Trojaner-Board - Yahoo-Account versendet mit meinem Namen aber anderer Endung Mails

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - Yahoo-Account versendet mit meinem Namen aber anderer Endung Mails (https://www.trojaner-board.de/155112-yahoo-account-versendet-meinem-namen-anderer-endung-mails.html)

tombo11

12.06.2014 09:56

Yahoo-Account versendet mit meinem Namen aber anderer Endung Mails

Hallo zusammen,
mein Vater hat gestern bemerkt das er von mir (z.B. 345678@yahoo) und meiner Mutter (z.B 123@yahoo) die selbe russische Mail bekommen hat, welche aber gleichzeitig noch unzählige andere bekommen haben. Dann hat er sich aber die Email-Adresse genau angesehen und statt meiner Adresse mit 345678@yahoo.de steht der gleiche Name aber eine andere Endung 345678@yahoo.com da. Nun verwendet meine Mutter aber ihren eigenen Rechner und ihr Handy, ich einen anderen pc, meinen Laptop, handy um die Mails abzurufen. Sie hat sich noch nie an meinen pc oder Laptop angemeldet und ich nicht an ihrem Pc, dennoch werden mit ihrer und meiner Mail-Adresse Mails mit dem selben Russischen Inhalt verschickt. :(

Vielen dank schon mal

schrauber

12.06.2014 10:05

Hi,

.com ist eine andere Emailadresse als .de. Fraglich ob der envelope passt.

Passwörter zu den Accounts auf jeden fall erneuern.

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

tombo11

12.06.2014 11:40

Mein Computer:

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-06-2014 01

Ran by Tom (ATTENTION: The logged in user is not administrator) on HP-PC on 12-06-2014 11:33:01

Running from C:\Users\Tom\Desktop

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 11

Boot Mode: Normal
 
 
 

==================== Processes (Whitelisted) =================
 

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe

(Hewlett-Packard) C:\Program Files (x86)\hp\HP Software Update\hpwuschd2.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe

(CyberLink) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe

(CyberLink Corp.) C:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-04] (Intel Corporation)

HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1271072 2014-03-11] (Microsoft Corporation)

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2234144 2014-02-05] (NVIDIA Corporation)

HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\nvspcap64.dll [1179576 2014-02-05] (NVIDIA Corporation)

HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-12] (Apple Inc.)

HKLM-x32\...\Run: [AppleSyncNotifier] => C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [59240 2011-09-27] (Apple Inc.)

HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)

HKLM-x32\...\Run: [] => [X]

HKLM-x32\...\Run: [Easybits Recovery] => C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe [612872 2014-01-03] (EasyBits Software AS)

HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)

HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-05-26] (Apple Inc.)

HKLM\...\RunOnce: [*WerKernelReporting] - %SYSTEMROOT%\SYSTEM32\WerFault.exe -k -rq [415232 2009-07-14] (Microsoft Corporation)

Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)

HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1

HKU\S-1-5-21-3866226941-2986741872-3141305892-1003\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)

HKU\S-1-5-21-3866226941-2986741872-3141305892-1003\...\Policies\system: [LogonHoursAction] 2

HKU\S-1-5-21-3866226941-2986741872-3141305892-1003\...\Policies\system: [DontDisplayLogonHoursWarnings] 1

HKU\S-1-5-21-3866226941-2986741872-3141305892-1003\...\MountPoints2: {0a4b6134-e52d-11e0-8b58-4061860db83a} - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL G:\index.html

HKU\S-1-5-21-3866226941-2986741872-3141305892-1003\...\MountPoints2: {92a9deeb-9e4e-11df-82b3-4061860db83a} - G:\LaunchU3.exe -a

HKU\S-1-5-21-3866226941-2986741872-3141305892-1003\...\MountPoints2: {d4a8951d-05bd-11df-8744-806e6f6e6963} - F:\autorun.exe

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\phase-6 Reminder.lnk

ShortcutTarget: phase-6 Reminder.lnk -> C:\Program Files (x86)\phase-6\phase-6\reminder\reminder.exe (phase-6)

GroupPolicyUsers\S-1-5-21-3866226941-2986741872-3141305892-1003\User: Group Policy restriction detected <======= ATTENTION
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_DE&c=94&bd=Pavilion&pf=cndt

SearchScopes: HKLM - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=102&systemid=406&q={searchTerms}

SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKLM - {55569AE9-E080-4075-8F4C-198D43C36528} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008

SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=102&systemid=406&q={searchTerms}

SearchScopes: HKLM - {D81DF4A5-2989-4677-8D95-BC3A4221F70F} URL = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcndtie7-de-de

SearchScopes: HKLM - {FA7B8497-781C-489C-B5B7-A24024F2DC7B} URL = hxxp://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933

SearchScopes: HKLM-x32 - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=102&systemid=406&q={searchTerms}

SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKLM-x32 - {55569AE9-E080-4075-8F4C-198D43C36528} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008

SearchScopes: HKLM-x32 - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=102&systemid=406&q={searchTerms}

SearchScopes: HKLM-x32 - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050

SearchScopes: HKLM-x32 - {D81DF4A5-2989-4677-8D95-BC3A4221F70F} URL = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcndtie7-de-de

SearchScopes: HKLM-x32 - {FA7B8497-781C-489C-B5B7-A24024F2DC7B} URL = hxxp://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933

SearchScopes: HKCU - DefaultScope {571635C1-C94C-4553-A47B-3794ECB5F688} URL = hxxp://www.google.de/#hl=de&q={searchTerms}&aq=f&aqi=g10&aql=&oq=&gs_rfai=&fp=340825e95a231672

SearchScopes: HKCU - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} URL = hxxp://www.crawler.com/search/dispatcher.aspx?tp=bs&qkw={searchTerms}&tbid=66019

SearchScopes: HKCU - {55569AE9-E080-4075-8F4C-198D43C36528} URL = 

SearchScopes: HKCU - {571635C1-C94C-4553-A47B-3794ECB5F688} URL = hxxp://www.google.de/#hl=de&q={searchTerms}&aq=f&aqi=g10&aql=&oq=&gs_rfai=&fp=340825e95a231672

BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll No File

Toolbar: HKCU - No Name - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} -  No File

Toolbar: HKCU - No Name - {DE9C389F-3316-41A7-809B-AA305ED9D922} -  No File

Toolbar: HKCU - No Name - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} -  No File

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} -  No File

Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

ShellExecuteHooks:  - {E54729E8-643D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook64.dll [773192 2014-03-20] ()

ShellExecuteHooks-x32:  - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook32.dll [484936 2014-03-20] ()

Winsock: Catalog5 09 C:\Windows\system32\d3dy1v1jk.dll File Not found ()

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
 

FireFox:

========

FF ProfilePath: C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\1s9wump8.default

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()

FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)

FF Plugin-x32: @esn/esnlaunch,version=1.104.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.104.0\npesnlaunch.dll No File

FF Plugin-x32: @esn/esnlaunch,version=1.116.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.116.0\npesnlaunch.dll No File

FF Plugin-x32: @esn/esnlaunch,version=1.122.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.122.0\npesnlaunch.dll No File

FF Plugin-x32: @esn/esnlaunch,version=1.140.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.140.0\npesnlaunch.dll No File

FF Plugin-x32: @esn/esnlaunch,version=1.96.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.96.0\npesnlaunch.dll No File

FF Plugin-x32: @esn/esnlaunch,version=2.1.3 - C:\Program Files (x86)\Battlelog Web Plugins\2.1.3\npesnlaunch.dll No File

FF Plugin-x32: @esn/npbattlelog,version=2.3.2 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.2\npbattlelog.dll (EA Digital Illusions CE AB)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2011-11-25]
 

==================== Services (Whitelisted) =================
 

R2 Dnscache; C:\Windows\System32\pouarljul.dll [354816 2012-06-09] (Parental Solutions Inc.) [File not signed]

R2 ezSharedSvc; C:\Windows\SysWOW64\ezsvc7.dll [129584 2009-02-22] (EasyBits Sofware AS) [File not signed]

R2 Fabs; C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [1253376 2009-08-27] (MAGIX AG) [File not signed]

S3 FirebirdServerMAGIXInstance; C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [3276800 2008-08-07] (MAGIX®) [File not signed]

S4 HerculesDJControlMP3; C:\Program Files\Hercules\Audio\DJ Console Series\HerculesDJControlMP3.EXE [20480 2007-11-21] () [File not signed]

R2 HP Health Check Service; C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe [124928 2009-07-09] (Hewlett-Packard) [File not signed]

S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [69632 2005-11-14] (Macrovision Corporation) [File not signed]

R2 LightScribeService; c:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2009-05-18] (Hewlett-Packard Company) [File not signed]

R2 lmhosts; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [398184 2012-12-14] (Malwarebytes Corporation) [File not signed]

R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [682344 2012-12-14] (Malwarebytes Corporation) [File not signed]

R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2014-03-11] (Microsoft Corporation)

R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [347872 2014-03-11] (Microsoft Corporation)

R2 NlaSvc; C:\Windows\System32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)

R2 nsi; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)

R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1593632 2014-02-05] (NVIDIA Corporation)

R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [16941856 2014-02-05] (NVIDIA Corporation)

R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-03-26] ()

R2 ezSharedSvc; C:\Windows\System32\ezsvc7.dll [X]

R2 Update-Service; %SystemRoot%\System32\UpdSvc.dll [X]
 

==================== Drivers (Whitelisted) ====================
 

R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2010-01-22] ()

S3 Bulk; C:\Windows\System32\Drivers\HDJBulk.sys [154112 2009-10-02] (© Guillemot R&D, 2009. All rights reserved.)

S3 Cardex; C:\Windows\SysWOW64\drivers\TBPANELX64.SYS [15648 2007-03-16] (Windows (R) Server 2003 DDK provider)

S3 HDJMidi; C:\Windows\System32\DRIVERS\HDJMidi.sys [144896 2009-10-02] (© Guillemot R&D, 2009. All rights reserved.)

R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2010-01-22] ()

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [24176 2012-12-14] (Malwarebytes Corporation) [File not signed]

R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [268512 2014-01-25] (Microsoft Corporation)

S3 Netaapl; C:\Windows\System32\DRIVERS\netaapl64.sys [22528 2011-05-10] (Apple Inc.) [File not signed]

R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133928 2014-03-11] (Microsoft Corporation)

R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-27] (NVIDIA Corporation)

S3 s0017bus; C:\Windows\System32\DRIVERS\s0017bus.sys [113704 2008-10-21] (MCCI Corporation)

S3 s0017mdfl; C:\Windows\System32\DRIVERS\s0017mdfl.sys [19496 2008-10-21] (MCCI Corporation)

S3 s0017mdm; C:\Windows\System32\DRIVERS\s0017mdm.sys [152616 2008-10-21] (MCCI Corporation)

S3 s0017obex; C:\Windows\System32\DRIVERS\s0017obex.sys [128552 2008-10-21] (MCCI Corporation)

S3 s0017unic; C:\Windows\System32\DRIVERS\s0017unic.sys [145960 2008-10-21] (MCCI Corporation)

S3 s3017bus; C:\Windows\System32\DRIVERS\s3017bus.sys [109096 2007-12-10] (MCCI Corporation)

S3 s3017mdfl; C:\Windows\System32\DRIVERS\s3017mdfl.sys [19496 2007-12-10] (MCCI Corporation)

S3 s3017mdm; C:\Windows\System32\DRIVERS\s3017mdm.sys [146984 2007-12-10] (MCCI Corporation)

S3 s3017mgmt; C:\Windows\System32\DRIVERS\s3017mgmt.sys [130600 2007-12-10] (MCCI Corporation)

S3 s3017nd5; C:\Windows\System32\DRIVERS\s3017nd5.sys [34344 2007-12-10] (MCCI Corporation)

S3 s3017obex; C:\Windows\System32\DRIVERS\s3017obex.sys [125480 2007-12-10] (MCCI Corporation)

S3 s3017unic; C:\Windows\System32\DRIVERS\s3017unic.sys [144936 2007-12-10] (MCCI Corporation)

R3 seehcri; C:\Windows\System32\DRIVERS\seehcri.sys [34032 2008-01-09] (Sony Ericsson Mobile Communications)

S2 TBPanel; No ImagePath

R2 {55662437-DA8C-40c0-AADA-2C816A897A49}; c:\Program Files (x86)\Hewlett-Packard\Media\DVD\000.fcl [146928 2009-10-20] (CyberLink Corp.)

S3 PCDSRVC{4942F9C0-0B403F17-06000000}_0; \??\c:\pcdr5\pcdsrvc_x64.pkms [X]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-06-12 11:33 - 2014-06-12 11:34 - 00017615 _____ () C:\Users\Tom\Desktop\FRST.txt

2014-06-12 11:33 - 2014-06-12 11:34 - 00000000 ____D () C:\Users\Tom\Desktop\Trojaner

2014-06-12 11:32 - 2014-06-12 11:33 - 00000000 ____D () C:\FRST

2014-06-12 11:29 - 2014-06-12 11:31 - 02081792 _____ (Farbar) C:\Users\Tom\Desktop\FRST64.exe

2014-06-09 15:02 - 2014-06-09 15:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes

2014-06-09 15:00 - 2014-06-09 15:02 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69

2014-06-09 15:00 - 2014-06-09 15:02 - 00000000 ____D () C:\Program Files\iTunes

2014-06-09 15:00 - 2014-06-09 15:02 - 00000000 ____D () C:\Program Files (x86)\iTunes

2014-06-09 15:00 - 2014-06-09 15:00 - 00000000 ____D () C:\Program Files\iPod

2014-06-08 23:27 - 2014-06-08 23:28 - 00000000 ____D () C:\Dark Shadows

2014-06-07 14:23 - 2014-06-07 14:23 - 00000000 ____D () C:\Users\Tom\Documents\Wizards of the Coast

2014-06-07 13:50 - 2014-06-07 13:50 - 00000222 _____ () C:\Users\Tom\Desktop\Magic 2014.url

2014-06-05 15:44 - 2014-06-05 15:44 - 00000000 ____D () C:\Users\Tom\AppData\Local\SniperV2

2014-06-05 14:10 - 2014-06-05 14:10 - 00000221 _____ () C:\Users\Tom\Desktop\Sniper Elite V2.url

2014-05-28 22:38 - 2014-05-28 22:38 - 00000000 ____D () C:\Users\HP\Documents\Battlefield 2

2014-05-28 22:36 - 2014-05-28 22:44 - 00000000 ____D () C:\Users\Tom\Documents\Battlefield 2

2014-05-28 22:34 - 2014-05-28 22:35 - 00000000 ____D () C:\Program Files (x86)\Battlefield 2

2014-05-27 16:12 - 2014-05-20 01:10 - 00601432 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe

2014-05-27 16:07 - 2014-05-20 04:44 - 31387936 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 25256224 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 24025376 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 17561544 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 17480432 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 16003912 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 12688328 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys

2014-05-27 16:07 - 2014-05-20 04:44 - 11644928 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 11599072 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 09735256 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 09697640 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 03141976 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 02953672 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 02785568 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvenc.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 02412376 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvenc.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 01889112 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6433788.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 01541576 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6433788.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 00895776 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 00892704 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 00867784 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 00861128 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 00837056 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 00354016 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 00305600 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 00166568 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 00146480 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll

2014-05-25 20:28 - 2014-05-29 15:43 - 00000000 ____D () C:\Users\Tom\Desktop\Holland Dreas

2014-05-25 20:22 - 2014-06-12 11:32 - 00000000 ____D () C:\Users\Tom\Desktop\Abschlusszeitung

2014-05-25 20:21 - 2014-05-25 20:22 - 00000000 ____D () C:\Users\Tom\Desktop\Absolventen Fotos

2014-05-25 19:55 - 2014-05-25 19:56 - 00000000 ____D () C:\Users\HP\AppData\Local\NVIDIA

2014-05-25 19:55 - 2014-05-25 19:55 - 00000000 ____D () C:\Users\Tom\AppData\Local\NVIDIA Corporation

2014-05-25 19:51 - 2014-05-27 15:56 - 00000000 ____D () C:\Users\Tom\AppData\Local\NVIDIA

2014-05-25 19:51 - 2014-02-05 11:31 - 01048152 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll

2014-05-25 19:51 - 2014-02-05 11:30 - 01179576 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll

2014-05-25 19:50 - 2014-05-27 16:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation

2014-05-25 19:50 - 2014-05-25 19:50 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies

2014-05-25 19:46 - 2014-03-04 16:35 - 01885472 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6433523.dll

2014-05-25 19:46 - 2014-03-04 16:35 - 01516488 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6433523.dll

2014-05-25 19:46 - 2013-12-27 20:42 - 00039200 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys

2014-05-25 19:46 - 2013-12-27 20:42 - 00035104 _____ (NVIDIA Corporation) C:\Windows\system32\nvaudcap64v.dll

2014-05-25 19:46 - 2013-12-27 20:42 - 00033056 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll

2014-05-25 19:46 - 2013-11-28 15:38 - 00197408 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys

2014-05-25 19:46 - 2013-11-28 15:38 - 00031520 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll

2014-05-24 15:03 - 2014-05-20 04:44 - 14434704 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll

2014-05-24 15:03 - 2012-03-01 02:02 - 01466176 _____ (NVIDIA Corporation) C:\Windows\system32\nvgenco64.dll

2014-05-24 15:03 - 2012-03-01 02:02 - 00364352 _____ (NVIDIA Corporation) C:\Windows\system32\nvdecodemft.dll

2014-05-24 15:03 - 2012-03-01 02:02 - 00301376 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvdecodemft.dll

2014-05-24 15:03 - 2012-03-01 02:02 - 00068928 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll

2014-05-24 15:03 - 2012-03-01 02:02 - 00061248 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll

2014-05-24 13:46 - 2014-05-24 15:02 - 00000000 ____D () C:\Users\Tom\.phase-6

2014-05-24 13:46 - 2014-05-24 13:46 - 00000000 ____D () C:\Users\Tom\AppData\Roaming\Phase6

2014-05-24 13:46 - 2014-05-24 13:46 - 00000000 ____D () C:\Users\Tom\.swt

2014-05-24 13:44 - 2014-05-24 13:45 - 85744960 _____ () C:\Users\HP\Downloads\phase-6-desktop-2.3.4-windows-installer.exe

2014-05-24 13:43 - 2014-05-24 13:43 - 00001119 _____ () C:\Users\Public\Desktop\phase-6 desktop.lnk

2014-05-24 13:43 - 2014-05-24 13:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\phase-6

2014-05-24 13:25 - 2014-05-24 13:25 - 00001075 _____ () C:\Users\Tom\Downloads\Bilder - Verknüpfung.lnk

2014-05-16 00:31 - 2014-05-06 06:40 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-05-16 00:31 - 2014-05-06 06:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-05-16 00:31 - 2014-05-06 05:25 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-05-16 00:31 - 2014-05-06 05:07 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-05-16 00:31 - 2014-05-06 05:00 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-05-16 00:31 - 2014-05-06 04:10 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-05-15 18:22 - 2014-05-09 08:14 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-05-15 18:22 - 2014-03-25 04:43 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll

2014-05-15 18:22 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll

2014-05-15 18:21 - 2014-05-09 08:11 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-05-15 18:20 - 2014-04-12 04:22 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys

2014-05-15 18:20 - 2014-04-12 04:22 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys

2014-05-15 18:20 - 2014-04-12 04:19 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll

2014-05-15 18:20 - 2014-04-12 04:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll

2014-05-15 18:20 - 2014-04-12 04:19 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe

2014-05-15 18:20 - 2014-04-12 04:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll

2014-05-15 18:20 - 2014-04-12 04:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll

2014-05-15 18:20 - 2014-04-12 04:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll

2014-05-15 18:20 - 2014-04-12 04:10 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll

2014-05-15 18:20 - 2014-03-04 11:47 - 05550016 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2014-05-15 18:20 - 2014-03-04 11:44 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll

2014-05-15 18:20 - 2014-03-04 11:44 - 00722944 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll

2014-05-15 18:20 - 2014-03-04 11:44 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll

2014-05-15 18:20 - 2014-03-04 11:44 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll

2014-05-15 18:20 - 2014-03-04 11:44 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll

2014-05-15 18:20 - 2014-03-04 11:44 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll

2014-05-15 18:20 - 2014-03-04 11:44 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll

2014-05-15 18:20 - 2014-03-04 11:44 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll

2014-05-15 18:20 - 2014-03-04 11:43 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe

2014-05-15 18:20 - 2014-03-04 11:43 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll

2014-05-15 18:20 - 2014-03-04 11:43 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll

2014-05-15 18:20 - 2014-03-04 11:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll

2014-05-15 18:20 - 2014-03-04 11:43 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll

2014-05-15 18:20 - 2014-03-04 11:43 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll

2014-05-15 18:20 - 2014-03-04 11:43 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll

2014-05-15 18:20 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe

2014-05-15 18:20 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe

2014-05-15 18:20 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll

2014-05-15 18:20 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll

2014-05-15 18:20 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll

2014-05-15 18:20 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll

2014-05-15 18:20 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll

2014-05-15 18:20 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll

2014-05-15 18:20 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cngprovider.dll

2014-05-15 18:20 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adprovider.dll

2014-05-15 18:20 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\capiprovider.dll

2014-05-15 18:20 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpapiprovider.dll

2014-05-15 18:20 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll

2014-05-15 18:20 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincredprovider.dll

2014-05-15 18:20 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll

2014-05-15 18:20 - 2014-03-04 11:16 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
 

==================== One Month Modified Files and Folders =======
 

2014-06-12 11:34 - 2014-06-12 11:33 - 00017615 _____ () C:\Users\Tom\Desktop\FRST.txt

2014-06-12 11:34 - 2014-06-12 11:33 - 00000000 ____D () C:\Users\Tom\Desktop\Trojaner

2014-06-12 11:34 - 2010-08-07 20:06 - 00000000 ____D () C:\Users\Tom\AppData\Local\Temp

2014-06-12 11:33 - 2014-06-12 11:32 - 00000000 ____D () C:\FRST

2014-06-12 11:33 - 2010-01-20 14:23 - 01635037 _____ () C:\Windows\WindowsUpdate.log

2014-06-12 11:32 - 2014-05-25 20:22 - 00000000 ____D () C:\Users\Tom\Desktop\Abschlusszeitung

2014-06-12 11:32 - 2009-07-14 06:45 - 00015568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-06-12 11:32 - 2009-07-14 06:45 - 00015568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-06-12 11:31 - 2014-06-12 11:29 - 02081792 _____ (Farbar) C:\Users\Tom\Desktop\FRST64.exe

2014-06-12 11:31 - 2009-09-25 02:14 - 02267384 _____ () C:\Windows\system32\perfh007.dat

2014-06-12 11:31 - 2009-09-25 02:14 - 00636088 _____ () C:\Windows\system32\perfc007.dat

2014-06-12 11:31 - 2009-07-14 07:13 - 00006264 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-06-12 11:27 - 2012-03-24 16:41 - 00121221 _____ () C:\Windows\setupact.log

2014-06-12 11:26 - 2010-12-09 16:17 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-06-12 11:26 - 2010-12-09 16:17 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-06-12 11:21 - 2012-03-24 16:41 - 00371052 _____ () C:\Windows\PFRO.log

2014-06-12 11:21 - 2009-09-24 16:26 - 00000000 ____D () C:\ProgramData\NVIDIA

2014-06-12 11:21 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-06-09 18:07 - 2010-01-20 14:23 - 00000000 ____D () C:\Users\HP\AppData\Local\Temp

2014-06-09 17:17 - 2012-04-02 10:22 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-06-09 15:02 - 2014-06-09 15:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes

2014-06-09 15:02 - 2014-06-09 15:00 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69

2014-06-09 15:02 - 2014-06-09 15:00 - 00000000 ____D () C:\Program Files\iTunes

2014-06-09 15:02 - 2014-06-09 15:00 - 00000000 ____D () C:\Program Files (x86)\iTunes

2014-06-09 15:02 - 2012-09-16 13:19 - 00001785 _____ () C:\Users\Public\Desktop\iTunes.lnk

2014-06-09 15:00 - 2014-06-09 15:00 - 00000000 ____D () C:\Program Files\iPod

2014-06-08 23:28 - 2014-06-08 23:27 - 00000000 ____D () C:\Dark Shadows

2014-06-07 14:23 - 2014-06-07 14:23 - 00000000 ____D () C:\Users\Tom\Documents\Wizards of the Coast

2014-06-07 14:23 - 2012-04-28 17:50 - 00000000 ____D () C:\Program Files (x86)\Steam

2014-06-07 13:50 - 2014-06-07 13:50 - 00000222 _____ () C:\Users\Tom\Desktop\Magic 2014.url

2014-06-05 15:44 - 2014-06-05 15:44 - 00000000 ____D () C:\Users\Tom\AppData\Local\SniperV2

2014-06-05 15:41 - 2012-04-28 19:22 - 00326304 _____ () C:\Windows\DirectX.log

2014-06-05 14:10 - 2014-06-05 14:10 - 00000221 _____ () C:\Users\Tom\Desktop\Sniper Elite V2.url

