Also hier noch
mbam Code:
Malwarebytes Anti-Malware
www.malwarebytes.org
Suchlauf Datum: 01.05.2014
Suchlauf-Zeit: 14:53:57
Logdatei: mbam.txt
Administrator: Ja
Version: 2.00.1.1004
Malware Datenbank: v2014.05.01.07
Rootkit Datenbank: v2014.03.27.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Chameleon: Deaktiviert
Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: Michael Schwörer
Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 307609
Verstrichene Zeit: 5 Min, 12 Sek
Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Aktiviert
Shuriken: Aktiviert
PUP: Aktiviert
PUM: Aktiviert
Prozesse: 0
(No malicious items detected)
Module: 0
(No malicious items detected)
Registrierungsschlüssel: 0
(No malicious items detected)
Registrierungswerte: 0
(No malicious items detected)
Registrierungsdaten: 0
(No malicious items detected)
Ordner: 0
(No malicious items detected)
Dateien: 0
(No malicious items detected)
Physische Sektoren: 0
(No malicious items detected)
(end) zoek Code:
Zoek.exe v5.0.0.0 Updated 14-April-2014
Tool run by Michael Schw”rer on 01.05.2014 at 15:01:32,28.
Microsoft Windows 7 Home Premium 6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\MICHAE~1\Desktop\zoek.exe [Scan all users] [Script inserted]
==== System Restore Info ======================
01.05.2014 15:02:03 Zoek.exe System Restore Point Created Succesfully.
==== Deleting CLSID Registry Keys ======================
==== Deleting CLSID Registry Values ======================
==== Deleting Services ======================
==== FireFox Fix ======================
Deleted from C:\Users\MICHAE~1\AppData\Roaming\Mozilla\Firefox\Profiles\z2rnc989.default\prefs.js:
user_pref("browser.startup.homepage", "https://www.facebook.com/");
user_pref("browser.search.selectedEngine", "Google");
user_pref("browser.search.suggest.enabled", false);
user_pref("browser.search.useDBForOrder", true);
Added to C:\Users\MICHAE~1\AppData\Roaming\Mozilla\Firefox\Profiles\z2rnc989.default\prefs.js:
user_pref("browser.startup.homepage", "http://www.google.com");
user_pref("browser.search.defaulturl", "http://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.newtab.url", "http://www.google.com/");
user_pref("browser.search.defaultengine", "Google");
user_pref("browser.search.defaultenginename", "Google");
user_pref("browser.search.selectedEngine", "Google");
user_pref("browser.search.order.1", "Google");
user_pref("keyword.URL", "http://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.search.suggest.enabled", true);
user_pref("browser.search.useDBForOrder", true);
==== Deleting Files \ Folders ======================
C:\PROGRA~2\COMMON~1\DVDVideoSoft\bin deleted
C:\PROGRA~3\Package Cache deleted
==== Firefox Extensions Registry ======================
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions]
"wrc@avast.com"="C:\Program Files\AVAST Software\Avast\WebRep\FF" [13.04.2014 10:39]
[HKEY_CURRENT_USER\Software\Mozilla\Firefox\Extensions]
"{B64D9B05-48E1-4CEB-BF58-E0643994E900}"="C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff" [23.01.2014 11:50]
==== Firefox Extensions ======================
ProfilePath: C:\Users\MICHAE~1\AppData\Roaming\Mozilla\Firefox\Profiles\z2rnc989.default
- avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF
- Adblock Plus Pop-up Addon - %ProfilePath%\extensions\adblockpopups@jessehakanen.net.xpi
- anonymoX - %ProfilePath%\extensions\client@anonymox.net.xpi
- Adblock Plus - %ProfilePath%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
AppDir: C:\Program Files (x86)\Mozilla Firefox
- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
==== Firefox Plugins ======================
==== Set IE to Default ======================
Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.com"
"Use Search Asst"="yes"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchUrl]
"Default"="http://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\SearchUrl]
"Default"="http://www.google.com"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl]
"Default"="http://www.google.com"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search]
"Default_Search_URL"="http://www.google.com"
"SearchAssistant"="http://www.google.com"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
No DefaultScope Set For HKCU
New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.com"
"Use Search Asst"="no"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchUrl]
"(Default)"="http://search.msn.com/results.asp?q=%s"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\SearchUrl]
"(Default)"="http://search.msn.com/results.asp?q=%s"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl]
"(Default)"="http://search.msn.com/results.asp?q=%s"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search]
"Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896"
"SearchAssistant"="http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{6A1806CD-94D4-4689-BA73-E35EA1EA9990}"
==== All HKCU SearchScopes ======================
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"
{6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google Url="http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}"
==== Reset Google Chrome ======================
Nothing found to reset
==== Empty IE Cache ======================
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Michael Schwörer\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Michael Schwörer\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
==== Empty FireFox Cache ======================
No FireFox Cache found
==== Empty Chrome Cache ======================
No Chrome User Data found
==== Empty All Flash Cache ======================
Flash Cache Emptied Successfully
==== Empty All Java Cache ======================
Java Cache cleared successfully
==== C:\zoek_backup content ======================
C:\zoek_backup (files=134 folders=37 28726807 bytes)
==== Empty Temp Folders ======================
C:\Users\Default\AppData\Local\temp emptied successfully
C:\Users\Default User\AppData\Local\temp emptied successfully
C:\Users\DefaultAppPool\AppData\Local\temp emptied successfully
C:\Users\Michael Schwörer\AppData\Local\Temp emptied successfully
C:\Users\Public\AppData\Local\temp emptied successfully
C:\Users\MICHAE~2\AppData\Local\temp emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot
==== After Reboot ======================
==== Empty Temp Folders ======================
C:\Windows\Temp successfully emptied
C:\Users\MICHAE~1\AppData\Local\Temp successfully emptied
==== Empty Recycle Bin ======================
C:\$RECYCLE.BIN successfully emptied
==== EOF on 01.05.2014 at 15:08:49,50 ====================== und frst
FRST Logfile: Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-04-2014
Ran by Michael Schwörer (administrator) on MS_PC on 01-05-2014 15:10:26
Running from C:\Users\Michael Schwörer\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
() C:\Program Files (x86)\Fatal1ty Utility\F-Stream Tuning\Bin\IOMonitorSrv.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe
() C:\Program Files (x86)\D-Link\DWA-140 revB\ANIWConnService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Windows\system32\IProsetMonitor.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
(Flexera Software LLC.) C:\Program Files\Siemens\PLMLicenseServer\lmgrd.exe
(Skype Technologies) C:\Program Files (x86)\Skype\Updater\Updater.exe
(Flexera Software LLC.) C:\Program Files\Siemens\PLMLicenseServer\lmgrd.exe
(Siemens PLM Software Inc.) C:\Program Files\Siemens\PLMLicenseServer\ugslmd.exe
() C:\Program Files (x86)\ASRock Utility\HDMISwitch\Bin\HDMISwitch.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(D-Link Corp.) C:\Program Files (x86)\D-Link\DWA-140 revB\AirNCFG.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Photosmart 5510 series\bin\HPNetworkCommunicator.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13636824 2013-07-26] (Realtek Semiconductor)
HKLM-x32\...\Run: [D-Link D-Link Wireless N DWA-140] => C:\Program Files (x86)\D-Link\DWA-140 revB\AirNCFG.exe [1079600 2013-01-29] (D-Link Corp.)
