Trojaner-Board - Systembefall nach vermeindlichem Flash-Player Update

Hey,

hier die gewünschten Logfiles:

Code:

defogger_disable by jpshortstuff (23.02.10.1)

Log created at 14:16 on 24/08/2013 (Gerrit)
 

Checking for autostart values...

HKCU\~\Run values retrieved.

HKLM\~\Run values retrieved.
 

Checking for services/drivers...
 
 

-=E.O.F=-

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 23-08-2013 01

Ran by Gerrit (administrator) on 24-08-2013 13:44:03

Running from C:\Users\Gerrit\Desktop

Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Normal
 

==================== Processes (Whitelisted) =================
 

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe

(Taiwan Shui Mu Chih Ching Technology Limited.) C:\Program Files (x86)\WinZipper\winzipersvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Adobe Systems Incorporated) c:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\adminservice.exe

(Conexant Systems Inc.) C:\Windows\system32\CxAudMsg64.exe

(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe

(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe

(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe

(Acer Incorporated) C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe

(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe

(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe

(NTI Corporation) C:\Program Files (x86)\NTI\Packard Bell MyBackup\IScheduleSvc.exe

() C:\Windows\SysWOW64\PnkBstrA.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe

(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe

(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe

(NTI Corporation) C:\Program Files (x86)\NTI\Packard Bell MyBackup\BackupManagerTray.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe

(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe

(Dolby Laboratories Inc.) C:\Dolby PCEE4\pcee4.exe

(Elaborate Bytes AG) C:\Program Files (x86)\VirtualCloneDrive\VCDDaemon.exe

(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe

(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe

(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BrMfcmon.exe

(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe

(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12Agent.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

(Intel Corporation) C:\Windows\system32\igfxext.exe

(Intel Corporation) C:\Windows\system32\igfxsrvc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerEvent.exe

(CyberLink) C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe

(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMP\CLHNServer\CLHNServiceForPowerDVD12.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [IntelTBRunOnce] - C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs [4526 2010-11-29] ()

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2723624 2011-03-28] (Synaptics Incorporated)

HKLM\...\Run: [AtherosBtStack] - C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [617120 2011-03-13] (Atheros Communications)

HKLM\...\Run: [AthBtTray] - C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe [379552 2011-03-13] (Atheros Commnucations)

HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [497648 2010-07-29] (Adobe Systems Incorporated)

HKLM\...\Run: [Power Management] - C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe [1796200 2011-02-22] (Acer Incorporated)

HKCU\...\Run: [Facebook Update] - "C:\Users\Gerrit\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver [x]

HKCU\...\Run: [Steam] - C:\Program Files (x86)\Steam\Steam.exe [1807272 2013-07-27] (Valve Corporation)

HKCU\...\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] - "C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020 [x]

HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2011-02-18] (Intel Corporation)

HKLM-x32\...\Run: [BackupManagerTray] - C:\Program Files (x86)\NTI\Packard Bell MyBackup\BackupManagerTray.exe [295744 2011-02-15] (NTI Corporation)

HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [41056 2013-05-08] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [LManager] - C:\Program Files (x86)\Launch Manager\LManager.exe [1081424 2011-03-14] (Dritek System Inc.)

HKLM-x32\...\Run: [NUSB3MON] - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)

HKLM-x32\...\Run: [Dolby Home Theater v4] - C:\Dolby PCEE4\pcee4.exe [506712 2011-02-03] (Dolby Laboratories Inc.)

HKLM-x32\...\Run: [NBKeyScan] - "C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [x]

HKLM-x32\...\Run: [VirtualCloneDrive] - C:\Program Files (x86)\VirtualCloneDrive\VCDDaemon.exe [89456 2011-03-07] (Elaborate Bytes AG)

HKLM-x32\...\Run: [GrooveMonitor] - C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [31072 2008-10-25] (Microsoft Corporation)

HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254696 2012-01-18] (Sun Microsystems, Inc.)

HKLM-x32\...\Run: [BrMfcWnd] - C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe [1159168 2009-05-26] (Brother Industries, Ltd.)

HKLM-x32\...\Run: [ControlCenter3] - C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)

HKLM-x32\...\Run: [PowerDVD12DMREngine] - C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe [501544 2012-01-02] (CyberLink)

HKLM-x32\...\Run: [PowerDVD12Agent] - C:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12Agent.exe [371256 2012-01-12] (CyberLink Corp.)

HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [345144 2013-08-06] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [SDTray] - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)

HKU\Default\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Packard Bell\Screensaver\run_Packard Bell.exe [154144 2010-07-29] ()

HKU\Default User\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Packard Bell\Screensaver\run_Packard Bell.exe [154144 2010-07-29] ()

AppInit_DLLs: C:\Windows\system32\nvinitx.dll [226920 2011-03-31] (NVIDIA Corporation)

AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll [193128 2011-03-31] (NVIDIA Corporation)

BootExecute: autocheck autochk * sdnclean64.exe
 

==================== Internet (Whitelisted) ====================
 

ProxyServer: localhost:21320

StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.qvo6.com/?utm_source=b&utm_medium=amt&from=amt&uid=WDCXWD5000BPVT-22HXZT1_WD-WXF1E61RLX71RLX71&ts=1377276521

SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=amt&from=amt&uid=WDCXWD5000BPVT-22HXZT1_WD-WXF1E61RLX71RLX71&ts=1377276521

SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=amt&from=amt&uid=WDCXWD5000BPVT-22HXZT1_WD-WXF1E61RLX71RLX71&ts=1377276521

SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=amt&from=amt&uid=WDCXWD5000BPVT-22HXZT1_WD-WXF1E61RLX71RLX71&ts=1377276521

SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=amt&from=amt&uid=WDCXWD5000BPVT-22HXZT1_WD-WXF1E61RLX71RLX71&ts=1377276521

SearchScopes: HKCU - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 

SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)

BHO-x32: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)

BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: DealPly Shopping - {9cf699ca-2174-4ed8-bec1-ba82095edce0} - C:\Program Files (x86)\DealPly\DealPlyIE.dll No File

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)

DPF: HKLM {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
 

Chrome: 

=======

CHR DefaultSearchURL: (qvo6) - hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=amt&from=amt&uid=WDCXWD5000BPVT-22HXZT1_WD-WXF1E61RLX71RLX71&ts=1377276521&type=default&q={searchTerms}

CHR DefaultSuggestURL: (qvo6) -       "suggest_url": ""

CHR Extension: (ProxTube) - C:\Users\Gerrit\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek\1.2.3_0

CHR Extension: (Google Docs) - C:\Users\Gerrit\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0

CHR Extension: (Google Drive) - C:\Users\Gerrit\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0

CHR Extension: (YouTube) - C:\Users\Gerrit\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_1

CHR Extension: (Google Search) - C:\Users\Gerrit\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_1

CHR Extension: (DealPly  Shopping) - C:\Users\Gerrit\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejnmnhkgiphcaeefbaooconkceehicfi\3.5.0.0_0

CHR Extension: (LyricXeeker) - C:\Users\Gerrit\AppData\Local\Google\Chrome\User Data\Default\Extensions\epojlgbehpaeekopencdagbdamnkppci\1.128_0

CHR Extension: (Lightning Newtab) - C:\Users\Gerrit\AppData\Local\Google\Chrome\User Data\Default\Extensions\ifohbjbgfchkkfhphahclmkpgejiplfo\0.0.4.1_0

CHR Extension: (Google Wallet Service) - C:\Users\Gerrit\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.9_0

CHR Extension: (Gmail) - C:\Users\Gerrit\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0

CHR HKLM-x32\...\Chrome\Extension: [epojlgbehpaeekopencdagbdamnkppci] - C:\Program Files (x86)\LyriXeeker\128.crx

CHR HKLM-x32\...\Chrome\Extension: [ifohbjbgfchkkfhphahclmkpgejiplfo] - C:\Users\Gerrit\AppData\Local\Google\Chrome\User Data\Default\Extensions\newtab.crx

CHR StartMenuInternet: Google Chrome - <$PROGRAMFILES>\Google\Chrome\Application\chrome.exe
 

==================== Services (Whitelisted) =================
 

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-08-06] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-08-06] (Avira Operations GmbH & Co. KG)

R2 CLHNServiceForPowerDVD12; C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMP\CLHNServer\CLHNServiceForPowerDVD12.exe [87336 2012-01-12] (CyberLink Corp.)

R2 CyberLink PowerDVD 12 Media Server Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe [75048 2012-01-12] (CyberLink)

R2 CyberLink PowerDVD 12 Media Server Service; C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe [296232 2012-01-12] (CyberLink)

R2 ePowerSvc; C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe [873064 2011-02-22] (Acer Incorporated)

R2 GREGService; C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe [23584 2010-01-08] (Acer Incorporated)

R2 Live Updater Service; C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe [244624 2011-01-31] (Acer Incorporated)

R2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Packard Bell MyBackup\IScheduleSvc.exe [257344 2011-02-15] (NTI Corporation)

R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [75136 2012-11-21] ()

R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1817560 2013-05-16] (Safer-Networking Ltd.)

R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1033688 2013-05-16] (Safer-Networking Ltd.)

S3 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2013-05-15] (Safer-Networking Ltd.)

R2 winzipersvc; C:\Program Files (x86)\WinZipper\winzipersvc.exe [424104 2013-08-23] (Taiwan Shui Mu Chih Ching Technology Limited.)
 

==================== Drivers (Whitelisted) ====================
 

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [100712 2013-08-06] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130016 2013-08-06] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-08-06] (Avira Operations GmbH & Co. KG)

R2 ntk_PowerDVD12; C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMP\CLHNServer\ntk_PowerDVD12_64.sys [82928 2011-10-27] (Cyberlink Corp.)

R2 ntk_PowerDVD12; C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMP\CLHNServer\ntk_PowerDVD12_64.sys [82928 2011-10-27] (Cyberlink Corp.)