2014-06-04 20:59 - 2012-03-24 16:35 - 00000868 _____ () C:\Users\Tom\Desktop\CCleaner.lnk

2014-05-29 17:09 - 2013-06-04 17:32 - 00000000 ____D () C:\Users\Tom\Documents\Stronghold Legends

2014-05-29 15:43 - 2014-05-25 20:28 - 00000000 ____D () C:\Users\Tom\Desktop\Holland Dreas

2014-05-28 22:44 - 2014-05-28 22:36 - 00000000 ____D () C:\Users\Tom\Documents\Battlefield 2

2014-05-28 22:38 - 2014-05-28 22:38 - 00000000 ____D () C:\Users\HP\Documents\Battlefield 2

2014-05-28 22:38 - 2010-02-26 23:22 - 00000000 ____D () C:\Users\HP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games

2014-05-28 22:36 - 2012-08-23 17:51 - 00000000 ____D () C:\Users\Tom\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games

2014-05-28 22:35 - 2014-05-28 22:34 - 00000000 ____D () C:\Program Files (x86)\Battlefield 2

2014-05-28 22:08 - 2012-06-22 16:45 - 00000000 ____D () C:\Program Files (x86)\Diablo III

2014-05-28 21:44 - 2012-12-15 19:43 - 00000000 ____D () C:\Users\Tom\Documents\my games

2014-05-28 21:42 - 2012-06-22 16:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Diablo III

2014-05-27 16:12 - 2014-05-25 19:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation

2014-05-27 16:12 - 2010-01-20 14:32 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation

2014-05-27 15:56 - 2014-05-25 19:51 - 00000000 ____D () C:\Users\Tom\AppData\Local\NVIDIA

2014-05-25 20:22 - 2014-05-25 20:21 - 00000000 ____D () C:\Users\Tom\Desktop\Absolventen Fotos

2014-05-25 20:21 - 2012-03-30 18:14 - 00000000 ____D () C:\Users\Tom\Desktop\Desktopverknüpfungen

2014-05-25 19:56 - 2014-05-25 19:55 - 00000000 ____D () C:\Users\HP\AppData\Local\NVIDIA

2014-05-25 19:55 - 2014-05-25 19:55 - 00000000 ____D () C:\Users\Tom\AppData\Local\NVIDIA Corporation

2014-05-25 19:55 - 2010-10-01 15:20 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation

2014-05-25 19:51 - 2010-01-20 14:31 - 00000000 ____D () C:\Program Files\NVIDIA Corporation

2014-05-25 19:50 - 2014-05-25 19:50 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies

2014-05-24 16:22 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache

2014-05-24 15:06 - 2010-01-20 14:30 - 00000000 ____D () C:\NVIDIA

2014-05-24 15:02 - 2014-05-24 13:46 - 00000000 ____D () C:\Users\Tom\.phase-6

2014-05-24 13:48 - 2012-03-25 10:49 - 209760560 _____ (NVIDIA Corporation) C:\Users\HP\Downloads\296.10-desktop-win7-winvista-64bit-international-whql.exe

2014-05-24 13:46 - 2014-05-24 13:46 - 00000000 ____D () C:\Users\Tom\AppData\Roaming\Phase6

2014-05-24 13:46 - 2014-05-24 13:46 - 00000000 ____D () C:\Users\Tom\.swt

2014-05-24 13:46 - 2012-03-24 18:20 - 00000000 ____D () C:\Users\Tom\AppData\Roaming\Mozilla

2014-05-24 13:46 - 2010-08-07 20:06 - 00000000 ____D () C:\Users\Tom

2014-05-24 13:45 - 2014-05-24 13:44 - 85744960 _____ () C:\Users\HP\Downloads\phase-6-desktop-2.3.4-windows-installer.exe

2014-05-24 13:44 - 2011-11-21 17:05 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-05-24 13:43 - 2014-05-24 13:43 - 00001119 _____ () C:\Users\Public\Desktop\phase-6 desktop.lnk

2014-05-24 13:43 - 2014-05-24 13:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\phase-6

2014-05-24 13:43 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup

2014-05-24 13:32 - 2012-12-15 16:53 - 00000000 ____D () C:\Users\Tom\Desktop\Games

2014-05-24 13:32 - 2012-12-15 16:53 - 00000000 ____D () C:\Users\Tom\Desktop\Foto

2014-05-24 13:25 - 2014-05-24 13:25 - 00001075 _____ () C:\Users\Tom\Downloads\Bilder - Verknüpfung.lnk

2014-05-22 16:15 - 2010-08-07 20:06 - 00001324 __RSH () C:\Users\Tom\ntuser.pol

2014-05-22 16:15 - 2010-08-07 20:06 - 00000000 ___RD () C:\Users\Tom\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

2014-05-22 16:15 - 2010-08-07 20:06 - 00000000 ___RD () C:\Users\Tom\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools

2014-05-22 16:10 - 2014-05-07 18:22 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-05-20 04:44 - 2014-05-27 16:07 - 31387936 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 25256224 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 24025376 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 17561544 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 17480432 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 16003912 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 12688328 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys

2014-05-20 04:44 - 2014-05-27 16:07 - 11644928 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 11599072 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 09735256 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 09697640 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 03141976 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 02953672 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 02785568 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvenc.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 02412376 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvenc.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 01889112 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6433788.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 01541576 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6433788.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 00895776 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 00892704 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 00867784 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 00861128 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 00837056 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 00354016 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 00305600 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 00166568 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 00146480 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll

2014-05-20 04:44 - 2014-05-24 15:03 - 14434704 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll

2014-05-20 04:44 - 2013-02-26 00:32 - 18531568 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll

2014-05-20 04:44 - 2013-02-26 00:32 - 03109248 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll

2014-05-20 04:44 - 2013-02-26 00:32 - 02730208 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll

2014-05-20 04:44 - 2013-02-26 00:32 - 00952952 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll

2014-05-20 04:44 - 2010-01-20 14:30 - 00026069 _____ () C:\Windows\system32\nvinfo.pb

2014-05-20 03:25 - 2010-07-09 16:17 - 06769096 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll

2014-05-20 03:25 - 2010-07-09 16:17 - 03514144 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll

2014-05-20 03:25 - 2010-07-09 16:17 - 02560968 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll

2014-05-20 03:25 - 2010-07-09 16:17 - 00927520 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe

2014-05-20 03:25 - 2010-07-09 16:17 - 00387528 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll

2014-05-20 03:25 - 2009-06-26 17:00 - 00062808 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll

2014-05-20 01:10 - 2014-05-27 16:12 - 00601432 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe

2014-05-16 00:31 - 2010-01-27 20:48 - 00000000 ____D () C:\ProgramData\Microsoft Help

2014-05-15 19:18 - 2012-04-02 10:22 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-05-15 19:18 - 2011-06-20 13:57 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-05-15 01:49 - 2012-02-24 17:43 - 03774821 _____ () C:\Windows\system32\nvcoproc.bin
 

Some content of TEMP:

====================

C:\Users\HP\AppData\Local\Temp\AskSLib.dll

C:\Users\HP\AppData\Local\Temp\AutoRun.exe

C:\Users\HP\AppData\Local\Temp\AutoRunGUI.dll

C:\Users\HP\AppData\Local\Temp\DeltaTB.exe

C:\Users\HP\AppData\Local\Temp\drm_dialogs.dll

C:\Users\HP\AppData\Local\Temp\drm_dyndata_7410004.dll

C:\Users\HP\AppData\Local\Temp\jre-6u31-windows-i586-iftw-rv.exe

C:\Users\HP\AppData\Local\Temp\nv3DVStreaming.dll

C:\Users\HP\AppData\Local\Temp\nvSCPAPI.dll

C:\Users\HP\AppData\Local\Temp\nvSCPAPI64.dll

C:\Users\HP\AppData\Local\Temp\nvStereoApiI.dll

C:\Users\HP\AppData\Local\Temp\nvStereoApiI64.dll

C:\Users\HP\AppData\Local\Temp\nvStInst.exe

C:\Users\HP\AppData\Local\Temp\qt-mt332.dll

C:\Users\HP\AppData\Local\Temp\sfamcc00001.dll

C:\Users\HP\AppData\Local\Temp\sfextra.dll

C:\Users\HP\AppData\Local\Temp\SkypeSetup.exe

C:\Users\HP\AppData\Local\Temp\sonarinst.exe

C:\Users\HP\AppData\Local\Temp\ubi9EBF.tmp.exe

C:\Users\Tom\AppData\Local\Temp\CmdLineExt.dll

C:\Users\Tom\AppData\Local\Temp\jna6418266350411418959.hunspell-win-x86-32.dll

C:\Users\Tom\AppData\Local\Temp\jna7627881277335600508.hunspell-win-x86-32.dll
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 12-06-2014 01

Ran by Tom at 2014-06-12 11:35:07

Running from C:\Users\Tom\Desktop

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

AV: Microsoft Security Essentials (Enabled - Up to date) {641105E6-77ED-3F35-A304-765193BCB75F}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Microsoft Security Essentials (Enabled - Up to date) {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
 

==================== Installed Programs ======================
 

 Update for Microsoft Office 2007 (KB2508958) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0C5823AA-7B6F-44E1-8D5B-8FD1FF0E6438}) (Version:  - Microsoft)

ActiveCheck component for HP Active Support Library (x32 Version: 3.0.0.2 - Hewlett-Packard) Hidden

Adobe Flash Player 13 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 13.0.0.214 - Adobe Systems Incorporated)

Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.214 - Adobe Systems Incorporated)

Adobe Reader 9.5.2 - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-A95000000001}) (Version: 9.5.2 - Adobe Systems Incorporated)

ANNO 1404 (HKLM-x32\...\{3D9CF3CA-3AB0-4A82-9853-D7C43FD1D775}) (Version: 1.01.0000 - Ubisoft)

Anno 1404 (x32 Version: 1.00.0000 - Ubisoft) Hidden

Apple Application Support (HKLM-x32\...\{D9DAD0FF-495A-472B-9F10-BAE430A26682}) (Version: 3.0.3 - Apple Inc.)

Apple Mobile Device Support (HKLM\...\{787136D2-F0F8-4625-AA3F-72D7795AC842}) (Version: 7.1.1.3 - Apple Inc.)

Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)

Assassin's Creed (HKLM-x32\...\{8CFA9151-6404-409A-AF22-4632D04582FD}) (Version: 1.02 - Ubisoft)

Assassin's Creed Brotherhood (HKLM-x32\...\{BE4BA698-8533-4F77-9559-C7F3F78C0B05}) (Version: 1.03 - Ubisoft)

Assassin's Creed II (HKLM-x32\...\{8570BEE8-0CA3-4977-9AB1-80ED93F0513C}) (Version: 1.01 - Ubisoft)

Assassin's Creed Revelations 1.03 (HKLM-x32\...\{33A22B2D-55BA-4508-B767-BF2E9C21A73F}) (Version: 1.03 - Ubisoft)

Assassin's Creed(R) III v1.05 (HKLM-x32\...\{9D15E813-0C26-41E7-ABC5-3EB06FF1B3CF}) (Version: 1.05 - Ubisoft)

Battlefield 1942™ (HKLM-x32\...\{5BE7BD06-512B-43bf-AD78-3BD2A5F5F7B3}) (Version: 1.6.20.0 - Electronic Arts)

Battlefield 3™ (HKLM-x32\...\{76285C16-411A-488A-BCE3-C83CB933D8CF}) (Version: 1.4.0.0 - Electronic Arts)

Battlelog Web Plugins (HKLM-x32\...\Battlelog Web Plugins) (Version: 2.3.2 - EA Digital Illusions CE AB)

Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)

Call of Duty: Ghosts - Multiplayer (HKLM-x32\...\Steam App 209170) (Version:  - )

Call of Duty: Ghosts (HKLM-x32\...\Steam App 209160) (Version:  - Infinity Ward)

CCleaner (HKLM\...\CCleaner) (Version: 3.16 - Piriform)

Compatibility Pack für 2007 Office System (HKLM-x32\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)

Counter-Strike (HKLM-x32\...\Steam App 10) (Version:  - Valve)

Counter-Strike: Condition Zero (HKLM-x32\...\Steam App 80) (Version:  - Valve)

Counter-Strike: Condition Zero Deleted Scenes (HKLM-x32\...\Steam App 100) (Version:  - Ritual)

Counter-Strike: Global Offensive - SDK (HKLM-x32\...\Steam App 745) (Version:  - )

Counter-Strike: Global Offensive (HKLM-x32\...\Steam App 730) (Version:  - )

Counter-Strike: Source (HKLM-x32\...\Steam App 240) (Version:  - Valve)

Counter-Strike: Source Beta (HKLM-x32\...\Steam App 260) (Version:  - )

CyberLink DVD Suite Deluxe (HKLM-x32\...\InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 6.0.3101 - CyberLink Corp.)

CyberLink DVD Suite Deluxe (x32 Version: 6.0.3101 - CyberLink Corp.) Hidden

Dead Space (HKLM-x32\...\{025A585C-0C66-413D-80D2-4C05CB699771}) (Version: 1.0.0.222 - Electronic Arts)

Defraggler (HKLM\...\Defraggler) (Version: 2.09 - Piriform)

Diablo III (HKLM-x32\...\Diablo III) (Version:  - Blizzard Entertainment)

DirectX for Managed Code Update (Summer 2004) (x32 Version: 9.02.2904 - Microsoft) Hidden

Download Updater (AOL LLC) (HKLM-x32\...\SoftwareUpdUtility) (Version:  - ) <==== ATTENTION

eReg (x32 Version: 1.20.138.34 - Logitech, Inc.) Hidden

ESN Sonar (HKLM-x32\...\ESN Sonar-0.70.4) (Version: 0.70.4 - ESN Social Software AB)

Far Cry 3 (HKLM-x32\...\{E3B9C5A9-BD7A-4B56-B754-FAEA7DD6FA88}) (Version: 1.05 - Ubisoft)

FIFA 11 (HKLM-x32\...\{3FEA6CD1-EA13-4CE7-A74E-A74A4A0A7B5C}) (Version: 1.0.0.0 - Electronic Arts)

Firebird SQL Server - MAGIX Edition (HKLM-x32\...\{34EB6245-C8D0-4D8A-B8D8-EEBFF7A91485}) (Version: 2.1.27.0 - MAGIX AG)

Free YouTube to MP3 Converter version 3.12.4.622 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.4.622 - DVDVideoSoft Ltd.)

GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden

GIMP 2.8.2 (HKLM\...\GIMP-2_is1) (Version: 2.8.2 - The GIMP Team)

Google Update Helper (x32 Version: 1.3.24.7 - Google Inc.) Hidden

Grand Theft Auto IV (HKLM-x32\...\{579BA58C-F33D-4970-9953-B94B43768AC3}) (Version: 1.00.0000 - Rockstar Games)

Grand Theft Auto IV (x32 Version: 1.0.0013.131 - Rockstar Games Inc.) Hidden

Grand Theft Auto San Andreas (HKLM-x32\...\{086BADF8-9B1F-4E89-B207-2EDA520972D6}) (Version: 1.00.00001 - Rockstar Games)

Hercules DJ Products Series drivers (HKLM-x32\...\{33999F1F-EA46-4E55-A239-1BA803235396}) (Version: 4.HDJS.2009 - Hercules)

HP Customer Experience Enhancements (HKLM-x32\...\{5B295588-59C1-4386-9F85-BB4BEDCB0D22}) (Version: 5.7.0.3036 - Hewlett-Packard)

HP Games (HKLM-x32\...\WildTangent hp Master Uninstall) (Version: 1.0.0.71 - WildTangent)

HP MediaSmart DVD (HKLM-x32\...\InstallShield_{DCCAD079-F92C-44DA-B258-624FC6517A5A}) (Version: 3.0.3420 - Hewlett-Packard)

HP MediaSmart DVD (x32 Version: 3.0.3420 - Hewlett-Packard) Hidden

HP MediaSmart Movie Themes (HKLM-x32\...\InstallShield_{3023EBDA-BF1B-4831-B347-E5018555F26E}) (Version: 3.0.3102 - Hewlett-Packard)

HP MediaSmart Movie Themes (x32 Version: 3.0.3102 - Hewlett-Packard) Hidden

HP MediaSmart Music/Photo/Video (HKLM-x32\...\InstallShield_{B2EE25B9-5B00-4ACF-94F0-92433C28C39E}) (Version: 3.1.3601 - Hewlett-Packard)

HP MediaSmart Music/Photo/Video (x32 Version: 3.1.3601 - Hewlett-Packard) Hidden

HP MediaSmart SmartMenu (HKLM\...\{26280024-DFB7-4967-90DB-7F9C6660D01E}) (Version: 3.0.28.2 - Hewlett-Packard)

HP Odometer (HKLM-x32\...\{B8AC1A89-FFD1-4F97-8051-E505A160F562}) (Version: 2.10.0000 - Hewlett-Packard)

HP Photo Creations (HKLM-x32\...\HP Photo Creations) (Version: 1.0.0.7702 - HP)

HP Photosmart 5520 series - Grundlegende Software für das Gerät (HKLM\...\{4F396B08-301D-4E53-A372-95A7E93ABD04}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)

HP Photosmart 5520 series Hilfe (HKLM-x32\...\{640A03B3-4E6B-4440-A350-E6A8D6348F12}) (Version: 27.0.0 - Hewlett Packard)

HP Remote Solution (HKLM-x32\...\HP Remote Solution) (Version: 1.1.9.0 - TopSeed)

HP Remote Solution (x32 Version: 1.1.9.0 - TopSeed) Hidden

HP Setup (HKLM-x32\...\{F3B912F5-EB57-45AA-B3D1-EB532BCF6EF8}) (Version: 1.2.3220.3079 - Hewlett-Packard)

HP Support Assistant (HKLM-x32\...\{4F46FDB9-B906-47BF-B3D5-C62E01B3C5EE}) (Version: 4.1.11.3 - Hewlett-Packard)

HP Support Information (HKLM-x32\...\{B9A03B7B-E0FF-4FB3-BA83-762E58A1B0AA}) (Version: 10.1.0002 - Hewlett-Packard)

HP Update (HKLM-x32\...\{6F1C00D2-25C2-4CBA-8126-AE9A6E2E9CD5}) (Version: 5.003.003.001 - Hewlett-Packard)

HPAsset component for HP Active Support Library (x32 Version: 3.0.0.3 - Hewlett-Packard) Hidden

iCloud (HKLM\...\{81E20D41-C277-4526-934D-F2380AF91B78}) (Version: 3.1.0.40 - Apple Inc.)

Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version:  - Intel Corporation)

Internet-TV für Windows Media Center (HKLM-x32\...\{9D318C86-AF4C-409F-A6AC-7183FF4CF424}) (Version: 4.2.2.0 - Microsoft Corporation)

iTunes (HKLM\...\{5A68A656-979F-4168-8795-E2E368AA4DC2}) (Version: 11.2.2.3 - Apple Inc.)

James Cameron's AVATAR(tm): DAS SPIEL (HKLM-x32\...\{7E19B002-4CA3-4C9F-BA92-91D101B97219}) (Version: 1.02.00 - Ubisoft)

LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.1901 - CyberLink Corp.)

LabelPrint (x32 Version: 2.5.1901 - CyberLink Corp.) Hidden

LightScribe System Software (HKLM-x32\...\{DD6C316A-FE75-4FBB-9D22-4C1920232B72}) (Version: 1.18.5.1 - LightScribe)

Logitech SetPoint 6.32 (HKLM\...\sp6) (Version: 6.32.20 - Logitech)

Magic 2014  (HKLM-x32\...\Steam App 213850) (Version:  - Stainless Games)

Magic Desktop (HKLM-x32\...\EasyBits Magic Desktop) (Version: 8.2 - EasyBits Software AS)

MAGIX Screenshare (HKLM-x32\...\{F31C9A68-7F07-4B96-AC58-F71D5DF3DA89}) (Version: 4.3.6.1987 - MAGIX AG)

MAGIX Speed 2 (MSI) (HKLM-x32\...\{7FA32C2E-E218-4A04-966D-DECCB0B9C81E}) (Version: 6.0.1.4 - MAGIX AG)

MAGIX Video deluxe 16 Plus Sonderedition (HKLM-x32\...\MAGIX_MSI_Videodeluxe16_plus) (Version: 9.0.5.10 - MAGIX AG)

MAGIX Video deluxe 16 Plus Sonderedition (x32 Version: 9.0.5.10 - MAGIX AG) Hidden

Malwarebytes Anti-Malware Version 1.70.0.1100 (HKLM-x32\...\Malwarebytes' Anti-Malware_is1) (Version: 1.70.0.1100 - Malwarebytes Corporation)

Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden

Microsoft Antimalware Service DE-DE Language Pack (Version: 3.0.8402.2 - Microsoft Corporation) Hidden

Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{832D9DE0-8AFC-4689-9819-4DBBDEBD3E4F}) (Version: 3.5.92.0 - Microsoft Corporation)

Microsoft Games for Windows Marketplace (HKLM-x32\...\{4CB0307C-565E-4441-86BE-0DF2E4FB828C}) (Version: 3.5.50.0 - Microsoft Corporation)

Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)

Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden

Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)

Microsoft Office Home and Student 2007 (HKLM-x32\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)

Microsoft Office Home and Student 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office PowerPoint Viewer 2007 (German) (HKLM-x32\...\{95120000-00AF-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)

Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden

Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden

Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Security Client (Version: 4.5.0216.0 - Microsoft Corporation) Hidden

Microsoft Security Client DE-DE Language Pack (Version: 2.1.1116.0 - Microsoft Corporation) Hidden

Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.5.216.0 - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175 (HKLM\...\{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}) (Version: 8.0.51011 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (HKLM\...\{EE936C7A-EA40-31D5-9B65-8E3E089C3828}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (HKLM\...\{8338783A-0968-3B85-AFC7-BAAE0A63DC50}) (Version: 9.0.30729.5570 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)

Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden

Microsoft Works (HKLM-x32\...\{39D0E034-1042-4905-BECB-5502909FCB7C}) (Version: 9.7.0621 - Microsoft Corporation)

Microsoft Xbox 360 Accessories 1.2 (HKLM\...\{B3B750C0-8C22-439D-B7CE-67F3ED99CC2B}) (Version: 1.20.146.0 - Microsoft)

MobileMe Control Panel (HKLM\...\{6DD01FF3-63CE-436B-96DB-61363EAA4EB8}) (Version: 3.1.8.0 - Apple Inc.)

Mozilla Firefox 12.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 12.0 (x86 de)) (Version: 12.0 - Mozilla)

Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 12.0 - Mozilla)

MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)

Need for Speed Underground 2 (HKLM-x32\...\{909F8EBC-EC7F-48FF-0085-475D818F0F31}) (Version:  - )

Need for Speed(TM) Hot Pursuit (HKLM-x32\...\{83A606F5-BF6F-42ED-9F33-B9F74297CDED}) (Version: 1.0.0.0 - Electronic Arts)

Norton Online Backup aktivieren (HKLM-x32\...\{C57BCDE1-7CB9-467D-B3BA-7E119916CDC1}) (Version: 1.1.20.0 - Symantec)

NVIDIA 3D Vision Controller Driver (x32 Version: 280.19 - NVIDIA Corporation) Hidden

NVIDIA 3D Vision Controller-Treiber 337.88 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 337.88 - NVIDIA Corporation)

NVIDIA 3D Vision Treiber 337.88 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 337.88 - NVIDIA Corporation)

NVIDIA Display Control Panel (HKLM\...\NVIDIA Display Control Panel) (Version: 6.14.12.5896 - NVIDIA Corporation)

NVIDIA GeForce Experience 1.8.2.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 1.8.2.1 - NVIDIA Corporation)

NVIDIA Grafiktreiber 337.88 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 337.88 - NVIDIA Corporation)

NVIDIA HD-Audiotreiber 1.3.30.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.30.1 - NVIDIA Corporation)

NVIDIA Install Application (Version: 2.1002.154.1168 - NVIDIA Corporation) Hidden

NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden

NVIDIA Network Service (Version: 1.0 - NVIDIA Corporation) Hidden

NVIDIA PhysX (x32 Version: 9.13.1220 - NVIDIA Corporation) Hidden

NVIDIA PhysX-Systemsoftware 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)

NVIDIA ShadowPlay 11.10.13 (Version: 11.10.13 - NVIDIA Corporation) Hidden

NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.12.6514 - NVIDIA Corporation) Hidden

NVIDIA Systemsteuerung 337.88 (Version: 337.88 - NVIDIA Corporation) Hidden

NVIDIA Update 11.10.13 (Version: 11.10.13 - NVIDIA Corporation) Hidden

NVIDIA Update Core (Version: 11.10.13 - NVIDIA Corporation) Hidden

NVIDIA Virtual Audio 1.2.20 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_VirtualAudio.Driver) (Version: 1.2.20 - NVIDIA Corporation)

OF Dragon Rising (HKLM-x32\...\{1A4052AB-BA77-44F7-8EE7-9F9131BFD7A6}) (Version: 1.02.0000 - Codemasters)

Origin (HKLM-x32\...\Origin) (Version: 8.5.0.4550 - Electronic Arts, Inc.)