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [134616 2013-09-03] (Intel Corporation)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848 2013-04-26] (Intel Corporation)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [676608 2013-06-04] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [3854640 2014-04-13] (AVAST Software)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-03-24] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKU\S-1-5-21-3953501866-2536193060-1674005732-1000\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3675352 2013-10-28] (Disc Soft Ltd)
Startup: C:\Users\Michael Schwörer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Photosmart 5510 series (Netzwerk).lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Photosmart 5510 series (Netzwerk).lnk -> C:\Program Files\HP\HP Photosmart 5510 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x57183A046A05CF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKCU - DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Michael Schwörer\AppData\Roaming\Mozilla\Firefox\Profiles\z2rnc989.default
FF NewTab: hxxp://www.google.com/
FF SearchEngineOrder.1: Google
FF SelectedSearchEngine: Google
FF Homepage: hxxp://www.google.com
FF Keyword.URL: hxxp://www.google.com/search?btnG=Google+Search&q=
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_206.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_206.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Adblock Plus Pop-up Addon - C:\Users\Michael Schwörer\AppData\Roaming\Mozilla\Firefox\Profiles\z2rnc989.default\Extensions\adblockpopups@jessehakanen.net.xpi [2014-01-04]
FF Extension: anonymoX - C:\Users\Michael Schwörer\AppData\Roaming\Mozilla\Firefox\Profiles\z2rnc989.default\Extensions\client@anonymox.net.xpi [2014-01-04]
FF Extension: Adblock Plus - C:\Users\Michael Schwörer\AppData\Roaming\Mozilla\Firefox\Profiles\z2rnc989.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-01-04]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-04-13]
FF HKCU\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\
FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\ []
==================== Services (Whitelisted) =================
R2 ASRockIOMon; C:\Program Files (x86)\Fatal1ty Utility\F-Stream Tuning\Bin\IOMonitorSrv.exe [454656 2013-05-28] ()
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-04-13] (AVAST Software)
R2 D-Link Wireless N DWA-140_WPS; C:\Program Files (x86)\D-Link\DWA-140 revB\ANIWConnService.exe [53248 2010-07-12] ()
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-11] (Intel(R) Corporation)
S2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-03] (Intel Corporation)
R2 Siemens PLM License Server; C:\Program Files\Siemens\PLMLicenseServer\lmgrd.exe [1830736 2013-01-18] (Flexera Software LLC.)
R2 W3SVC; C:\Windows\system32\inetsrv\iisw3adm.dll [453120 2010-11-20] (Microsoft Corporation)
S4 AntiVirWebService; "C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe" [X]
==================== Drivers (Whitelisted) ====================
R1 anodlwf; C:\Windows\System32\DRIVERS\anodlwfx.sys [15872 2011-02-21] ()
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R3 AsrDrv101; C:\Windows\SysWOW64\Drivers\AsrDrv101.sys [22280 2013-12-30] (ASRock Incorporation)
S3 AsrHidFilter; C:\Windows\System32\DRIVERS\AsrHidFilter.sys [20232 2013-09-09] (ASRock Inc.)
R0 AsrRamDisk; C:\Windows\System32\DRIVERS\AsrRamDisk.sys [40200 2013-05-09] (ASRock Inc.)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-04-13] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-04-13] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-04-13] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2014-04-13] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2014-04-13] (AVAST Software)
R3 aswStm; C:\Windows\system32\drivers\aswStm.sys [84816 2014-04-13] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208928 2014-04-13] ()
R3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [306536 2011-03-04] ()
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-01-31] (Disc Soft Ltd)
R3 e1dexpress; C:\Windows\System32\DRIVERS\e1d62x64.sys [495376 2013-05-30] (Intel Corporation)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28008 2013-08-07] (Intel Corporation)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [99288 2013-09-03] (Intel Corporation)
R3 netr28ux; C:\Windows\System32\DRIVERS\Dnetr28ux.sys [1617472 2011-04-28] (Ralink Technology Corp.)
R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-05-01 15:10 - 2014-05-01 15:10 - 00013686 _____ () C:\Users\Michael Schwörer\Desktop\FRST.txt
2014-05-01 15:08 - 2014-05-01 15:08 - 00000000 ____D () C:\Users\Michael Schw÷rer\AppData\Roaming\Macromedia
2014-05-01 15:08 - 2014-05-01 15:08 - 00000000 ____D () C:\Users\Michael Schw÷rer
2014-05-01 15:08 - 2014-05-01 15:01 - 00024064 _____ () C:\Windows\zoek-delete.exe
2014-05-01 15:01 - 2014-05-01 15:08 - 00007394 _____ () C:\zoek-results.log
2014-05-01 15:01 - 2014-05-01 15:07 - 00000000 ____D () C:\zoek_backup
2014-05-01 15:00 - 2014-05-01 15:00 - 01285120 _____ () C:\Users\Michael Schwörer\Desktop\zoek.exe
2014-05-01 15:00 - 2014-05-01 15:00 - 00001160 _____ () C:\Users\Michael Schwörer\Desktop\mbam.txt
2014-05-01 14:47 - 2014-05-01 14:48 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-01 14:47 - 2014-05-01 14:47 - 00001110 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-05-01 14:47 - 2014-05-01 14:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-05-01 14:47 - 2014-05-01 14:47 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-01 14:47 - 2014-05-01 14:47 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-05-01 14:47 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-01 14:47 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-01 14:47 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-05-01 14:43 - 2014-05-01 14:44 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\Michael Schwörer\Downloads\mbam-setup-2.0.1.1004.exe
2014-05-01 14:33 - 2014-05-01 14:34 - 00000000 ____D () C:\AdwCleaner
2014-05-01 14:31 - 2014-05-01 14:31 - 01310621 _____ () C:\Users\Michael Schwörer\Desktop\adwcleaner.exe
2014-05-01 12:00 - 2014-05-01 12:00 - 00017786 _____ () C:\ComboFix.txt
2014-05-01 11:48 - 2014-05-01 12:00 - 00000000 ____D () C:\Qoobox
2014-05-01 11:48 - 2014-05-01 11:58 - 00000000 ____D () C:\Windows\erdnt
2014-05-01 11:48 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-05-01 11:48 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-05-01 11:48 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-05-01 11:48 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-05-01 11:48 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-05-01 11:48 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-05-01 11:48 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-05-01 11:48 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-05-01 11:47 - 2014-05-01 11:47 - 05197895 ____R (Swearware) C:\Users\Michael Schwörer\Desktop\ComboFix.exe
2014-04-29 19:03 - 2014-04-29 19:03 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-04-29 17:05 - 2014-05-01 15:10 - 00000000 ____D () C:\FRST
2014-04-29 17:05 - 2014-04-29 17:05 - 00048194 _____ () C:\Users\Michael Schwörer\Desktop\FRST1.txt
2014-04-29 17:05 - 2014-04-29 17:05 - 00029880 _____ () C:\Users\Michael Schwörer\Desktop\Addition1.txt