S3 s0016bus; C:\Windows\System32\DRIVERS\s0016bus.sys [115240 2008-05-16] (MCCI Corporation)

S3 s0016mdfl; C:\Windows\System32\DRIVERS\s0016mdfl.sys [19496 2008-05-16] (MCCI Corporation)

S3 s0016mdm; C:\Windows\System32\DRIVERS\s0016mdm.sys [158760 2008-05-16] (MCCI Corporation)

S3 s0016mgmt; C:\Windows\System32\DRIVERS\s0016mgmt.sys [137256 2008-05-16] (MCCI Corporation)

S3 s0016nd5; C:\Windows\System32\DRIVERS\s0016nd5.sys [34344 2008-05-16] (MCCI Corporation)

S3 s0016obex; C:\Windows\System32\DRIVERS\s0016obex.sys [136744 2008-05-16] (MCCI Corporation)

S3 s0016unic; C:\Windows\System32\DRIVERS\s0016unic.sys [151592 2008-05-16] (MCCI Corporation)

R2 {329F96B6-DF1E-4328-BFDA-39EA953C1312}; C:\Program Files (x86)\CyberLink\PowerDVD12\Common\NavFilter\000.fcl [146928 2012-01-11] (CyberLink Corp.)

R2 {329F96B6-DF1E-4328-BFDA-39EA953C1312}; C:\Program Files (x86)\CyberLink\PowerDVD12\Common\NavFilter\000.fcl [146928 2012-01-11] (CyberLink Corp.)
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-08-23 19:37 - 2013-08-23 19:37 - 00000000 ____D C:\Users\Gerrit\AppData\Roaming\Malwarebytes

2013-08-23 19:36 - 2013-08-23 19:36 - 00001085 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-08-23 19:36 - 2013-08-23 19:36 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-08-23 19:36 - 2013-08-23 19:36 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-08-23 19:36 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2013-08-23 19:34 - 2013-08-23 19:28 - 01576584 _____ (Farbar) C:\Users\Gerrit\Desktop\FRST64.exe

2013-08-23 19:18 - 2013-08-24 13:28 - 00001984 _____ C:\Users\Gerrit\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lollipop.lnk

2013-08-23 19:15 - 2013-08-23 19:15 - 00004776 _____ C:\Windows\wininit.ini

2013-08-23 18:50 - 2013-08-24 13:33 - 00000000 ____D C:\Program Files (x86)\WinZipper

2013-08-23 18:50 - 2013-08-23 18:50 - 00000000 ____D C:\Users\Gerrit\AppData\Roaming\WinZipper

2013-08-23 18:49 - 2013-08-23 19:54 - 00000906 _____ C:\Windows\Tasks\DealPlyLiveUpdateTaskMachineUA.job

2013-08-23 18:49 - 2013-08-23 19:50 - 00000294 _____ C:\Windows\Tasks\Dealply.job

2013-08-23 18:49 - 2013-08-23 18:49 - 00003902 _____ C:\Windows\System32\Tasks\DealPlyLiveUpdateTaskMachineUA

2013-08-23 18:49 - 2013-08-23 18:49 - 00003368 _____ C:\Windows\System32\Tasks\DealPlyUpdate

2013-08-23 18:49 - 2013-08-23 18:49 - 00003238 _____ C:\Windows\System32\Tasks\Dealply

2013-08-23 18:48 - 2013-08-23 18:48 - 00000000 ____D C:\Users\Gerrit\AppData\Local\SwvUpdater

2013-08-23 18:19 - 2013-08-24 13:29 - 00000000 ____D C:\Program Files (x86)\LyriXeeker

2013-08-23 12:05 - 2013-08-23 12:39 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy

2013-08-23 12:05 - 2013-08-23 12:05 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking

2013-08-23 12:05 - 2009-01-25 13:14 - 00017272 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe

2013-08-23 12:04 - 2013-08-23 12:09 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2

2013-08-23 11:58 - 2013-08-24 13:30 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2013-08-23 11:58 - 2013-08-23 20:03 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2013-08-23 11:58 - 2013-08-23 11:59 - 00000000 ____D C:\Program Files (x86)\Google

2013-08-23 11:58 - 2013-08-23 11:58 - 00004106 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA

2013-08-23 11:58 - 2013-08-23 11:58 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

2013-08-20 11:43 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2013-08-20 11:43 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2013-08-20 11:43 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2013-08-20 11:43 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2013-08-20 11:43 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2013-08-20 11:43 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2013-08-20 11:43 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2013-08-20 11:43 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2013-08-20 11:43 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2013-08-20 11:43 - 2013-07-26 07:12 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2013-08-20 11:43 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll

2013-08-20 11:43 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2013-08-20 11:43 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2013-08-20 11:43 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2013-08-20 11:43 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2013-08-20 11:43 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2013-08-20 11:43 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2013-08-20 11:43 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2013-08-20 11:43 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2013-08-20 11:43 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2013-08-20 11:43 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2013-08-20 11:43 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2013-08-20 11:43 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2013-08-20 11:43 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll

2013-08-20 11:43 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2013-08-20 11:43 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2013-08-20 11:43 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2013-08-20 11:43 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2013-08-20 11:43 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2013-08-20 11:43 - 2013-07-26 04:39 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe

2013-08-20 11:43 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe

2013-08-19 18:17 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL

2013-08-19 18:17 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL

2013-08-19 18:17 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll

2013-08-19 18:17 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll

2013-08-19 18:17 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll

2013-08-19 18:17 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll

2013-08-19 18:17 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll

2013-08-19 18:17 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll

2013-08-19 18:17 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll

2013-08-19 18:17 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll

2013-08-19 18:17 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll

2013-08-19 18:17 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll

2013-08-19 18:17 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll

2013-08-19 18:17 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll

2013-08-19 18:17 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys

2013-08-19 18:17 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys

2013-08-06 11:19 - 2013-08-06 11:19 - 00000000 ____D C:\Users\Gerrit\AppData\Roaming\Avira

2013-08-06 11:15 - 2013-08-06 11:15 - 00083672 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys

2013-08-06 11:14 - 2013-08-06 11:14 - 00000000 ____D C:\ProgramData\APN

2013-08-06 11:13 - 2013-08-06 11:14 - 00000000 ____D C:\ProgramData\Avira

2013-08-06 11:13 - 2013-08-06 11:13 - 00000000 ____D C:\Program Files (x86)\Avira

2013-08-06 11:13 - 2013-08-06 11:10 - 00130016 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys

2013-08-06 11:13 - 2013-08-06 11:10 - 00100712 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys

2013-08-06 11:13 - 2013-08-06 11:10 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys

2013-07-27 09:28 - 2013-07-27 09:28 - 00000000 ____D C:\Users\Gerrit\Desktop\Borkum - 20.07.2013
 

==================== One Month Modified Files and Folders =======
 

2013-08-24 13:44 - 2013-08-24 13:44 - 00000000 ____D C:\FRST

2013-08-24 13:41 - 2013-02-10 17:37 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2013-08-24 13:38 - 2009-07-14 06:45 - 00016752 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-08-24 13:38 - 2009-07-14 06:45 - 00016752 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-08-24 13:34 - 2011-08-10 20:01 - 01060817 _____ C:\Windows\WindowsUpdate.log

2013-08-24 13:33 - 2013-08-23 18:50 - 00000000 ____D C:\Program Files (x86)\WinZipper

2013-08-24 13:31 - 2012-03-17 17:14 - 00000000 ____D C:\Program Files (x86)\Steam

2013-08-24 13:30 - 2013-08-23 11:58 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2013-08-24 13:30 - 2012-11-06 18:29 - 00032401 _____ C:\Windows\setupact.log

2013-08-24 13:30 - 2010-11-21 05:47 - 00432394 _____ C:\Windows\PFRO.log

2013-08-24 13:30 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2013-08-24 13:29 - 2013-08-23 18:19 - 00000000 ____D C:\Program Files (x86)\LyriXeeker

2013-08-24 13:28 - 2013-08-23 19:18 - 00001984 _____ C:\Users\Gerrit\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lollipop.lnk

2013-08-23 20:03 - 2013-08-23 11:58 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2013-08-23 19:54 - 2013-08-23 18:49 - 00000906 _____ C:\Windows\Tasks\DealPlyLiveUpdateTaskMachineUA.job

2013-08-23 19:50 - 2013-08-23 18:49 - 00000294 _____ C:\Windows\Tasks\Dealply.job

2013-08-23 19:40 - 2011-08-11 05:53 - 00700468 _____ C:\Windows\system32\perfh007.dat

2013-08-23 19:40 - 2011-08-11 05:53 - 00149232 _____ C:\Windows\system32\perfc007.dat

2013-08-23 19:40 - 2009-07-14 07:13 - 01621448 _____ C:\Windows\system32\PerfStringBackup.INI

2013-08-23 19:37 - 2013-08-23 19:37 - 00000000 ____D C:\Users\Gerrit\AppData\Roaming\Malwarebytes

2013-08-23 19:36 - 2013-08-23 19:36 - 00001085 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-08-23 19:36 - 2013-08-23 19:36 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-08-23 19:36 - 2013-08-23 19:36 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-08-23 19:28 - 2013-08-23 19:34 - 01576584 _____ (Farbar) C:\Users\Gerrit\Desktop\FRST64.exe

2013-08-23 19:18 - 2009-07-14 06:45 - 00432760 _____ C:\Windows\system32\FNTCACHE.DAT

2013-08-23 19:15 - 2013-08-23 19:15 - 00004776 _____ C:\Windows\wininit.ini

2013-08-23 18:51 - 2012-03-17 16:37 - 00001142 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2815610152-1451309939-3061597360-1001UA.job

2013-08-23 18:50 - 2013-08-23 18:50 - 00000000 ____D C:\Users\Gerrit\AppData\Roaming\WinZipper

2013-08-23 18:49 - 2013-08-23 18:49 - 00003902 _____ C:\Windows\System32\Tasks\DealPlyLiveUpdateTaskMachineUA

