\Windows\system32\DTSBoostDLL.dll

2013-08-10 19:38 - 2011-05-31 09:42 - 00654952 _____ (DTS) C:\Windows\system32\DTSBassEnhancementDLL.dll

2013-08-10 19:38 - 2011-05-31 09:42 - 00631400 _____ (DTS) C:\Windows\system32\DTSSymmetryDLL.dll

2013-08-10 19:38 - 2011-05-31 09:42 - 00601704 _____ (DTS) C:\Windows\system32\DTSVoiceClarityDLL.dll

2013-08-10 19:38 - 2011-05-31 09:42 - 00458344 _____ (DTS) C:\Windows\system32\DTSNeoPCDLL.dll

2013-08-10 19:38 - 2011-05-31 09:42 - 00389736 _____ (DTS) C:\Windows\system32\DTSGainCompensatorDLL.dll

2013-08-10 19:38 - 2011-05-31 09:42 - 00375400 _____ (DTS) C:\Windows\system32\DTSLimiterDLL.dll

2013-08-10 19:38 - 2011-05-31 09:42 - 00218728 _____ (DTS) C:\Windows\system32\DTSGFXAPONS.dll

2013-08-10 19:38 - 2011-05-31 09:42 - 00218728 _____ (DTS) C:\Windows\system32\DTSGFXAPO.dll

2013-08-10 19:38 - 2011-05-31 09:42 - 00218216 _____ (DTS) C:\Windows\system32\DTSLFXAPO.dll

2013-08-10 19:38 - 2011-03-17 12:16 - 01379760 _____ (TOSHIBA Corporation) C:\Windows\system32\tosade.dll

2013-08-10 19:38 - 2011-03-07 17:03 - 00134584 _____ (TOSHIBA Corporation) C:\Windows\system32\tadefxapo.dll

2013-08-10 19:38 - 2010-11-08 07:31 - 00359768 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEP32A.dll

2013-08-10 19:38 - 2010-11-08 07:31 - 00295768 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RP3DHT32.dll

2013-08-10 19:38 - 2010-11-08 07:31 - 00295768 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RP3DAA32.dll

2013-08-10 19:38 - 2010-11-08 07:31 - 00170840 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEED32A.dll

2013-08-10 19:38 - 2010-11-08 07:31 - 00078680 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEL32A.dll

2013-08-10 19:38 - 2010-11-08 07:31 - 00064856 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEG32A.dll

2013-08-10 19:38 - 2010-09-27 09:34 - 00232792 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO20.dll

2013-08-10 19:38 - 2009-12-04 15:43 - 00132368 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO.dll

2013-08-10 19:38 - 2009-11-24 09:55 - 00345328 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSTSXT.dll

2013-08-10 19:38 - 2009-11-24 09:55 - 00185584 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSTSHD.dll

2013-08-10 19:38 - 2009-11-24 09:55 - 00173296 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSHP360.dll

2013-08-10 19:38 - 2009-11-24 09:55 - 00140528 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSWOW.dll

2013-08-10 19:38 - 2009-11-18 18:42 - 01783056 _____ (Waves Audio Ltd.) C:\Windows\system32\WavesLib.dll

2013-08-10 19:37 - 2013-06-10 15:44 - 02080472 _____ (Realtek Semiconductor Corp.) C:\Windows\RtlExUpd.dll

2013-08-10 19:06 - 2013-08-10 19:09 - 00000000 ____D C:\Users\Andrea\Desktop\Andrea While Fixing

2013-08-02 11:30 - 2013-08-02 11:30 - 10959998 _____ C:\Users\Andrea\Downloads\Unconfirmed 497121.crdownload

2013-07-29 17:13 - 2013-08-15 09:42 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2013-07-29 17:13 - 2013-07-29 17:13 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe

2013-07-29 13:10 - 2013-07-29 13:10 - 00000175 _____ C:\Windows\system32\Drivers\aswVmm.sys.sum

2013-07-29 13:10 - 2013-07-29 13:10 - 00000175 _____ C:\Windows\system32\Drivers\aswSP.sys.sum

2013-07-29 13:10 - 2013-07-29 13:10 - 00000175 _____ C:\Windows\system32\Drivers\aswSnx.sys.sum

2013-07-29 13:09 - 2013-07-29 13:10 - 00175176 _____ C:\Windows\system32\Drivers\aswVmm.sys

2013-07-29 13:09 - 2013-05-09 10:59 - 00049376 _____ C:\Windows\system32\Drivers\aswRvrt.sys
 

==================== One Month Modified Files and Folders =======
 

2013-08-15 09:54 - 2013-08-15 09:54 - 00891115 _____ C:\Users\Andrea\Desktop\SecurityCheck.exe