2014-04-29 17:02 - 2014-03-06 11:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-29 17:02 - 2014-03-06 11:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-04-29 17:02 - 2014-03-06 10:59 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-04-29 17:02 - 2014-03-06 10:57 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-04-29 17:02 - 2014-03-06 10:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-04-29 17:02 - 2014-03-06 10:39 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-04-29 17:02 - 2014-03-06 10:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-29 17:02 - 2014-03-06 10:32 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-04-29 17:02 - 2014-03-06 10:29 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-04-29 17:02 - 2014-03-06 10:28 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-04-29 17:02 - 2014-03-06 10:09 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-04-29 17:02 - 2014-03-06 10:03 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-04-29 17:02 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-04-29 17:02 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-04-29 17:02 - 2014-03-06 09:56 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-04-29 17:02 - 2014-03-06 09:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-04-29 17:02 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-04-29 17:02 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-04-29 17:02 - 2014-03-06 09:42 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-04-29 17:02 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-04-29 17:02 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-04-29 17:02 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-04-29 17:02 - 2014-03-06 09:21 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-04-29 17:02 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-04-29 17:02 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-04-29 17:02 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-04-29 17:02 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-04-29 17:01 - 2014-03-06 12:21 - 23549440 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-29 17:01 - 2014-03-06 11:19 - 17387008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-29 17:01 - 2014-03-06 10:57 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-04-29 17:01 - 2014-03-06 10:53 - 02767360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-04-29 17:01 - 2014-03-06 10:29 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-04-29 17:01 - 2014-03-06 10:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-04-29 17:01 - 2014-03-06 10:11 - 05784064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-04-29 17:01 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-04-29 17:01 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-04-29 17:01 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-04-29 17:01 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-04-29 17:01 - 2014-03-06 09:11 - 02043904 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-04-29 17:01 - 2014-03-06 08:53 - 13551104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-04-29 17:01 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-04-29 17:01 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-04-29 17:01 - 2014-03-06 08:22 - 02260480 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-04-29 17:01 - 2014-03-06 07:58 - 01400832 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-04-29 17:01 - 2014-03-06 07:50 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-04-29 17:01 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-04-29 17:01 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-04-29 17:01 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-04-29 16:55 - 2014-04-29 16:56 - 02061824 _____ (Farbar) C:\Users\Michael Schwörer\Desktop\FRST64.exe
2014-04-27 12:11 - 2014-05-01 15:01 - 00000278 _____ () C:\Windows\Tasks\HP Photo Creations Messager.job
2014-04-27 12:11 - 2014-04-27 12:11 - 00003160 _____ () C:\Windows\System32\Tasks\HP Photo Creations Messager
2014-04-27 12:11 - 2014-04-27 12:11 - 00002011 _____ () C:\Users\Public\Desktop\HP Photo Creations.lnk
2014-04-27 12:11 - 2014-04-27 12:11 - 00000000 ____D () C:\ProgramData\HP Photo Creations
2014-04-27 12:11 - 2014-04-27 12:11 - 00000000 ____D () C:\Program Files (x86)\HP Photo Creations
2014-04-27 12:10 - 2014-04-30 21:00 - 00000000 ____D () C:\Users\Michael Schwörer\AppData\Roaming\HpUpdate
2014-04-27 12:10 - 2014-04-27 12:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP
2014-04-27 12:10 - 2014-04-27 12:10 - 00002216 _____ () C:\Users\Public\Desktop\HP Photosmart 5510 series.lnk
2014-04-27 12:10 - 2014-04-27 12:10 - 00001888 _____ () C:\Users\Public\Desktop\HP ePrintCenter - HP Photosmart 5510 series.lnk
2014-04-27 12:10 - 2014-04-27 12:10 - 00001184 _____ () C:\Users\Public\Desktop\Zubehör einkaufen - HP Photosmart 5510 series.lnk
2014-04-27 12:10 - 2014-04-27 12:10 - 00000000 ____D () C:\ProgramData\HP
2014-04-27 12:10 - 2014-04-27 12:10 - 00000000 ____D () C:\Program Files (x86)\HP
2014-04-27 12:10 - 2011-05-25 17:44 - 00778088 ____N (Hewlett-Packard Co.) C:\Windows\system32\HPDiscoPMa111.dll
2014-04-27 12:09 - 2014-04-27 12:12 - 00000000 ____D () C:\Users\Michael Schwörer\AppData\Local\HP
2014-04-27 12:09 - 2014-04-27 12:09 - 00000057 _____ () C:\ProgramData\Ament.ini
2014-04-27 12:09 - 2014-04-27 12:09 - 00000000 ____D () C:\Program Files\HP
2014-04-15 21:39 - 2014-04-15 21:39 - 00000000 ____D () C:\Users\Default\AppData\Local\Microsoft Help
2014-04-15 21:39 - 2014-04-15 21:39 - 00000000 ____D () C:\Users\Default User\AppData\Local\Microsoft Help
2014-04-14 17:35 - 2014-04-14 17:35 - 00002699 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-04-14 17:35 - 2014-04-14 17:35 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-04-14 17:35 - 2014-04-14 17:35 - 00000000 ____D () C:\Users\Michael Schwörer\AppData\Local\Skype
2014-04-14 17:35 - 2014-04-14 17:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-04-14 17:34 - 2014-04-14 17:34 - 00003095 _____ () C:\Users\Michael Schwörer\Desktop\Microsoft PowerPoint 2010.lnk
2014-04-14 17:34 - 2014-04-14 17:34 - 00003047 _____ () C:\Users\Michael Schwörer\Desktop\Microsoft Excel 2010.lnk
2014-04-14 17:30 - 2014-04-14 17:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
2014-04-14 17:30 - 2014-04-14 17:30 - 00003029 _____ () C:\Users\Michael Schwörer\Desktop\Microsoft Word 2010.lnk
2014-04-14 17:30 - 2014-04-14 17:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SharePoint
2014-04-14 17:29 - 2014-04-14 17:29 - 00000000 ____D () C:\Windows\System32\Tasks\OfficeSoftwareProtectionPlatform
2014-04-14 17:29 - 2014-04-14 17:29 - 00000000 ____D () C:\Windows\PCHEALTH
2014-04-14 17:29 - 2014-04-14 17:29 - 00000000 ____D () C:\Program Files (x86)\Microsoft Synchronization Services
2014-04-14 17:29 - 2014-04-14 17:29 - 00000000 ____D () C:\Program Files (x86)\Microsoft Sync Framework
2014-04-14 17:29 - 2014-04-14 17:29 - 00000000 ____D () C:\Program Files (x86)\Microsoft SQL Server Compact Edition
2014-04-14 17:27 - 2014-04-14 17:27 - 00000000 ____D () C:\Program Files\Microsoft Office
2014-04-14 17:27 - 2014-04-14 17:27 - 00000000 ____D () C:\Program Files (x86)\Microsoft Visual Studio 8
2014-04-14 17:27 - 2014-04-14 17:27 - 00000000 ____D () C:\Program Files (x86)\Microsoft Analysis Services