2013-08-23 18:49 - 2013-08-23 18:49 - 00003368 _____ C:\Windows\System32\Tasks\DealPlyUpdate

2013-08-23 18:49 - 2013-08-23 18:49 - 00003238 _____ C:\Windows\System32\Tasks\Dealply

2013-08-23 18:48 - 2013-08-23 18:48 - 00000000 ____D C:\Users\Gerrit\AppData\Local\SwvUpdater

2013-08-23 18:48 - 2012-03-17 16:02 - 00112928 _____ C:\Users\Gerrit\AppData\Local\GDIPFONTCACHEV1.DAT

2013-08-23 12:39 - 2013-08-23 12:05 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy

2013-08-23 12:09 - 2013-08-23 12:04 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2

2013-08-23 12:05 - 2013-08-23 12:05 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking

2013-08-23 12:00 - 2012-03-17 16:30 - 00000000 ____D C:\Users\Gerrit\AppData\Local\Google

2013-08-23 11:59 - 2013-08-23 11:58 - 00000000 ____D C:\Program Files (x86)\Google

2013-08-23 11:58 - 2013-08-23 11:58 - 00004106 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA

2013-08-23 11:58 - 2013-08-23 11:58 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

2013-08-21 11:09 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache

2013-08-20 23:41 - 2013-02-10 17:37 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater

2013-08-20 23:41 - 2012-08-23 15:28 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2013-08-20 23:41 - 2012-03-18 14:04 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2013-08-19 21:51 - 2012-03-17 16:37 - 00001120 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2815610152-1451309939-3061597360-1001Core.job

2013-08-14 17:21 - 2012-05-16 18:54 - 00000000 ____D C:\Users\Gerrit\AppData\Roaming\Mp3tag

2013-08-06 11:19 - 2013-08-06 11:19 - 00000000 ____D C:\Users\Gerrit\AppData\Roaming\Avira

2013-08-06 11:15 - 2013-08-06 11:15 - 00083672 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys

2013-08-06 11:14 - 2013-08-06 11:14 - 00000000 ____D C:\ProgramData\APN

2013-08-06 11:14 - 2013-08-06 11:13 - 00000000 ____D C:\ProgramData\Avira

2013-08-06 11:13 - 2013-08-06 11:13 - 00000000 ____D C:\Program Files (x86)\Avira

2013-08-06 11:10 - 2013-08-06 11:13 - 00130016 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys

2013-08-06 11:10 - 2013-08-06 11:13 - 00100712 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys

2013-08-06 11:10 - 2013-08-06 11:13 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys

2013-07-29 11:12 - 2011-05-19 08:50 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight

2013-07-27 09:28 - 2013-07-27 09:28 - 00000000 ____D C:\Users\Gerrit\Desktop\Borkum - 20.07.2013

2013-07-26 07:13 - 2013-08-20 11:43 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2013-07-26 07:13 - 2013-08-20 11:43 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2013-07-26 07:13 - 2013-08-20 11:43 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2013-07-26 07:12 - 2013-08-20 11:43 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2013-07-26 07:12 - 2013-08-20 11:43 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2013-07-26 07:12 - 2013-08-20 11:43 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2013-07-26 07:12 - 2013-08-20 11:43 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2013-07-26 07:12 - 2013-08-20 11:43 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2013-07-26 07:12 - 2013-08-20 11:43 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2013-07-26 07:12 - 2013-08-20 11:43 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2013-07-26 07:12 - 2013-08-20 11:43 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll

2013-07-26 07:12 - 2013-08-20 11:43 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2013-07-26 07:12 - 2013-08-20 11:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2013-07-26 07:12 - 2013-08-20 11:43 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2013-07-26 05:35 - 2013-08-20 11:43 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2013-07-26 05:13 - 2013-08-20 11:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2013-07-26 05:13 - 2013-08-20 11:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2013-07-26 05:12 - 2013-08-20 11:43 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2013-07-26 05:12 - 2013-08-20 11:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2013-07-26 05:12 - 2013-08-20 11:43 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2013-07-26 05:12 - 2013-08-20 11:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2013-07-26 05:12 - 2013-08-20 11:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2013-07-26 05:12 - 2013-08-20 11:43 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2013-07-26 05:12 - 2013-08-20 11:43 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll

2013-07-26 05:12 - 2013-08-20 11:43 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2013-07-26 05:12 - 2013-08-20 11:43 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2013-07-26 05:11 - 2013-08-20 11:43 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2013-07-26 05:11 - 2013-08-20 11:43 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2013-07-26 04:49 - 2013-08-20 11:43 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2013-07-26 04:39 - 2013-08-20 11:43 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe

2013-07-26 03:59 - 2013-08-20 11:43 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe

2013-07-25 11:25 - 2013-08-19 18:17 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL

2013-07-25 10:57 - 2013-08-19 18:17 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-08-12 17:20
 

==================== End Of Log ============================

--- --- ---

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 23-08-2013 01

Ran by Gerrit at 2013-08-24 13:45:10

Running from C:\Users\Gerrit\Desktop

Boot Mode: Normal

==========================================================
 
 

==================== Installed Programs =======================
 

   

2007 Microsoft Office Suite Service Pack 2 (SP2) (x32)

7-Zip 9.20 (x64 edition) (Version: 9.20.00.0)

Acrobat.com (x32 Version: 1.6.65)

Adobe AIR (x32 Version: 1.5.3.9130)

Adobe Community Help (x32 Version: 3.2.1)

Adobe Community Help (x32 Version: 3.2.1.650)

Adobe Flash Player 11 ActiveX (x32 Version: 11.8.800.94)

Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.94)

Adobe Photoshop Elements 9 (x32 Version: 9.0)

Adobe Premiere Elements 9 (x32 Version: 9.0)

Adobe Reader 9.5.5 MUI (x32 Version: 9.5.5)

Ashampoo Music Studio 3.50 (x32 Version: 3.5.0)

Assassin's Creed Revelations 1.03 (x32 Version: 1.03)

Assassin's Creed(R) III v1.04 (x32 Version: 1.04)

Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (x32 Version: 1.0.0.36)

Avira Free Antivirus (x32 Version: 13.0.0.3885)

Backup Manager V3 (x32 Version: 3.0.0.85)

Bluetooth Win7 Suite (64) (Version: 7.2.0.65)

Brother MFL-Pro Suite DCP-135C (x32 Version: 1.0.2.0)

Counter-Strike (x32)

Counter-Strike: Source (x32)

CyberLink MediaEspresso (x32 Version: 6.5.1615_36053b)

CyberLink PowerDVD 12 (x32 Version: 12.0.1312.54)

D3DX10 (x32 Version: 15.4.2368.0902)

DVDStyler v2.2 (x32)

Elements 9 Organizer (x32 Version: 9.0)

Elements STI Installer (x32 Version: 1.0)

EVEREST Home Edition v2.20 (x32 Version: 2.20)

exant HD Audio (Version: 8.54.8.50)

Facebook Video Calling 1.2.0.287 (x32 Version: 1.2.287)

Fotogalerija Windows Live (x32 Version: 15.4.3502.0922)

Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922)

Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922)

Galeria fotogràfica del Windows Live (x32 Version: 15.4.3502.0922)

Galeria fotografii usługi Windows Live (x32 Version: 15.4.3502.0922)

Galerie de photos Windows Live (x32 Version: 15.4.3502.0922)

Galerie foto Windows Live (x32 Version: 15.4.3502.0922)

Google Chrome (x32 Version: 29.0.1547.57)

Google Update Helper (x32 Version: 1.3.21.153)

HomeMedia (x32 Version: 2.0.8520)

Identity Card (x32 Version: 1.00.3006)

Intel(R) Control Center (x32 Version: 1.2.1.1007)

Intel(R) Management Engine Components (x32 Version: 7.0.0.1144)

Intel(R) Processor Graphics (x32 Version: 8.15.10.2342)

Intel(R) Rapid Storage Technology (x32 Version: 10.1.5.1001)

Java Auto Updater (x32 Version: 2.0.7.1)

Java(TM) 6 Update 31 (x32 Version: 6.0.310)

JDownloader 0.9 (x32 Version: 0.9)

Junk Mail filter update (x32 Version: 15.4.3502.0922)

K-Lite Codec Pack 8.2.0 (Full) (x32 Version: 8.2.0)

Launch Manager (x32 Version: 5.1.4)

LyricXeeker (x32)

Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)

Media Player Classic - Home Cinema 1.6.0.4014 x64 (Version: 1.6.0.4014)

MediaInfo 0.7.56 (Version: 0.7.56)

Mesh Runtime (x32 Version: 15.4.5722.2)

Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)

Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)

Microsoft .NET Framework 4 Extended (Version: 4.0.30319)

Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319)

Microsoft Application Error Reporting (Version: 12.0.6015.5000)

Microsoft Office Access MUI (German) 2007 (x32 Version: 12.0.6425.1000)

Microsoft Office Enterprise 2007 (x32 Version: 12.0.6425.1000)

Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6425.1000)

Microsoft Office Groove MUI (German) 2007 (x32 Version: 12.0.6425.1000)

Microsoft Office InfoPath MUI (German) 2007 (x32 Version: 12.0.6425.1000)

Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6425.1000)

Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6425.1000)

Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6425.1000)

Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6425.1000)

Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6425.1000)

Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6425.1000)

Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6425.1000)

Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6425.1000)

Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014)

Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.6425.1000)

Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6425.1000)

Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6425.1000)

Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6425.1000)

Microsoft Silverlight (x32 Version: 5.1.20513.0)

Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)

Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336)

Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)

Microsoft_VC80_CRT_x86 (x32 Version: 8.0.50727.4053)

Microsoft_VC80_MFC_x86 (x32 Version: 8.0.50727.4053)

Microsoft_VC80_MFCLOC_x86 (x32 Version: 8.0.50727.4053)

Microsoft_VC90_CRT_x86 (x32 Version: 1.00.0000)

mkv2vob (x32 Version: 2.4.9)