Pando Media Booster (HKLM-x32\...\{980A182F-E0A2-4A40-94C1-AE0C1235902E}) (Version: 2.3.4.0 - Pando Networks Inc.)

phase-6 2.3.1 (HKLM-x32\...\phase-6) (Version: 2.3.1 - phase-6)

PlayStation(R)Network Downloader (HKLM-x32\...\{B6659DD8-00A7-4A24-BBFB-C1F6982E5D66}) (Version: 2.05.00710 - Sony Computer Entertainment Inc.)

PlayStation(R)Store (HKLM-x32\...\{0E532C84-4275-41B3-9D81-D4A1A20D8EE7}) (Version: 4.1.8.11883 - Sony Computer Entertainment Inc.)

Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.0.3101 - CyberLink Corp.)

Power2Go (x32 Version: 6.0.3101 - CyberLink Corp.) Hidden

PowerDirector (HKLM-x32\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 7.0.3101 - CyberLink Corp.)

PowerDirector (x32 Version: 7.0.3101 - CyberLink Corp.) Hidden

PowerRecover (x32 Version: 5.5.1923 - CyberLink Corp.) Hidden

PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.993 - Even Balance, Inc.)

QuickTime 7 (HKLM-x32\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6196 - Realtek Semiconductor Corp.)

Risen (HKLM-x32\...\{155F4A0E-76ED-45A2-91FB-FF2A2133C31A}) (Version: 1.00.0000 - Deep Silver)

RollerCoaster Tycoon 3 (HKLM-x32\...\{907B4640-266B-4A21-92FB-CD1A86CD0F63}) (Version: 1.00.000 - )

Safari (HKLM-x32\...\{C779648B-410E-4BBA-B75B-5815BCEFE71D}) (Version: 5.34.57.2 - Apple Inc.)

SHIELD Streaming (Version: 1.7.321 - NVIDIA Corporation) Hidden

Skype Click to Call (HKLM-x32\...\{B6CF2967-C81E-40C0-9815-C05774FEF120}) (Version: 5.7.8773 - Skype Technologies S.A.)

Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)

Sniper Elite V2 (HKLM-x32\...\Steam App 63380) (Version:  - Rebellion)

Solid Edge V20 (HKLM-x32\...\{886F91D5-4B45-45DC-938E-6B0276C6B015}) (Version: 20.00.0096 - UGS)

SpeedFan (remove only) (HKLM-x32\...\SpeedFan) (Version:  - )

StarCraft II (HKLM-x32\...\StarCraft II) (Version: 1.4.4.22418 - Blizzard Entertainment)

Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)

Stronghold Legends (HKLM-x32\...\{66A405D2-BA14-4594-BF36-B3B544F0754E}) (Version: 1.20.0000 - Firefly Studios)

The Elder Scrolls V: Skyrim (HKLM-x32\...\Steam App 72850) (Version:  - Bethesda Game Studios)

The Witcher 2 (HKLM-x32\...\{F0A209B7-7F85-4BDD-8F1F-B98EEAD9E04B}) (Version: 1.00.0000 - CD Projekt Red)

Tune Sweeper (HKLM-x32\...\{D845DAF3-B887-4D5E-BFF8-8441FCF6F468}) (Version: 3.00 - Wide Angle Software)

Ubisoft Game Launcher (HKLM-x32\...\{888F1505-C2B3-4FDE-835D-36353EBD4754}) (Version: 1.0.0.0 - UBISOFT)

Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)

Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version:  - Microsoft)

Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-002A-0000-1000-0000000FF1CE}_HOMESTUDENTR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)

Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)

Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version:  - Microsoft)

Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)

Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)

Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)

Uplay (HKLM-x32\...\Uplay) (Version: 2.0 - Ubisoft)

Virtual DJ - Atomix Productions (HKLM-x32\...\Virtual DJ - Atomix Productions) (Version:  - )

VirtualDJ Home FREE (HKLM-x32\...\{5E1375CB-6792-4464-8715-CC3EC83D48FA}) (Version: 7.0.5 - Atomix Productions)

VLC media player 1.1.11 (HKLM-x32\...\VLC media player) (Version: 1.1.11 - VideoLAN)

Vtune 7.11 (HKLM-x32\...\MySSID_is1) (Version:  - )

Windows Live ID Sign-in Assistant (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation)

Windows Media Center Add-in for Silverlight (HKLM-x32\...\{0EDBEB2B-7C8D-42E6-8312-0F84394A3223}) (Version: 4.7.2.0 - Microsoft Corporation)

World of Warcraft (HKLM-x32\...\World of Warcraft) (Version:  - Blizzard Entertainment)
 

==================== Restore Points  =========================
 

Could not list Restore Points. Check "winmgmt" service or repair WMI.
 
 

==================== Hosts content: ==========================
 

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
 

==================== Scheduled Tasks (whitelisted) =============
 

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => ?

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => ?

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => ?
 

==================== Loaded Modules (whitelisted) =============
 
 

==================== Alternate Data Streams (whitelisted) =========
 
 

==================== Safe Mode (whitelisted) ===================
 
 

==================== EXE Association (whitelisted) =============
 
 

==================== MSCONFIG/TASK MANAGER disabled items =========
 

MSCONFIG\Services: GameConsoleService => 3

MSCONFIG\Services: gupdate => 2

MSCONFIG\Services: gupdatem => 3

MSCONFIG\Services: HerculesDJControlMP3 => 2

MSCONFIG\Services: MozillaMaintenance => 3

MSCONFIG\Services: Netzmanager Service => 2

MSCONFIG\Services: SkypeUpdate => 2

MSCONFIG\Services: Steam Client Service => 3

MSCONFIG\Services: TomTomHOMEService => 2

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^p6_erinnerung_197.lnk => C:\Windows\pss\p6_erinnerung_197.lnk.CommonStartup

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^phase-6 Reminder.lnk => C:\Windows\pss\phase-6 Reminder.lnk.CommonStartup

MSCONFIG\startupfolder: C:^Users^HP^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk => C:\Windows\pss\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk.Startup

MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"

MSCONFIG\startupreg: Easybits Recovery => C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe

MSCONFIG\startupreg: EvtMgr6 => C:\Program Files\Logitech\SetPointP\SetPoint.exe /launchGaming

MSCONFIG\startupreg: Hercules DJ Series => C:\Program Files\Hercules\Audio\DJ Console Series\HDJSeriesCPL.exe /boot

MSCONFIG\startupreg: HP Software Update => c:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe

MSCONFIG\startupreg: hpsysdrv => c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe

MSCONFIG\startupreg: MobileDocuments => C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe

MSCONFIG\startupreg: NortonOnlineBackupReminder => "C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe" UNATTENDED

MSCONFIG\startupreg: SmartMenu => C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe /background

MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

MSCONFIG\startupreg: TBPanel => C:\Program Files (x86)\Vtune\TBPanel.exe /A

MSCONFIG\startupreg: TomTomHOME.exe => "C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe"

MSCONFIG\startupreg: TrayServer => C:\PROGRA~2\MAGIX\VIDEO_~1\TrayServer.exe

MSCONFIG\startupreg: UpdatePRCShortCut => "C:\Program Files (x86)\Hewlett-Packard\Recovery\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\Hewlett-Packard\Recovery" UpdateWithCreateOnce "Software\CyberLink\PowerRecover"

MSCONFIG\startupreg: XboxStat => "C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe" silentrun
 

==================== Faulty Device Manager Devices =============
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (06/12/2014 11:31:12 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)

Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.
 

Error: (06/12/2014 11:31:12 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)

Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
 

Error: (06/12/2014 11:31:12 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)

Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
 

Error: (06/12/2014 11:25:50 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)

Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.
 

Error: (06/12/2014 11:25:50 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)

Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
 

Error: (06/12/2014 11:25:50 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)

Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
 

Error: (06/09/2014 06:07:21 PM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: )

Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008]
 

Error: (06/09/2014 03:07:11 PM) (Source: EventSystem) (EventID: 4622) (User: )

Description: 80070005{80328612-D857-4D8D-98F0-170DF27BCB0C}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}
 

Error: (06/09/2014 03:07:11 PM) (Source: EventSystem) (EventID: 4622) (User: )

Description: 80070005{D9E3A134-A375-4589-99F5-D38A0A0E0550}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}
 

Error: (06/09/2014 03:07:11 PM) (Source: EventSystem) (EventID: 4622) (User: )

Description: 80070005{2F870BCF-6BF6-4A58-93A5-ABBAC0842400}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}
 
 

System errors:

=============

Error: (06/12/2014 11:22:37 AM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)

Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)
 

Error: (06/12/2014 11:22:35 AM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)

Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTLOKALER DIENSTS-1-5-19LocalHost (unter Verwendung von LRPC)
 

Error: (06/12/2014 11:21:32 AM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Der Dienst "TBPanel" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (06/09/2014 02:55:40 PM) (Source: DCOM) (EventID: 10010) (User: )

Description: {DC0C2640-1415-4644-875C-6F4D769839BA}
 

Error: (06/09/2014 02:52:58 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)

Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)
 

Error: (06/09/2014 02:52:55 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)

Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTLOKALER DIENSTS-1-5-19LocalHost (unter Verwendung von LRPC)
 

Error: (06/09/2014 02:51:51 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Der Dienst "TBPanel" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (06/08/2014 11:25:23 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )

Description: Beim Aktualisieren der Signaturen wurde von %NT-AUTORITÄT60 ein Fehler festgestellt.
 

        Neue Signaturversion: 
 

        Vorherige Signaturversion: 1.175.1586.0
 

        Aktualisierungsquelle: %NT-AUTORITÄT59
 

        Aktualisierungsphase: 4.5.0216.00
 

        Quellpfad: 4.5.0216.01
 

        Signaturtyp: %NT-AUTORITÄT602
 

        Aktualisierungstyp: %NT-AUTORITÄT604
 

        Benutzer: NT-AUTORITÄT\SYSTEM
 

        Aktuelle Modulversion: %NT-AUTORITÄT605
 

        Vorherige Modulversion: %NT-AUTORITÄT606
 

        Fehlercode: %NT-AUTORITÄT607
 

        Fehlerbeschreibung: %NT-AUTORITÄT608
 

Error: (06/08/2014 11:16:22 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)

Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)
 

Error: (06/08/2014 11:16:19 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)

Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTLOKALER DIENSTS-1-5-19LocalHost (unter Verwendung von LRPC)
 
 

Microsoft Office Sessions:

=========================

Error: (11/27/2013 08:26:18 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6683.5002, Microsoft Office Version: 12.0.6612.1000. This session lasted 6871 seconds with 5520 seconds of active time.  This session ended with a crash.
 

Error: (02/07/2012 08:02:53 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6612.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 5931 seconds with 2040 seconds of active time.  This session ended with a crash.
 
 

CodeIntegrity Errors:

===================================

  Date: 2010-11-26 20:14:14.848

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\usbaapl64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2010-11-26 20:14:14.831

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\usbaapl64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2010-11-26 20:13:44.665

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\usbaapl64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2010-11-26 20:13:44.646

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\usbaapl64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2010-11-26 20:11:50.535

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\usbaapl64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2010-11-26 20:11:50.518

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\usbaapl64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2010-11-26 20:11:02.646

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\usbaapl64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2010-11-26 20:11:02.629

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\usbaapl64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 
 

==================== Memory info =========================== 
 

Percentage of memory in use: 37%

Total physical RAM: 8183.08 MB

Available physical RAM: 5149.08 MB

Total Pagefile: 16364.34 MB

Available Pagefile: 13411.8 MB

Total Virtual: 8192 MB

Available Virtual: 8191.82 MB
 

==================== Drives ================================
 

Drive c: (HP) (Fixed) (Total:684.15 GB) (Free:14.08 GB) NTFS

Drive d: (FACTORY_IMAGE) (Fixed) (Total:14.39 GB) (Free:2.52 GB) NTFS ==>[System with boot components (obtained from reading drive)]

Drive e: (HP2) (Fixed) (Total:698.64 GB) (Free:57.12 GB) NTFS

Drive f: (CDROM) (CDROM) (Total:4.37 GB) (Free:0 GB) UDF
 

==================== MBR & Partition Table ==================
 

==================== End Of Log ============================

tombo11

12.06.2014 11:43

Laptop:

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-06-2014 01

Ran by Julia (administrator) on LAPTOP on 12-06-2014 11:22:33

Running from C:\Users\Julia\Downloads

Platform: Windows 7 Professional (X64) OS Language: German Standard

Internet Explorer Version 8

Boot Mode: Normal
 
 
 

==================== Processes (Whitelisted) =================
 

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe

(Hercules®) C:\Program Files\Hercules\Audio\DJ Console Series\drivers\amd64\HerculesDJControlMP3.EXE

() C:\Windows\System32\dmwu.exe

(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe

(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe

(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNService.exe

(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe

(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe

(Microsoft Corporation) C:\Windows\System32\alg.exe

(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe

(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCSpt.exe

(Sony Corporation) C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe

() C:\Windows\SysWOW64\jmdp\stij.exe

() C:\Windows\System32\ljkb\stij.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe

(Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3050A J611 series\Bin\ScanToPCActivationApp.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe

(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe

(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe

(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe

(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCsystray.exe

(MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCPerfService.exe

(Sony of America Corporation) C:\Program Files\Sony\VAIO Care\listener.exe

(Microsoft Corporation) C:\Program Files (x86)\Internet Explorer\ielowutil.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

(Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\SeaPort.EXE

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3050A J611 series\Bin\HPNetworkCommunicator.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [10920552 2010-08-11] (Realtek Semiconductor)

HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1271072 2014-03-11] (Microsoft Corporation)

HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-03-03] (Intel Corporation)

HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [35760 2009-12-22] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Adobe ARM] => c:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [948672 2009-12-11] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-12] (Apple Inc.)

HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2012-10-25] (Apple Inc.)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254896 2012-09-17] (Sun Microsystems, Inc.)

HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)

HKLM-x32\...\Run: [] => [X]

HKLM-x32\...\Run: [Norton Online Backup] => C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [1155928 2010-06-01] (Symantec Corporation)

HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-02-21] (Apple Inc.)

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKU\S-1-5-21-1467540412-3089772811-3921172512-1000\...\Run: [HP Deskjet 3050A J611 series (NET)] => C:\Program Files\HP\HP Deskjet 3050A J611 series\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)

HKU\S-1-5-21-1467540412-3089772811-3921172512-1000\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-10-31] (Apple Inc.)

HKU\S-1-5-21-1467540412-3089772811-3921172512-1000\...\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-10-31] (Apple Inc.)

HKU\S-1-5-21-1467540412-3089772811-3921172512-1000\...\Policies\system: [LogonHoursAction] 2

HKU\S-1-5-21-1467540412-3089772811-3921172512-1000\...\Policies\system: [DontDisplayLogonHoursWarnings] 1

HKU\S-1-5-21-1467540412-3089772811-3921172512-1000\...\MountPoints2: {5b339b5e-773c-11e2-a976-18f46ae84f75} - D:\LaunchU3.exe -a

Startup: C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk

ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)

GroupPolicyUsers\S-1-5-21-1467540412-3089772811-3921172512-1002\User: Group Policy restriction detected <======= ATTENTION
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://sony.msn.com

HKCU\Software\Microsoft\Internet Explorer\Main,bProtector Start Page = hxxp://www1.delta-search.com/?babsrc=HP_ss&mntrId=98104A0F6EF1E82E&affID=119360&tsp=4965

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://home.sweetim.com/?st=6&barid={F6E2ABBA-0A54-11E2-BEEB-544249A1E8EE}

URLSearchHook: HKCU - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - C:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)

URLSearchHook: HKCU - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - C:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

SearchScopes: HKLM-x32 - {EEE6C360-6118-11DC-9C72-001320C79847} URL = hxxp://search.sweetim.com/search.asp?src=6&crg=3.26010003&st=12&q={searchTerms}&barid={F6E2ABBA-0A54-11E2-BEEB-544249A1E8EE}

SearchScopes: HKCU - DefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www1.delta-search.com/?q={searchTerms}&babsrc=SP_ss&mntrId=98104A0F6EF1E82E&affID=119360&tsp=4965

SearchScopes: HKCU - bProtectorDefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}

SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www1.delta-search.com/?q={searchTerms}&babsrc=SP_ss&mntrId=98104A0F6EF1E82E&affID=119360&tsp=4965

SearchScopes: HKCU - {3B06BB6D-8896-4136-A916-0B6F2EF0B1B7} URL = hxxp://services.zinio.com/search?s={searchTerms}&rf=sonyslices

SearchScopes: HKCU - {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL = 

SearchScopes: HKCU - {4B86C531-3C22-4AF4-B257-D05E8ED96A72} URL = hxxp://rover.ebay.com/rover/1/707-37276-16609-9/4?satitle={searchTerms}

SearchScopes: HKCU - {7339ED9D-4167-41F8-A683-013691788DC5} URL = hxxp://de.shopping.com/?linkin_id=8056363

SearchScopes: HKCU - {C04B7D22-5AEC-4561-8F49-27F6269208F6} URL = hxxp://www2.inbox.com/search/dispatcher.aspx?tp=bs&qkw={searchTerms}&tbid=80760&lng=de

SearchScopes: HKCU - {C9A1107A-1CC0-4967-AC55-5A6DEECEB1CD} URL = hxxp://www.bing.com/search?q={searchTerms}&form=QBLH&filt=all

SearchScopes: HKCU - {CFF4DB9B-135F-47c0-9269-B4C6572FD61A} URL = hxxp://mystart.incredibar.com/?a=6PQHWwpgVd&loc=skw&search={searchTerms}&i=26

SearchScopes: HKCU - {EEE6C360-6118-11DC-9C72-001320C79847} URL = 

BHO: Bing Bar Helper - {1dad3af3-ef2f-4f64-ac4b-11789189fcb6} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\amd64\BingExt.dll (Microsoft Corporation.)

BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\PROGRA~1\mcafee\msk\MSKAPB~1.DLL No File

BHO: Web Assistant - {336D0C35-8A85-403a-B9D2-65C292C39087} - C:\Program Files\Web Assistant\Extension64.dll ()

BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - C:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)

BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)

BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO-x32: Bing Bar Helper - {1dad3af3-ef2f-4f64-ac4b-11789189fcb6} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll (Microsoft Corporation.)

BHO-x32: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\progra~1\mcafee\msk\mskapbho.dll No File

BHO-x32: Web Assistant - {336D0C35-8A85-403a-B9D2-65C292C39087} - C:\Program Files\Web Assistant\Extension32.dll ()

BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File

BHO-x32: Incredibar.com Helper Object - {6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99} - C:\Program Files (x86)\Incredibar.com\incredibar\1.5.11.14\bh\incredibar.dll (Montera Technologeis LTD)

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)

BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO-x32: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - C:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)

BHO-x32: Inbox Toolbar - {D3D233D5-9F6D-436C-B6C7-E63F77503B30} - C:\Program Files (x86)\Inbox Toolbar\Inbox.dll (Inbox.com, Inc.)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)

Toolbar: HKLM - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - C:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)

Toolbar: HKLM - Bing Bar - {eec0f710-38b5-4aba-99bf-ec87564a4e13} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\amd64\BingExt.dll (Microsoft Corporation.)

Toolbar: HKLM-x32 - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - C:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)

Toolbar: HKLM-x32 - Incredibar Toolbar - {F9639E4A-801B-4843-AEE3-03D9DA199E77} - C:\Program Files (x86)\Incredibar.com\incredibar\1.5.11.14\incredibarTlbr.dll (Montera Technologeis LTD)

Toolbar: HKLM-x32 - &Inbox Toolbar - {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - C:\Program Files (x86)\Inbox Toolbar\Inbox.dll (Inbox.com, Inc.)

Toolbar: HKLM-x32 - Bing Bar - {eec0f710-38b5-4aba-99bf-ec87564a4e13} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll (Microsoft Corporation.)

Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File

Toolbar: HKCU - No Name - {EEE6C35B-6118-11DC-9C72-001320C79847} -  No File

Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File

Toolbar: HKCU - No Name - {D7E97865-918F-41E4-9CD0-25AB1C574CE8} -  No File

Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)

Handler: inbox - {37540F19-DD4C-478B-B2DF-C19281BCAF27} -  No File

Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)

Handler-x32: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)

Handler-x32: inbox - {37540F19-DD4C-478B-B2DF-C19281BCAF27} - C:\Program Files (x86)\Inbox Toolbar\Inbox.dll (Inbox.com, Inc.)

Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)

Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)

Handler-x32: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
 

FireFox:

========

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32.dll No File

FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @java.com/DTPlugin,version=1.6.0_38 - C:\Windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.)

FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)

FF Plugin-x32: @mcafee.com/SAFFPlugin - C:\Program Files (x86)\McAfee\SiteAdvisor\npmcffplg32.dll (McAfee, Inc.)

FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)

FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\Julia\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)

FF Plugin HKCU: facebook.com/fbDesktopPlugin - C:\Users\Julia\AppData\Local\Facebook\Messenger\2.1.4814.0\npFbDesktopPlugin.dll (Facebook, Inc.)

FF HKLM\...\Firefox\Extensions: [{336D0C35-8A85-403a-B9D2-65C292C39087}] - C:\Program Files\Web Assistant\Firefox

FF Extension: Web Assistant - C:\Program Files\Web Assistant\Firefox [2012-08-28]

FF HKLM\...\Firefox\Extensions: [{FE1DEEEA-DB6D-44b8-83F0-34FC0F9D1052}] - C:\Program Files\Web Assistant\Firefox

FF Extension: Web Assistant - C:\Program Files\Web Assistant\Firefox [2012-08-28]

FF HKLM-x32\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor

FF Extension: McAfee SiteAdvisor - C:\Program Files (x86)\McAfee\SiteAdvisor [2012-08-03]

FF HKLM-x32\...\Firefox\Extensions: [{336D0C35-8A85-403a-B9D2-65C292C39087}] - C:\Program Files\Web Assistant\Firefox

FF Extension: Web Assistant - C:\Program Files\Web Assistant\Firefox [2012-08-28]

FF HKLM-x32\...\Firefox\Extensions: [{FE1DEEEA-DB6D-44b8-83F0-34FC0F9D1052}] - C:\Program Files\Web Assistant\Firefox

FF Extension: Web Assistant - C:\Program Files\Web Assistant\Firefox [2012-08-28]

FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK

FF HKCU\...\Firefox\Extensions: [lyrix@lyrixeeker.co] - C:\Program Files (x86)\LyriXeeker\128.xpi
 

Chrome: 

=======

CHR HomePage: hxxp://www.google.de/

CHR StartupUrls: "https://www.google.de/"

CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\PepperFlash\pepflashplayer.dll ()

CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\ppGoogleNaClPluginChrome.dll ()

CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\pdf.dll ()

CHR Plugin: (Injovo Extension Plugin) - C:\Users\Julia\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd\2.0.0.474_0\npbrowserext.dll No File

CHR Plugin: (McAfee SiteAdvisor) - C:\Users\Julia\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.50.146.2_0\McChPlg.dll No File

CHR Plugin: (Java Deployment Toolkit 6.0.200.2) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll No File

CHR Plugin: (Java(TM) Platform SE 6 U20) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll No File

CHR Plugin: (Adobe Acrobat) - c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)

CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File

CHR Plugin: (McAfee SiteAdvisor) - C:\Program Files (x86)\McAfee\SiteAdvisor\npmcffplg32.dll (McAfee, Inc.)