2014-04-14 17:26 - 2014-04-15 21:43 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-04-14 17:26 - 2014-04-14 17:29 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office
2014-04-14 17:26 - 2014-04-14 17:26 - 00000000 ___RD () C:\MSOCache
2014-04-14 17:26 - 2014-04-14 17:26 - 00000000 ____D () C:\Users\Michael Schwörer\AppData\Local\Microsoft Help
2014-04-14 17:23 - 2014-04-14 17:23 - 00000000 ____D () C:\Users\Michael Schwörer\Tracing
2014-04-14 17:23 - 2014-04-14 17:23 - 00000000 ____D () C:\Program Files (x86)\OCSetup
2014-04-13 10:56 - 2014-03-31 09:35 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-04-13 10:39 - 2014-04-29 17:04 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-04-13 10:39 - 2014-04-13 10:39 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2014-04-13 10:39 - 2014-04-13 10:39 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2014-04-13 10:39 - 2014-04-13 10:39 - 00334648 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-04-13 10:39 - 2014-04-13 10:39 - 00208928 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-04-13 10:39 - 2014-04-13 10:39 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2014-04-13 10:39 - 2014-04-13 10:39 - 00084816 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2014-04-13 10:39 - 2014-04-13 10:39 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-04-13 10:39 - 2014-04-13 10:39 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-04-13 10:39 - 2014-04-13 10:39 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-04-13 10:39 - 2014-04-13 10:39 - 00001970 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-04-13 10:39 - 2014-04-13 10:39 - 00000000 ____D () C:\Users\Michael Schwörer\AppData\Roaming\AVAST Software
2014-04-13 10:39 - 2014-04-13 10:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast
2014-04-13 10:38 - 2014-04-13 10:38 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-04-13 10:38 - 2014-04-13 10:38 - 00000000 ____D () C:\Program Files\AVAST Software
2014-04-13 10:21 - 2014-04-13 10:31 - 88551496 _____ (AVAST Software) C:\Users\Michael Schwörer\Downloads\avast_free_antivirus_setup_9.0.2016.exe
2014-04-12 20:34 - 2014-04-12 20:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\K-Lite Codec Pack
2014-04-12 20:34 - 2014-04-12 20:34 - 00000000 ____D () C:\Program Files (x86)\K-Lite Codec Pack
2014-04-12 20:34 - 2014-03-24 20:00 - 00127488 _____ () C:\Windows\system32\ff_vfw.dll
2014-04-12 20:34 - 2014-03-24 20:00 - 00112640 _____ () C:\Windows\SysWOW64\ff_vfw.dll
2014-04-12 20:34 - 2013-12-01 15:10 - 00257624 _____ () C:\Windows\system32\unrar64.dll
2014-04-12 20:34 - 2013-12-01 15:10 - 00218200 _____ () C:\Windows\SysWOW64\unrar.dll
2014-04-12 20:34 - 2013-03-17 20:22 - 03554304 _____ (x264vfw project) C:\Windows\system32\x264vfw64.dll
2014-04-12 20:34 - 2013-03-17 19:21 - 03649536 _____ (x264vfw project) C:\Windows\SysWOW64\x264vfw.dll
2014-04-12 20:34 - 2012-07-21 13:55 - 00180736 _____ (fccHandler) C:\Windows\system32\ac3acm.acm
2014-04-12 20:34 - 2012-07-21 13:54 - 00122880 _____ (fccHandler) C:\Windows\SysWOW64\ac3acm.acm
2014-04-12 20:34 - 2011-12-07 20:37 - 00148992 _____ ( ) C:\Windows\system32\lagarith.dll
2014-04-12 20:34 - 2011-12-07 20:32 - 00216064 _____ ( ) C:\Windows\SysWOW64\lagarith.dll
2014-04-12 20:34 - 2011-06-24 17:45 - 00258560 _____ () C:\Windows\system32\xvidvfw.dll
2014-04-12 20:34 - 2011-06-24 17:44 - 00243200 _____ () C:\Windows\SysWOW64\xvidvfw.dll
2014-04-12 20:34 - 2011-06-24 17:31 - 00703488 _____ () C:\Windows\system32\xvidcore.dll
2014-04-12 20:34 - 2011-06-24 17:28 - 00650752 _____ () C:\Windows\SysWOW64\xvidcore.dll
2014-04-12 20:29 - 2014-04-12 20:29 - 00613200 _____ (Chip Digital GmbH) C:\Users\Michael Schwörer\Downloads\K Lite Mega Codec Pack - CHIP-Downloader.exe
2014-04-12 17:30 - 2014-04-12 17:30 - 00001015 _____ () C:\Users\Michael Schwörer\Desktop\SpeedFan.lnk
2014-04-12 17:30 - 2014-04-12 17:30 - 00000045 _____ () C:\Windows\SysWOW64\initdebug.nfo
2014-04-12 17:30 - 2014-04-12 17:30 - 00000000 ____D () C:\Users\Michael Schwörer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpeedFan
2014-04-12 17:30 - 2014-04-12 17:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpeedFan
2014-04-12 17:30 - 2014-04-12 17:30 - 00000000 ____D () C:\Program Files (x86)\SpeedFan
2014-04-12 17:29 - 2014-04-12 17:29 - 00613200 _____ (Chip Digital GmbH) C:\Users\Michael Schwörer\Downloads\SpeedFan - CHIP-Downloader.exe
2014-04-10 16:22 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-04-10 16:22 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2014-04-10 16:22 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2014-04-10 16:22 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2014-04-10 16:22 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2014-04-10 16:22 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2014-04-10 16:22 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-04-10 16:22 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2014-04-10 16:22 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2014-04-10 16:22 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2014-04-10 16:22 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2014-04-10 16:22 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-04-10 16:22 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2014-04-10 16:22 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2014-04-10 16:22 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2014-04-10 16:22 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll
2014-04-10 16:22 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-04-05 14:43 - 2014-04-05 14:43 - 02112847 _____ () C:\Users\Michael Schwörer\Downloads\WDFirmwareUpdater.zip
2014-04-05 14:43 - 2014-04-05 14:43 - 00000000 ____D () C:\Users\Michael Schwörer\Downloads\WDFirmwareUpdater
2014-04-05 14:43 - 2014-04-05 14:43 - 00000000 ____D () C:\ProgramData\Western Digital
2014-04-05 14:42 - 2014-04-05 14:42 - 00000000 ____D () C:\Program Files\DIFX
2014-04-05 14:41 - 2014-04-05 14:41 - 00000000 ____D () C:\Users\Michael Schwörer\Downloads\WD_SES_Driver_Setup_x64
2014-04-05 14:41 - 2014-04-05 14:41 - 00000000 ____D () C:\Program Files\WDCSAM
2014-04-03 21:05 - 2014-04-03 21:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-04-03 21:05 - 2014-04-03 21:05 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-04-03 21:05 - 2014-04-03 21:05 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-04-02 16:07 - 2014-04-02 16:43 - 00000000 ____D () C:\The KMPlayer
==================== One Month Modified Files and Folders =======
2014-05-01 15:10 - 2014-05-01 15:10 - 00013686 _____ () C:\Users\Michael Schwörer\Desktop\FRST.txt
2014-05-01 15:10 - 2014-04-29 17:05 - 00000000 ____D () C:\FRST
2014-05-01 15:08 - 2014-05-01 15:08 - 00000000 ____D () C:\Users\Michael Schw÷rer\AppData\Roaming\Macromedia
2014-05-01 15:08 - 2014-05-01 15:08 - 00000000 ____D () C:\Users\Michael Schw÷rer
2014-05-01 15:08 - 2014-05-01 15:01 - 00007394 _____ () C:\zoek-results.log
2014-05-01 15:08 - 2013-12-30 22:59 - 00003056 _____ () C:\Windows\System32\Tasks\AsrKM
2014-05-01 15:08 - 2013-12-30 22:59 - 00002996 _____ () C:\Windows\System32\Tasks\HDMISwitch
2014-05-01 15:08 - 2013-12-30 16:36 - 00239906 _____ () C:\Windows\PFRO.log
2014-05-01 15:08 - 2013-12-29 21:07 - 01282103 _____ () C:\Windows\WindowsUpdate.log
2014-05-01 15:08 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-01 15:08 - 2009-07-14 06:51 - 00034444 _____ () C:\Windows\setupact.log