MKVToolNix 5.5.0 (x32 Version: 5.5.0)

Mp3tag v2.50 (x32 Version: v2.50)

MSVCRT (x32 Version: 15.4.2862.0708)

MSVCRT_amd64 (x32 Version: 15.4.2862.0708)

MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)

MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)

Nero 11 Collection 1 (x32 Version: 11.0.11200.12.0)

Nero 11 Kwik Themes 3 (x32 Version: 11.0.11200.12.0)

Nero 11 Kwik Themes 4 (x32 Version: 11.0.11200.12.0)

Nero 11 PiP Effects 1 (x32 Version: 11.0.11200.12.0)

Nero 11 Video Transitions 1 (x32 Version: 11.0.11200.12.0)

Nero Burning ROM 11 (x32 Version: 11.0.10400)

Nero Burning ROM 11 (x32 Version: 11.0.12200.23.100)

Nero Burning ROM 11 Help (CHM) (x32 Version: 11.0.10300)

Nero ControlCenter 11 (x32 Version: 11.0.12300.0.23)

Nero ControlCenter 11 Help (CHM) (x32 Version: 11.0.10300)

Nero Core Components 11 (x32 Version: 11.0.13500.1.0)

Nero RescueAgent 11 (x32 Version: 4.0.10600.10.100)

Nero RescueAgent 11 Help (CHM) (x32 Version: 11.0.10400)

Nero Update (x32 Version: 11.0.10623.22.0)

nero.prerequisites.msi (x32 Version: 11.0.20007)

neroxml (x32 Version: 1.0.0)

NVIDIA Grafiktreiber 268.00 (Version: 268.00)

NVIDIA Install Application (Version: 2.265.39.0)

NVIDIA Optimus 1.0.21 (Version: 1.0.21)

NVIDIA PhysX (x32 Version: 9.10.0514)

NVIDIA Systemsteuerung 268.00 (Version: 268.00)

NVIDIA Update Components (Version: 1.0.21)

Packard Bell MyBackup (x32 Version: 3.0.0.85)

Packard Bell Power Management (x32 Version: 6.00.3006)

Packard Bell Recovery Management (x32 Version: 5.00.3002)

Packard Bell Registration (x32 Version: 1.03.3004)

Packard Bell ScreenSaver (x32 Version: 1.1.0328.2011)

Packard Bell Social Networks (x32 Version: 2.0.2211)

Packard Bell Updater (x32 Version: 1.02.3005)

Poczta usługi Windows Live (x32 Version: 15.4.3502.0922)

Podstawowe programy Windows Live (x32 Version: 15.4.3502.0922)

Pošta Windows Live (x32 Version: 15.4.3502.0922)

PunkBuster Services (x32 Version: 0.991)

Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922)

Realtek PCIE Card Reader (x32 Version: 6.1.7600.77)

Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.0.34.0)

Skype™ 5.8 (x32 Version: 5.8.158)

Sony Ericsson Update Engine (x32 Version: 2.13.6.201305161305)

Sony PC Companion 2.10.165 (x32 Version: 2.10.165)

Spybot - Search & Destroy (x32 Version: 2.1.21)

Steam (x32 Version: 1.0.0.0)

SUPER © v2012.build.51 (April 7, 2012) Version v2012.build.51 (x32 Version: v2012.build.51)

Synaptics Pointing Device Driver (Version: 15.2.17.5)

Überwachungstool für die Intel® Turbo-Boost-Technik 2.0 (Version: 2.1.23.0)

Ubisoft Game Launcher (x32 Version: 1.0.0.0)

Uplay (x32 Version: 2.0)

Video Web Camera (x32 Version: 1.0.1510)

VirtualCloneDrive (x32)

VLC media player 2.0.1 (x32 Version: 2.0.1)

Welcome Center (x32 Version: 1.02.3102)

Windows Live Argazki Galeria (x32 Version: 15.4.3502.0922)

Windows Live Communications Platform (x32 Version: 15.4.3502.0922)

Windows Live Essentials (x32 Version: 15.4.3502.0922)

Windows Live Essentials (x32 Version: 15.4.3508.1109)

Windows Live Fotogaléria (x32 Version: 15.4.3502.0922)

Windows Live Fotogalerie (x32 Version: 15.4.3502.0922)

Windows Live Fotogalleri (x32 Version: 15.4.3502.0922)

Windows Live Fotoğraf Galerisi (x32 Version: 15.4.3502.0922)

Windows Live Fotótár (x32 Version: 15.4.3502.0922)

Windows Live Galeria de Fotos (x32 Version: 15.4.3502.0922)

Windows Live Galerija fotografija (x32 Version: 15.4.3502.0922)

Windows Live ID Sign-in Assistant (Version: 7.250.4225.0)

Windows Live Installer (x32 Version: 15.4.3502.0922)

Windows Live Language Selector (Version: 15.4.3508.1109)

Windows Live Mail (x32 Version: 15.4.3502.0922)

Windows Live Mesh (x32 Version: 15.4.3502.0922)

Windows Live Messenger (x32 Version: 15.4.3502.0922)

Windows Live MIME IFilter (Version: 15.4.3502.0922)

Windows Live Movie Maker (x32 Version: 15.4.3502.0922)

Windows Live Photo Common (x32 Version: 15.4.3502.0922)

Windows Live Photo Gallery (x32 Version: 15.4.3502.0922)

Windows Live PIMT Platform (x32 Version: 15.4.3508.1109)

Windows Live Remote Client (Version: 15.4.5722.2)

Windows Live Remote Client Resources (Version: 15.4.5722.2)

Windows Live Remote Service (Version: 15.4.5722.2)

Windows Live Remote Service Resources (Version: 15.4.5722.2)

Windows Live SOXE (x32 Version: 15.4.3502.0922)

Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922)

Windows Live Temel Parçalar (x32 Version: 15.4.3502.0922)

Windows Live UX Platform (x32 Version: 15.4.3502.0922)

Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109)

Windows Live Writer (x32 Version: 15.4.3502.0922)

Windows Live Writer Resources (x32 Version: 15.4.3502.0922)

Windows Live 影像中心 (x32 Version: 15.4.3502.0922)

Windows Live 程式集 (x32 Version: 15.4.3502.0922)

Windows Liven asennustyökalu (x32 Version: 15.4.3502.0922)

Windows Liven sähköposti (x32 Version: 15.4.3502.0922)

Windows Liven valokuvavalikoima (x32 Version: 15.4.3502.0922)

WinRAR 4.10 (64-Bit) (Version: 4.10.0)

WinZipper (x32 Version: 1.4.8)

Συλλογή φωτογραφιών του Windows Live (x32 Version: 15.4.3502.0922)

Основные компоненты Windows Live (x32 Version: 15.4.3502.0922)

Почта Windows Live (x32 Version: 15.4.3502.0922)

Фотоальбом Windows Live (x32 Version: 15.4.3502.0922)

Фотогалерия на Windows Live (x32 Version: 15.4.3502.0922)

גלריית התמונות של Windows Live (x32 Version: 15.4.3502.0922)

بريد Windows Live (x32 Version: 15.4.3502.0922)

معرض صور Windows Live (x32 Version: 15.4.3502.0922)
 

==================== Restore Points  =========================
 

06-08-2013 13:23:09 Windows Update

13-08-2013 10:08:56 Windows Update

19-08-2013 16:17:32 Windows Update

20-08-2013 09:37:33 Windows Update
 

==================== Hosts content: ==========================
 

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
 

==================== Scheduled Tasks (whitelisted) =============
 

Task: {08457ED6-5D21-4541-8095-762DB383DE87} - System32\Tasks\Desk 365 RunAsStdUser => C:\Program Files (x86)\Desk 365\desk365.exe No File

Task: {0A519DE6-169C-4211-9442-225B1BE0E9E5} - System32\Tasks\DealPlyLiveUpdateTaskMachineUA => C:\Program Files (x86)\DealPlyLive\Update\DealPlyLive.exe No File

Task: {0F22B8AA-CA83-48A8-8A30-DCC66E695BE5} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-08-23] (Google Inc.)

Task: {19E0EB28-F76C-4F8C-8586-8EA5A3D7DDAA} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-08-23] (Google Inc.)

Task: {1F2325B7-81BC-4BD8-AEDD-B760CF8F5800} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task

Task: {62E61A23-A48A-415E-A342-595108E60F27} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDUpdate.exe No File

Task: {69C5918C-9A46-4A29-9311-E930AD12E419} - System32\Tasks\DeviceDetector => C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe [2011-04-15] (CyberLink)

Task: {70B60F6F-BC45-4073-9119-A7076760B7A9} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDImmunize.exe No File

Task: {7589B0B4-92A3-44E5-B363-836205882EC3} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2815610152-1451309939-3061597360-1001Core => C:\Users\Gerrit\AppData\Local\Facebook\Update\FacebookUpdate.exe No File

Task: {786240B5-4993-431F-83EE-ECE14B07F84B} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2815610152-1451309939-3061597360-1001UA => C:\Users\Gerrit\AppData\Local\Facebook\Update\FacebookUpdate.exe No File

Task: {96698BA6-5579-4E7D-99F7-0CB8533AF741} - System32\Tasks\AdobeAAMUpdater-1.0-Gerrit-PC-Gerrit => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2010-07-29] (Adobe Systems Incorporated)

Task: {9934FC07-E5B7-4150-B861-C9D2E96960DD} - System32\Tasks\Dealply => C:\Users\Gerrit\AppData\Roaming\Dealply\UPDATE~1\UPDATE~1.EXE No File

Task: {9D4A5DA5-9785-460D-B5C4-638F7280D357} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDScan.exe No File

Task: {A253DF19-A183-481F-BE08-11C958A47ACD} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-08-20] (Adobe Systems Incorporated)

Task: {A38ADD47-37C8-4724-A9D7-F16C915E413E} - System32\Tasks\DealPlyUpdate => C:\Program No File