2013-08-15 09:42 - 2013-07-29 17:13 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2013-08-15 09:09 - 2012-01-01 14:10 - 00000888 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2013-08-15 09:04 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\Microsoft.NET

2013-08-15 08:49 - 2006-11-02 12:33 - 00800208 _____ C:\Windows\system32\PerfStringBackup.INI

2013-08-15 08:48 - 2013-08-15 08:48 - 00000000 ____D C:\Program Files\ESET

2013-08-15 08:48 - 2008-05-15 00:15 - 01433805 _____ C:\Windows\WindowsUpdate.log

2013-08-15 08:47 - 2013-08-15 08:47 - 02347384 _____ (ESET) C:\Users\Andrea\Desktop\esetsmartinstaller_enu.exe

2013-08-15 08:46 - 2006-11-02 14:52 - 00033090 _____ C:\Windows\setupact.log

2013-08-15 08:42 - 2010-07-25 17:45 - 00000000 ___RD C:\Users\Andrea\Documents\My Dropbox

2013-08-15 08:42 - 2010-07-25 17:44 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Dropbox

2013-08-15 08:41 - 2008-05-15 11:58 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite

2013-08-15 08:40 - 2012-01-01 14:10 - 00000884 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2013-08-15 08:39 - 2006-11-02 15:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2013-08-15 08:39 - 2006-11-02 14:47 - 00003616 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

2013-08-15 08:39 - 2006-11-02 14:47 - 00003616 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

2013-08-15 00:56 - 2006-11-02 15:01 - 00032620 _____ C:\Windows\Tasks\SCHEDLGU.TXT

2013-08-15 00:55 - 2013-08-15 00:53 - 00000000 ____D C:\Windows\system32\MRT

2013-08-15 00:53 - 2006-11-02 12:24 - 75778376 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe

2013-08-13 20:35 - 2013-08-13 20:35 - 00000635 _____ C:\Users\Andrea\Desktop\JRT.txt

2013-08-13 20:33 - 2013-08-13 20:33 - 00000000 ____D C:\Windows\ERUNT

2013-08-13 20:32 - 2013-08-13 20:32 - 01158722 _____ (Thisisu) C:\Users\Andrea\Desktop\JRT.exe

2013-08-13 20:13 - 2013-08-13 20:13 - 00001124 _____ C:\AdwCleaner[S1].txt

2013-08-13 20:11 - 2013-08-13 20:11 - 00666633 _____ C:\Users\Andrea\Desktop\adwcleaner.exe

2013-08-13 17:50 - 2013-08-13 17:50 - 00000914 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-08-13 17:50 - 2013-08-13 17:50 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Malwarebytes

2013-08-13 17:50 - 2013-08-13 17:50 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-08-13 17:50 - 2013-08-13 17:50 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware

2013-08-13 17:49 - 2013-08-13 17:49 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Andrea\Desktop\mbam-setup-1.75.0.1300.exe

2013-08-12 19:26 - 2010-09-04 15:47 - 00000000 ____D C:\Users\Andrea\AppData\Local\Apps\2.0

2013-08-12 19:26 - 2008-01-21 04:47 - 00127676 _____ C:\Windows\PFRO.log

2013-08-12 17:23 - 2013-08-12 17:23 - 00011795 _____ C:\ComboFix.txt

2013-08-12 17:23 - 2013-08-12 17:09 - 00000000 ____D C:\Qoobox

2013-08-12 17:23 - 2013-08-12 17:09 - 00000000 ____D C:\ComboFix

2013-08-12 17:23 - 2006-11-02 13:18 - 00000000 __RHD C:\Users\Default

2013-08-12 17:23 - 2006-11-02 13:18 - 00000000 ___RD C:\Users\Public

2013-08-12 17:22 - 2013-08-12 17:08 - 00000000 ____D C:\Windows\erdnt

2013-08-12 17:21 - 2006-11-02 12:23 - 00000215 _____ C:\Windows\system.ini

2013-08-12 17:07 - 2013-08-12 17:07 - 05102975 ____R (Swearware) C:\Users\Andrea\Desktop\ComboFix.exe

2013-08-12 16:52 - 2010-09-04 15:47 - 00000000 ____D C:\Users\Andrea\AppData\Local\Deployment

2013-08-11 10:03 - 2013-08-11 10:03 - 00000000 ____D C:\FRST

2013-08-11 10:03 - 2013-08-11 10:02 - 01230570 _____ (Farbar) C:\Users\Andrea\Desktop\FRST.exe

2013-08-10 20:01 - 2011-09-07 14:51 - 00000000 ____D C:\Program Files\NVIDIA Corporation

2013-08-10 20:01 - 2008-03-15 01:36 - 00000000 ___HD C:\Program Files\InstallShield Installation Information