CHR Plugin: (Windows Live Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

CHR Plugin: (Facebook Desktop) - C:\Users\Julia\AppData\Local\Facebook\Messenger\2.1.4651.0\npFbDesktopPlugin.dll No File

CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32.dll No File

CHR Plugin: (McAfee SecurityCenter) - c:\progra~2\mcafee\msc\npmcsn~1.dll No File

CHR Extension: (Google Wallet) - C:\Users\Julia\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-10-18]

CHR Extension: (Marc Ecko) - C:\Users\Julia\AppData\Local\Google\Chrome\User Data\Default\Extensions\opjonmehjfmkejjifhhknofdnacklmjk [2013-12-25]

CHR HKLM\...\Chrome\Extension: [dlnembnfbcpjnepmfjmngjenhhajpdfd] - C:\Program Files\Web Assistant\source.crx [2012-08-28]

CHR HKLM-x32\...\Chrome\Extension: [dlnembnfbcpjnepmfjmngjenhhajpdfd] - C:\Program Files\Web Assistant\source.crx [2012-08-28]

CHR HKLM-x32\...\Chrome\Extension: [epojlgbehpaeekopencdagbdamnkppci] - C:\Program Files (x86)\LyriXeeker\128.crx [2012-08-28]

CHR HKLM-x32\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files (x86)\McAfee\SiteAdvisor\McChPlg.crx [2013-01-31]

CHR HKLM-x32\...\Chrome\Extension: [ogccgbmabaphcakpiclgcnmcnimhokcj] - C:\Windows\SysWOW64\jmdp\SweetNT.crx [2014-04-06]
 

==================== Services (Whitelisted) =================
 

S3 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)

R2 Fabs; C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [1840128 2011-05-24] (MAGIX AG) [File not signed]

S4 FirebirdServerMAGIXInstance; C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [2702848 2011-04-26] (MAGIX®) [File not signed]

R2 HerculesDJControlMP3; C:\Program Files\Hercules\Audio\DJ Console Series\drivers\amd64\HerculesDJControlMP3.EXE [18944 2012-04-10] (Hercules®) [File not signed]

R2 IBUpdaterService; C:\Windows\system32\dmwu.exe [2276144 2014-04-07] ()

R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2014-03-11] (Microsoft Corporation)

R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [347872 2014-03-11] (Microsoft Corporation)

R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-01] (Symantec Corporation)

R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [60416 2009-06-22] (Hewlett-Packard) [File not signed]

R2 SampleCollector; C:\Program Files\Sony\VAIO Care\VCPerfService.exe [252416 2010-05-25] (Sony Corporation) [File not signed]

R2 VSNService; C:\Program Files\Sony\VAIO Smart Network\VSNService.exe [836608 2010-06-08] (Sony Corporation) [File not signed]

S3 VUAgent; C:\Program Files\Sony\VAIO Update 5\VUAgent.exe [1250160 2010-05-31] (Sony Corporation)

S4 Web Assistant; C:\Program Files\Web Assistant\ExtensionUpdaterService.exe [188760 2013-01-31] () [File not signed]

S2 McAfee SiteAdvisor Service; "C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe" /McCoreSvc [X]
 

==================== Drivers (Whitelisted) ====================
 

R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2014-04-23] ()

S3 Bulk; C:\Windows\System32\Drivers\HDJBulk.sys [232272 2012-04-10] (© Guillemot R&D, 2012. All rights reserved.)

S3 HDJMidi; C:\Windows\System32\DRIVERS\HDJMidi.sys [253264 2012-04-10] (© Guillemot R&D, 2011. All rights reserved.)

R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2014-04-23] ()

R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [268512 2014-01-25] (Microsoft Corporation)

R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133928 2014-03-11] (Microsoft Corporation)
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-06-12 11:18 - 2014-06-12 11:19 - 00033276 _____ () C:\Users\Julia\Downloads\Addition.txt

2014-06-12 11:16 - 2014-06-12 11:22 - 00023101 _____ () C:\Users\Julia\Downloads\FRST.txt

2014-06-12 11:16 - 2014-06-12 11:22 - 00000000 ____D () C:\FRST

2014-06-12 11:15 - 2014-06-12 11:15 - 02081792 _____ (Farbar) C:\Users\Julia\Downloads\FRST64 (1).exe

2014-06-12 11:14 - 2014-06-12 11:14 - 02081792 _____ (Farbar) C:\Users\Julia\Downloads\FRST64.exe

2014-06-11 19:49 - 2014-06-11 19:51 - 00000000 ____D () C:\Users\Julia 1\Desktop\Tom

2014-06-10 22:09 - 2014-06-10 22:09 - 00608816 _____ () C:\Users\Julia 1\Downloads\TinyMediaPlayerInstaller.exe
 

==================== One Month Modified Files and Folders =======
 

2014-06-12 11:23 - 2012-08-07 15:28 - 00000000 ____D () C:\Users\Julia\AppData\Local\Temp

2014-06-12 11:22 - 2014-06-12 11:16 - 00023101 _____ () C:\Users\Julia\Downloads\FRST.txt

2014-06-12 11:22 - 2014-06-12 11:16 - 00000000 ____D () C:\FRST

2014-06-12 11:19 - 2014-06-12 11:18 - 00033276 _____ () C:\Users\Julia\Downloads\Addition.txt

2014-06-12 11:17 - 2009-07-14 06:45 - 00013936 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-06-12 11:17 - 2009-07-14 06:45 - 00013936 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-06-12 11:15 - 2014-06-12 11:15 - 02081792 _____ (Farbar) C:\Users\Julia\Downloads\FRST64 (1).exe

2014-06-12 11:14 - 2014-06-12 11:14 - 02081792 _____ (Farbar) C:\Users\Julia\Downloads\FRST64.exe

2014-06-12 11:14 - 2012-09-29 18:44 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-06-12 11:05 - 2013-10-23 19:47 - 00000936 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1467540412-3089772811-3921172512-1002UA.job

2014-06-12 11:02 - 2012-08-03 00:55 - 01621114 _____ () C:\Windows\WindowsUpdate.log

2014-06-12 10:43 - 2012-10-02 17:03 - 00001104 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-06-12 10:25 - 2012-10-02 17:03 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-06-12 09:37 - 2012-08-07 15:33 - 00003922 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{1CF7C5D8-54EA-4809-BCF6-8C871690FC6E}

2014-06-12 09:34 - 2013-12-25 15:23 - 00000434 _____ () C:\Windows\system32\Drivers\etc\hosts.ics

2014-06-12 09:34 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-06-12 09:34 - 2009-07-14 06:51 - 00090715 _____ () C:\Windows\setupact.log

2014-06-11 23:19 - 2013-04-05 19:36 - 00000000 ____D () C:\Users\Julia 1\AppData\Local\Temp

2014-06-11 20:45 - 2012-09-02 15:25 - 00000928 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1467540412-3089772811-3921172512-1000UA.job

2014-06-11 20:45 - 2012-09-02 15:24 - 00000906 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1467540412-3089772811-3921172512-1000Core.job

2014-06-11 20:40 - 2012-11-23 21:33 - 00000914 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1467540412-3089772811-3921172512-1001Core.job

2014-06-11 20:39 - 2012-11-23 21:33 - 00000936 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1467540412-3089772811-3921172512-1001UA.job

2014-06-11 20:05 - 2013-10-23 19:47 - 00000914 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1467540412-3089772811-3921172512-1002Core.job

2014-06-11 19:51 - 2014-06-11 19:49 - 00000000 ____D () C:\Users\Julia 1\Desktop\Tom

2014-06-11 19:50 - 2012-08-03 01:50 - 00654166 _____ () C:\Windows\system32\perfh007.dat

2014-06-11 19:50 - 2012-08-03 01:50 - 00130006 _____ () C:\Windows\system32\perfc007.dat

2014-06-11 19:50 - 2009-07-14 07:13 - 01498506 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-06-11 19:48 - 2013-04-05 22:15 - 00003930 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{CB2C0858-E159-4D06-9394-EC7308A1F73C}

2014-06-11 00:45 - 2013-10-18 17:00 - 00000000 ____D () C:\Windows\system32\MRT

2014-06-11 00:41 - 2013-10-18 17:00 - 95414520 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-06-11 00:41 - 2013-01-30 13:20 - 00000000 ____D () C:\ProgramData\Microsoft Help

2014-06-10 22:09 - 2014-06-10 22:09 - 00608816 _____ () C:\Users\Julia 1\Downloads\TinyMediaPlayerInstaller.exe

2014-05-15 18:15 - 2012-09-29 18:44 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-05-15 18:15 - 2012-09-29 18:44 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-05-15 18:14 - 2012-09-29 18:44 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
 

Some content of TEMP:

====================

C:\Users\Julia\AppData\Local\Temp\bundlesweetimsetup.exe

C:\Users\Julia\AppData\Local\Temp\eTypeSetup.exe

C:\Users\Julia\AppData\Local\Temp\incredibar_installer.exe

C:\Users\Julia\AppData\Local\Temp\jre-6u35-windows-i586-iftw.exe

C:\Users\Julia\AppData\Local\Temp\jre-6u38-windows-i586-iftw.exe

C:\Users\Julia\AppData\Local\Temp\LyriXtmp.exe

C:\Users\Julia\AppData\Local\Temp\ose00000.exe

C:\Users\Julia\AppData\Local\Temp\Shortcut_FlashPlayerSDM[1].exe

C:\Users\Julia\AppData\Local\Temp\SIMEEIInstaller.exe

C:\Users\Julia\AppData\Local\Temp\ubi69C5.tmp.exe

C:\Users\Julia\AppData\Local\Temp\uninst1.exe

C:\Users\Julia\AppData\Local\Temp\UpdateCheckerSetup.exe

C:\Users\Julia 1\AppData\Local\Temp\ubiB758.tmp.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-06-11 20:58
 

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 12-06-2014 01

Ran by Julia at 2014-06-12 11:23:46

Running from C:\Users\Julia\Downloads

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

AV: Microsoft Security Essentials (Enabled - Up to date) {641105E6-77ED-3F35-A304-765193BCB75F}

AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Microsoft Security Essentials (Enabled - Up to date) {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
 

==================== Installed Programs ======================
 

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 1.5.3.9130 - Adobe Systems Inc.)

Adobe AIR (x32 Version: 1.5.3.9130 - Adobe Systems Inc.) Hidden

Adobe Flash Player 10 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 10.0.45.2 - Adobe Systems Incorporated)

Adobe Flash Player 13 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 13.0.0.214 - Adobe Systems Incorporated)

Adobe Photoshop Elements 8.0 (HKLM-x32\...\Adobe Photoshop Elements 8.0) (Version: 8.0 - Adobe Systems Incorporated)

Adobe Photoshop Elements 8.0 (x32 Version: 8.0 - Adobe Systems Incorporated) Hidden

Adobe Premiere Elements 8.0 (HKLM-x32\...\PremElem80) (Version: 8.0 - Adobe Systems Incorporated)

Adobe Premiere Elements 8.0 (x32 Version: 8.0 - Adobe Systems Incorporated) Hidden

Adobe Reader 9.3 - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-A93000000001}) (Version: 9.3.0 - Adobe Systems Incorporated)

ANNO 1404 (HKLM-x32\...\{3D9CF3CA-3AB0-4A82-9853-D7C43FD1D775}) (Version: 1.00.0000 - Ubisoft)

Anno 1404 (x32 Version: 1.00.0000 - Ubisoft) Hidden

Apple Application Support (HKLM-x32\...\{AAC5D43E-816D-4C2D-8E51-55FFF35BE301}) (Version: 3.0.1 - Apple Inc.)

Apple Mobile Device Support (HKLM\...\{787136D2-F0F8-4625-AA3F-72D7795AC842}) (Version: 7.1.1.3 - Apple Inc.)

Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)

ArcSoft WebCam Companion 3 (HKLM-x32\...\{DE8AAC73-6D8D-483E-96EA-CAEDDADB9079}) (Version: 3.0.21.368 - ArcSoft)

Battlefield 1942™ (HKLM-x32\...\{5BE7BD06-512B-43bf-AD78-3BD2A5F5F7B3}) (Version: 1.6.20.0 - Electronic Arts)

Bing Bar (HKLM-x32\...\{3365E735-48A6-4194-9988-CE59AC5AE503}) (Version: 7.3.132.0 - Microsoft Corporation)

Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)

Counter-Strike: Global Offensive (HKLM-x32\...\Steam App 730) (Version:  - )

Counter-Strike: Source (HKLM-x32\...\Steam App 240) (Version:  - Valve)

Evernote (HKLM-x32\...\{F761359C-9CED-45AE-9A51-9D6605CD55C4}) (Version: 3.5.4.2224 - Evernote Corp.)

Facebook Messenger 2.1.4814.0 (HKLM-x32\...\{7204BDEE-1A48-4D95-A964-44A9250B439E}) (Version: 2.1.4814.0 - Facebook)

Facebook Video Calling 2.0.0.447 (HKLM-x32\...\{8DF41A9F-FE13-43E8-A003-5F9B55A011EE}) (Version: 2.0.447 - Skype Limited)

FilesFrog Update Checker (HKLM-x32\...\FilesFrog Update Checker) (Version:  - ) <==== ATTENTION

Firebird SQL Server - MAGIX Edition (HKLM-x32\...\{6C5F8503-55D2-4398-858C-362B7A7AF51C}) (Version: 2.1.31.0 - MAGIX AG)

Free YouTube Download version 3.2.1.320 (HKLM-x32\...\Free YouTube Download_is1) (Version: 3.2.1.320 - DVDVideoSoft Ltd.)

GIMP 2.8.10 (HKLM\...\GIMP-2_is1) (Version: 2.8.10 - The GIMP Team)

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 35.0.1916.153 - Google Inc.)

Google Update Helper (x32 Version: 1.3.24.7 - Google Inc.) Hidden

Hercules DJ Products Series drivers (HKLM-x32\...\{33999F1F-EA46-4E55-A239-1BA803235396}) (Version: 3.HDJS.2012 - Hercules)

HP Deskjet 3050 J610 series - Grundlegende Software für das Gerät (HKLM\...\{EF3293DE-FCAC-4742-91BF-AD0174143FC3}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)

HP Deskjet 3050A J611 series - Grundlegende Software für das Gerät (HKLM\...\{61ADDE9C-3AE6-46FC-9127-DFFF637AED03}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)

HP Deskjet 3050A J611 series Hilfe (HKLM-x32\...\{97DDCAB8-B770-4089-A10F-67568069D78A}) (Version: 140.0.2.2 - Hewlett Packard)

HP Photo Creations (HKLM-x32\...\HP Photo Creations) (Version: 1.0.0.7702 - HP)

HP Photosmart 5520 series - Grundlegende Software für das Gerät (HKLM\...\{4F396B08-301D-4E53-A372-95A7E93ABD04}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)

HP Update (HKLM-x32\...\{6F1C00D2-25C2-4CBA-8126-AE9A6E2E9CD5}) (Version: 5.003.003.001 - Hewlett-Packard)

IB Updater Service (HKLM-x32\...\WNLT) (Version: 5.0.8.6 - ) <==== ATTENTION

iCloud (HKLM\...\{CE97E4D3-9F91-4D72-8A29-ED9EA90E5A15}) (Version: 2.1.3.25 - Apple Inc.)

Inbox Toolbar (HKLM-x32\...\{612AD33D-9824-4E87-8396-92374E91C4BB}_is1) (Version: 2.0.0.46 - Inbox.com, Inc.)

Incredibar Toolbar  on IE (HKLM-x32\...\incredibar) (Version:  - ) <==== ATTENTION

Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)

Intel(R) Graphics Media Accelerator Driver (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2141 - Intel Corporation)

Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.0.0.1179 - Intel Corporation)

Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 9.6.0.1014 - Intel Corporation)

iTunes (HKLM\...\{B8BA155B-1E75-405F-9CB4-8A99615D09DC}) (Version: 11.1.5.5 - Apple Inc.)

Java Auto Updater (x32 Version: 2.0.7.2 - Sun Microsystems, Inc.) Hidden

Java(TM) 6 Update 20 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86416020FF}) (Version: 6.0.200 - Sun Microsystems, Inc.)

Java(TM) 6 Update 38 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216038FF}) (Version: 6.0.380 - Oracle)

Junk Mail filter update (x32 Version: 14.0.8117.416 - Microsoft Corporation) Hidden

MAGIX Content und Soundpools (HKLM-x32\...\MAGIX_GlobalContent) (Version: 1.0.0.0 - MAGIX AG)

MAGIX Goya burnR (MSI) (HKLM-x32\...\MAGIX_{83877B00-513F-4F4B-B56E-B7FBB002E06B}) (Version: 4.3.2.0 - MAGIX AG)

MAGIX Goya burnR (MSI) (Version: 4.3.2.0 - MAGIX AG) Hidden

MAGIX Music Maker 2013 (HKLM-x32\...\MAGIX_{3F5C2BC0-B7D7-4114-B273-3B1460B2452B}) (Version: 19.0.1.36 - MAGIX AG)

MAGIX Music Maker 2013 (Version: 19.0.1.36 - MAGIX AG) Hidden

MAGIX Music Maker 2013 Trial Soundpools (Version: 1.0.0.0 - MAGIX AG) Hidden

Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)

Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden

Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)

Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden

Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden

Microsoft Choice Guard (x32 Version: 2.0.48.0 - Microsoft Corporation) Hidden

Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)

Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden

Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)

Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)

Microsoft Office Home and Student 2007 (HKLM-x32\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)

Microsoft Office Home and Student 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)

Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden

Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden

Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Security Client (Version: 4.5.0216.0 - Microsoft Corporation) Hidden

Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.5.216.0 - Microsoft Corporation)

Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)

Microsoft Sync Framework Runtime Native v1.0 (x86) (HKLM-x32\...\{8A74E887-8F0F-4017-AF53-CBA42211AAA5}) (Version: 1.0.1215.0 - Microsoft Corporation)

Microsoft Sync Framework Services Native v1.0 (x86) (HKLM-x32\...\{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}) (Version: 1.0.1215.0 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

MSVCRT (x32 Version: 14.0.1468.721 - Microsoft) Hidden

MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)

MSXML 4.0 SP3 Parser (KB2721691) (HKLM-x32\...\{355B5AC0-CEEE-42C5-AD4D-7F3CFD806C36}) (Version: 4.30.2114.0 - Microsoft Corporation)

MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)

Norton Online Backup (HKLM-x32\...\{40A66DF6-22D3-44B5-A7D3-83B118A2C0DC}) (Version: 2.1.17869 - Symantec Corporation)

Origin (HKLM-x32\...\Origin) (Version: 9.2.1.4399 - Electronic Arts, Inc.)

QuickTime (HKLM-x32\...\{AF0CE7C0-A3E4-4D73-988B-B29187EC6E9A}) (Version: 7.73.80.64 - Apple Inc.)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6141 - Realtek Semiconductor Corp.)

Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30113 - Realtek Semiconductor Corp.)

Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)

simplitec simplicheck (HKLM-x32\...\{EC3825A1-02C6-4A83-8CA4-3F97A25CD37B}) (Version: 1.2.6.0 - simplitec GmbH)

Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)

SmartSound Quicktracks for Premiere Elements 8.0 (HKLM-x32\...\InstallShield_{4685A344-6718-4923-AA9D-158A0A2E1CFB}) (Version: 3.11.3090 - SmartSound Software Inc)

SmartSound Quicktracks for Premiere Elements 8.0 (x32 Version: 3.11.3090 - SmartSound Software Inc) Hidden

Spotify (HKCU\...\Spotify) (Version: 0.8.8.459.g4430eae7 - Spotify AB)

Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)

Studie zur Verbesserung von HP Deskjet 3050A J611 series Produkten (HKLM\...\{EF27865C-E636-47C4-8B35-CE8A88045681}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)

SweetIM for Messenger 3.7 (HKLM-x32\...\{7683B745-6060-41FD-AA75-0BBB383FEAD4}) (Version: 3.7.0005 - SweetIM Technologies Ltd.) <==== ATTENTION

Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.0.24.0 - Synaptics Incorporated)

Text-To-Speech-Runtime (HKLM-x32\...\{7B3F0113-E63C-4D6D-AF19-111A3165CCA2}) (Version: 1.0.0.0 - Magix Development GmbH)

Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)

Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2468871) (Version: 1 - Microsoft Corporation)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2533523) (Version: 1 - Microsoft Corporation)

Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2600217) (Version: 1 - Microsoft Corporation)

Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version:  - Microsoft)

Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-002A-0000-1000-0000000FF1CE}_HOMESTUDENTR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)

Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)

Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version:  - Microsoft)

Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)

Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)

Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)

Update Manager for SweetPacks 1.1 (HKLM-x32\...\{EA8FA6BE-29BE-4AF2-9352-841F83215EB0}) (Version: 1.1.0008 - SweetIM Technologies Ltd.) <==== ATTENTION

VAIO Care (HKLM-x32\...\{36C5BBF0-E5BF-4DE1-B684-7E90B0C93FB5}) (Version: 6.2.2.07150 - Sony Corporation)

VAIO Care (x32 Version: 6.2.2.07150 - Sony Corporation) Hidden

VAIO Control Center (HKLM-x32\...\{72042FA6-5609-489F-A8EA-3C2DD650F667}) (Version: 4.3.0.05310 - Sony Corporation)

VAIO Data Restore Tool (HKLM-x32\...\{57B955CE-B5D3-495D-AF1B-FAEE0540BFEF}) (Version: 1.4.0.05240 - Sony Corporation)

VAIO Data Restore Tool (x32 Version: 1.4.0.05240 - Sony Corporation) Hidden

VAIO Gate (HKLM-x32\...\{A7C30414-2382-4086-B0D6-01A88ABA21C3}) (Version: 2.2.0.06080 - Sony Corporation)

VAIO Gate Default (HKLM-x32\...\{B7546697-2A80-4256-A24B-1C33163F535B}) (Version: 2.2.0.07020 - Sony Corporation)

VAIO Hardware Diagnostics (x32 Version: 4.0.0.06230 - Sony Corporation) Hidden

VAIO screensaver (HKLM-x32\...\VAIO screensaver) (Version: 1.0.0.0 - Sony Europe)

VAIO Smart Network (HKLM-x32\...\{0899D75A-C2FC-42EA-A702-5B9A5F24EAD5}) (Version: 3.3.0.06080 - Sony Corporation)

VAIO Update (HKLM-x32\...\{5BEE8F1F-BD32-4553-8107-500439E43BD7}) (Version: 5.2.0.05310 - Sony Corporation)

VAIO-Handbuch (HKLM-x32\...\{C6E893E7-E5EA-4CD5-917C-5443E753FCBD}) (Version: 1.1.0.05280 - Sony Corporation)

VAIO-Support für Übertragungen (HKLM-x32\...\{5DDAFB4B-C52E-468A-9E23-3B0CEEB671BF}) (Version: 1.2.0.06230 - Sony Corporation)

Virtual DJ - Atomix Productions (HKLM-x32\...\Virtual DJ - Atomix Productions) (Version:  - )

VLC media player 2.1.2 (HKLM-x32\...\VLC media player) (Version: 2.1.2 - VideoLAN)

Web Assistant 2.0.0.570 (HKLM\...\{336D0C35-8A85-403a-B9D2-65C292C39087}_is1) (Version: 2.0.0.570 - IncrediBar) <==== ATTENTION

WIDCOMM Bluetooth Software (HKLM\...\{436E0B79-2CFB-4E5F-9380-E17C1B25D0C5}) (Version: 6.3.0.5600 - Broadcom Corporation)

Windows Live Anmelde-Assistent (HKLM-x32\...\{52B97218-98CB-4B8B-9283-D213C85E1AA4}) (Version: 5.000.818.5 - Microsoft Corporation)

Windows Live Call (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden

Windows Live Communications Platform (x32 Version: 14.0.8117.416 - Microsoft Corporation) Hidden

Windows Live Essentials (HKLM-x32\...\WinLiveSuite_Wave3) (Version: 14.0.8117.0416 - Microsoft Corporation)

Windows Live Essentials (x32 Version: 14.0.8117.416 - Microsoft Corporation) Hidden

Windows Live Fotogalerie (x32 Version: 14.0.8117.416 - Microsoft Corporation) Hidden

Windows Live Mail (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden

Windows Live Messenger (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden

Windows Live Sync (HKLM-x32\...\{586509F0-350D-48B5-B763-9CC2F8D96C4C}) (Version: 14.0.8117.416 - Microsoft Corporation)

Windows Live Writer (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden

Windows Live-Uploadtool (HKLM-x32\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
 

==================== Restore Points  =========================
 

23-04-2014 11:57:29 DirectX wurde installiert

27-04-2014 13:45:03 Windows Update

02-05-2014 13:58:23 Windows Update

05-05-2014 20:16:39 Windows Update

10-05-2014 16:44:28 Windows Update

15-05-2014 15:40:00 Windows Update

22-05-2014 04:18:57 Windows Update

26-05-2014 17:47:15 Windows Update

02-06-2014 14:13:07 Windows Update

07-06-2014 12:53:03 Windows Update

10-06-2014 17:53:39 Windows Update

10-06-2014 22:39:22 Windows Update
 

==================== Hosts content: ==========================
 

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
 

==================== Scheduled Tasks (whitelisted) =============
 

Task: {0493AA8A-0DB6-41CB-A8B9-2F3BC1909BC9} - System32\Tasks\SONY\VAIO Gate\VAIO Gate => C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe [2010-06-08] (Sony Corporation)

Task: {2652998E-4FA5-4E86-AFC6-DD5F306A3134} - System32\Tasks\SONY\VAIO Update\VAIO Update 5 => C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe [2010-05-31] (Sony Corporation)

Task: {2FEA53E9-C12D-4817-BEFE-6D8FDA23B260} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)

Task: {391D71CE-2B50-4D50-912C-92D0A1A8B9ED} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-10-02] (Google Inc.)

Task: {4560BBA0-792F-4590-945C-1794637F55CB} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-1467540412-3089772811-3921172512-1001Core => C:\Users\Julia 1\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-10-23] (Facebook Inc.)

Task: {5E458837-6E61-4F6A-82C6-838B548BCBE2} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-1467540412-3089772811-3921172512-1000Core => C:\Users\Julia\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-02-07] (Facebook Inc.)

Task: {64590280-4455-46F3-B231-2E3CF22C2370} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-1467540412-3089772811-3921172512-1002Core => C:\Users\Julia 1\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-10-23] (Facebook Inc.)