Task: {DA11961C-AEC7-4B8D-96E6-94A2BC432924} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => c:\program files\windows defender\MpCmdRun.exe [2009-07-14] (Microsoft Corporation)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\Dealply.job => C:\Users\Gerrit\AppData\Roaming\Dealply\UPDATE~1\UPDATE~1.EXE

Task: C:\Windows\Tasks\DealPlyLiveUpdateTaskMachineUA.job => C:\Program Files (x86)\DealPlyLive\Update\DealPlyLive.exe

Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2815610152-1451309939-3061597360-1001Core.job => C:\Users\Gerrit\AppData\Local\Facebook\Update\FacebookUpdate.exe

Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2815610152-1451309939-3061597360-1001UA.job => C:\Users\Gerrit\AppData\Local\Facebook\Update\FacebookUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
 

==================== Faulty Device Manager Devices =============
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (08/24/2013 01:30:45 PM) (Source: WinMgmt) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (08/24/2013 01:14:51 PM) (Source: WinMgmt) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (08/23/2013 07:18:52 PM) (Source: WinMgmt) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (08/23/2013 06:49:23 PM) (Source: MsiInstaller) (User: Gerrit-PC)

Description: Product: Google Update Helper -- Error 1316. A network error occurred while attempting to read from the file: C:\Program Files (x86)\DealPlyLive\Update\1.3.23.0\GoogleUpdateHelper.msi
 

Error: (08/23/2013 05:48:01 PM) (Source: WinMgmt) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (08/23/2013 11:16:43 AM) (Source: WinMgmt) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (08/22/2013 02:58:07 PM) (Source: Brother BrLog) (User: )

Description: WDLMW BrtWDLMW: [2013/08/22 14:58:07.699]: [00003920]: lperrcode->api = 1 , lperrcode->code = 2
 

Error: (08/22/2013 02:58:06 PM) (Source: Brother BrLog) (User: )

Description: WDLMW BrtWDLMW: [2013/08/22 14:58:06.199]: [00003920]: lperrcode->api = 1 , lperrcode->code = 2
 

Error: (08/22/2013 02:58:04 PM) (Source: Brother BrLog) (User: )

Description: WDLMW BrtWDLMW: [2013/08/22 14:58:04.698]: [00003920]: lperrcode->api = 1 , lperrcode->code = 2
 

Error: (08/22/2013 02:58:03 PM) (Source: Brother BrLog) (User: )

Description: WDLMW BrtWDLMW: [2013/08/22 14:58:03.197]: [00003920]: lperrcode->api = 1 , lperrcode->code = 2
 
 

System errors:

=============

Error: (08/23/2013 07:27:29 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Windows Update" wurde nicht richtig gestartet.
 

Error: (08/23/2013 07:23:42 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "NVIDIA Update Service Daemon" wurde nicht richtig gestartet.
 

Error: (08/23/2013 07:18:47 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Spybot-S&D 2 Scanner Service" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%1053
 

Error: (08/23/2013 07:18:47 PM) (Source: Service Control Manager) (User: )

Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Spybot-S&D 2 Scanner Service erreicht.
 

Error: (08/23/2013 06:51:50 PM) (Source: Service Control Manager) (User: )

Description: Dienst "Adobe Active File Monitor V9" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
 

Error: (08/23/2013 06:51:31 PM) (Source: Service Control Manager) (User: )

Description: Dienst "Wsys Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
 

Error: (08/23/2013 06:51:26 PM) (Source: Service Control Manager) (User: )

Description: Dienst "Acer ePower Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
 

Error: (08/23/2013 11:59:38 AM) (Source: DCOM) (User: )

Description: {5C65F4B0-3651-4514-B207-D10CB699B14B}
 

Error: (08/21/2013 10:09:33 AM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Windows Search" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%1053
 

Error: (08/21/2013 10:09:33 AM) (Source: Service Control Manager) (User: )

Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows Search erreicht.
 
 

Microsoft Office Sessions:

=========================
 

CodeIntegrity Errors:

===================================

  Date: 2012-03-18 15:17:19.215

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Users\Gerrit\AppData\Local\Temp\EverestDriver.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2012-03-18 15:17:19.215

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Users\Gerrit\AppData\Local\Temp\EverestDriver.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2012-03-18 15:17:19.152

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\EVEREST Home Edition\kerneld.amd64" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2012-03-18 15:17:19.152

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\EVEREST Home Edition\kerneld.amd64" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 
 

==================== Memory info =========================== 
 

Percentage of memory in use: 29%

Total physical RAM: 5995.86 MB

Available physical RAM: 4206.29 MB

Total Pagefile: 11989.9 MB

Available Pagefile: 9989.68 MB

Total Virtual: 8192 MB

Available Virtual: 8191.82 MB
 

==================== Drives ================================
 

Drive c: (Packard Bell) (Fixed) (Total:444.66 GB) (Free:244.29 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 293207FD)

Partition 1: (Not Active) - (Size=21 GB) - (Type=27)

Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=445 GB) - (Type=07 NTFS)
 

==================== End Of Log ============================

Code:

GMER 2.1.19163 - hxxp://www.gmer.net

Rootkit scan 2013-08-24 14:25:50

Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD50 rev.01.0 465,76GB

Running: gmer_2.1.19163.exe; Driver: C:\Users\Gerrit\AppData\Local\Temp\pgriapob.sys
 
 

---- User code sections - GMER 2.1 ----
 

.text  C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe[2064] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69          0000000076161465 2 bytes [16, 76]

.text  C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe[2064] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155         00000000761614bb 2 bytes [16, 76]

.text  ...                                                                                                                                                * 2

.text  C:\Program Files (x86)\NTI\Packard Bell MyBackup\IScheduleSvc.exe[2404] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                    0000000076161465 2 bytes [16, 76]

.text  C:\Program Files (x86)\NTI\Packard Bell MyBackup\IScheduleSvc.exe[2404] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                   00000000761614bb 2 bytes [16, 76]

.text  ...                                                                                                                                                * 2

.text  C:\Windows\SysWOW64\PnkBstrA.exe[2456] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 322                                                            0000000070c41a22 2 bytes [C4, 70]

.text  C:\Windows\SysWOW64\PnkBstrA.exe[2456] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 496                                                            0000000070c41ad0 2 bytes [C4, 70]

.text  C:\Windows\SysWOW64\PnkBstrA.exe[2456] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 552                                                            0000000070c41b08 2 bytes [C4, 70]

.text  C:\Windows\SysWOW64\PnkBstrA.exe[2456] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 730                                                            0000000070c41bba 2 bytes [C4, 70]

.text  C:\Windows\SysWOW64\PnkBstrA.exe[2456] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 762                                                            0000000070c41bda 2 bytes [C4, 70]

.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2480] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69                       0000000076161465 2 bytes [16, 76]

.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2480] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155                      00000000761614bb 2 bytes [16, 76]

.text  ...                                                                                                                                                * 2

.text  C:\Program Files (x86)\Steam\Steam.exe[3032] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                                       00000000765f1429 7 bytes JMP 0000000171e11e90

.text  C:\Program Files (x86)\Steam\Steam.exe[3032] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW                                              000000007660b223 5 bytes JMP 0000000171e11da0

.text  C:\Program Files (x86)\Steam\Steam.exe[3032] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                                              00000000766888f4 7 bytes JMP 0000000171e11d90

.text  C:\Program Files (x86)\Steam\Steam.exe[3032] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                                              0000000076688979 5 bytes JMP 0000000171e11e80

.text  C:\Program Files (x86)\Steam\Steam.exe[3032] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                                0000000076688ccf 5 bytes JMP 0000000171e11e10

.text  C:\Program Files (x86)\Steam\Steam.exe[3032] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                                   0000000074df1d1b 5 bytes JMP 0000000171e12450

.text  C:\Program Files (x86)\Steam\Steam.exe[3032] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                                 0000000074df1dc9 5 bytes JMP 0000000171e124b0

.text  C:\Program Files (x86)\Steam\Steam.exe[3032] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                                     0000000074df2aa4 5 bytes JMP 0000000171e12520

.text  C:\Program Files (x86)\Steam\Steam.exe[3032] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                                        0000000074df2d0a 5 bytes JMP 0000000171e12620

.text  C:\Program Files (x86)\Steam\Steam.exe[3032] C:\Windows\syswow64\KERNELBASE.dll!HeapCreate                                                         0000000074df548e 5 bytes JMP 0000000100490800

.text  C:\Program Files (x86)\NTI\Packard Bell MyBackup\BackupManagerTray.exe[2644] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69               0000000076161465 2 bytes [16, 76]

.text  C:\Program Files (x86)\NTI\Packard Bell MyBackup\BackupManagerTray.exe[2644] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155              00000000761614bb 2 bytes [16, 76]

.text  ...                                                                                                                                                * 2

.text  C:\Program Files (x86)\Launch Manager\LManager.exe[3052] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                   0000000076161465 2 bytes [16, 76]

.text  C:\Program Files (x86)\Launch Manager\LManager.exe[3052] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                  00000000761614bb 2 bytes [16, 76]

.text  ...                                                                                                                                                * 2

.text  C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe[3244] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter  00000000765e87b1 5 bytes JMP 0000000174741000

.text  C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe[3244] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69       0000000076161465 2 bytes [16, 76]

.text  C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe[3244] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155      00000000761614bb 2 bytes [16, 76]

.text  ...                                                                                                                                                * 2

.text  C:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12Agent.exe[3252] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter                 00000000765e87b1 5 bytes JMP 0000000174741000

.text  C:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12Agent.exe[3252] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                      0000000076161465 2 bytes [16, 76]

.text  C:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12Agent.exe[3252] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                     00000000761614bb 2 bytes [16, 76]

.text  ...                                                                                                                                                * 2

.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[3288] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69                        0000000076161465 2 bytes [16, 76]

.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[3288] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155                       00000000761614bb 2 bytes [16, 76]

.text  ...                                                                                                                                                * 2

.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4392] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                 0000000076161465 2 bytes [16, 76]