2014-05-01 15:07 - 2014-05-01 15:01 - 00000000 ____D () C:\zoek_backup
2014-05-01 15:01 - 2014-05-01 15:08 - 00024064 _____ () C:\Windows\zoek-delete.exe
2014-05-01 15:01 - 2014-04-27 12:11 - 00000278 _____ () C:\Windows\Tasks\HP Photo Creations Messager.job
2014-05-01 15:01 - 2014-01-04 02:01 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-05-01 15:00 - 2014-05-01 15:00 - 01285120 _____ () C:\Users\Michael Schwörer\Desktop\zoek.exe
2014-05-01 15:00 - 2014-05-01 15:00 - 00001160 _____ () C:\Users\Michael Schwörer\Desktop\mbam.txt
2014-05-01 14:48 - 2014-05-01 14:47 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-01 14:47 - 2014-05-01 14:47 - 00001110 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-05-01 14:47 - 2014-05-01 14:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-05-01 14:47 - 2014-05-01 14:47 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-01 14:47 - 2014-05-01 14:47 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-05-01 14:44 - 2014-05-01 14:43 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\Michael Schwörer\Downloads\mbam-setup-2.0.1.1004.exe
2014-05-01 14:42 - 2009-07-14 06:45 - 00015120 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-01 14:42 - 2009-07-14 06:45 - 00015120 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-01 14:40 - 2009-07-14 19:58 - 00770534 _____ () C:\Windows\system32\perfh007.dat
2014-05-01 14:40 - 2009-07-14 19:58 - 00174350 _____ () C:\Windows\system32\perfc007.dat
2014-05-01 14:40 - 2009-07-14 07:13 - 01798866 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-01 14:34 - 2014-05-01 14:33 - 00000000 ____D () C:\AdwCleaner
2014-05-01 14:31 - 2014-05-01 14:31 - 01310621 _____ () C:\Users\Michael Schwörer\Desktop\adwcleaner.exe
2014-05-01 14:31 - 2014-01-05 14:13 - 00000000 ____D () C:\Users\Michael Schwörer\AppData\Roaming\Skype
2014-05-01 14:17 - 2014-03-22 11:14 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-01 13:06 - 2014-01-04 02:03 - 00000000 ____D () C:\Users\Michael Schwörer\AppData\Local\PMB Files
2014-05-01 12:00 - 2014-05-01 12:00 - 00017786 _____ () C:\ComboFix.txt
2014-05-01 12:00 - 2014-05-01 11:48 - 00000000 ____D () C:\Qoobox
2014-05-01 11:58 - 2014-05-01 11:48 - 00000000 ____D () C:\Windows\erdnt
2014-05-01 11:54 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-05-01 11:52 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-01 11:47 - 2014-05-01 11:47 - 05197895 ____R (Swearware) C:\Users\Michael Schwörer\Desktop\ComboFix.exe
2014-05-01 00:11 - 2014-01-04 02:03 - 00000000 ____D () C:\ProgramData\PMB Files
2014-04-30 21:00 - 2014-04-27 12:10 - 00000000 ____D () C:\Users\Michael Schwörer\AppData\Roaming\HpUpdate
2014-04-30 20:50 - 2014-01-05 14:16 - 00000000 ____D () C:\Users\Michael Schwörer\AppData\Roaming\TS3Client
2014-04-30 19:21 - 2013-12-31 00:18 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-04-29 20:53 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-04-29 19:03 - 2014-04-29 19:03 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-04-29 17:19 - 2014-03-22 11:14 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-04-29 17:19 - 2013-12-31 02:38 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-04-29 17:19 - 2013-12-31 02:38 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-04-29 17:05 - 2014-04-29 17:05 - 00048194 _____ () C:\Users\Michael Schwörer\Desktop\FRST1.txt
2014-04-29 17:05 - 2014-04-29 17:05 - 00029880 _____ () C:\Users\Michael Schwörer\Desktop\Addition1.txt
2014-04-29 17:04 - 2014-04-13 10:39 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-04-29 17:03 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-04-29 16:56 - 2014-04-29 16:55 - 02061824 _____ (Farbar) C:\Users\Michael Schwörer\Desktop\FRST64.exe
2014-04-27 12:12 - 2014-04-27 12:09 - 00000000 ____D () C:\Users\Michael Schwörer\AppData\Local\HP
2014-04-27 12:12 - 2013-12-29 21:07 - 00000000 ___RD () C:\Users\Michael Schwörer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-04-27 12:11 - 2014-04-27 12:11 - 00003160 _____ () C:\Windows\System32\Tasks\HP Photo Creations Messager
2014-04-27 12:11 - 2014-04-27 12:11 - 00002011 _____ () C:\Users\Public\Desktop\HP Photo Creations.lnk
2014-04-27 12:11 - 2014-04-27 12:11 - 00000000 ____D () C:\ProgramData\HP Photo Creations
2014-04-27 12:11 - 2014-04-27 12:11 - 00000000 ____D () C:\Program Files (x86)\HP Photo Creations
2014-04-27 12:11 - 2014-04-27 12:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP
2014-04-27 12:10 - 2014-04-27 12:10 - 00002216 _____ () C:\Users\Public\Desktop\HP Photosmart 5510 series.lnk
2014-04-27 12:10 - 2014-04-27 12:10 - 00001888 _____ () C:\Users\Public\Desktop\HP ePrintCenter - HP Photosmart 5510 series.lnk
2014-04-27 12:10 - 2014-04-27 12:10 - 00001184 _____ () C:\Users\Public\Desktop\Zubehör einkaufen - HP Photosmart 5510 series.lnk
2014-04-27 12:10 - 2014-04-27 12:10 - 00000000 ____D () C:\ProgramData\HP
2014-04-27 12:10 - 2014-04-27 12:10 - 00000000 ____D () C:\Program Files (x86)\HP
2014-04-27 12:09 - 2014-04-27 12:09 - 00000057 _____ () C:\ProgramData\Ament.ini
2014-04-27 12:09 - 2014-04-27 12:09 - 00000000 ____D () C:\Program Files\HP
2014-04-18 23:55 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-04-15 21:55 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-04-15 21:43 - 2014-04-14 17:26 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-04-15 21:41 - 2009-07-14 04:34 - 00000478 _____ () C:\Windows\win.ini
2014-04-15 21:39 - 2014-04-15 21:39 - 00000000 ____D () C:\Users\Default\AppData\Local\Microsoft Help
2014-04-15 21:39 - 2014-04-15 21:39 - 00000000 ____D () C:\Users\Default User\AppData\Local\Microsoft Help
2014-04-14 22:03 - 2013-12-30 16:23 - 00110904 _____ () C:\Users\Michael Schwörer\AppData\Local\GDIPFONTCACHEV1.DAT
2014-04-14 22:03 - 2009-07-14 06:45 - 00419880 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-04-14 17:35 - 2014-04-14 17:35 - 00002699 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-04-14 17:35 - 2014-04-14 17:35 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-04-14 17:35 - 2014-04-14 17:35 - 00000000 ____D () C:\Users\Michael Schwörer\AppData\Local\Skype
2014-04-14 17:35 - 2014-04-14 17:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-04-14 17:35 - 2014-01-05 14:13 - 00000000 ____D () C:\ProgramData\Skype
2014-04-14 17:34 - 2014-04-14 17:34 - 00003095 _____ () C:\Users\Michael Schwörer\Desktop\Microsoft PowerPoint 2010.lnk
2014-04-14 17:34 - 2014-04-14 17:34 - 00003047 _____ () C:\Users\Michael Schwörer\Desktop\Microsoft Excel 2010.lnk
2014-04-14 17:33 - 2014-04-14 17:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
2014-04-14 17:30 - 2014-04-14 17:30 - 00003029 _____ () C:\Users\Michael Schwörer\Desktop\Microsoft Word 2010.lnk
2014-04-14 17:30 - 2014-04-14 17:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SharePoint
2014-04-14 17:29 - 2014-04-14 17:29 - 00000000 ____D () C:\Windows\System32\Tasks\OfficeSoftwareProtectionPlatform
2014-04-14 17:29 - 2014-04-14 17:29 - 00000000 ____D () C:\Windows\PCHEALTH
2014-04-14 17:29 - 2014-04-14 17:29 - 00000000 ____D () C:\Program Files (x86)\Microsoft Synchronization Services
2014-04-14 17:29 - 2014-04-14 17:29 - 00000000 ____D () C:\Program Files (x86)\Microsoft Sync Framework
2014-04-14 17:29 - 2014-04-14 17:29 - 00000000 ____D () C:\Program Files (x86)\Microsoft SQL Server Compact Edition
2014-04-14 17:29 - 2014-04-14 17:26 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office