Task: {77114BA0-EBFF-4E8A-A94E-01751487D357} - System32\Tasks\VAIO Care Support => C:\Program Files\Sony\VAIO Care\VCSpt.exe [2010-05-26] (Sony Corporation)

Task: {7D82F0F5-B5AC-4FCA-A059-2913C6B4EBE7} - System32\Tasks\VAIO Care => C:\Program Files\Sony\VAIO Care\VCsystray.exe [2010-07-15] (Sony Corporation)

Task: {8A8504BB-C558-492D-B9FF-B9CA21FEAA54} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-15] (Adobe Systems Incorporated)

Task: {8BABA5EC-B5FA-4310-B7C6-10AC0CDFB3BC} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-10-02] (Google Inc.)

Task: {B3C62193-C501-4F2C-9F7E-9E44F99FE34A} - System32\Tasks\SONY\VAIO Gate\StartExecuteProxy => C:\Program Files\Sony\VAIO Gate\ExecutionProxy.exe [2010-06-08] (Sony Corporation)

Task: {B8F12D3C-A545-4D4C-926F-ED96D168D15D} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-1467540412-3089772811-3921172512-1001UA => C:\Users\Julia 1\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-10-23] (Facebook Inc.)

Task: {CFC1526B-3706-4B6C-AE44-7FA4CB2F9B37} - System32\Tasks\HPCustParticipation HP Deskjet 3050A J611 series => C:\Program Files\HP\HP Deskjet 3050A J611 series\Bin\HPCustPartic.exe [2012-10-17] (Hewlett-Packard Co.)

Task: {D73E02E8-6B22-41F7-899F-67E2F3827FFA} - System32\Tasks\SONY\VAIO Wallpaper Setting Tool\VAIO Wallpaper Setting Tool => C:\Program Files (x86)\Sony\VAIO Wallpaper Setting Tool\VWSet.exe

Task: {D7F36667-14B4-4138-B7C4-A332F24EB647} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-1467540412-3089772811-3921172512-1000UA => C:\Users\Julia\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-02-07] (Facebook Inc.)

Task: {E4EDF16A-3455-42A4-B0D4-54C7AECB846A} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-1467540412-3089772811-3921172512-1002UA => C:\Users\Julia 1\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-10-23] (Facebook Inc.)

Task: {EAA3BC2B-F51E-4D13-A193-F145FA270510} - System32\Tasks\Dealply => C:\Users\Julia\AppData\Roaming\Dealply\UPDATE~1\UPDATE~1.EXE <==== ATTENTION

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\Dealply.job => C:\Users\Julia\AppData\Roaming\Dealply\UPDATE~1\UPDATE~1.EXE <==== ATTENTION

Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1467540412-3089772811-3921172512-1000Core.job => C:\Users\Julia\AppData\Local\Facebook\Update\FacebookUpdate.exe

Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1467540412-3089772811-3921172512-1000UA.job => C:\Users\Julia\AppData\Local\Facebook\Update\FacebookUpdate.exe

Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1467540412-3089772811-3921172512-1001Core.job => C:\Users\Julia 1\AppData\Local\Facebook\Update\FacebookUpdate.exe

Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1467540412-3089772811-3921172512-1001UA.job => C:\Users\Julia 1\AppData\Local\Facebook\Update\FacebookUpdate.exe

Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1467540412-3089772811-3921172512-1002Core.job => C:\Users\Julia 1\AppData\Local\Facebook\Update\FacebookUpdate.exe

Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1467540412-3089772811-3921172512-1002UA.job => C:\Users\Julia 1\AppData\Local\Facebook\Update\FacebookUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
 

==================== Loaded Modules (whitelisted) =============
 

2013-04-18 14:13 - 2014-04-07 16:57 - 02276144 _____ () C:\Windows\system32\dmwu.exe

2014-04-07 16:57 - 2014-04-07 16:57 - 01100592 _____ () C:\Windows\SysWOW64\jmdp\stij.exe

2014-04-07 16:57 - 2014-04-07 16:57 - 01303856 _____ () C:\Windows\System32\ljkb\stij.exe

2014-04-07 16:57 - 2014-04-07 16:57 - 01571120 _____ () C:\Windows\System32\ljkb\lmrn.dll

2014-02-12 21:58 - 2014-02-12 21:58 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll

2014-02-12 21:58 - 2014-02-12 21:58 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll

2012-08-03 17:40 - 2010-05-31 19:18 - 00013824 _____ () C:\Program Files (x86)\Sony\VAIO Event Service\VESBasePS.dll

2012-08-03 17:40 - 2010-05-31 19:18 - 00013312 _____ () C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSubPS.dll

2014-04-07 16:57 - 2014-04-07 16:57 - 01266992 _____ () C:\Windows\SysWOW64\jmdp\lmrn.dll

2013-09-14 02:51 - 2013-09-14 02:51 - 00087952 _____ () C:\Program Files (x86)\Common Files\Apple\Internet Services\zlib1.dll

2013-09-14 02:50 - 2013-09-14 02:50 - 01242952 _____ () C:\Program Files (x86)\Common Files\Apple\Internet Services\libxml2.dll

2013-01-11 15:26 - 2013-01-11 15:26 - 00170496 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\d89f0252d910d617de1de783a812f840\IsdiInterop.ni.dll

2012-08-03 01:05 - 2010-03-03 20:08 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll

2014-06-12 09:42 - 2014-06-05 15:58 - 00716616 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\libglesv2.dll

2014-06-12 09:42 - 2014-06-05 15:58 - 00126280 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\libegl.dll

2014-06-12 09:42 - 2014-06-05 15:58 - 04217672 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\pdf.dll

2014-06-12 09:42 - 2014-06-05 15:58 - 00414536 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\ppGoogleNaClPluginChrome.dll

2014-06-12 09:42 - 2014-06-05 15:58 - 01732424 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\ffmpegsumo.dll
 

==================== Alternate Data Streams (whitelisted) =========
 
 

==================== Safe Mode (whitelisted) ===================
 
 

==================== EXE Association (whitelisted) =============
 
 

==================== MSCONFIG/TASK MANAGER disabled items =========
 

MSCONFIG\Services: FirebirdServerMAGIXInstance => 3

MSCONFIG\Services: FLEXnet Licensing Service => 3

MSCONFIG\Services: NOBU => 2

MSCONFIG\Services: Steam Client Service => 3

MSCONFIG\Services: Web Assistant => 2

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Bluetooth.lnk => C:\Windows\pss\Bluetooth.lnk.CommonStartup

MSCONFIG\startupfolder: C:^Users^Julia^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Facebook Messenger.lnk => C:\Windows\pss\Facebook Messenger.lnk.Startup

MSCONFIG\startupfolder: C:^Users^Julia^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^simplicheck.lnk => C:\Windows\pss\simplicheck.lnk.Startup

MSCONFIG\startupreg: Facebook Update => "C:\Users\Julia\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver

MSCONFIG\startupreg: Hercules DJ Series => C:\Program Files\Hercules\Audio\DJ Console Series\HDJSeriesCPL.exe /boot

MSCONFIG\startupreg: InboxToolbar => "C:\Program Files (x86)\Inbox Toolbar\Inbox.exe" /STARTUP

MSCONFIG\startupreg: Norton Online Backup => C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe

MSCONFIG\startupreg: SDP => C:\Program Files (x86)\FilesFrog Update Checker\update_checker.exe /auto 

MSCONFIG\startupreg: Spotify => "C:\Users\Julia\AppData\Roaming\Spotify\Spotify.exe" /uri spotify:autostart

MSCONFIG\startupreg: Spotify Web Helper => "C:\Users\Julia\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"

MSCONFIG\startupreg: SweetIM => C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe

MSCONFIG\startupreg: Sweetpacks Communicator => C:\Program Files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe

MSCONFIG\startupreg: SynTPEnh => %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
 

==================== Faulty Device Manager Devices =============
 

Name: Microsoft-Adapter für Miniports virtueller WiFis

Description: Microsoft-Adapter für Miniports virtueller WiFis

Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}

Manufacturer: Microsoft

Service: vwifimp

Problem: : This device is disabled. (Code 22)

Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (06/11/2014 09:05:22 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 8346
 

Error: (06/11/2014 09:05:22 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 8346
 

Error: (06/11/2014 09:05:22 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: Continuously busy for more than a second
 

Error: (06/11/2014 09:05:21 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 7347
 

Error: (06/11/2014 09:05:21 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 7347
 

Error: (06/11/2014 09:05:21 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: Continuously busy for more than a second
 

Error: (06/11/2014 09:05:20 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 6333
 

Error: (06/11/2014 09:05:20 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 6333
 

Error: (06/11/2014 09:05:20 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: Continuously busy for more than a second
 

Error: (06/11/2014 09:05:19 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 5335
 
 

System errors:

=============

Error: (06/12/2014 09:35:20 AM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)

Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)
 

Error: (06/12/2014 09:34:20 AM) (Source: Service Control Manager) (EventID: 7026) (User: )

Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 

cdrom
 

Error: (06/12/2014 09:34:17 AM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Der Dienst "McAfee SiteAdvisor Service" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (06/11/2014 09:03:19 PM) (Source: ipnathlp) (EventID: 31004) (User: )

Description: 0
 

Error: (06/11/2014 07:38:33 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)

Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)
 

Error: (06/11/2014 07:37:33 PM) (Source: Service Control Manager) (EventID: 7026) (User: )

Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 

cdrom
 

Error: (06/11/2014 07:37:27 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Der Dienst "McAfee SiteAdvisor Service" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (06/11/2014 04:41:26 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)

Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)
 

Error: (06/11/2014 04:40:26 PM) (Source: Service Control Manager) (EventID: 7026) (User: )

Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 

cdrom
 

Error: (06/11/2014 04:40:25 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Der Dienst "McAfee SiteAdvisor Service" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 
 

Microsoft Office Sessions:

=========================
 

==================== Memory info =========================== 
 

Percentage of memory in use: 41%

Total physical RAM: 3765.86 MB

Available physical RAM: 2189.7 MB

Total Pagefile: 7529.86 MB

Available Pagefile: 5629.16 MB

Total Virtual: 8192 MB

Available Virtual: 8191.82 MB
 

==================== Drives ================================
 

Drive c: () (Fixed) (Total:455.28 GB) (Free:300.12 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 4E072F71)

Partition 1: (Not Active) - (Size=10 GB) - (Type=27)

Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=455 GB) - (Type=07 NTFS)
 

==================== End Of Log ============================

Pc von Mama:

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:12-06-2014

Ran by Administrator (administrator) on SYLVIA-8DB84CC2 on 12-06-2014 12:01:41

Running from C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\Downloads

Platform: Microsoft Windows XP Professional Service Pack 3 (X86) OS Language: German Standard

Internet Explorer Version 8

Boot Mode: Normal
 
 
 

==================== Processes (Whitelisted) =================
 

(Broadcom Corporation.) C:\Programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe

(Microsoft Corporation) C:\WINDOWS\system32\scardsvr.exe

(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\sched.exe

(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\avguard.exe

(Hewlett-Packard Company) C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe

(Analog Devices, Inc.) C:\Programme\Analog Devices\SoundMAX\SMAgent.exe

(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\avshadow.exe

() C:\Programme\Java\j2re1.4.2_05\bin\jusched.exe

() C:\Programme\Java\j2re1.4.2_05\bin\jucheck.exe

(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\avgnt.exe

() C:\Programme\Belkin\Belkin Wireless AG Desktop Network Card\Wireless Utility\WLanCfgAG.exe

(Analog Devices, Inc.) C:\Programme\Analog Devices\SoundMAX\SMTray.exe

(Systweak) C:\Programme\Advanced System Protector\AdvancedSystemProtector.exe

(Hewlett-Packard Company) C:\Programme\Gemeinsame Dateien\LightScribe\LightScribeControlPanel.exe

(Broadcom Corporation.) C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe

() C:\Programme\NETGEAR\WG111v3\WG111v3.exe

(Google Inc.) C:\Programme\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Programme\Google\Chrome\Application\chrome.exe

(MyPCBackup.com) C:\Programme\MyPC Backup\MyPC Backup.exe

(Google Inc.) C:\Programme\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Programme\Google\Chrome\Application\chrome.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [SunJavaUpdateSched] => C:\Programme\Java\j2re1.4.2_05\bin\jusched.exe [32881 2014-01-03] ()

HKLM\...\Run: [LayoutM] => C:\WINDOWS\KLayMgr.exe [45056 2004-08-26] (Chicony)

HKLM\...\Run: [SetRefresh] => C:\Programme\COMPAQ\SetRefresh\\SetRefresh.exe [525824 2003-11-20] (Hewlett-Packard Company)

HKLM\...\Run: [avgnt] => C:\Programme\Avira\AntiVir Desktop\avgnt.exe [737872 2014-06-11] (Avira Operations GmbH & Co. KG)

HKLM\...\Run: [Adobe ARM] => C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)

HKLM\...\Run: [InvokeSvc.exe] => C:\Programme\Belkin\Belkin Wireless AG Desktop Network Card\Wireless Utility\WLanCfgAG.exe [921600 2006-07-12] ()

HKLM\...\Run: [Smapp] => C:\Programme\Analog Devices\SoundMAX\SMTray.exe [143360 2003-07-30] (Analog Devices, Inc.)

HKLM\...\Run: [Advanced System Protector_startup] => C:\Programme\Advanced System Protector\AdvancedSystemProtector.exe [6659440 2014-05-23] (Systweak)

Winlogon\Notify\GtkLogon: C:\WINDOWS\system32\GtkLogon.dll (Gemtek Technology Co., Ltd.)

HKU\S-1-5-21-1935655697-884357618-682003330-500\...\Run: [LightScribe Control Panel] => C:\Programme\Gemeinsame Dateien\LightScribe\LightScribeControlPanel.exe [2363392 2008-08-22] (Hewlett-Packard Company)

HKU\S-1-5-21-1935655697-884357618-682003330-500\...\Run: [RDReminder] => C:\Programme\RegClean Pro\RegCleanPro.exe [7913304 2014-04-25] (Systweak Inc)

Startup: C:\Dokumente und Einstellungen\Administrator\Startmenü\Programme\Autostart\MyPC Backup.lnk

ShortcutTarget: MyPC Backup.lnk -> C:\Programme\MyPC Backup\MyPC Backup.exe (MyPCBackup.com)

Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\BTTray.lnk

ShortcutTarget: BTTray.lnk -> C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)

Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\NETGEAR WG111v3 Setup-Assistent.lnk

ShortcutTarget: NETGEAR WG111v3 Setup-Assistent.lnk -> C:\Programme\NETGEAR\WG111v3\WG111v3.exe ()
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.mysearchdial.com/?f=1&a=dsites0103&cd=2XzuyEtN2Y1L1QzutDtDtD0F0F0EtB0C0D0ByDtDzzzyzy0DtN0D0Tzu0CyByByCtN1L2XzutBtFtBtFtCyDtFtCyCtAtCtN1L1CzutBtAtDtC1N1R&cr=1242037489&ir=

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.mysearchdial.com/?f=1&a=dsites0103&cd=2XzuyEtN2Y1L1QzutDtDtD0F0F0EtB0C0D0ByDtDzzzyzy0DtN0D0Tzu0CyByByCtN1L2XzutBtFtBtFtCyDtFtCyCtAtCtN1L1CzutBtAtDtC1N1R&cr=1242037489&ir=

SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=dsites0103&cd=2XzuyEtN2Y1L1QzutDtDtD0F0F0EtB0C0D0ByDtDzzzyzy0DtN0D0Tzu0CyByByCtN1L2XzutBtFtBtFtCyDtFtCyCtAtCtN1L1CzutBtAtDtC1N1R&cr=1242037489&ir=

SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=dsites0103&cd=2XzuyEtN2Y1L1QzutDtDtD0F0F0EtB0C0D0ByDtDzzzyzy0DtN0D0Tzu0CyByByCtN1L2XzutBtFtBtFtCyDtFtCyCtAtCtN1L1CzutBtAtDtC1N1R&cr=1242037489&ir=

BHO: FindRight - {2c774641-5504-46a8-b63f-6715ae3fe376} - C:\Programme\FindRight\FindRightbho.dll (FindRight)

Toolbar: HKCU - &Adresse - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)

Toolbar: HKCU - &Links - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\system32\SHELL32.dll (Microsoft Corporation)

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab

DPF: {CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA} hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab

Handler: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)

Handler: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)

Handler: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)

Handler: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)

Handler: ipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)

Handler: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)

Handler: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
 

FireFox:

========

FF Plugin: @microsoft.com/WPF,version=3.5 - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF Plugin: @tools.google.com/Google Update;version=3 - C:\Programme\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: @tools.google.com/Google Update;version=9 - C:\Programme\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: Adobe Reader - C:\Programme\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

FF Extension: Microsoft .NET Framework Assistant - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ []
 

Chrome: 

=======

CHR HomePage: hxxp://start.mysearchdial.com/?f=1&a=dsites0103&cd=2XzuyEtN2Y1L1QzutDtDtD0F0F0EtB0C0D0ByDtDzzzyzy0DtN0D0Tzu0CyByByCtN1L2XzutBtFtBtFtCyDtFtCyCtAtCtN1L1CzutBtAtDtC1N1R&cr=1242037489&ir=

CHR StartupUrls: "hxxp://start.mysearchdial.com/?f=1&a=dsites0103&cd=2XzuyEtN2Y1L1QzutDtDtD0F0F0EtB0C0D0ByDtDzzzyzy0DtN0D0Tzu0CyByByCtN1L2XzutBtFtBtFtCyDtFtCyCtAtCtN1L1CzutBtAtDtC1N1R&cr=1242037489&ir="

CHR DefaultSearchKeyword: mysearchdial.com

CHR DefaultSearchProvider: Mysearchdial

CHR DefaultSearchURL: hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=dsites0103&cd=2XzuyEtN2Y1L1QzutDtDtD0F0F0EtB0C0D0ByDtDzzzyzy0DtN0D0Tzu0CyByByCtN1L2XzutBtFtBtFtCyDtFtCyCtAtCtN1L1CzutBtAtDtC1N1R&cr=1242037489&ir=

CHR DefaultNewTabURL: 

CHR Extension: (Google Docs) - C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-01-07]

CHR Extension: (Google Drive) - C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-01-07]

CHR Extension: (YouTube) - C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-01-07]

CHR Extension: (Google-Suche) - C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-01-07]

CHR Extension: (Google Wallet) - C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-01-07]

CHR Extension: (Google Mail) - C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-01-07]
 

========================== Services (Whitelisted) =================
 

R2 AntiVirSchedulerService; C:\Programme\Avira\AntiVir Desktop\sched.exe [430160 2014-06-11] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Programme\Avira\AntiVir Desktop\avguard.exe [430160 2014-06-11] (Avira Operations GmbH & Co. KG)

S4 AntiVirWebService; C:\Programme\Avira\AntiVir Desktop\AVWEBGRD.EXE [1039440 2014-06-11] (Avira Operations GmbH & Co. KG)

S2 BackupStack; C:\Programme\MyPC Backup\BackupStack.exe [36392 2014-03-14] (Just Develop It)

R2 btwdins; C:\Programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe [273256 2007-04-01] (Broadcom Corporation.)

S2 gupdate; C:\Programme\Google\Update\GoogleUpdate.exe [116648 2014-01-06] (Google Inc.)

S3 gupdatem; C:\Programme\Google\Update\GoogleUpdate.exe [116648 2014-01-06] (Google Inc.)

R2 LightScribeService; C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe [73728 2008-08-22] (Hewlett-Packard Company) [File not signed]

R2 SoundMAX Agent Service (default); C:\Programme\Analog Devices\SoundMAX\SMAgent.exe [45056 2002-09-20] (Analog Devices, Inc.) [File not signed]
 

==================== Drivers (Whitelisted) ====================
 

R3 aeaudio; C:\WINDOWS\System32\drivers\aeaudio.sys [100384 2003-10-23] (Andrea Electronics Corporation) [File not signed]

R2 AegisP; C:\WINDOWS\System32\DRIVERS\AegisP.sys [21361 2014-01-06] (Cisco Systems, Inc.) [File not signed]

R2 avgntflt; C:\WINDOWS\System32\DRIVERS\avgntflt.sys [93528 2014-06-11] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\WINDOWS\System32\DRIVERS\avipbb.sys [136216 2014-06-11] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\WINDOWS\System32\DRIVERS\avkmgr.sys [37352 2013-12-09] (Avira Operations GmbH & Co. KG)

S3 Blfp; C:\WINDOWS\System32\DRIVERS\baspxp32.sys [98816 2008-06-06] (Broadcom Corporation)

R3 BTKRNL; C:\WINDOWS\System32\DRIVERS\btkrnl.sys [876384 2007-03-31] (Broadcom Corporation.)

R2 EAPPkt; C:\WINDOWS\System32\DRIVERS\EAPPkt.sys [38144 2007-10-09] (Realtek) [File not signed]

S3 HPKBCCID; C:\WINDOWS\System32\DRIVERS\HPKBCCID.sys [48256 2009-08-05] (Hewlett-Packard Company)

S3 RTL8187B; C:\WINDOWS\System32\DRIVERS\wg111v3.sys [341504 2009-07-31] (Realtek Semiconductor Corporation                           )

R3 smwdm; C:\WINDOWS\System32\drivers\smwdm.sys [612416 2004-04-15] (Analog Devices, Inc.) [File not signed]

R1 ssmdrv; C:\WINDOWS\System32\DRIVERS\ssmdrv.sys [28520 2013-12-09] (Avira GmbH)

S3 STCFUx32; C:\WINDOWS\System32\DRIVERS\STCFUx32.SYS [7680 2007-01-24] (SCM Microsystems Inc.)

U5 ScsiPort; C:\WINDOWS\system32\drivers\scsiport.sys [96384 2008-04-14] (Microsoft Corporation)

S3 STC2DFU; system32\DRIVERS\Stc2Dfu.SYS [X]

U1 WS2IFSL; 
 

==================== NetSvcs (Whitelisted) ===================

Code:

Additional scan result of Farbar Recovery Scan Tool (x86) Version:12-06-2014

Ran by Administrator at 2014-06-12 12:00:29

Running from C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\Downloads

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

AV: Avira Desktop (Disabled - Up to date) {AD166499-45F9-482A-A743-FDD3350758C7}
 

==================== Installed Programs ======================
 

Adobe Reader XI (11.0.07) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.07 - Adobe Systems Incorporated)

Advanced System Protector (HKLM\...\00212D92-C5D8-4ff4-AE50-B20F0F85C40A_Systweak_Ad~B9F029BF_is1) (Version: 2.1.1000.13591 - Systweak Software) <==== ATTENTION

Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 14.0.4.642 - Avira)

Belkin Wireless A/G Desktop Network Card (HKLM\...\{57E37DB6-41B1-4570-B42D-2B23085F3CF9}) (Version: 1.00.100 - Belkin Electronics Inc.)

Bluetooth by hp (HKLM\...\{84814E6B-2581-46EC-926A-823BD1C670F6}) (Version: 5.1.0.3300 - HP)

Broadcom Management Programs (HKLM\...\{7BB045C3-D5E4-4620-B536-DC11AACD5942}) (Version: 11.67.01 - Broadcom Corporation)

Broadcom NetXtreme Ethernet Controller (HKLM\...\{F870B987-18BC-45FC-9BE8-35C02DCDA10F}) (Version: 11.32.03 - Broadcom Corporation)

FindRight (HKLM\...\FindRight) (Version: 2014.02.14.172742 - FindRight) <==== ATTENTION

Google Chrome (HKLM\...\Google Chrome) (Version: 35.0.1916.153 - Google Inc.)

Google Update Helper (Version: 1.3.24.7 - Google Inc.) Hidden

High Definition Audio Driver Package - KB835221 (HKLM\...\KB835221WXP) (Version: 20040219.000000 - Microsoft Corporation)

Hotfix für Windows XP (KB952287) (HKLM\...\KB952287) (Version: 1 - Microsoft Corporation)

Hotfix für Windows XP (KB961118) (HKLM\...\KB961118) (Version: 1 - Microsoft Corporation)

HP Deskjet 3050 J610 series - Grundlegende Software für das Gerät (HKLM\...\{6C88C4F6-797D-4FDE-9FCE-7C486B78EFBB}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)

HP Deskjet 3050A J611 series - Grundlegende Software für das Gerät (HKLM\...\{DC2C5DE5-8315-48C3-8866-DC3A7C88DC84}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)

HP SetRefresh (HKLM\...\{F5242227-2051-4158-AC42-0F2BAA3CD3D6}) (Version: 1.2.1.3 - Hewlett-Packard Company)

HP USB Smart Card Keyboard (HKLM\...\{E24A2D94-3215-4E81-A8BA-17BC0E577597}) (Version: 4.33 - Ihr Firmenname)

Java 2 Runtime Environment, SE v1.4.2_05 (HKLM\...\{7148F0A8-6813-11D6-A77B-00B0D0142050}) (Version: 1.4.2_05 - Sun Microsystems, Inc.)