.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4392] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                00000000761614bb 2 bytes [16, 76]

.text  ...                                                                                                                                                * 2
 

---- Registry - GMER 2.1 ----
 

Reg    HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\3859f9581b5a                                                                        

Reg    HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\3859f9581b5a (not active ControlSet)                                                    
 

---- EOF - GMER 2.1 ----

Code:

Malwarebytes Anti-Malware 1.75.0.1300

www.malwarebytes.org
 

Datenbank Version: v2013.08.24.01
 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 10.0.9200.16660

Gerrit :: GERRIT-PC [Administrator]
 

24.08.2013 13:17:55

mbam-log-2013-08-24 (13-17-55).txt
 

Art des Suchlaufs: Quick-Scan

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 245584

Laufzeit: 5 Minute(n), 1 Sekunde(n)
 

Infizierte Speicherprozesse: 1

C:\Users\Gerrit\AppData\Local\Lollipop\Lollipop.exe (Adware.LolliPop.IT) -> 4004 -> Löschen bei Neustart.
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 6

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\lollipop (Adware.LolliPop.IT) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCU\SOFTWARE\INSTALLCORE (PUP.Optional.InstallCore.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{81563814-fea0-415e-ba46-5b4735306573} (PUP.Optional.LyricXeeker.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\CLSID\{81563814-fea0-415e-ba46-5b4735306573} (PUP.Optional.LyricXeeker.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\TypeLib\{7BD6FB1D-D418-48E1-95D1-53F2152945E7} (PUP.Optional.LyricXeeker.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\Interface\{31AC9AD1-BBF6-491B-8279-D7CDE5B5415E} (PUP.Optional.LyricXeeker.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

Infizierte Registrierungswerte: 2

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|lollipop (Adware.LolliPop.IT) -> Daten: "c:\users\gerrit\appdata\local\lollipop\lollipop.exe" lollipop -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCU\Software\InstallCore|tb (PUP.Optional.InstallCore.A) -> Daten: 0N2P2W1F0Z1S1U1H -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 3

C:\Users\Gerrit\AppData\Local\Lollipop (Adware.LolliPop.IT) -> Löschen bei Neustart.

C:\Users\Gerrit\AppData\Roaming\Dealply (PUP.Optional.DealPly.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Gerrit\AppData\Roaming\Dealply\UpdateProc (PUP.Optional.DealPly.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

Infizierte Dateien: 11

C:\Users\Gerrit\AppData\Roaming\Dealply\UpdateProc\UpdateTask.exe (PUP.DealPly.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Gerrit\AppData\Local\Lollipop\lollipop.bat (Adware.LolliPop.IT) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Gerrit\AppData\Local\Lollipop\logo.ico (Adware.LolliPop.IT) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Gerrit\AppData\Local\Lollipop\Lollipop.exe (Adware.LolliPop.IT) -> Löschen bei Neustart.

C:\Users\Gerrit\AppData\Local\Lollipop\lollipop.lpd (Adware.LolliPop.IT) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Gerrit\AppData\Local\Lollipop\lollipop_cfg.lpd (Adware.LolliPop.IT) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Gerrit\AppData\Local\Lollipop\lollipop_ps.lpd (Adware.LolliPop.IT) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Windows\Tasks\DealPlyLiveUpdateTaskMachineCore.job (PUP.Optional.DealPly.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Windows\Tasks\LyricXeeker Update.job (PUP.Optional.Lyrixeeker) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Gerrit\AppData\Roaming\Dealply\UpdateProc\config.dat (PUP.Optional.DealPly.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Program Files (x86)\LyriXeeker\128.dll (PUP.Optional.LyricXeeker.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

(Ende)

Einige Hintergrundprogramme scheinen schonmal weg zu sein :) Vielen Dank schonmal. Hier die nächsten Logs:

Code:

# AdwCleaner v3.000 - Report created 24/08/2013 at 18:33:33

# Updated 20/08/2013 by Xplode

# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)

# Username : Gerrit - GERRIT-PC

# Running from : C:\Users\Gerrit\Desktop\adwcleaner_3.0.exe

# Option : Clean
 

***** [ Services ] *****
 
 

***** [ Files / Folders ] *****
 

Folder Deleted : C:\ProgramData\APN

Folder Deleted : C:\Users\Gerrit\AppData\Local\SwvUpdater

Folder Deleted : C:\Users\Gerrit\AppData\Local\Temp\APN

Folder Deleted : C:\Users\Gerrit\AppData\Local\Temp\eIntaller

File Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\lollipop.lnk

File Deleted : C:\Users\Gerrit\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\lollipop.lnk

File Deleted : C:\Windows\Tasks\Dealply.job

File Deleted : C:\Windows\System32\Tasks\Dealply

File Deleted : C:\Windows\System32\Tasks\DealPlyUpdate
 

***** [ Shortcuts ] *****
 

Shortcut Disinfected : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Packard Bell - Security & Support\Contact.lnk

Shortcut Disinfected : C:\Users\Gerrit\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk

Shortcut Disinfected : C:\Users\Gerrit\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk

Shortcut Disinfected : C:\Users\Gerrit\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk
 

***** [ Registry ] *****
 

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_k-lite-codec-pack_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_k-lite-codec-pack_RASMANCS

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{A0EE0278-2986-4E5A-884E-A3BF0357E476}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7F1796B2-BEC6-427B-B734-F9C75ED94A80}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8C338DDB-19FC-4C1F-B74D-6931EE55F7A1}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7F1796B2-BEC6-427B-B734-F9C75ED94A80}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8C338DDB-19FC-4C1F-B74D-6931EE55F7A1}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C536F080-57B7-46D6-8894-C647553F2889}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}

Key Deleted : HKCU\Software\lollipop

Key Deleted : HKCU\Software\Softonic

Key Deleted : HKLM\Software\delta-homesSoftware
 

***** [ Browsers ] *****
 

-\\ Internet Explorer v10.0.9200.16660
 
 

-\\ Google Chrome v29.0.1547.57
 

[ File : C:\Users\Gerrit\AppData\Local\Google\Chrome\User Data\Default\preferences ]
 

Deleted : search_url

Deleted : keyword
 

*************************
 

AdwCleaner[R0].txt - [3919 octets] - [24/08/2013 18:32:58]

AdwCleaner[S0].txt - [3054 octets] - [24/08/2013 18:33:33]
 

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [3114 octets] ##########

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 23-08-2013 01

Ran by Gerrit (administrator) on 24-08-2013 18:35:45

Running from C:\Users\Gerrit\Desktop

Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Normal
 

==================== Processes (Whitelisted) =================
 

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe

(Taiwan Shui Mu Chih Ching Technology Limited.) C:\Program Files (x86)\WinZipper\winzipersvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Adobe Systems Incorporated) c:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\adminservice.exe

(Conexant Systems Inc.) C:\Windows\system32\CxAudMsg64.exe

(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe

(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe

(Acer Incorporated) C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe

(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe

(Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe

(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(NTI Corporation) C:\Program Files (x86)\NTI\Packard Bell MyBackup\IScheduleSvc.exe

(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe

(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe

() C:\Windows\SysWOW64\PnkBstrA.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe

(NTI Corporation) C:\Program Files (x86)\NTI\Packard Bell MyBackup\BackupManagerTray.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe

(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe

(Dolby Laboratories Inc.) C:\Dolby PCEE4\pcee4.exe

(Elaborate Bytes AG) C:\Program Files (x86)\VirtualCloneDrive\VCDDaemon.exe

(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe

(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe

(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe

(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12Agent.exe

(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BrMfcmon.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe

(Skype Technologies) C:\Program Files (x86)\Skype\Updater\Updater.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Intel Corporation) C:\Windows\system32\igfxext.exe

(Intel Corporation) C:\Windows\system32\igfxsrvc.exe

(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerEvent.exe

(CyberLink) C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [IntelTBRunOnce] - C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs [4526 2010-11-29] ()

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2723624 2011-03-28] (Synaptics Incorporated)

HKLM\...\Run: [AtherosBtStack] - C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [617120 2011-03-13] (Atheros Communications)

HKLM\...\Run: [AthBtTray] - C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe [379552 2011-03-13] (Atheros Commnucations)

HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [497648 2010-07-29] (Adobe Systems Incorporated)

HKLM\...\Run: [Power Management] - C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe [1796200 2011-02-22] (Acer Incorporated)

HKCU\...\Run: [Facebook Update] - "C:\Users\Gerrit\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver [x]

HKCU\...\Run: [Steam] - C:\Program Files (x86)\Steam\Steam.exe [1807272 2013-07-27] (Valve Corporation)

HKCU\...\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] - "C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020 [x]

HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2011-02-18] (Intel Corporation)

HKLM-x32\...\Run: [BackupManagerTray] - C:\Program Files (x86)\NTI\Packard Bell MyBackup\BackupManagerTray.exe [295744 2011-02-15] (NTI Corporation)

HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [41056 2013-05-08] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [LManager] - C:\Program Files (x86)\Launch Manager\LManager.exe [1081424 2011-03-14] (Dritek System Inc.)

HKLM-x32\...\Run: [NUSB3MON] - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)

HKLM-x32\...\Run: [Dolby Home Theater v4] - C:\Dolby PCEE4\pcee4.exe [506712 2011-02-03] (Dolby Laboratories Inc.)

HKLM-x32\...\Run: [NBKeyScan] - "C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [x]

HKLM-x32\...\Run: [VirtualCloneDrive] - C:\Program Files (x86)\VirtualCloneDrive\VCDDaemon.exe [89456 2011-03-07] (Elaborate Bytes AG)

HKLM-x32\...\Run: [GrooveMonitor] - C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [31072 2008-10-25] (Microsoft Corporation)

HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254696 2012-01-18] (Sun Microsystems, Inc.)

HKLM-x32\...\Run: [BrMfcWnd] - C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe [1159168 2009-05-26] (Brother Industries, Ltd.)