2014-04-14 17:29 - 2009-07-14 20:18 - 00000000 ____D () C:\Windows\ShellNew
2014-04-14 17:29 - 2009-07-14 07:32 - 00000000 ____D () C:\Program Files (x86)\MSBuild
2014-04-14 17:29 - 2009-07-14 05:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2014-04-14 17:27 - 2014-04-14 17:27 - 00000000 ____D () C:\Program Files\Microsoft Office
2014-04-14 17:27 - 2014-04-14 17:27 - 00000000 ____D () C:\Program Files (x86)\Microsoft Visual Studio 8
2014-04-14 17:27 - 2014-04-14 17:27 - 00000000 ____D () C:\Program Files (x86)\Microsoft Analysis Services
2014-04-14 17:26 - 2014-04-14 17:26 - 00000000 ___RD () C:\MSOCache
2014-04-14 17:26 - 2014-04-14 17:26 - 00000000 ____D () C:\Users\Michael Schwörer\AppData\Local\Microsoft Help
2014-04-14 17:23 - 2014-04-14 17:23 - 00000000 ____D () C:\Users\Michael Schwörer\Tracing
2014-04-14 17:23 - 2014-04-14 17:23 - 00000000 ____D () C:\Program Files (x86)\OCSetup
2014-04-14 17:23 - 2013-12-29 21:07 - 00000000 ____D () C:\Users\Michael Schwörer
2014-04-13 10:39 - 2014-04-13 10:39 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2014-04-13 10:39 - 2014-04-13 10:39 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2014-04-13 10:39 - 2014-04-13 10:39 - 00334648 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-04-13 10:39 - 2014-04-13 10:39 - 00208928 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-04-13 10:39 - 2014-04-13 10:39 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2014-04-13 10:39 - 2014-04-13 10:39 - 00084816 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2014-04-13 10:39 - 2014-04-13 10:39 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-04-13 10:39 - 2014-04-13 10:39 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-04-13 10:39 - 2014-04-13 10:39 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-04-13 10:39 - 2014-04-13 10:39 - 00001970 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-04-13 10:39 - 2014-04-13 10:39 - 00000000 ____D () C:\Users\Michael Schwörer\AppData\Roaming\AVAST Software
2014-04-13 10:39 - 2014-04-13 10:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast
2014-04-13 10:38 - 2014-04-13 10:38 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-04-13 10:38 - 2014-04-13 10:38 - 00000000 ____D () C:\Program Files\AVAST Software
2014-04-13 10:31 - 2014-04-13 10:21 - 88551496 _____ (AVAST Software) C:\Users\Michael Schwörer\Downloads\avast_free_antivirus_setup_9.0.2016.exe
2014-04-12 20:34 - 2014-04-12 20:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\K-Lite Codec Pack
2014-04-12 20:34 - 2014-04-12 20:34 - 00000000 ____D () C:\Program Files (x86)\K-Lite Codec Pack
2014-04-12 20:29 - 2014-04-12 20:29 - 00613200 _____ (Chip Digital GmbH) C:\Users\Michael Schwörer\Downloads\K Lite Mega Codec Pack - CHIP-Downloader.exe
2014-04-12 17:30 - 2014-04-12 17:30 - 00001015 _____ () C:\Users\Michael Schwörer\Desktop\SpeedFan.lnk
2014-04-12 17:30 - 2014-04-12 17:30 - 00000045 _____ () C:\Windows\SysWOW64\initdebug.nfo
2014-04-12 17:30 - 2014-04-12 17:30 - 00000000 ____D () C:\Users\Michael Schwörer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpeedFan
2014-04-12 17:30 - 2014-04-12 17:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpeedFan
2014-04-12 17:30 - 2014-04-12 17:30 - 00000000 ____D () C:\Program Files (x86)\SpeedFan
2014-04-12 17:29 - 2014-04-12 17:29 - 00613200 _____ (Chip Digital GmbH) C:\Users\Michael Schwörer\Downloads\SpeedFan - CHIP-Downloader.exe
2014-04-10 23:11 - 2013-12-30 23:57 - 90655440 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-04-10 23:11 - 2013-12-30 23:57 - 00000000 ____D () C:\Windows\system32\MRT
2014-04-05 14:43 - 2014-04-05 14:43 - 02112847 _____ () C:\Users\Michael Schwörer\Downloads\WDFirmwareUpdater.zip
2014-04-05 14:43 - 2014-04-05 14:43 - 00000000 ____D () C:\Users\Michael Schwörer\Downloads\WDFirmwareUpdater
2014-04-05 14:43 - 2014-04-05 14:43 - 00000000 ____D () C:\ProgramData\Western Digital
2014-04-05 14:42 - 2014-04-05 14:42 - 00000000 ____D () C:\Program Files\DIFX
2014-04-05 14:41 - 2014-04-05 14:41 - 00000000 ____D () C:\Users\Michael Schwörer\Downloads\WD_SES_Driver_Setup_x64
2014-04-05 14:41 - 2014-04-05 14:41 - 00000000 ____D () C:\Program Files\WDCSAM
2014-04-03 21:05 - 2014-04-03 21:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-04-03 21:05 - 2014-04-03 21:05 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-04-03 21:05 - 2014-04-03 21:05 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-04-03 09:51 - 2014-05-01 14:47 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-03 09:51 - 2014-05-01 14:47 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-03 09:50 - 2014-05-01 14:47 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-04-02 16:43 - 2014-04-02 16:07 - 00000000 ____D () C:\The KMPlayer
2014-04-02 16:35 - 2014-01-04 20:53 - 00000000 ____D () C:\Users\Michael Schwörer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-04-29 20:46
==================== End Of Log ============================ --- --- ---
Addition Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 29-04-2014
Ran by Michael Schwörer at 2014-05-01 15:10:41
Running from C:\Users\Michael Schwörer\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: avast! Antivirus (Disabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Disabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
==================== Installed Programs ======================
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 13.0.0.83 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 13.0.0.83 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.206 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.06) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.06 - Adobe Systems Incorporated)
Age of Empires III (HKLM-x32\...\InstallShield_{A8CF5C37-8EC5-4C33-BB4A-87F468B77D45}) (Version: 1.00.0000 - Microsoft Game Studios)
Age of Empires III (x32 Version: 1.00.0000 - Microsoft Game Studios) Hidden
AMD Accelerated Video Transcoding (Version: 13.10.100.30604 - Advanced Micro Devices, Inc.) Hidden
AMD Catalyst Control Center (x32 Version: 2013.0604.1838.31590 - Ihr Firmenname) Hidden
AMD Catalyst Install Manager (HKLM\...\{A6F936DD-DD80-7EA6-0AFC-5CA0558D0BB7}) (Version: 8.0.915.0 - Advanced Micro Devices, Inc.)
AMD Drag and Drop Transcoding (Version: 2.00.0000 - Advanced Micro Devices, Inc.) Hidden
AMD Media Foundation Decoders (Version: 1.0.80604.1838 - Advanced Micro Devices, Inc.) Hidden
AMD Wireless Display v3.0 (Version: 1.0.0.12 - Advanced Micro Devices, Inc.) Hidden
ASRock HDMI Switch v1.0.25 (HKLM-x32\...\ASRock HDMI Switch_is1) (Version: 1.0.25 - )
ASRock Key Master v1.0.7 (HKLM-x32\...\ASRock Key Master_is1) (Version: 1.0.7 - )
ASRock XFast RAM v3.0.2 (HKLM\...\ASRock XFast RAM_is1) (Version: - ASRock Inc.)
avast! Free Antivirus (HKLM-x32\...\Avast) (Version: 9.0.2016 - Avast Software)
Call of Duty: Modern Warfare 2 - Multiplayer (HKLM-x32\...\Steam App 10190) (Version: - Infinity Ward)
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2013.0604.1838.31590 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2013.0604.1838.31590 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2013.0604.1838.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2013.0604.1838.31590 - Advanced Micro Devices, Inc.) Hidden
Cisco Systems VPN Client 5.0.07.0440 (HKLM\...\{5FDC06BF-3D3D-4367-8FFB-4FAFCB61972D}) (Version: 5.0.7 - Cisco Systems, Inc.)