Keyboard Layout Management Application (HKLM\...\{79770F05-E3B8-4DAA-BEDB-9EBF29EAF527}) (Version:  - )

LightScribe System Software  1.14.25.1 (HKLM\...\{DA9DAC64-C947-47BA-B411-8A1959B177CF}) (Version: 1.14.25.1 - LightScribe)

Microsoft .NET Framework 2.0 Service Pack 2 (HKLM\...\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}) (Version: 2.2.30729 - Microsoft Corporation)

Microsoft .NET Framework 3.0 Service Pack 2 (HKLM\...\{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}) (Version: 3.2.30729 - Microsoft Corporation)

Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version:  - Microsoft Corporation)

Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

MyPC Backup  (HKLM\...\MyPC Backup) (Version:  - JDi Backup Ltd) <==== ATTENTION

NETGEAR WG111v3 wireless USB 2.0 adapter (HKLM\...\InstallShield_{5396FBD8-8BD7-47F9-92AE-F62F13D5A11D}) (Version: 1.01.10 - NETGEAR)

NETGEAR WG111v3 wireless USB 2.0 adapter (Version: 1.01.10 - NETGEAR) Hidden

NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version:  - )

OpenOffice 4.0.1 (HKLM\...\{0AEC308E-7EB3-47F7-BB59-F2C9C6166B27}) (Version: 4.01.9714 - Apache Software Foundation)

RegClean-Pro (HKLM\...\RegClean-Pro_is1) (Version: 6.21 - Systweak Inc) <==== ATTENTION

Sicherheitsupdate für Microsoft Windows (KB2564958) (HKLM\...\KB2564958) (Version:  - Microsoft Corporation)

Sicherheitsupdate für Windows Internet Explorer 8 (KB2510531) (HKLM\...\KB2510531-IE8) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows Internet Explorer 8 (KB2898785) (HKLM\...\KB2898785-IE8) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows Internet Explorer 8 (KB2909210) (HKLM\...\KB2909210-IE8) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows Internet Explorer 8 (KB2909921) (HKLM\...\KB2909921-IE8) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows Internet Explorer 8 (KB2925418) (HKLM\...\KB2925418-IE8) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows Internet Explorer 8 (KB2936068) (HKLM\...\KB2936068-IE8) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows Internet Explorer 8 (KB2964358) (HKLM\...\KB2964358-IE8) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows Media Player (KB2378111) (HKLM\...\KB2378111_WM9) (Version:  - Microsoft Corporation)

Sicherheitsupdate für Windows Media Player (KB2803821-v2) (HKLM\...\KB2803821-v2_WM9) (Version:  - Microsoft Corporation)

Sicherheitsupdate für Windows Media Player (KB952069) (HKLM\...\KB952069_WM9) (Version:  - Microsoft Corporation)

Sicherheitsupdate für Windows Media Player (KB954155) (HKLM\...\KB954155_WM9) (Version:  - Microsoft Corporation)

Sicherheitsupdate für Windows Media Player (KB973540) (HKLM\...\KB973540_WM9) (Version:  - Microsoft Corporation)

Sicherheitsupdate für Windows Media Player (KB975558) (HKLM\...\KB975558_WM8) (Version:  - Microsoft Corporation)

Sicherheitsupdate für Windows Media Player (KB978695) (HKLM\...\KB978695_WM9) (Version:  - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2115168) (HKLM\...\KB2115168) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2229593) (HKLM\...\KB2229593) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2296011) (HKLM\...\KB2296011) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2347290) (HKLM\...\KB2347290) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2387149) (HKLM\...\KB2387149) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2393802) (HKLM\...\KB2393802) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2419632) (HKLM\...\KB2419632) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2423089) (HKLM\...\KB2423089) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2440591) (HKLM\...\KB2440591) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2443105) (HKLM\...\KB2443105) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2478960) (HKLM\...\KB2478960) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2478971) (HKLM\...\KB2478971) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2479943) (HKLM\...\KB2479943) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2481109) (HKLM\...\KB2481109) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2483185) (HKLM\...\KB2483185) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2485663) (HKLM\...\KB2485663) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2506212) (HKLM\...\KB2506212) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2507938) (HKLM\...\KB2507938) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2508429) (HKLM\...\KB2508429) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2509553) (HKLM\...\KB2509553) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2535512) (HKLM\...\KB2535512) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2536276-v2) (HKLM\...\KB2536276-v2) (Version: 2 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2544893-v2) (HKLM\...\KB2544893-v2) (Version: 2 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2566454) (HKLM\...\KB2566454) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2570947) (HKLM\...\KB2570947) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2584146) (HKLM\...\KB2584146) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2585542) (HKLM\...\KB2585542) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2592799) (HKLM\...\KB2592799) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2598479) (HKLM\...\KB2598479) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2603381) (HKLM\...\KB2603381) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2619339) (HKLM\...\KB2619339) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2620712) (HKLM\...\KB2620712) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2631813) (HKLM\...\KB2631813) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2653956) (HKLM\...\KB2653956) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2655992) (HKLM\...\KB2655992) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2659262) (HKLM\...\KB2659262) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2661637) (HKLM\...\KB2661637) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2676562) (HKLM\...\KB2676562) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2686509) (HKLM\...\KB2686509) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2691442) (HKLM\...\KB2691442) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2698365) (HKLM\...\KB2698365) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2705219-v2) (HKLM\...\KB2705219-v2) (Version: 2 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2712808) (HKLM\...\KB2712808) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2719985) (HKLM\...\KB2719985) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2723135-v2) (HKLM\...\KB2723135-v2) (Version: 2 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2727528) (HKLM\...\KB2727528) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2757638) (HKLM\...\KB2757638) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2758857) (HKLM\...\KB2758857) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2770660) (HKLM\...\KB2770660) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2780091) (HKLM\...\KB2780091) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2802968) (HKLM\...\KB2802968) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2807986) (HKLM\...\KB2807986) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2813345) (HKLM\...\KB2813345) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2820917) (HKLM\...\KB2820917) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2834886) (HKLM\...\KB2834886) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2845187) (HKLM\...\KB2845187) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2847311) (HKLM\...\KB2847311) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2850869) (HKLM\...\KB2850869) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2859537) (HKLM\...\KB2859537) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2862152) (HKLM\...\KB2862152) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2862330) (HKLM\...\KB2862330) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2862335) (HKLM\...\KB2862335) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2864063) (HKLM\...\KB2864063) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2868038) (HKLM\...\KB2868038) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2868626) (HKLM\...\KB2868626) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2876217) (HKLM\...\KB2876217) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2876331) (HKLM\...\KB2876331) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2892075) (HKLM\...\KB2892075) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2893294) (HKLM\...\KB2893294) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2893984) (HKLM\...\KB2893984) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2898715) (HKLM\...\KB2898715) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2900986) (HKLM\...\KB2900986) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2914368) (HKLM\...\KB2914368) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2916036) (HKLM\...\KB2916036) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2922229) (HKLM\...\KB2922229) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2929961) (HKLM\...\KB2929961) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2930275) (HKLM\...\KB2930275) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB923561) (HKLM\...\KB923561) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB923789) (HKLM\...\KB923789) (Version:  - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB946648) (HKLM\...\KB946648) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB950762) (HKLM\...\KB950762) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB950974) (HKLM\...\KB950974) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB951376-v2) (HKLM\...\KB951376-v2) (Version: 2 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB952004) (HKLM\...\KB952004) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB952954) (HKLM\...\KB952954) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB956572) (HKLM\...\KB956572) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB956844) (HKLM\...\KB956844) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB959426) (HKLM\...\KB959426) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB960803) (HKLM\...\KB960803) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB960859) (HKLM\...\KB960859) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB969059) (HKLM\...\KB969059) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB970430) (HKLM\...\KB970430) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB971657) (HKLM\...\KB971657) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB972270) (HKLM\...\KB972270) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB973507) (HKLM\...\KB973507) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB973869) (HKLM\...\KB973869) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB973904) (HKLM\...\KB973904) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB974112) (HKLM\...\KB974112) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB974318) (HKLM\...\KB974318) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB974392) (HKLM\...\KB974392) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB974571) (HKLM\...\KB974571) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB975025) (HKLM\...\KB975025) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB975467) (HKLM\...\KB975467) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB975560) (HKLM\...\KB975560) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB975713) (HKLM\...\KB975713) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB977816) (HKLM\...\KB977816) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB977914) (HKLM\...\KB977914) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB978338) (HKLM\...\KB978338) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB978542) (HKLM\...\KB978542) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB978706) (HKLM\...\KB978706) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB979309) (HKLM\...\KB979309) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB979482) (HKLM\...\KB979482) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB979687) (HKLM\...\KB979687) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB981997) (HKLM\...\KB981997) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB982132) (HKLM\...\KB982132) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB982665) (HKLM\...\KB982665) (Version: 1 - Microsoft Corporation)

SoundMAX (HKLM\...\{F0A37341-D692-11D4-A984-009027EC0A9C}) (Version: 5.12.01.4070 - Analog Devices)

Update for Codec Pack (HKCU\...\Digital Sites) (Version:  - Update for Codec Pack) <==== ATTENTION

Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (HKLM\...\{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB963707) (Version: 1 - Microsoft Corporation)

Update für Windows XP (KB2345886) (HKLM\...\KB2345886) (Version: 1 - Microsoft Corporation)

Update für Windows XP (KB2749655) (HKLM\...\KB2749655) (Version: 1 - Microsoft Corporation)

Update für Windows XP (KB2904266) (HKLM\...\KB2904266) (Version: 1 - Microsoft Corporation)

Update für Windows XP (KB2934207) (HKLM\...\KB2934207) (Version: 1 - Microsoft Corporation)

Update für Windows XP (KB898461) (HKLM\...\KB898461) (Version: 1 - Microsoft Corporation)

Update für Windows XP (KB951978) (HKLM\...\KB951978) (Version: 1 - Microsoft Corporation)

Update für Windows XP (KB955759) (HKLM\...\KB955759) (Version: 1 - Microsoft Corporation)

Update für Windows XP (KB968389) (HKLM\...\KB968389) (Version: 1 - Microsoft Corporation)

Update für Windows XP (KB971029) (HKLM\...\KB971029) (Version: 1 - Microsoft Corporation)

Update für Windows XP (KB973815) (HKLM\...\KB973815) (Version: 1 - Microsoft Corporation)

WebFldrs XP (Version: 9.50.7523 - Microsoft Corporation) Hidden

Windows Internet Explorer 8 (HKLM\...\ie8) (Version: 20090308.140743 - Microsoft Corporation)

Windows XP Service Pack 3 (HKLM\...\Windows XP Service Pack) (Version: 20080414.031514 - Microsoft Corporation)
 

==================== Restore Points  =========================
 

20-03-2014 17:25:03 Software Distribution Service 3.0

23-03-2014 10:14:38 Systemprüfpunkt

29-03-2014 19:42:09 Software Distribution Service 3.0

31-03-2014 16:20:55 Systemprüfpunkt

04-04-2014 11:20:14 Systemprüfpunkt

06-04-2014 10:33:05 Systemprüfpunkt

10-04-2014 16:12:38 Systemprüfpunkt

10-04-2014 22:06:51 Software Distribution Service 3.0

25-04-2014 13:00:36 Systemprüfpunkt

27-04-2014 10:41:55 Systemprüfpunkt

28-04-2014 16:45:59 Systemprüfpunkt

03-05-2014 07:53:43 Systemprüfpunkt

03-05-2014 19:20:36 Software Distribution Service 3.0

05-05-2014 14:29:18 Systemprüfpunkt

08-05-2014 07:35:27 Systemprüfpunkt

14-05-2014 17:13:06 Systemprüfpunkt

14-05-2014 18:41:30 Software Distribution Service 3.0

22-05-2014 15:39:56 Systemprüfpunkt

24-05-2014 09:52:37 RegClean Pro Sa, Mai 24, 14  11:52

29-05-2014 11:35:00 Systemprüfpunkt

29-05-2014 20:33:28 Software Distribution Service 3.0

30-05-2014 12:25:11 Software Distribution Service 3.0

01-06-2014 09:25:28 Systemprüfpunkt

01-06-2014 19:17:33 Software Distribution Service 3.0

11-06-2014 11:19:37 Systemprüfpunkt

11-06-2014 21:49:34 Software Distribution Service 3.0
 

==================== Hosts content: ==========================
 

2004-08-04 14:00 - 2004-08-04 14:00 - 00000820 ____A C:\WINDOWS\system32\Drivers\etc\hosts

127.0.0.1       localhost
 

==================== Scheduled Tasks (whitelisted) =============
 

Task: C:\WINDOWS\Tasks\At1.job => C:\DOKUME~1\ADMINI~1\ANWEND~1\DIGITA~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION

Task: C:\WINDOWS\Tasks\At2.job => C:\DOKUME~1\ADMINI~1\ANWEND~1\MYSEAR~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION

Task: C:\WINDOWS\Tasks\At3.job => C:\DOKUME~1\NETWOR~1\ANWEND~1\MYSEAR~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION

Task: C:\WINDOWS\Tasks\Ende des Supports für Microsoft Windows XP –  Benachrichtigung – Anmeldung.job => C:\WINDOWS\system32\xp_eos.exe

Task: C:\WINDOWS\Tasks\Ende des Supports für Microsoft Windows XP – Monatliche Benachrichtigung.job => C:\WINDOWS\system32\xp_eos.exe

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Programme\Google\Update\GoogleUpdate.exe

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Programme\Google\Update\GoogleUpdate.exe

Task: C:\WINDOWS\Tasks\RegClean Pro_DEFAULT.job => C:\Programme\RegClean Pro\RegCleanPro.exe <==== ATTENTION

Task: C:\WINDOWS\Tasks\RegClean Pro_UPDATES.job => C:\Programme\RegClean Pro\RegCleanPro.exe <==== ATTENTION
 

==================== Loaded Modules (whitelisted) =============
 

2007-04-01 09:57 - 2007-04-01 09:57 - 00053248 _____ () C:\Programme\WIDCOMM\Bluetooth Software\btkeyind.dll

2014-01-03 18:39 - 2014-01-03 18:39 - 00032881 _____ () C:\Programme\Java\j2re1.4.2_05\bin\jusched.exe

2014-01-03 18:39 - 2014-01-03 18:39 - 00241777 _____ () C:\Programme\Java\j2re1.4.2_05\bin\jucheck.exe

2014-01-12 14:47 - 2006-07-12 11:34 - 00921600 _____ () C:\Programme\Belkin\Belkin Wireless AG Desktop Network Card\Wireless Utility\WLanCfgAG.exe

2014-01-12 14:47 - 2002-10-03 12:57 - 00110592 _____ () C:\Programme\Belkin\Belkin Wireless AG Desktop Network Card\Wireless Utility\PINGDLL.dll

2014-01-12 14:47 - 2003-06-30 16:37 - 00036864 _____ () C:\Programme\Belkin\Belkin Wireless AG Desktop Network Card\Wireless Utility\ProcNICs.dll

2014-01-12 14:47 - 2006-08-18 16:35 - 00212992 _____ () C:\Programme\Belkin\Belkin Wireless AG Desktop Network Card\Wireless Utility\AtherosAB.dll

2014-01-12 14:47 - 2002-04-09 08:49 - 00110592 _____ () C:\Programme\Belkin\Belkin Wireless AG Desktop Network Card\Wireless Utility\GEMWEP.DLL

2014-01-12 14:47 - 2005-09-03 01:25 - 00045056 _____ () C:\Programme\Belkin\Belkin Wireless AG Desktop Network Card\Wireless Utility\Security.dll

2014-05-24 11:53 - 2012-07-25 12:03 - 00886272 _____ () C:\Programme\Advanced System Protector\System.Data.SQLite.dll

2014-05-24 11:53 - 2014-05-23 18:50 - 01730928 _____ () C:\Programme\Advanced System Protector\aspsys.dll

2007-07-12 14:55 - 2007-07-12 14:55 - 01581056 _____ () C:\Programme\Gemeinsame Dateien\LightScribe\QtCore4.dll

2007-08-14 14:59 - 2007-08-14 14:59 - 06365184 _____ () C:\Programme\Gemeinsame Dateien\LightScribe\QtGui4.dll

2007-07-12 14:55 - 2007-07-12 14:55 - 00131072 _____ () C:\Programme\Gemeinsame Dateien\LightScribe\plugins\imageformats\qjpeg4.dll

2007-04-01 10:00 - 2007-04-01 10:00 - 02842624 _____ () C:\WINDOWS\system32\btwicons.dll

2009-12-23 12:48 - 2009-12-23 12:48 - 01937408 _____ () C:\Programme\NETGEAR\WG111v3\WG111v3.exe

2009-12-23 11:56 - 2009-12-23 11:56 - 00053248 _____ () C:\Programme\NETGEAR\WG111v3\WlanDll.dll

2009-07-14 18:31 - 2009-07-14 18:31 - 00335872 _____ () C:\Programme\NETGEAR\WG111v3\WG111v3.dll

2007-12-15 02:30 - 2007-12-15 02:30 - 01167360 _____ () C:\Programme\NETGEAR\WG111v3\acAuth.dll

2007-09-14 11:27 - 2007-09-14 11:27 - 00024576 _____ () C:\Programme\NETGEAR\WG111v3\CheckSessions.dll

2004-08-04 14:00 - 2008-04-14 08:52 - 00014336 _____ () C:\WINDOWS\system32\msdmo.dll

2014-06-11 22:32 - 2014-06-05 15:58 - 04217672 _____ () C:\Programme\Google\Chrome\Application\35.0.1916.153\pdf.dll

2014-06-11 22:32 - 2014-06-05 15:58 - 00414536 _____ () C:\Programme\Google\Chrome\Application\35.0.1916.153\ppGoogleNaClPluginChrome.dll

2014-06-11 22:32 - 2014-06-05 15:58 - 01732424 _____ () C:\Programme\Google\Chrome\Application\35.0.1916.153\ffmpegsumo.dll

2014-03-14 16:06 - 2014-03-14 16:06 - 00012288 _____ () C:\Programme\MyPC Backup\GetText.dll

2014-03-14 16:00 - 2014-03-14 16:00 - 00904704 _____ () C:\Programme\MyPC Backup\x86\System.Data.SQLite.dll

2014-06-11 22:32 - 2014-06-05 15:58 - 14612296 _____ () C:\Programme\Google\Chrome\Application\35.0.1916.153\PepperFlash\pepflashplayer.dll
 

==================== Alternate Data Streams (whitelisted) =========
 
 

==================== Safe Mode (whitelisted) ===================
 
 

==================== EXE Association (whitelisted) =============
 
 

==================== MSCONFIG/TASK MANAGER disabled items =========
 
 

==================== Faulty Device Manager Devices =============
 

Name: Videocontroller (VGA-kompatibel)

Description: Videocontroller (VGA-kompatibel)

Class Guid: {4D36E97E-E325-11CE-BFC1-08002BE10318}

Manufacturer: 

Service: 

Problem: : The drivers for this device are not installed. (Code 28)

Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
 

Name: PS/2-kompatible Maus

Description: PS/2-kompatible Maus

Class Guid: {4D36E96F-E325-11CE-BFC1-08002BE10318}

Manufacturer: Microsoft

Service: i8042prt

Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)

Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.

Devices stay in this state if they have been prepared for removal.

After you remove the device, this error disappears.Remove the device, and this error should be resolved.
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (03/21/2014 10:39:14 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Fehlgeschlagene Anwendung chrome.exe, Version 33.0.1750.154, fehlgeschlagenes Modul chrome.dll, Version 33.0.1750.154, Fehleradresse 0x0040c2e8.

Das medienspezifische Ereignis für [chrome.exe!ws!] wird verarbeitet.
 

Error: (03/07/2014 03:43:56 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Fehlgeschlagene Anwendung wg111v3.exe, Version 3.6.73.314, fehlgeschlagenes Modul wg111v3.exe, Version 3.6.73.314, Fehleradresse 0x0000b315.

Das medienspezifische Ereignis für [wg111v3.exe!ws!] wird verarbeitet.
 
 

System errors:

=============

Error: (06/12/2014 11:52:00 AM) (Source: Schedule) (EventID: 7901) (User: )

Description: Der Befehl "At1.job" konnte aufgrund folgenden Fehlers nicht ausgeführt werden: 

%%2147942402
 

Error: (06/12/2014 11:45:59 AM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Der Dienst "Computer Backup (MyPC Backup)" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%1053
 

Error: (06/12/2014 11:45:59 AM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: Zeitüberschreitung (30000 ms) beim Verbindungsversuch mit Dienst Computer Backup (MyPC Backup).
 

Error: (06/11/2014 10:52:00 PM) (Source: Schedule) (EventID: 7901) (User: )

Description: Der Befehl "At1.job" konnte aufgrund folgenden Fehlers nicht ausgeführt werden: 

%%2147942402
 

Error: (06/11/2014 09:52:00 PM) (Source: Schedule) (EventID: 7901) (User: )

Description: Der Befehl "At1.job" konnte aufgrund folgenden Fehlers nicht ausgeführt werden: 

%%2147942402
 

Error: (06/11/2014 08:52:00 PM) (Source: Schedule) (EventID: 7901) (User: )

Description: Der Befehl "At1.job" konnte aufgrund folgenden Fehlers nicht ausgeführt werden: 

%%2147942402
 

Error: (06/11/2014 07:52:00 PM) (Source: Schedule) (EventID: 7901) (User: )

Description: Der Befehl "At1.job" konnte aufgrund folgenden Fehlers nicht ausgeführt werden: 

%%2147942402
 

Error: (06/11/2014 06:52:00 PM) (Source: Schedule) (EventID: 7901) (User: )

Description: Der Befehl "At1.job" konnte aufgrund folgenden Fehlers nicht ausgeführt werden: 

%%2147942402
 

Error: (06/11/2014 05:52:00 PM) (Source: Schedule) (EventID: 7901) (User: )

Description: Der Befehl "At1.job" konnte aufgrund folgenden Fehlers nicht ausgeführt werden: 

%%2147942402
 

Error: (06/11/2014 04:52:00 PM) (Source: Schedule) (EventID: 7901) (User: )

Description: Der Befehl "At1.job" konnte aufgrund folgenden Fehlers nicht ausgeführt werden: 

%%2147942402
 
 

Microsoft Office Sessions:

=========================

Error: (03/21/2014 10:39:14 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: chrome.exe33.0.1750.154chrome.dll33.0.1750.1540040c2e8
 

Error: (03/07/2014 03:43:56 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: wg111v3.exe3.6.73.314wg111v3.exe3.6.73.3140000b315
 
 

==================== Memory info =========================== 
 

Percentage of memory in use: 80%

Total physical RAM: 1015.43 MB

Available physical RAM: 199.45 MB

Total Pagefile: 2446.14 MB

Available Pagefile: 1488.73 MB

Total Virtual: 2047.88 MB

Available Virtual: 1933.86 MB
 

==================== Drives ================================
 

Drive c: () (Fixed) (Total:74.53 GB) (Free:61.42 GB) NTFS ==>[Drive with boot components (Windows XP)]

Drive d: (ServiceDVD) (CDROM) (Total:1.72 GB) (Free:0 GB) CDFS

Drive e: (MOBA STICK) (Removable) (Total:3.8 GB) (Free:3.8 GB) FAT32
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (Size: 75 GB) (Disk ID: 9D989D98)

Partition 1: (Active) - (Size=75 GB) - (Type=07 NTFS)
 

========================================================

Disk: 1 (Size: 4 GB) (Disk ID: BC38287D)

Partition 1: (Not Active) - (Size=4 GB) - (Type=0B)
 

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

schrauber

12.06.2014 11:52

lol, alle 3 verseucht :)

wir machen jetzt erstmal einen rechner, deinen:

Adware & Co. deinstallieren

Lade Dir bitte von hier http://deeprybka.trojaner-board.de/b...ninstaller.pngRevo Uninstaller herunter.
Installiere und starte das Programm.
Suche im Uninstallerfeld nach den Programmen, die unter:
http://deeprybka.trojaner-board.de/b.../revo/add1.png
diesen Zusatz haben:
http://deeprybka.trojaner-board.de/b...e/revo/att.PNG
Wähle die Programme nacheinander aus und klicke jedesmal auf Uninstall.
Wähle anschließend den Modus "Moderat" aus.
http://deeprybka.trojaner-board.de/b.../uninstall.PNG http://deeprybka.trojaner-board.de/b...o/moderat2.PNG
Reste löschen:
Klicke auf http://deeprybka.trojaner-board.de/b.../selectall.PNG dann auf http://deeprybka.trojaner-board.de/b...evo/delete.PNG und dann auf http://deeprybka.trojaner-board.de/b...evo/weiter.PNG.

Solltest Du ein Programm nicht finden oder nicht deinstallieren können, mache bitte mit dem nächsten Schritt weiter:

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

tombo11

12.06.2014 12:32

Mein PC:

Code:

ComboFix 14-06-12.01 - HP 12.06.2014  13:13:15.1.8 - x64

Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.8183.5695 [GMT 2:00]

ausgeführt von:: c:\users\Tom\Desktop\ComboFix.exe

AV: Microsoft Security Essentials *Disabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}

SP: Microsoft Security Essentials *Disabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\windows\SysWow64\SETC40.tmp

.

.

(((((((((((((((((((((((   Dateien erstellt von 2014-05-12 bis 2014-06-12  ))))))))))))))))))))))))))))))

.