HKLM-x32\...\Run: [ControlCenter3] - C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)

HKLM-x32\...\Run: [PowerDVD12DMREngine] - C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe [501544 2012-01-02] (CyberLink)

HKLM-x32\...\Run: [PowerDVD12Agent] - C:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12Agent.exe [371256 2012-01-12] (CyberLink Corp.)

HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [345144 2013-08-06] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [SDTray] - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)

HKU\Default\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Packard Bell\Screensaver\run_Packard Bell.exe [154144 2010-07-29] ()

HKU\Default User\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Packard Bell\Screensaver\run_Packard Bell.exe [154144 2010-07-29] ()

HKU\UpdatusUser\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Packard Bell\Screensaver\run_Packard Bell.exe [154144 2010-07-29] ()

AppInit_DLLs: C:\Windows\system32\nvinitx.dll [226920 2011-03-31] (NVIDIA Corporation)

AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll [193128 2011-03-31] (NVIDIA Corporation)

BootExecute: autocheck autochk * sdnclean64.exe
 

==================== Internet (Whitelisted) ====================
 

ProxyServer: localhost:21320

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 

SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)

BHO-x32: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)

BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: DealPly Shopping - {9cf699ca-2174-4ed8-bec1-ba82095edce0} - C:\Program Files (x86)\DealPly\DealPlyIE.dll No File

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)

DPF: HKLM {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
 

Chrome: 

=======

Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION

CHR Extension: (ProxTube) - C:\Users\Gerrit\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek\1.2.3_0

CHR Extension: (Google Docs) - C:\Users\Gerrit\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0

CHR Extension: (Google Drive) - C:\Users\Gerrit\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0

CHR Extension: (YouTube) - C:\Users\Gerrit\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_1

CHR Extension: (Google Search) - C:\Users\Gerrit\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_1

CHR Extension: (DealPly  Shopping) - C:\Users\Gerrit\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejnmnhkgiphcaeefbaooconkceehicfi\3.5.0.0_0

CHR Extension: (LyricXeeker) - C:\Users\Gerrit\AppData\Local\Google\Chrome\User Data\Default\Extensions\epojlgbehpaeekopencdagbdamnkppci\1.128_0

CHR Extension: (Lightning Newtab) - C:\Users\Gerrit\AppData\Local\Google\Chrome\User Data\Default\Extensions\ifohbjbgfchkkfhphahclmkpgejiplfo\0.0.4.1_0

CHR Extension: (Google Wallet Service) - C:\Users\Gerrit\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.9_0

CHR Extension: (Gmail) - C:\Users\Gerrit\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0

CHR HKLM-x32\...\Chrome\Extension: [epojlgbehpaeekopencdagbdamnkppci] - C:\Program Files (x86)\LyriXeeker\128.crx

CHR HKLM-x32\...\Chrome\Extension: [ifohbjbgfchkkfhphahclmkpgejiplfo] - C:\Users\Gerrit\AppData\Local\Google\Chrome\User Data\Default\Extensions\newtab.crx

CHR StartMenuInternet: Google Chrome - <$PROGRAMFILES>\Google\Chrome\Application\chrome.exe
 

==================== Services (Whitelisted) =================
 

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-08-06] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-08-06] (Avira Operations GmbH & Co. KG)

S2 CLHNServiceForPowerDVD12; C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMP\CLHNServer\CLHNServiceForPowerDVD12.exe [87336 2012-01-12] (CyberLink Corp.)

R2 CyberLink PowerDVD 12 Media Server Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe [75048 2012-01-12] (CyberLink)

R2 CyberLink PowerDVD 12 Media Server Service; C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe [296232 2012-01-12] (CyberLink)

R2 ePowerSvc; C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe [873064 2011-02-22] (Acer Incorporated)

R2 GREGService; C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe [23584 2010-01-08] (Acer Incorporated)

R2 Live Updater Service; C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe [244624 2011-01-31] (Acer Incorporated)

R2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Packard Bell MyBackup\IScheduleSvc.exe [257344 2011-02-15] (NTI Corporation)

R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [75136 2012-11-21] ()

R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1817560 2013-05-16] (Safer-Networking Ltd.)

R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1033688 2013-05-16] (Safer-Networking Ltd.)

S3 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2013-05-15] (Safer-Networking Ltd.)

R2 winzipersvc; C:\Program Files (x86)\WinZipper\winzipersvc.exe [424104 2013-08-23] (Taiwan Shui Mu Chih Ching Technology Limited.)
 

==================== Drivers (Whitelisted) ====================
 

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [100712 2013-08-06] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130016 2013-08-06] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-08-06] (Avira Operations GmbH & Co. KG)

R2 ntk_PowerDVD12; C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMP\CLHNServer\ntk_PowerDVD12_64.sys [82928 2011-10-27] (Cyberlink Corp.)

R2 ntk_PowerDVD12; C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMP\CLHNServer\ntk_PowerDVD12_64.sys [82928 2011-10-27] (Cyberlink Corp.)

S3 s0016bus; C:\Windows\System32\DRIVERS\s0016bus.sys [115240 2008-05-16] (MCCI Corporation)

S3 s0016mdfl; C:\Windows\System32\DRIVERS\s0016mdfl.sys [19496 2008-05-16] (MCCI Corporation)

S3 s0016mdm; C:\Windows\System32\DRIVERS\s0016mdm.sys [158760 2008-05-16] (MCCI Corporation)

S3 s0016mgmt; C:\Windows\System32\DRIVERS\s0016mgmt.sys [137256 2008-05-16] (MCCI Corporation)

S3 s0016nd5; C:\Windows\System32\DRIVERS\s0016nd5.sys [34344 2008-05-16] (MCCI Corporation)

S3 s0016obex; C:\Windows\System32\DRIVERS\s0016obex.sys [136744 2008-05-16] (MCCI Corporation)

S3 s0016unic; C:\Windows\System32\DRIVERS\s0016unic.sys [151592 2008-05-16] (MCCI Corporation)

R2 {329F96B6-DF1E-4328-BFDA-39EA953C1312}; C:\Program Files (x86)\CyberLink\PowerDVD12\Common\NavFilter\000.fcl [146928 2012-01-11] (CyberLink Corp.)

R2 {329F96B6-DF1E-4328-BFDA-39EA953C1312}; C:\Program Files (x86)\CyberLink\PowerDVD12\Common\NavFilter\000.fcl [146928 2012-01-11] (CyberLink Corp.)
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-08-24 18:31 - 2013-08-24 18:33 - 00000000 ____D C:\AdwCleaner

2013-08-24 18:31 - 2013-08-24 18:27 - 00975858 _____ C:\Users\Gerrit\Desktop\adwcleaner_3.0.exe

2013-08-24 14:16 - 2013-08-24 14:16 - 00000000 _____ C:\Users\Gerrit\defogger_reenable

2013-08-24 14:15 - 2013-08-24 13:07 - 00377856 _____ C:\Users\Gerrit\Desktop\gmer_2.1.19163.exe

2013-08-24 14:15 - 2013-08-24 13:06 - 00050477 _____ C:\Users\Gerrit\Desktop\Defogger.exe

2013-08-24 13:44 - 2013-08-24 13:44 - 00000000 ____D C:\FRST

2013-08-23 19:37 - 2013-08-23 19:37 - 00000000 ____D C:\Users\Gerrit\AppData\Roaming\Malwarebytes

2013-08-23 19:36 - 2013-08-23 19:36 - 00001085 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-08-23 19:36 - 2013-08-23 19:36 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-08-23 19:36 - 2013-08-23 19:36 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-08-23 19:36 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2013-08-23 19:34 - 2013-08-23 19:28 - 01576584 _____ (Farbar) C:\Users\Gerrit\Desktop\FRST64.exe

2013-08-23 19:15 - 2013-08-23 19:15 - 00004776 _____ C:\Windows\wininit.ini

2013-08-23 18:50 - 2013-08-24 18:34 - 00000000 ____D C:\Program Files (x86)\WinZipper

2013-08-23 18:50 - 2013-08-23 18:50 - 00000000 ____D C:\Users\Gerrit\AppData\Roaming\WinZipper

2013-08-23 18:49 - 2013-08-24 13:54 - 00000906 _____ C:\Windows\Tasks\DealPlyLiveUpdateTaskMachineUA.job

2013-08-23 18:49 - 2013-08-23 18:49 - 00003902 _____ C:\Windows\System32\Tasks\DealPlyLiveUpdateTaskMachineUA

2013-08-23 18:19 - 2013-08-24 13:29 - 00000000 ____D C:\Program Files (x86)\LyriXeeker

2013-08-23 12:05 - 2013-08-23 12:39 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy

2013-08-23 12:05 - 2013-08-23 12:05 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking

2013-08-23 12:05 - 2009-01-25 13:14 - 00017272 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe

2013-08-23 12:04 - 2013-08-23 12:09 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2

2013-08-23 11:58 - 2013-08-24 18:34 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2013-08-23 11:58 - 2013-08-24 14:03 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2013-08-23 11:58 - 2013-08-23 11:59 - 00000000 ____D C:\Program Files (x86)\Google

2013-08-23 11:58 - 2013-08-23 11:58 - 00004106 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA

2013-08-23 11:58 - 2013-08-23 11:58 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

2013-08-20 11:43 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2013-08-20 11:43 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2013-08-20 11:43 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2013-08-20 11:43 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2013-08-20 11:43 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2013-08-20 11:43 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2013-08-20 11:43 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2013-08-20 11:43 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2013-08-20 11:43 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2013-08-20 11:43 - 2013-07-26 07:12 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2013-08-20 11:43 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll

2013-08-20 11:43 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2013-08-20 11:43 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2013-08-20 11:43 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2013-08-20 11:43 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2013-08-20 11:43 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2013-08-20 11:43 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2013-08-20 11:43 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2013-08-20 11:43 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2013-08-20 11:43 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2013-08-20 11:43 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2013-08-20 11:43 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2013-08-20 11:43 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2013-08-20 11:43 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll