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.48.1.0347 - Disc Soft Ltd)
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{5971CA1F-6BDE-498F-952C-9F2BF94070A4}) (Version: - Microsoft)
D-Link DWA-140 (HKLM-x32\...\{D7D2F494-89E3-42ED-8A2B-75BDD9B464CB}) (Version: - D-Link)
Free YouTube Download version 3.2.20.1230 (HKLM-x32\...\Free YouTube Download_is1) (Version: 3.2.20.1230 - DVDVideoSoft Ltd.)
F-Stream Tuning v2.0.48 (HKLM-x32\...\F-Stream Tuning_is1) (Version: 2.0.48 - )
HP FWUpdateEDO2 (HKLM-x32\...\{415FA9AD-DA10-4ABE-97B6-5051D4795C90}) (Version: 1.2.0.0 - Hewlett-Packard)
HP Photo Creations (HKLM-x32\...\HP Photo Creations) (Version: 1.0.0.5192 - HP Photo Creations)
HP Photosmart 5510 series - Grundlegende Software für das Gerät (HKLM\...\{AB6268C0-EDA4-46C3-8A1C-11D86A5A8E93}) (Version: 24.0.342.0 - Hewlett-Packard Co.)
HP Photosmart 5510 series Hilfe (HKLM-x32\...\{E02964EA-0E1B-4620-A26E-CBAB0341B1BB}) (Version: 140.0.2.2 - Hewlett Packard)
HP Update (HKLM-x32\...\{85DF2EED-08BC-46FB-90DA-28B0D0A8E8A8}) (Version: 5.003.000.004 - Hewlett-Packard)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1011 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.14.1724 - Intel Corporation)
Intel(R) Network Connections 18.5.54.0 (HKLM\...\PROSetDX) (Version: 18.5.54.0 - Intel)
Intel(R) Network Connections 18.5.54.0 (Version: 18.5.54.0 - Intel) Hidden
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 2.5.0.19 - Intel Corporation)
Intel® Trusted Connect Service Client (Version: 1.28.487.1 - Intel Corporation) Hidden
Java 7 Update 51 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217051FF}) (Version: 7.0.510 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
K-Lite Mega Codec Pack 10.4.0 (HKLM-x32\...\KLiteCodecPack_is1) (Version: 10.4.0 - )
League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games )
League of Legends (x32 Version: 3.0.1 - Riot Games ) Hidden
Malwarebytes Anti-Malware Version 2.0.1.1004 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.1.1004 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Groove MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUSR) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.50727 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.50727 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden
Mirror's Edge (HKLM-x32\...\Steam App 17410) (Version: - DICE)
Mozilla Firefox 29.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 29.0 (x86 de)) (Version: 29.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Origin (HKLM-x32\...\Origin) (Version: 9.3.11.2762 - Electronic Arts, Inc.)
Pando Media Booster (HKLM-x32\...\{980A182F-E0A2-4A40-94C1-AE0C1235902E}) (Version: 2.6.0.7 - Pando Networks Inc.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7004 - Realtek Semiconductor Corp.)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32 Version: - Microsoft) Hidden
SES Driver (HKLM\...\{D8CC254C-C671-4664-9A38-FA368D1E2C97}) (Version: 1.0.0 - Western Digital)
Siemens NX 9.0 (HKLM\...\{CAE1D783-E86C-4144-B0E3-8D2485019B11}) (Version: 9.0.0.19 - Siemens)
Siemens PLM License Server (HKLM-x32\...\Siemens PLM License Server) (Version: 6.1.1.3 - Siemens Product Lifecycle Management Software Inc.)
Skype™ 6.14 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.14.104 - Skype Technologies S.A.)
SpeedFan (remove only) (HKLM-x32\...\SpeedFan) (Version: - )
Steam (HKLM-x32\...\Steam) (Version: - Valve Corporation)
TeamSpeak 3 Client (HKCU\...\TeamSpeak 3 Client) (Version: 3.0.13 - TeamSpeak Systems GmbH)
The Witcher 2: Assassins of Kings Enhanced Edition (HKLM-x32\...\Steam App 20920) (Version: - CD Projekt RED)
The Witcher: Enhanced Edition (HKLM-x32\...\Steam App 20900) (Version: - CD Projekt RED)
Tomb Raider (HKLM-x32\...\Steam App 203160) (Version: - Crystal Dynamics)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{B4A38370-2ADB-46B0-A1B0-0C4A2F7DCA31}) (Version: - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2837594) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{D3C85176-ACCC-4AF0-817D-1BC803303B74}) (Version: - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2837594) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{D3C85176-ACCC-4AF0-817D-1BC803303B74}) (Version: - Microsoft)
Update for Microsoft InfoPath 2010 (KB2817369) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{4EEA3D3E-989C-4DF4-AB0A-3042C0C12AA3}) (Version: - Microsoft)
Update for Microsoft InfoPath 2010 (KB2817396) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{39767ECA-1731-45DB-AB5B-6BF40E151D66}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DADF7E25-FFA4-4D02-BE84-1DAE62C18516}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{287A1E92-9E41-4BC1-8920-B3D0E9220800}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{9D69691D-823D-4C3E-9B12-563A3F520366}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{5AA578BB-759C-40FD-9661-A737C0884541}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2825640) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{BA610006-2C39-4419-9834-CF61AB24810A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2863818) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{C70D2038-A2C4-4A99-87DE-5272BB44F0CE}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2863818) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{83B1B530-7D9E-4C6A-907F-E979CEE9C295}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2863818) 32-Bit Edition (HKLM-x32\...\{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUSR_{82F87E28-B18E-46D6-A399-E2F19CF5949B}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2878225) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{EFF5EBA3-40AD-4859-85E7-3C1CF4F297EB}) (Version: - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version: - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version: - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-001A-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{A0657506-69DC-44AE-8DC1-58E7C6F5B1C9}) (Version: - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{2AB483F1-C86E-427A-83B4-23889B03512D}) (Version: - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM-x32\...\{90140000-0018-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{40EC8FB1-5202-469D-9232-C28FB1C6FC64}) (Version: - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{2BA40F82-F3A4-441C-BF1A-ED4C42FF4872}) (Version: - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version: - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version: - Microsoft)
Update for Microsoft Visio 2010 (KB2553444) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{799005D3-9B70-4219-AFE0-BC479614CC4D}) (Version: - Microsoft)
Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{8C55AA83-54C2-4236-A622-78440A411DC5}) (Version: - Microsoft)
VC_CRT_x64 (Version: 1.02.0000 - Intel Corporation) Hidden
Windows Driver Package - Western Digital Technologies (WDC_SAM) WDC_SAM (01/19/2011 1.0.0009.0) (HKLM\...\4CA7CFBB29889F25ACB3DF6E3A42BAE29EB43B20) (Version: 01/19/2011 1.0.0009.0 - Western Digital Technologies)
WinRAR 5.01 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.01.0 - win.rar GmbH)
==================== Restore Points =========================
22-04-2014 14:52:45 Windows Update
29-04-2014 14:54:02 Windows Update
29-04-2014 15:01:49 Windows Update
01-05-2014 09:48:57 ComboFix created restore point
01-05-2014 13:01:57 zoek.exe restore point
==================== Hosts content: ==========================
2009-07-14 04:34 - 2014-05-01 11:54 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
Task: {0DC469A4-FD51-4744-8D80-08D635E718CD} - System32\Tasks\HDMISwitch => C:\Program Files (x86)\ASRock Utility\HDMISwitch\Bin\HDMISwitch.exe [2013-09-04] ()