.

2014-06-12 11:21 . 2014-06-12 11:21        --------        d-----w-        c:\users\HP\AppData\Local\temp

2014-06-12 11:21 . 2014-06-12 11:21        --------        d-----w-        c:\users\Default\AppData\Local\temp

2014-06-12 10:57 . 2014-06-12 10:57        --------        d-----w-        c:\program files (x86)\VS Revo Group

2014-06-12 09:38 . 2014-05-02 05:38        1031560        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7A64641E-A6E2-49FF-93C5-613C7547B0EF}\gapaengine.dll

2014-06-12 09:37 . 2014-05-19 23:26        10702536        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{971F3756-5562-4271-8FF0-608912893FD8}\mpengine.dll

2014-06-12 09:32 . 2014-06-12 09:35        --------        d-----w-        C:\FRST

2014-06-09 13:03 . 2014-05-19 23:26        10702536        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2014-06-09 13:00 . 2014-06-09 13:00        --------        d-----w-        c:\program files\iPod

2014-06-09 13:00 . 2014-06-09 13:02        --------        d-----w-        c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69

2014-06-09 13:00 . 2014-06-09 13:02        --------        d-----w-        c:\program files\iTunes

2014-06-09 13:00 . 2014-06-09 13:02        --------        d-----w-        c:\program files (x86)\iTunes

2014-06-08 21:27 . 2014-06-08 21:28        --------        d-----w-        C:\Dark Shadows

2014-06-07 10:35 . 2014-05-02 05:38        1031560        ------w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{22403769-83DF-41E1-BDAE-813BF672607A}\gapaengine.dll

2014-06-05 13:44 . 2014-06-05 13:44        --------        d-----w-        c:\users\Tom\AppData\Local\SniperV2

2014-05-28 20:34 . 2014-05-28 20:35        --------        d-----w-        c:\program files (x86)\Battlefield 2

2014-05-27 14:12 . 2014-05-19 23:10        601432        ----a-w-        c:\windows\SysWow64\nvStreaming.exe

2014-05-25 17:55 . 2014-05-25 17:55        --------        d-----w-        c:\users\Tom\AppData\Local\NVIDIA Corporation

2014-05-25 17:55 . 2014-05-25 17:56        --------        d-----w-        c:\users\HP\AppData\Local\NVIDIA

2014-05-25 17:51 . 2014-05-27 13:56        --------        d-----w-        c:\users\Tom\AppData\Local\NVIDIA

2014-05-25 17:51 . 2014-02-05 09:31        1048152        ----a-w-        c:\windows\SysWow64\nvspcap.dll

2014-05-25 17:51 . 2014-02-05 09:30        1179576        ----a-w-        c:\windows\system32\nvspcap64.dll

2014-05-25 17:50 . 2014-05-25 17:50        --------        d-----w-        c:\program files (x86)\AGEIA Technologies

2014-05-25 17:46 . 2013-12-27 18:42        39200        ----a-w-        c:\windows\system32\drivers\nvvad64v.sys

2014-05-25 17:46 . 2013-12-27 18:42        35104        ----a-w-        c:\windows\system32\nvaudcap64v.dll

2014-05-25 17:46 . 2013-12-27 18:42        33056        ----a-w-        c:\windows\SysWow64\nvaudcap32v.dll

2014-05-25 17:46 . 2014-03-04 14:35        1885472        ----a-w-        c:\windows\system32\nvdispco6433523.dll

2014-05-25 17:46 . 2014-03-04 14:35        1516488        ----a-w-        c:\windows\system32\nvdispgenco6433523.dll

2014-05-25 17:46 . 2013-11-28 13:38        31520        ----a-w-        c:\windows\system32\nvhdap64.dll

2014-05-25 17:46 . 2013-11-28 13:38        197408        ----a-w-        c:\windows\system32\drivers\nvhda64v.sys

2014-05-24 13:03 . 2014-05-20 02:44        14434704        ----a-w-        c:\windows\SysWow64\nvd3dum.dll

2014-05-24 13:03 . 2012-03-01 00:02        68928        ----a-w-        c:\windows\system32\OpenCL.dll

2014-05-24 13:03 . 2012-03-01 00:02        61248        ----a-w-        c:\windows\SysWow64\OpenCL.dll

2014-05-24 13:03 . 2012-03-01 00:02        364352        ----a-w-        c:\windows\system32\nvdecodemft.dll

2014-05-24 13:03 . 2012-03-01 00:02        301376        ----a-w-        c:\windows\SysWow64\nvdecodemft.dll

2014-05-24 13:03 . 2012-03-01 00:02        1466176        ----a-w-        c:\windows\system32\nvgenco64.dll

2014-05-24 11:46 . 2014-05-24 13:02        --------        d-----w-        c:\users\Tom\.phase-6

2014-05-24 11:46 . 2014-05-24 11:46        --------        d-----w-        c:\users\Tom\AppData\Roaming\Phase6

2014-05-24 11:46 . 2014-05-24 11:46        --------        d-----w-        c:\users\Tom\.swt

2014-05-15 22:31 . 2014-05-06 04:40        23544320        ----a-w-        c:\windows\system32\mshtml.dll

2014-05-15 22:31 . 2014-05-06 03:00        84992        ----a-w-        c:\windows\system32\mshtmled.dll

2014-05-15 22:31 . 2014-05-06 04:17        2724864        ----a-w-        c:\windows\system32\mshtml.tlb

2014-05-15 22:31 . 2014-05-06 03:07        2724864        ----a-w-        c:\windows\SysWow64\mshtml.tlb

2014-05-15 16:22 . 2014-03-25 02:43        14175744        ----a-w-        c:\windows\system32\shell32.dll

2014-05-15 16:22 . 2014-05-09 06:14        477184        ----a-w-        c:\windows\system32\aepdu.dll

2014-05-15 16:21 . 2014-05-09 06:11        424448        ----a-w-        c:\windows\system32\aeinv.dll

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2014-05-20 02:44 . 2013-02-25 22:32        2730208        ----a-w-        c:\windows\SysWow64\nvapi.dll

2014-05-20 02:44 . 2013-02-25 22:32        3109248        ----a-w-        c:\windows\system32\nvapi64.dll

2014-05-20 02:44 . 2013-02-25 22:32        952952        ----a-w-        c:\windows\system32\nvumdshimx.dll

2014-05-20 02:44 . 2013-02-25 22:32        18531568        ----a-w-        c:\windows\system32\nvwgf2umx.dll

2014-05-20 01:25 . 2010-07-09 14:17        6769096        ----a-w-        c:\windows\system32\nvcpl.dll

2014-05-20 01:25 . 2010-07-09 14:17        3514144        ----a-w-        c:\windows\system32\nvsvc64.dll

2014-05-20 01:25 . 2010-07-09 14:17        927520        ----a-w-        c:\windows\system32\nvvsvc.exe

2014-05-20 01:25 . 2010-07-09 14:17        387528        ----a-w-        c:\windows\system32\nvmctray.dll

2014-05-20 01:25 . 2010-07-09 14:17        2560968        ----a-w-        c:\windows\system32\nvsvcr.dll

2014-05-20 01:25 . 2009-06-26 15:00        62808        ----a-w-        c:\windows\system32\nvshext.dll

2014-05-15 17:18 . 2012-04-02 08:22        692400        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe

2014-05-15 17:18 . 2011-06-20 11:57        70832        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2014-05-14 23:49 . 2012-02-24 15:43        3774821        ----a-w-        c:\windows\system32\nvcoproc.bin

2014-05-02 05:38 . 2012-06-12 16:59        1031560        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll

2014-03-31 20:46 . 2014-03-31 20:46        130712        ----a-w-        c:\windows\SysWow64\MSSTDFMT.DLL

2014-03-31 20:46 . 2014-03-31 20:46        1070232        ----a-w-        c:\windows\SysWow64\MSCOMCTL.OCX

2014-03-27 18:29 . 2011-03-24 15:00        281688        ----a-w-        c:\windows\SysWow64\PnkBstrB.xtr

2014-03-27 18:29 . 2011-03-23 13:19        281688        ----a-w-        c:\windows\SysWow64\PnkBstrB.exe

2014-03-20 19:04 . 2011-03-23 13:19        290184        ----a-w-        c:\windows\SysWow64\PnkBstrB.ex0

2014-03-20 18:51 . 2014-03-20 18:51        773192        ----a-w-        c:\windows\SysWow64\ezUPBHook64.dll

2014-03-20 18:51 . 2014-03-20 18:51        484936        ----a-w-        c:\windows\SysWow64\ezUPBHook32.dll

2014-03-20 18:51 . 2009-09-24 14:48        325640        ----a-w-        c:\windows\SysWow64\ezseng.exe

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2014-02-12 43848]

"AppleSyncNotifier"="c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-09-27 59240]

"HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2011-10-28 49208]

"Easybits Recovery"="c:\program files (x86)\EasyBits For Kids\ezRecover.exe" [2014-01-03 612872]

"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2014-01-17 421888]

"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2014-05-26 152392]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

phase-6 Reminder.lnk - c:\program files (x86)\phase-6\phase-6\reminder\reminder.exe [2012-8-21 724992]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]

"EnableShellExecuteHooks"= 1 (0x1)

.

[hkey_local_machine\software\Wow6432Node\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{E54729E8-BB3D-4270-9D49-7389EA579090}"= "c:\windows\SysWOW64\ezUPBHook32.dll" [2014-03-20 484936]

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]

"LoadAppInit_DLLs"=1 (0x1)

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

.

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]

R2 ezSharedSvc;Easybits Shared Services for Windows;c:\windows\system32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]

R2 Update-Service;Update-Service;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]

R3 Bulk;HDJBulk;c:\windows\system32\Drivers\HDJBulk.sys;c:\windows\SYSNATIVE\Drivers\HDJBulk.sys [x]

R3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [x]

R3 HDJMidi;DJ Control MP3 e2 MIDI;c:\windows\system32\DRIVERS\HDJMidi.sys;c:\windows\SYSNATIVE\DRIVERS\HDJMidi.sys [x]

R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]

R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl64.sys;c:\windows\SYSNATIVE\DRIVERS\netaapl64.sys [x]

R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]

R3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]

R3 PCDSRVC{4942F9C0-0B403F17-06000000}_0;PCDSRVC{4942F9C0-0B403F17-06000000}_0 - PCDR Kernel Mode Service Helper Driver;c:\pcdr5\pcdsrvc_x64.pkms;c:\pcdr5\pcdsrvc_x64.pkms [x]

R3 s0017bus;Sony Ericsson Device 0017 driver (WDM);c:\windows\system32\DRIVERS\s0017bus.sys;c:\windows\SYSNATIVE\DRIVERS\s0017bus.sys [x]

R3 s0017mdfl;Sony Ericsson Device 0017 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s0017mdfl.sys;c:\windows\SYSNATIVE\DRIVERS\s0017mdfl.sys [x]

R3 s0017mdm;Sony Ericsson Device 0017 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s0017mdm.sys;c:\windows\SYSNATIVE\DRIVERS\s0017mdm.sys [x]

R3 s0017obex;Sony Ericsson Device 0017 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s0017obex.sys;c:\windows\SYSNATIVE\DRIVERS\s0017obex.sys [x]

R3 s0017unic;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (WDM);c:\windows\system32\DRIVERS\s0017unic.sys;c:\windows\SYSNATIVE\DRIVERS\s0017unic.sys [x]

R3 s3017bus;Sony Ericsson Device 3017 driver (WDM);c:\windows\system32\DRIVERS\s3017bus.sys;c:\windows\SYSNATIVE\DRIVERS\s3017bus.sys [x]

R3 s3017mdfl;Sony Ericsson Device 3017 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s3017mdfl.sys;c:\windows\SYSNATIVE\DRIVERS\s3017mdfl.sys [x]

R3 s3017mdm;Sony Ericsson Device 3017 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s3017mdm.sys;c:\windows\SYSNATIVE\DRIVERS\s3017mdm.sys [x]

R3 s3017mgmt;Sony Ericsson Device 3017 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s3017mgmt.sys;c:\windows\SYSNATIVE\DRIVERS\s3017mgmt.sys [x]

R3 s3017nd5;Sony Ericsson Device 3017 USB Ethernet Emulation SEMC3017 (NDIS);c:\windows\system32\DRIVERS\s3017nd5.sys;c:\windows\SYSNATIVE\DRIVERS\s3017nd5.sys [x]

R3 s3017obex;Sony Ericsson Device 3017 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s3017obex.sys;c:\windows\SYSNATIVE\DRIVERS\s3017obex.sys [x]

R3 s3017unic;Sony Ericsson Device 3017 USB Ethernet Emulation SEMC3017 (WDM);c:\windows\system32\DRIVERS\s3017unic.sys;c:\windows\SYSNATIVE\DRIVERS\s3017unic.sys [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]

R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]

R3 WSDScan;WSD-Scanunterstützung durch UMB;c:\windows\system32\DRIVERS\WSDScan.sys;c:\windows\SYSNATIVE\DRIVERS\WSDScan.sys [x]

R4 HerculesDJControlMP3;Hercules DJ Control MP3;c:\program files\Hercules\Audio\DJ Console Series\HerculesDJControlMP3.EXE;c:\program files\Hercules\Audio\DJ Console Series\HerculesDJControlMP3.EXE [x]

S2 {55662437-DA8C-40c0-AADA-2C816A897A49};Power Control [2010/05/20 17:15];c:\program files (x86)\Hewlett-Packard\Media\DVD\000.fcl;c:\program files (x86)\Hewlett-Packard\Media\DVD\000.fcl [x]

S2 Fabs;FABS - Helping agent for MAGIX media database;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [x]

S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [x]

S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [x]

S2 NvNetworkService;NVIDIA Network Service;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [x]

S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [x]

S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]

S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad64v.sys;c:\windows\SYSNATIVE\drivers\nvvad64v.sys [x]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]

S3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\DRIVERS\seehcri.sys;c:\windows\SYSNATIVE\DRIVERS\seehcri.sys [x]

.

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]

Update-Service-Installer-Service        REG_MULTI_SZ           Update-Service-Installer-Service

Update-Service        REG_MULTI_SZ           Update-Service

.

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs

ezSharedSvc

.

Inhalt des "geplante Tasks" Ordners

.

2014-06-12 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-02 17:18]

.

2014-06-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-12-09 14:17]

.

2014-06-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-12-09 14:17]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-04 186904]

"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2014-03-11 1271072]

"NvBackend"="c:\program files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe" [2014-02-05 2234144]

"ShadowPlay"="c:\windows\system32\nvspcap64.dll" [2014-02-05 1179576]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

"*WerKernelReporting"="c:\windows\SYSTEM32\WerFault.exe" [2009-07-14 415232]

.

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{E54729E8-643D-4270-9D49-7389EA579090}"= "c:\windows\SysWOW64\ezUPBHook64.dll" [2014-03-20 773192]

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://www.google.de/

uLocal Page = c:\windows\system32\blank.htm

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = *.local

IE: Free YouTube to MP3 Converter - c:\users\HP\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm

IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000

TCP: DhcpNameServer = 192.168.2.1

FF - ProfilePath - c:\users\HP\AppData\Roaming\Mozilla\Firefox\Profiles\2e4xqkik.default\

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

Toolbar-10 - (no file)

Wow6432Node-HKLM-Run-<NO NAME> - (no file)

HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start

Toolbar-10 - (no file)

AddRemove-EasyBits Magic Desktop - c:\windows\system32\ezMDUninstall.exe

AddRemove-{43B74FAB-FB58-447D-8D3A-5F638AF36FD1} - c:\programdata\{290883D4-FF33-4C80-B8FB-E5D5A89C103B}\Netzmanager1.045.1230_100322a.exe

.

.

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\PCDSRVC{4942F9C0-0B403F17-06000000}_0]

"ImagePath"="\??\c:\pcdr5\pcdsrvc_x64.pkms"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\{55662437-DA8C-40c0-AADA-2C816A897A49}]

"ImagePath"="\??\c:\program files (x86)\Hewlett-Packard\Media\DVD\000.fcl"

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_USERS\S-1-5-21-3866226941-2986741872-3141305892-1003\Software\SecuROM\License information*]

"datasecu"=hex:9e,9b,65,ff,0b,5d,38,6b,58,c3,32,a1,8d,43,8a,b5,23,1a,e4,c4,d0,

   0e,96,09,3b,54,b1,d8,f9,fc,2d,1e,ce,e0,1f,59,63,e5,21,af,2b,83,ca,0f,86,9b,\

"rkeysecu"=hex:db,90,a2,49,6f,9d,5e,ae,b7,a3,fd,02,65,d1,fd,9d

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_13_0_0_214_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_13_0_0_214_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_13_0_0_214_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_13_0_0_214_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_214.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.13"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_214.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_214.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_214.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Zeit der Fertigstellung: 2014-06-12  13:23:53

ComboFix-quarantined-files.txt  2014-06-12 11:23

.

Vor Suchlauf: 10 Verzeichnis(se), 18.285.408.256 Bytes frei

Nach Suchlauf: 15 Verzeichnis(se), 19.932.033.024 Bytes frei

.

- - End Of File - - BE9BCAE39F4E60D6551146B9463085B2

353F71FFD05627A1E79698548889C581

schrauber

13.06.2014 11:57

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

tombo11

17.06.2014 21:26

Sorry das es ein paar Tage gedauert hat.

Code:

Malwarebytes Anti-Malware

www.malwarebytes.org
 

Suchlauf Datum: 17.06.2014

Suchlauf-Zeit: 21:14:41

Logdatei: mbam.txt

Administrator: Ja
 

Version: 2.00.2.1012

Malware Datenbank: v2014.06.17.10

Rootkit Datenbank: v2014.06.02.01

Lizenz: Testversion

Malware Schutz: Aktiviert

Bösartiger Webseiten Schutz: Aktiviert

Self-protection: Deaktiviert
 

Betriebssystem: Windows 7 Service Pack 1

CPU: x64

Dateisystem: NTFS

Benutzer: HP
 

Suchlauf-Art: Bedrohungs-Suchlauf

Ergebnis: Abgeschlossen

Durchsuchte Objekte: 349407

Verstrichene Zeit: 13 Min, 42 Sek
 

Speicher: Aktiviert

Autostart: Aktiviert

Dateisystem: Aktiviert

Archive: Aktiviert

Rootkits: Deaktiviert

Heuristics: Aktiviert

PUP: Aktiviert

PUM: Aktiviert
 

Prozesse: 0

(No malicious items detected)
 

Module: 0

(No malicious items detected)
 

Registrierungsschlüssel: 3

PUP.Optional.PriceGong.A, HKU\S-1-5-21-3866226941-2986741872-3141305892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\PriceGong, In Quarantäne, [305e3e3b205b3afcaa14fac4b949d62a], 

PUP.Optional.DataMngr.A, HKU\S-1-5-21-3866226941-2986741872-3141305892-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Datamngr, In Quarantäne, [cac4a4d5e992ac8a6ad1e7f3cb38ea16], 

PUP.Optional.PriceGong.A, HKU\S-1-5-21-3866226941-2986741872-3141305892-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\PriceGong, In Quarantäne, [5b33a5d46a1104327c42536b25dd728e], 
 

Registrierungswerte: 0

(No malicious items detected)
 

Registrierungsdaten: 0

(No malicious items detected)
 

Ordner: 0

(No malicious items detected)
 

Dateien: 1

Trojan.Mediyes, C:\Windows\System32\xpt8036x.tsp, Löschen bei Neustart, [92fcaccd2952b97d85c9c82ba65a30d0], 
 

Physische Sektoren: 0

(No malicious items detected)
 
 

(end)

Code:

# AdwCleaner v3.212 - Bericht erstellt am 17/06/2014 um 21:42:32

# Aktualisiert 05/06/2014 von Xplode

# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)

# Benutzername : HP - HP-PC

# Gestartet von : C:\Users\Tom\Desktop\adwcleaner_3.212.exe

# Option : Löschen
 

***** [ Dienste ] *****
 
 

***** [ Dateien / Ordner ] *****
 

Ordner Gelöscht : C:\Program Files (x86)\Common Files\Software Update Utility

Ordner Gelöscht : C:\Users\HP\AppData\Local\PackageAware

Ordner Gelöscht : C:\Users\HP\AppData\LocalLow\Conduit

Ordner Gelöscht : C:\Users\HP\AppData\LocalLow\DataMngr

Ordner Gelöscht : C:\Users\HP\AppData\LocalLow\PriceGong

Ordner Gelöscht : C:\Users\HP\AppData\LocalLow\searchquband

Ordner Gelöscht : C:\Users\HP\AppData\Roaming\dvdvideosoftiehelpers

Ordner Gelöscht : C:\Users\Tom\AppData\LocalLow\Conduit

Ordner Gelöscht : C:\Users\Tom\AppData\LocalLow\DVDVideoSoftTB

Ordner Gelöscht : C:\Users\Tom\AppData\LocalLow\PriceGong

Datei Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eBay.lnk
 

***** [ Verknüpfungen ] *****
 
 

***** [ Registrierungsdatenbank ] *****
 

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\dnu.EXE

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Applications\ilividsetupv1.exe

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\dnUpdate

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUIBrowser

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUIBrowser.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUpdController

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUpdController.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\biclient_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\biclient_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\CToolbar_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\CToolbar_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\DVDVideoSoftTBToolbarHelper_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\DVDVideoSoftTBToolbarHelper_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\HPSF_Tasks_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\HPSF_Tasks_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Searchqu Toolbar uninstall_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Searchqu Toolbar uninstall_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT2269050

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{6C259840-5BA8-46E6-8ED1-EF3BA47D8BA1}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E15A9BFD-D16D-496D-8222-44CADF316E70}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{660E6F4F-840D-436D-B668-433D9591BAC5}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E7435878-65B9-44D1-A443-81754E5DFC90}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{92380354-381A-471F-BE2E-DD9ACD9777EA}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{4B3803EA-5230-4DC3-A7FC-33638F3D3542}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8736C681-37A0-40C6-A0F0-4C083409151C}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{4B3803EA-5230-4DC3-A7FC-33638F3D3542}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}

Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{4B3803EA-5230-4DC3-A7FC-33638F3D3542}]

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{01C78433-6FDF-4E5A-A82D-B535C32E03DF}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{41349826-5C7F-4BF0-8279-5DAF1DE6E9AE}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{604EA016-1EDE-41E6-A23E-76CF8F2A4808}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{660E6F4F-840D-436D-B668-433D9591BAC5}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{B3BA5582-79A9-464D-A7FA-711C5888C6E9}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E7435878-65B9-44D1-A443-81754E5DFC90}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E9BBD270-4B87-4EE2-912F-6635674986C0}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Toolbar

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Conduit

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\searchqutoolbar

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SoftwareUpdUtility
 

***** [ Browser ] *****
 

-\\ Internet Explorer v11.0.9600.17126
 
 

-\\ Mozilla Firefox v14.0.1 (de)
 

[ Datei : C:\Users\HP\AppData\Roaming\Mozilla\Firefox\Profiles\2e4xqkik.default\prefs.js ]
 
 

[ Datei : C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\1s9wump8.default\prefs.js ]
 
 

*************************
 

AdwCleaner[R0].txt - [7002 octets] - [17/06/2014 21:40:40]

AdwCleaner[S0].txt - [6527 octets] - [17/06/2014 21:42:32]
 

########## EOF - \AdwCleaner\AdwCleaner[S0].txt - [6587 octets] ##########

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 16-06-2014

Ran by HP (administrator) on HP-PC on 17-06-2014 22:14:26

Running from C:\Users\Tom\Desktop\Trojaner

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 11

Boot Mode: Normal
 
 
 

==================== Processes (Whitelisted) =================
 

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe

(MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

() C:\Windows\SysWOW64\PnkBstrA.exe

(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(Hewlett-Packard) C:\Program Files (x86)\hp\HP Software Update\hpwuschd2.exe

(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe

(CyberLink) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe

(CyberLink Corp.) C:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Health Check\HPHC_Service.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-04] (Intel Corporation)

HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1271072 2014-03-11] (Microsoft Corporation)

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2234144 2014-02-05] (NVIDIA Corporation)

HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\nvspcap64.dll [1179576 2014-02-05] (NVIDIA Corporation)

HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-12] (Apple Inc.)

HKLM-x32\...\Run: [AppleSyncNotifier] => C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [59240 2011-09-27] (Apple Inc.)

HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)

HKLM-x32\...\Run: [] => [X]

HKLM-x32\...\Run: [Easybits Recovery] => C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe [612872 2014-01-03] (EasyBits Software AS)

HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)

HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-05-26] (Apple Inc.)