2013-08-20 11:43 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2013-08-20 11:43 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2013-08-20 11:43 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2013-08-20 11:43 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2013-08-20 11:43 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2013-08-20 11:43 - 2013-07-26 04:39 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe

2013-08-20 11:43 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe

2013-08-19 18:17 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL

2013-08-19 18:17 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL

2013-08-19 18:17 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll

2013-08-19 18:17 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll

2013-08-19 18:17 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll

2013-08-19 18:17 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll

2013-08-19 18:17 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll

2013-08-19 18:17 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll

2013-08-19 18:17 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll

2013-08-19 18:17 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll

2013-08-19 18:17 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll

2013-08-19 18:17 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll

2013-08-19 18:17 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll

2013-08-19 18:17 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll

2013-08-19 18:17 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys

2013-08-19 18:17 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys

2013-08-06 11:19 - 2013-08-06 11:19 - 00000000 ____D C:\Users\Gerrit\AppData\Roaming\Avira

2013-08-06 11:15 - 2013-08-06 11:15 - 00083672 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys

2013-08-06 11:13 - 2013-08-06 11:14 - 00000000 ____D C:\ProgramData\Avira

2013-08-06 11:13 - 2013-08-06 11:13 - 00000000 ____D C:\Program Files (x86)\Avira

2013-08-06 11:13 - 2013-08-06 11:10 - 00130016 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys

2013-08-06 11:13 - 2013-08-06 11:10 - 00100712 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys

2013-08-06 11:13 - 2013-08-06 11:10 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys

2013-07-27 09:28 - 2013-07-27 09:28 - 00000000 ____D C:\Users\Gerrit\Desktop\Borkum - 20.07.2013
 

==================== One Month Modified Files and Folders =======
 

2013-08-24 18:35 - 2012-03-17 17:14 - 00000000 ____D C:\Program Files (x86)\Steam

2013-08-24 18:34 - 2013-08-24 18:34 - 00003198 _____ C:\Users\Gerrit\Desktop\AdwCleaner[S0].txt

2013-08-24 18:34 - 2013-08-23 18:50 - 00000000 ____D C:\Program Files (x86)\WinZipper

2013-08-24 18:34 - 2013-08-23 11:58 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2013-08-24 18:34 - 2012-11-06 18:29 - 00032513 _____ C:\Windows\setupact.log

2013-08-24 18:34 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2013-08-24 18:33 - 2013-08-24 18:31 - 00000000 ____D C:\AdwCleaner

2013-08-24 18:33 - 2011-08-11 05:53 - 00685676 _____ C:\Windows\system32\perfh007.dat

2013-08-24 18:33 - 2011-08-11 05:53 - 00144496 _____ C:\Windows\system32\perfc007.dat

2013-08-24 18:33 - 2011-08-10 20:01 - 01078384 _____ C:\Windows\WindowsUpdate.log

2013-08-24 18:33 - 2009-07-14 06:45 - 00016752 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-08-24 18:33 - 2009-07-14 06:45 - 00016752 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-08-24 18:27 - 2013-08-24 18:31 - 00975858 _____ C:\Users\Gerrit\Desktop\adwcleaner_3.0.exe

2013-08-24 14:30 - 2009-07-14 07:13 - 01621448 _____ C:\Windows\system32\PerfStringBackup.INI

2013-08-24 14:16 - 2013-08-24 14:16 - 00000000 _____ C:\Users\Gerrit\defogger_reenable

2013-08-24 14:16 - 2012-03-17 16:02 - 00000000 ____D C:\Users\Gerrit

2013-08-24 14:03 - 2013-08-23 11:58 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2013-08-24 13:54 - 2013-08-23 18:49 - 00000906 _____ C:\Windows\Tasks\DealPlyLiveUpdateTaskMachineUA.job

2013-08-24 13:44 - 2013-08-24 13:44 - 00000000 ____D C:\FRST

2013-08-24 13:41 - 2013-02-10 17:37 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2013-08-24 13:30 - 2010-11-21 05:47 - 00432394 _____ C:\Windows\PFRO.log

2013-08-24 13:29 - 2013-08-23 18:19 - 00000000 ____D C:\Program Files (x86)\LyriXeeker

2013-08-24 13:07 - 2013-08-24 14:15 - 00377856 _____ C:\Users\Gerrit\Desktop\gmer_2.1.19163.exe

2013-08-24 13:06 - 2013-08-24 14:15 - 00050477 _____ C:\Users\Gerrit\Desktop\Defogger.exe

2013-08-23 19:37 - 2013-08-23 19:37 - 00000000 ____D C:\Users\Gerrit\AppData\Roaming\Malwarebytes

2013-08-23 19:36 - 2013-08-23 19:36 - 00001085 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-08-23 19:36 - 2013-08-23 19:36 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-08-23 19:36 - 2013-08-23 19:36 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-08-23 19:28 - 2013-08-23 19:34 - 01576584 _____ (Farbar) C:\Users\Gerrit\Desktop\FRST64.exe

2013-08-23 19:18 - 2009-07-14 06:45 - 00432760 _____ C:\Windows\system32\FNTCACHE.DAT

2013-08-23 19:15 - 2013-08-23 19:15 - 00004776 _____ C:\Windows\wininit.ini

2013-08-23 18:51 - 2012-03-17 16:37 - 00001142 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2815610152-1451309939-3061597360-1001UA.job

2013-08-23 18:50 - 2013-08-23 18:50 - 00000000 ____D C:\Users\Gerrit\AppData\Roaming\WinZipper

2013-08-23 18:49 - 2013-08-23 18:49 - 00003902 _____ C:\Windows\System32\Tasks\DealPlyLiveUpdateTaskMachineUA

2013-08-23 18:48 - 2012-03-17 16:02 - 00112928 _____ C:\Users\Gerrit\AppData\Local\GDIPFONTCACHEV1.DAT

2013-08-23 12:39 - 2013-08-23 12:05 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy

2013-08-23 12:09 - 2013-08-23 12:04 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2

2013-08-23 12:05 - 2013-08-23 12:05 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking

2013-08-23 12:00 - 2012-03-17 16:30 - 00000000 ____D C:\Users\Gerrit\AppData\Local\Google

2013-08-23 11:59 - 2013-08-23 11:58 - 00000000 ____D C:\Program Files (x86)\Google

2013-08-23 11:58 - 2013-08-23 11:58 - 00004106 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA

2013-08-23 11:58 - 2013-08-23 11:58 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

2013-08-21 11:09 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache

2013-08-20 23:41 - 2013-02-10 17:37 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater

2013-08-20 23:41 - 2012-08-23 15:28 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2013-08-20 23:41 - 2012-03-18 14:04 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2013-08-19 21:51 - 2012-03-17 16:37 - 00001120 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2815610152-1451309939-3061597360-1001Core.job

2013-08-14 17:21 - 2012-05-16 18:54 - 00000000 ____D C:\Users\Gerrit\AppData\Roaming\Mp3tag

2013-08-06 11:19 - 2013-08-06 11:19 - 00000000 ____D C:\Users\Gerrit\AppData\Roaming\Avira

2013-08-06 11:15 - 2013-08-06 11:15 - 00083672 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys

2013-08-06 11:14 - 2013-08-06 11:13 - 00000000 ____D C:\ProgramData\Avira

2013-08-06 11:13 - 2013-08-06 11:13 - 00000000 ____D C:\Program Files (x86)\Avira

2013-08-06 11:10 - 2013-08-06 11:13 - 00130016 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys

2013-08-06 11:10 - 2013-08-06 11:13 - 00100712 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys

2013-08-06 11:10 - 2013-08-06 11:13 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys

2013-07-29 11:12 - 2011-05-19 08:50 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight

2013-07-27 09:28 - 2013-07-27 09:28 - 00000000 ____D C:\Users\Gerrit\Desktop\Borkum - 20.07.2013

2013-07-26 07:13 - 2013-08-20 11:43 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2013-07-26 07:13 - 2013-08-20 11:43 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2013-07-26 07:13 - 2013-08-20 11:43 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2013-07-26 07:12 - 2013-08-20 11:43 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2013-07-26 07:12 - 2013-08-20 11:43 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2013-07-26 07:12 - 2013-08-20 11:43 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2013-07-26 07:12 - 2013-08-20 11:43 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2013-07-26 07:12 - 2013-08-20 11:43 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2013-07-26 07:12 - 2013-08-20 11:43 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2013-07-26 07:12 - 2013-08-20 11:43 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2013-07-26 07:12 - 2013-08-20 11:43 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll

2013-07-26 07:12 - 2013-08-20 11:43 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2013-07-26 07:12 - 2013-08-20 11:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2013-07-26 07:12 - 2013-08-20 11:43 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2013-07-26 05:35 - 2013-08-20 11:43 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2013-07-26 05:13 - 2013-08-20 11:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2013-07-26 05:13 - 2013-08-20 11:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2013-07-26 05:12 - 2013-08-20 11:43 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2013-07-26 05:12 - 2013-08-20 11:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2013-07-26 05:12 - 2013-08-20 11:43 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2013-07-26 05:12 - 2013-08-20 11:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2013-07-26 05:12 - 2013-08-20 11:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2013-07-26 05:12 - 2013-08-20 11:43 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2013-07-26 05:12 - 2013-08-20 11:43 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll

2013-07-26 05:12 - 2013-08-20 11:43 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2013-07-26 05:12 - 2013-08-20 11:43 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2013-07-26 05:11 - 2013-08-20 11:43 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2013-07-26 05:11 - 2013-08-20 11:43 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2013-07-26 04:49 - 2013-08-20 11:43 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2013-07-26 04:39 - 2013-08-20 11:43 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe

2013-07-26 03:59 - 2013-08-20 11:43 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe

2013-07-25 11:25 - 2013-08-19 18:17 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL

2013-07-25 10:57 - 2013-08-19 18:17 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-08-12 17:20
 

==================== End Of Log ============================

--- --- ---