2013-08-10 19:53 - 2013-08-10 19:53 - 00000000 ____D C:\Windows\system32\sda

2013-08-10 19:53 - 2008-05-09 15:00 - 00000000 ____D C:\ProgramData\NVIDIA

2013-08-10 19:52 - 2008-05-15 11:57 - 00000000 ____D C:\Users\Andrea

2013-08-10 19:50 - 2013-08-10 19:50 - 00000000 ____D C:\Users\Andrea\{65241908-f7ce-4c91-8809-534ef6fe3c87}

2013-08-10 19:50 - 2013-08-10 19:38 - 00000000 ____D C:\Program Files\Realtek

2013-08-10 19:42 - 2013-08-10 19:42 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_LMouFilt_01005.Wdf

2013-08-10 19:41 - 2013-08-10 19:41 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_LHidFilt_01005.Wdf

2013-08-10 19:39 - 2008-05-09 14:55 - 00000000 ____D C:\Windows\system32\RTCOM

2013-08-10 19:09 - 2013-08-10 19:06 - 00000000 ____D C:\Users\Andrea\Desktop\Andrea While Fixing

2013-08-02 11:30 - 2013-08-02 11:30 - 10959998 _____ C:\Users\Andrea\Downloads\Unconfirmed 497121.crdownload

2013-08-02 08:14 - 2012-03-02 21:16 - 00001979 _____ C:\Users\Public\Desktop\Google Chrome.lnk

2013-07-29 17:13 - 2013-07-29 17:13 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe

2013-07-29 17:13 - 2011-08-14 23:39 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl

2013-07-29 17:02 - 2012-04-12 18:35 - 00000680 _____ C:\Users\Andrea\AppData\Local\d3d9caps.dat

2013-07-29 13:10 - 2013-07-29 13:10 - 00000175 _____ C:\Windows\system32\Drivers\aswVmm.sys.sum

2013-07-29 13:10 - 2013-07-29 13:10 - 00000175 _____ C:\Windows\system32\Drivers\aswSP.sys.sum

2013-07-29 13:10 - 2013-07-29 13:10 - 00000175 _____ C:\Windows\system32\Drivers\aswSnx.sys.sum

2013-07-29 13:10 - 2013-07-29 13:09 - 00175176 _____ C:\Windows\system32\Drivers\aswVmm.sys

2013-07-29 13:10 - 2011-11-15 18:20 - 00770344 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys

2013-07-29 13:10 - 2010-09-14 11:00 - 00369584 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys

2013-07-29 13:09 - 2006-11-02 12:23 - 00002577 _____ C:\Windows\system32\config.nt

2013-07-25 04:40 - 2013-08-15 00:47 - 12334080 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2013-07-25 04:32 - 2013-08-15 00:47 - 01800704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2013-07-25 04:30 - 2013-08-15 00:47 - 09738752 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2013-07-25 04:26 - 2013-08-15 00:47 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2013-07-25 04:26 - 2013-08-15 00:47 - 01104384 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2013-07-25 04:25 - 2013-08-15 00:47 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2013-07-25 04:24 - 2013-08-15 00:47 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll

2013-07-25 04:24 - 2013-08-15 00:47 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2013-07-25 04:23 - 2013-08-15 00:47 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2013-07-25 04:23 - 2013-08-15 00:47 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2013-07-25 04:23 - 2013-08-15 00:47 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2013-07-25 04:23 - 2013-08-15 00:47 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2013-07-25 04:23 - 2013-08-15 00:47 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2013-07-25 04:22 - 2013-08-15 00:47 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2013-07-25 04:22 - 2013-08-15 00:47 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2013-07-25 04:22 - 2013-08-15 00:47 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2013-07-17 21:41 - 2013-08-14 22:51 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
 

Files to move or delete:

====================

C:\ProgramData\nvModes.dat
 

==================== Bamital & volsnap Check =================
 

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-08-15 08:44
 

==================== End Of Log ============================

--- --- ---

--- --- ---

Was war das eigentlich für ein Ding, oder besser was hätte ich mir da installiert, wenn ich es hätte laufen lassen?
Danke und lg,
Plekdemon

Das war Adware :)

Adobe Reader updaten.

Fertig :)

Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Hier noch ein paar Tipps zur Absicherung deines Systems.

Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
Windows Updates
- Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
- Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
Gehe sicher das die automatischen Updates aktiviert sind.
Software Updates
Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

MalwareBytes Anti Malware
Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
Ein Tutorial zur Verwendung findest Du hier.
WinPatrol
Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

SpywareBlaster
Eine kurze Einführung findest du Hier
MVPs hosts file
Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
WOT (Web of trust)
Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

Opera
Mozilla Firefox.
- Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
- NoScript
  Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
- AdblockPlus
  Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
  Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )

Don'ts

Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.