Task: {517A960F-E135-41A4-8029-F7EE38FD77E4} - System32\Tasks\AsrKM => C:\Program Files (x86)\ASRock Utility\Key Master\AsrKM.exe [2013-09-11] ()
Task: {99570A1D-012B-4623-B522-AAE0C6023876} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-04-13] (AVAST Software)
Task: {9FA915B6-84DE-48C2-A9F2-1088116C32B7} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-04-29] (Adobe Systems Incorporated)
Task: {C9DF20C2-E4A1-4542-AE28-F61327E070DF} - System32\Tasks\HP Photo Creations Messager => C:\ProgramData\HP Photo Creations\MessageCheck.exe [2011-02-15] ()
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\HP Photo Creations Messager.job => C:\ProgramData\HP Photo Creations\MessageCheck.exe
==================== Loaded Modules (whitelisted) =============
2013-12-30 22:59 - 2013-05-28 18:58 - 00454656 _____ () C:\Program Files (x86)\Fatal1ty Utility\F-Stream Tuning\Bin\IOMonitorSrv.exe
2013-12-30 16:14 - 2010-07-12 15:39 - 00053248 _____ () C:\Program Files (x86)\D-Link\DWA-140 revB\ANIWConnService.exe
2013-09-05 00:17 - 2013-09-05 00:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2013-12-30 22:59 - 2013-09-04 18:26 - 02217224 _____ () C:\Program Files (x86)\ASRock Utility\HDMISwitch\Bin\HDMISwitch.exe
2014-04-30 23:24 - 2014-04-30 23:24 - 02252800 _____ () C:\Program Files\AVAST Software\Avast\defs\14043002\algo.dll
2011-03-04 13:49 - 2011-03-04 13:49 - 00202752 _____ () C:\Program Files (x86)\Cisco Systems\VPN Client\vpnapi.dll
2013-12-30 16:15 - 2013-12-30 16:15 - 00315392 _____ () C:\Program Files (x86)\D-Link\DWA-140 revB\ANPDApi.dll
2013-12-30 16:14 - 2012-12-05 11:40 - 00303104 _____ () C:\Program Files (x86)\D-Link\DWA-140 revB\WlanApp.dll
2014-04-13 10:39 - 2014-04-13 10:39 - 19336120 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
==================== Alternate Data Streams (whitelisted) =========
==================== Safe Mode (whitelisted) ===================
==================== Disabled items from MSCONFIG ==============
==================== Faulty Device Manager Devices =============
Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: Cisco Systems VPN Adapter for 64-bit Windows
Description: Cisco Systems VPN Adapter for 64-bit Windows
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: CVirtA
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (04/28/2014 09:52:17 PM) (Source: Application Hang) (User: )
Description: Programm DeviceSetup.exe, Version 24.0.342.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 17fc
Startzeit: 01cf631b4b13e7a2
Endzeit: 6
Anwendungspfad: C:\Program Files\HP\HP Photosmart 5510 series\Bin\DeviceSetup.exe
Berichts-ID:
Error: (04/28/2014 09:45:22 PM) (Source: Application Hang) (User: )
Description: Programm FSTU.exe, Version 2.0.48.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 136c
Startzeit: 01cf631a0261f833
Endzeit: 20
Anwendungspfad: C:\Program Files (x86)\Fatal1ty Utility\F-Stream Tuning\Bin\FSTU.exe
Berichts-ID: a18b98fb-cf0d-11e3-99a1-bc5ff4f4a3bb
Error: (04/23/2014 05:26:40 PM) (Source: Steam Client Service) (User: )
Description: Error: Failed to poke open firewall
Error: (04/22/2014 09:56:51 PM) (Source: Application Hang) (User: )
Description: Programm rads_user_kernel.exe, Version 0.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 48c
Startzeit: 01cf5e64d46df306
Endzeit: 1
Anwendungspfad: C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe
Berichts-ID: 3db2dbfa-ca58-11e3-b886-bc5ff4f4a3bb
Error: (04/22/2014 06:10:21 PM) (Source: Steam Client Service) (User: )
Description: Error: Failed to poke open firewall
Error: (04/21/2014 06:42:19 PM) (Source: Steam Client Service) (User: )
Description: Error: Failed to poke open firewall
Error: (04/20/2014 09:26:55 PM) (Source: Steam Client Service) (User: )
Description: Error: Failed to poke open firewall
Error: (04/20/2014 01:02:12 PM) (Source: Steam Client Service) (User: )
Description: Error: Failed to poke open firewall
Error: (04/19/2014 01:29:28 PM) (Source: Steam Client Service) (User: )
Description: Error: Failed to poke open firewall
Error: (04/19/2014 02:03:49 AM) (Source: Steam Client Service) (User: )
Description: Error: Failed to poke open firewall
System errors:
=============
Error: (05/01/2014 03:08:35 PM) (Source: volmgr) (User: )
Description: Die Initialisierung des Speicherabbildes ist fehlgeschlagen.
Error: (05/01/2014 03:07:12 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.
Error: (05/01/2014 03:07:12 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.
Error: (05/01/2014 03:07:11 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.
Error: (05/01/2014 03:07:11 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.
Error: (05/01/2014 03:07:11 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.
Error: (05/01/2014 02:35:07 PM) (Source: volmgr) (User: )
Description: Die Initialisierung des Speicherabbildes ist fehlgeschlagen.
Error: (05/01/2014 00:01:27 PM) (Source: volmgr) (User: )
Description: Die Initialisierung des Speicherabbildes ist fehlgeschlagen.
Error: (05/01/2014 11:54:23 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.
Error: (05/01/2014 11:52:50 AM) (Source: Application Popup) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \??\C:\ComboFix\catchme.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.
Microsoft Office Sessions:
=========================
Error: (04/28/2014 09:52:17 PM) (Source: Application Hang)(User: )
Description: DeviceSetup.exe24.0.342.017fc01cf631b4b13e7a26C:\Program Files\HP\HP Photosmart 5510 series\Bin\DeviceSetup.exe
Error: (04/28/2014 09:45:22 PM) (Source: Application Hang)(User: )
Description: FSTU.exe2.0.48.0136c01cf631a0261f83320C:\Program Files (x86)\Fatal1ty Utility\F-Stream Tuning\Bin\FSTU.exea18b98fb-cf0d-11e3-99a1-bc5ff4f4a3bb
Error: (04/23/2014 05:26:40 PM) (Source: Steam Client Service)(User: )
Description: Failed to poke open firewall
Error: (04/22/2014 09:56:51 PM) (Source: Application Hang)(User: )
Description: rads_user_kernel.exe0.0.0.048c01cf5e64d46df3061C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe3db2dbfa-ca58-11e3-b886-bc5ff4f4a3bb
Error: (04/22/2014 06:10:21 PM) (Source: Steam Client Service)(User: )
Description: Failed to poke open firewall
Error: (04/21/2014 06:42:19 PM) (Source: Steam Client Service)(User: )
Description: Failed to poke open firewall
Error: (04/20/2014 09:26:55 PM) (Source: Steam Client Service)(User: )
Description: Failed to poke open firewall
Error: (04/20/2014 01:02:12 PM) (Source: Steam Client Service)(User: )
Description: Failed to poke open firewall
Error: (04/19/2014 01:29:28 PM) (Source: Steam Client Service)(User: )
Description: Failed to poke open firewall
Error: (04/19/2014 02:03:49 AM) (Source: Steam Client Service)(User: )
Description: Failed to poke open firewall
CodeIntegrity Errors:
===================================
Date: 2014-05-01 11:52:50.038
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-05-01 11:52:49.975
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
==================== Memory info ===========================
Percentage of memory in use: 17%
Total physical RAM: 8111.47 MB
Available physical RAM: 6723.16 MB
Total Pagefile: 8109.65 MB
Available Pagefile: 6584.57 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB
==================== Drives ================================
Drive c: (SSD ) (Fixed) (Total:111.69 GB) (Free:37 GB) NTFS
Drive d: (HDD) (Fixed) (Total:931.51 GB) (Free:878.81 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 199A1823)
Partition 1: (Not Active) - (Size=932 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 112 GB) (Disk ID: B7DB1726)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=112 GB) - (Type=07 NTFS)
==================== End Of Log ============================ |