HKLM\...\RunOnce: [*WerKernelReporting] - %SYSTEMROOT%\SYSTEM32\WerFault.exe -k -rq [415232 2009-07-14] (Microsoft Corporation)

HKLM-x32\...\RunOnce: [Malwarebytes Anti-Malware (cleanup)] - "C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\mbamdor.exe" "C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware" [54072 2014-05-12] (Malwarebytes Corporation)

Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)

HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1

HKU\S-1-5-21-3866226941-2986741872-3141305892-1000\...\RunOnce: [FlashPlayerUpdate] - C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_13_0_0_214_Plugin.exe [847536 2014-05-15] (Adobe Systems Incorporated)

HKU\S-1-5-21-3866226941-2986741872-3141305892-1000\...\Policies\system: [LogonHoursAction] 2

HKU\S-1-5-21-3866226941-2986741872-3141305892-1000\...\Policies\system: [DontDisplayLogonHoursWarnings] 1

HKU\S-1-5-21-3866226941-2986741872-3141305892-1003\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)

HKU\S-1-5-21-3866226941-2986741872-3141305892-1003\...\Policies\system: [LogonHoursAction] 2

HKU\S-1-5-21-3866226941-2986741872-3141305892-1003\...\Policies\system: [DontDisplayLogonHoursWarnings] 1

HKU\S-1-5-21-3866226941-2986741872-3141305892-1003\...\MountPoints2: {0a4b6134-e52d-11e0-8b58-4061860db83a} - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL G:\index.html

HKU\S-1-5-21-3866226941-2986741872-3141305892-1003\...\MountPoints2: {92a9deeb-9e4e-11df-82b3-4061860db83a} - G:\LaunchU3.exe -a

HKU\S-1-5-21-3866226941-2986741872-3141305892-1003\...\MountPoints2: {d4a8951d-05bd-11df-8744-806e6f6e6963} - F:\autorun.exe

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\phase-6 Reminder.lnk

ShortcutTarget: phase-6 Reminder.lnk -> C:\Program Files (x86)\phase-6\phase-6\reminder\reminder.exe (phase-6)

GroupPolicyUsers\S-1-5-21-3866226941-2986741872-3141305892-1003\User: Group Policy restriction detected <======= ATTENTION
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

SearchScopes: HKLM - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = 

SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKLM - {55569AE9-E080-4075-8F4C-198D43C36528} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008

SearchScopes: HKLM - {D81DF4A5-2989-4677-8D95-BC3A4221F70F} URL = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcndtie7-de-de

SearchScopes: HKLM - {FA7B8497-781C-489C-B5B7-A24024F2DC7B} URL = hxxp://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933

SearchScopes: HKLM-x32 - DefaultScope value is missing.

SearchScopes: HKLM-x32 - {55569AE9-E080-4075-8F4C-198D43C36528} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008

SearchScopes: HKCU - {55569AE9-E080-4075-8F4C-198D43C36528} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008

SearchScopes: HKCU - {6A6F49A0-7205-4700-A462-71F06F221962} URL = hxxp://www.google.de/search?q={searchTerms}

BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll No File

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} -  No File

Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

ShellExecuteHooks:  - {E54729E8-643D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook64.dll [773192 2014-03-20] ()

ShellExecuteHooks-x32:  - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook32.dll [484936 2014-03-20] ()

Winsock: Catalog5 09 C:\Windows\system32\d3dy1v1jk.dll File Not found ()

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
 

FireFox:

========

FF ProfilePath: C:\Users\HP\AppData\Roaming\Mozilla\Firefox\Profiles\2e4xqkik.default

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()

FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)

FF Plugin-x32: @esn/esnlaunch,version=1.104.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.104.0\npesnlaunch.dll No File

FF Plugin-x32: @esn/esnlaunch,version=1.116.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.116.0\npesnlaunch.dll No File

FF Plugin-x32: @esn/esnlaunch,version=1.122.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.122.0\npesnlaunch.dll No File

FF Plugin-x32: @esn/esnlaunch,version=1.140.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.140.0\npesnlaunch.dll No File

FF Plugin-x32: @esn/esnlaunch,version=1.96.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.96.0\npesnlaunch.dll No File

FF Plugin-x32: @esn/esnlaunch,version=2.1.3 - C:\Program Files (x86)\Battlelog Web Plugins\2.1.3\npesnlaunch.dll No File

FF Plugin-x32: @esn/npbattlelog,version=2.3.2 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.2\npbattlelog.dll (EA Digital Illusions CE AB)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2011-11-25]
 

==================== Services (Whitelisted) =================
 

R2 Dnscache; C:\Windows\System32\pouarljul.dll [354816 2012-06-09] (Parental Solutions Inc.) [File not signed]

R2 ezSharedSvc; C:\Windows\SysWOW64\ezsvc7.dll [129584 2009-02-22] (EasyBits Sofware AS) [File not signed]

R2 Fabs; C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [1253376 2009-08-27] (MAGIX AG) [File not signed]

S3 FirebirdServerMAGIXInstance; C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [3276800 2008-08-07] (MAGIX®) [File not signed]

S4 HerculesDJControlMP3; C:\Program Files\Hercules\Audio\DJ Console Series\HerculesDJControlMP3.EXE [20480 2007-11-21] () [File not signed]

R2 HP Health Check Service; C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe [124928 2009-07-09] (Hewlett-Packard) [File not signed]

S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [69632 2005-11-14] (Macrovision Corporation) [File not signed]

R2 LightScribeService; c:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2009-05-18] (Hewlett-Packard Company) [File not signed]

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)

R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2014-03-11] (Microsoft Corporation)

S3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [347872 2014-03-11] (Microsoft Corporation)

R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1593632 2014-02-05] (NVIDIA Corporation)

R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [16941856 2014-02-05] (NVIDIA Corporation)

R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-03-26] ()

R2 ezSharedSvc; C:\Windows\System32\ezsvc7.dll [X]

R2 Update-Service; %SystemRoot%\System32\UpdSvc.dll [X]
 

==================== Drivers (Whitelisted) ====================
 

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)

R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2010-01-22] ()

S3 Bulk; C:\Windows\System32\Drivers\HDJBulk.sys [154112 2009-10-02] (© Guillemot R&D, 2009. All rights reserved.)

S3 Cardex; C:\Windows\SysWOW64\drivers\TBPANELX64.SYS [15648 2007-03-16] (Windows (R) Server 2003 DDK provider)

S3 HDJMidi; C:\Windows\System32\DRIVERS\HDJMidi.sys [144896 2009-10-02] (© Guillemot R&D, 2009. All rights reserved.)

R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2010-01-22] ()

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)

S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-06-17] (Malwarebytes Corporation)

R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation)

R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [268512 2014-01-25] (Microsoft Corporation)

S3 Netaapl; C:\Windows\System32\DRIVERS\netaapl64.sys [22528 2011-05-10] (Apple Inc.) [File not signed]

S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133928 2014-03-11] (Microsoft Corporation)

R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-27] (NVIDIA Corporation)

S3 s0017bus; C:\Windows\System32\DRIVERS\s0017bus.sys [113704 2008-10-21] (MCCI Corporation)

S3 s0017mdfl; C:\Windows\System32\DRIVERS\s0017mdfl.sys [19496 2008-10-21] (MCCI Corporation)

S3 s0017mdm; C:\Windows\System32\DRIVERS\s0017mdm.sys [152616 2008-10-21] (MCCI Corporation)

S3 s0017obex; C:\Windows\System32\DRIVERS\s0017obex.sys [128552 2008-10-21] (MCCI Corporation)

S3 s0017unic; C:\Windows\System32\DRIVERS\s0017unic.sys [145960 2008-10-21] (MCCI Corporation)

S3 s3017bus; C:\Windows\System32\DRIVERS\s3017bus.sys [109096 2007-12-10] (MCCI Corporation)

S3 s3017mdfl; C:\Windows\System32\DRIVERS\s3017mdfl.sys [19496 2007-12-10] (MCCI Corporation)

S3 s3017mdm; C:\Windows\System32\DRIVERS\s3017mdm.sys [146984 2007-12-10] (MCCI Corporation)

S3 s3017mgmt; C:\Windows\System32\DRIVERS\s3017mgmt.sys [130600 2007-12-10] (MCCI Corporation)

S3 s3017nd5; C:\Windows\System32\DRIVERS\s3017nd5.sys [34344 2007-12-10] (MCCI Corporation)

S3 s3017obex; C:\Windows\System32\DRIVERS\s3017obex.sys [125480 2007-12-10] (MCCI Corporation)

S3 s3017unic; C:\Windows\System32\DRIVERS\s3017unic.sys [144936 2007-12-10] (MCCI Corporation)

R3 seehcri; C:\Windows\System32\DRIVERS\seehcri.sys [34032 2008-01-09] (Sony Ericsson Mobile Communications)

S2 TBPanel; No ImagePath

R2 {55662437-DA8C-40c0-AADA-2C816A897A49}; c:\Program Files (x86)\Hewlett-Packard\Media\DVD\000.fcl [146928 2009-10-20] (CyberLink Corp.)

S3 catchme; \??\C:\ComboFix\catchme.sys [X]

S3 PCDSRVC{4942F9C0-0B403F17-06000000}_0; \??\c:\pcdr5\pcdsrvc_x64.pkms [X]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-06-17 22:08 - 2014-06-17 22:08 - 00001479 _____ () C:\Users\HP\Desktop\JRT.txt

2014-06-17 21:55 - 2014-06-17 21:55 - 00000000 ____D () C:\Windows\ERUNT

2014-06-17 21:54 - 2014-06-17 21:54 - 01016261 _____ (Thisisu) C:\Users\Tom\Desktop\JRT.exe

2014-06-17 21:39 - 2014-06-17 21:42 - 00000000 ____D () C:\AdwCleaner

2014-06-17 21:38 - 2014-06-17 21:38 - 01333465 _____ () C:\Users\Tom\Desktop\adwcleaner_3.212.exe

2014-06-17 21:37 - 2014-06-17 21:37 - 00001813 _____ () C:\Users\Tom\Desktop\mbam.txt.txt

2014-06-17 21:12 - 2014-06-17 21:12 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-06-17 21:12 - 2014-06-17 21:12 - 00001108 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-06-17 21:12 - 2014-06-17 21:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-06-17 21:12 - 2014-06-17 21:12 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-06-17 21:12 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-06-17 21:12 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-06-17 21:12 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-06-12 13:23 - 2014-06-17 22:14 - 00000000 ____D () C:\Users\HP\AppData\Local\temp

2014-06-12 13:23 - 2014-06-12 13:23 - 00023976 _____ () C:\ComboFix.txt

2014-06-12 13:23 - 2014-06-12 13:23 - 00000000 ____D () C:\Users\Public\AppData\Local\temp

2014-06-12 13:23 - 2014-06-12 13:23 - 00000000 ____D () C:\Users\Default\AppData\Local\temp

2014-06-12 13:23 - 2014-06-12 13:23 - 00000000 ____D () C:\Users\Default User\AppData\Local\temp

2014-06-12 13:23 - 2014-06-12 13:23 - 00000000 ____D () C:\Users\AppData\AppData\Local\temp

2014-06-12 13:10 - 2014-06-12 13:23 - 00000000 ____D () C:\Qoobox

2014-06-12 13:10 - 2014-06-12 13:22 - 00000000 ____D () C:\Windows\erdnt

2014-06-12 13:10 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe

2014-06-12 13:10 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe

2014-06-12 13:10 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2014-06-12 13:10 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2014-06-12 13:10 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2014-06-12 13:10 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe

2014-06-12 13:10 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe

2014-06-12 13:10 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe

2014-06-12 12:57 - 2014-06-12 12:57 - 00001270 _____ () C:\Users\HP\Desktop\Revo Uninstaller.lnk

2014-06-12 12:57 - 2014-06-12 12:57 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group

2014-06-12 11:36 - 2014-05-30 12:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-06-12 11:36 - 2014-05-30 12:02 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-06-12 11:36 - 2014-05-30 11:45 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-06-12 11:36 - 2014-05-30 11:39 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-06-12 11:36 - 2014-05-30 11:38 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-06-12 11:36 - 2014-05-30 11:21 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-06-12 11:36 - 2014-05-30 11:18 - 17271296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-06-12 11:36 - 2014-05-30 11:06 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-06-12 11:36 - 2014-05-30 11:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-06-12 11:36 - 2014-05-30 10:55 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-06-12 11:36 - 2014-05-30 10:43 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-06-12 11:36 - 2014-05-30 10:42 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-06-12 11:36 - 2014-05-30 10:38 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-06-12 11:36 - 2014-05-30 10:35 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-06-12 11:36 - 2014-05-30 10:34 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-06-12 11:36 - 2014-05-30 10:33 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-06-12 11:36 - 2014-05-30 10:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-06-12 11:36 - 2014-05-30 10:29 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-06-12 11:36 - 2014-05-30 10:27 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-06-12 11:36 - 2014-05-30 10:23 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-06-12 11:36 - 2014-05-30 10:16 - 00368128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2014-06-12 11:36 - 2014-05-30 10:10 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2014-06-12 11:36 - 2014-05-30 10:04 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-06-12 11:36 - 2014-05-30 10:02 - 00242688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-06-12 11:36 - 2014-05-30 09:54 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-06-12 11:36 - 2014-05-30 09:50 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2014-06-12 11:36 - 2014-05-30 09:49 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-06-12 11:36 - 2014-05-30 09:40 - 11725312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-06-12 11:36 - 2014-05-30 09:30 - 01398272 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-06-12 11:36 - 2014-05-30 09:15 - 01143296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-06-12 11:36 - 2014-04-25 04:34 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll

2014-06-12 11:36 - 2014-04-25 04:06 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll

2014-06-12 11:36 - 2014-04-05 04:47 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys

2014-06-12 11:36 - 2014-04-05 04:47 - 00288192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS

2014-06-12 11:36 - 2014-03-26 16:44 - 02002432 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll

2014-06-12 11:36 - 2014-03-26 16:44 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll

2014-06-12 11:36 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll

2014-06-12 11:36 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll

2014-06-12 11:36 - 2014-03-26 16:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll

2014-06-12 11:36 - 2014-03-26 16:27 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll

2014-06-12 11:36 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll

2014-06-12 11:36 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll

2014-06-12 11:35 - 2014-05-30 12:21 - 23414784 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-06-12 11:35 - 2014-05-30 11:39 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-06-12 11:35 - 2014-05-30 11:28 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-06-12 11:35 - 2014-05-30 11:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-06-12 11:35 - 2014-05-30 11:24 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-06-12 11:35 - 2014-05-30 11:21 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-06-12 11:35 - 2014-05-30 11:20 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-06-12 11:35 - 2014-05-30 11:11 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-06-12 11:35 - 2014-05-30 11:08 - 05782528 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-06-12 11:35 - 2014-05-30 10:49 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-06-12 11:35 - 2014-05-30 10:46 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-06-12 11:35 - 2014-05-30 10:44 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-06-12 11:35 - 2014-05-30 10:44 - 00295424 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-06-12 11:35 - 2014-05-30 10:28 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-06-12 11:35 - 2014-05-30 10:24 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2014-06-12 11:35 - 2014-05-30 10:06 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-06-12 11:35 - 2014-05-30 09:56 - 04244992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-06-12 11:35 - 2014-05-30 09:56 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-06-12 11:35 - 2014-05-30 09:43 - 13522944 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-06-12 11:35 - 2014-05-30 09:21 - 01790976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-06-12 11:35 - 2014-05-30 09:13 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-06-12 11:35 - 2014-05-30 09:13 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-06-12 11:33 - 2014-06-17 22:14 - 00000000 ____D () C:\Users\Tom\Desktop\Trojaner

2014-06-12 11:32 - 2014-06-17 22:14 - 00000000 ____D () C:\FRST

2014-06-12 11:32 - 2014-06-08 11:13 - 00506368 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-06-12 11:32 - 2014-06-08 11:08 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-06-09 15:02 - 2014-06-09 15:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes

2014-06-09 15:00 - 2014-06-09 15:02 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69

2014-06-09 15:00 - 2014-06-09 15:02 - 00000000 ____D () C:\Program Files\iTunes

2014-06-09 15:00 - 2014-06-09 15:02 - 00000000 ____D () C:\Program Files (x86)\iTunes

2014-06-09 15:00 - 2014-06-09 15:00 - 00000000 ____D () C:\Program Files\iPod

2014-06-07 14:23 - 2014-06-07 14:23 - 00000000 ____D () C:\Users\Tom\Documents\Wizards of the Coast

2014-06-07 13:50 - 2014-06-07 13:50 - 00000222 _____ () C:\Users\Tom\Desktop\Magic 2014.url

2014-06-05 15:44 - 2014-06-05 15:44 - 00000000 ____D () C:\Users\Tom\AppData\Local\SniperV2

2014-06-05 14:10 - 2014-06-05 14:10 - 00000221 _____ () C:\Users\Tom\Desktop\Sniper Elite V2.url

2014-05-28 22:38 - 2014-05-28 22:38 - 00000000 ____D () C:\Users\HP\Documents\Battlefield 2

2014-05-28 22:36 - 2014-05-28 22:44 - 00000000 ____D () C:\Users\Tom\Documents\Battlefield 2

2014-05-28 22:34 - 2014-05-28 22:35 - 00000000 ____D () C:\Program Files (x86)\Battlefield 2

2014-05-27 16:12 - 2014-05-20 01:10 - 00601432 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe

2014-05-27 16:07 - 2014-05-20 04:44 - 31387936 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 25256224 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 24025376 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 17561544 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 17480432 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 16003912 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 12688328 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys

2014-05-27 16:07 - 2014-05-20 04:44 - 11644928 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 11599072 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 09735256 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 09697640 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 03141976 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 02953672 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 02785568 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvenc.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 02412376 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvenc.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 01889112 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6433788.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 01541576 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6433788.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 00895776 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 00892704 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 00867784 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 00861128 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 00837056 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 00354016 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 00305600 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 00166568 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 00146480 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll

2014-05-25 20:28 - 2014-05-29 15:43 - 00000000 ____D () C:\Users\Tom\Desktop\Holland Dreas

2014-05-25 20:22 - 2014-06-12 11:32 - 00000000 ____D () C:\Users\Tom\Desktop\Abschlusszeitung

2014-05-25 20:21 - 2014-05-25 20:22 - 00000000 ____D () C:\Users\Tom\Desktop\Absolventen Fotos

2014-05-25 19:55 - 2014-05-25 19:56 - 00000000 ____D () C:\Users\HP\AppData\Local\NVIDIA

2014-05-25 19:55 - 2014-05-25 19:55 - 00000000 ____D () C:\Users\Tom\AppData\Local\NVIDIA Corporation

2014-05-25 19:51 - 2014-05-27 15:56 - 00000000 ____D () C:\Users\Tom\AppData\Local\NVIDIA

2014-05-25 19:51 - 2014-02-05 11:31 - 01048152 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll

2014-05-25 19:51 - 2014-02-05 11:30 - 01179576 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll

2014-05-25 19:50 - 2014-05-27 16:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation

2014-05-25 19:50 - 2014-05-25 19:50 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies

2014-05-25 19:46 - 2014-03-04 16:35 - 01885472 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6433523.dll

2014-05-25 19:46 - 2014-03-04 16:35 - 01516488 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6433523.dll

2014-05-25 19:46 - 2013-12-27 20:42 - 00039200 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys

2014-05-25 19:46 - 2013-12-27 20:42 - 00035104 _____ (NVIDIA Corporation) C:\Windows\system32\nvaudcap64v.dll

2014-05-25 19:46 - 2013-12-27 20:42 - 00033056 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll

2014-05-25 19:46 - 2013-11-28 15:38 - 00197408 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys

2014-05-25 19:46 - 2013-11-28 15:38 - 00031520 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll

2014-05-24 15:03 - 2014-05-20 04:44 - 14434704 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll

2014-05-24 15:03 - 2012-03-01 02:02 - 01466176 _____ (NVIDIA Corporation) C:\Windows\system32\nvgenco64.dll

2014-05-24 15:03 - 2012-03-01 02:02 - 00364352 _____ (NVIDIA Corporation) C:\Windows\system32\nvdecodemft.dll

2014-05-24 15:03 - 2012-03-01 02:02 - 00301376 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvdecodemft.dll

2014-05-24 15:03 - 2012-03-01 02:02 - 00068928 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll

2014-05-24 15:03 - 2012-03-01 02:02 - 00061248 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll

2014-05-24 13:46 - 2014-05-24 15:02 - 00000000 ____D () C:\Users\Tom\.phase-6

2014-05-24 13:46 - 2014-05-24 13:46 - 00000000 ____D () C:\Users\Tom\AppData\Roaming\Phase6

2014-05-24 13:46 - 2014-05-24 13:46 - 00000000 ____D () C:\Users\Tom\.swt

2014-05-24 13:44 - 2014-05-24 13:45 - 85744960 _____ () C:\Users\HP\Downloads\phase-6-desktop-2.3.4-windows-installer.exe

2014-05-24 13:43 - 2014-05-24 13:43 - 00001119 _____ () C:\Users\Public\Desktop\phase-6 desktop.lnk

2014-05-24 13:43 - 2014-05-24 13:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\phase-6

2014-05-24 13:25 - 2014-05-24 13:25 - 00001075 _____ () C:\Users\Tom\Downloads\Bilder - Verknüpfung.lnk
 

==================== One Month Modified Files and Folders =======
 

2014-06-17 22:14 - 2014-06-12 13:23 - 00000000 ____D () C:\Users\HP\AppData\Local\temp

2014-06-17 22:14 - 2014-06-12 11:33 - 00000000 ____D () C:\Users\Tom\Desktop\Trojaner

2014-06-17 22:14 - 2014-06-12 11:32 - 00000000 ____D () C:\FRST

2014-06-17 22:08 - 2014-06-17 22:08 - 00001479 _____ () C:\Users\HP\Desktop\JRT.txt

2014-06-17 21:55 - 2014-06-17 21:55 - 00000000 ____D () C:\Windows\ERUNT

2014-06-17 21:54 - 2014-06-17 21:54 - 01016261 _____ (Thisisu) C:\Users\Tom\Desktop\JRT.exe

2014-06-17 21:54 - 2010-08-07 20:06 - 00000000 ____D () C:\Users\Tom\AppData\Local\Temp

2014-06-17 21:51 - 2009-07-14 06:45 - 00015568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-06-17 21:51 - 2009-07-14 06:45 - 00015568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-06-17 21:48 - 2009-09-25 02:14 - 02311010 _____ () C:\Windows\system32\perfh007.dat

2014-06-17 21:48 - 2009-09-25 02:14 - 00649642 _____ () C:\Windows\system32\perfc007.dat

2014-06-17 21:48 - 2009-07-14 07:13 - 00006264 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-06-17 21:44 - 2010-12-09 16:17 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-06-17 21:43 - 2012-03-24 16:41 - 00374038 _____ () C:\Windows\PFRO.log

2014-06-17 21:43 - 2012-03-24 16:41 - 00122061 _____ () C:\Windows\setupact.log

2014-06-17 21:43 - 2009-09-24 16:26 - 00000000 ____D () C:\ProgramData\NVIDIA

2014-06-17 21:43 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-06-17 21:42 - 2014-06-17 21:39 - 00000000 ____D () C:\AdwCleaner

2014-06-17 21:42 - 2010-01-20 14:23 - 01943302 _____ () C:\Windows\WindowsUpdate.log

2014-06-17 21:38 - 2014-06-17 21:38 - 01333465 _____ () C:\Users\Tom\Desktop\adwcleaner_3.212.exe

2014-06-17 21:37 - 2014-06-17 21:37 - 00001813 _____ () C:\Users\Tom\Desktop\mbam.txt.txt

2014-06-17 21:29 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\Vss

2014-06-17 21:27 - 2010-12-09 16:17 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-06-17 21:17 - 2012-04-02 10:22 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-06-17 21:12 - 2014-06-17 21:12 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-06-17 21:12 - 2014-06-17 21:12 - 00001108 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-06-17 21:12 - 2014-06-17 21:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-06-17 21:12 - 2014-06-17 21:12 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-06-17 21:09 - 2012-03-24 18:00 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-06-12 14:59 - 2012-05-10 16:30 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

2014-06-12 13:54 - 2010-01-27 20:48 - 00000000 ____D () C:\ProgramData\Microsoft Help

2014-06-12 13:53 - 2014-05-07 18:22 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-06-12 13:27 - 2011-11-21 17:05 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-06-12 13:24 - 2010-01-20 14:27 - 00000000 ___RD () C:\Users\HP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

2014-06-12 13:24 - 2010-01-20 14:27 - 00000000 ___RD () C:\Users\HP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools

2014-06-12 13:24 - 2009-07-14 07:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD

2014-06-12 13:23 - 2014-06-12 13:23 - 00023976 _____ () C:\ComboFix.txt

2014-06-12 13:23 - 2014-06-12 13:23 - 00000000 ____D () C:\Users\Public\AppData\Local\temp

2014-06-12 13:23 - 2014-06-12 13:23 - 00000000 ____D () C:\Users\Default\AppData\Local\temp

2014-06-12 13:23 - 2014-06-12 13:23 - 00000000 ____D () C:\Users\Default User\AppData\Local\temp

2014-06-12 13:23 - 2014-06-12 13:23 - 00000000 ____D () C:\Users\AppData\AppData\Local\temp

2014-06-12 13:23 - 2014-06-12 13:10 - 00000000 ____D () C:\Qoobox

2014-06-12 13:23 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default

2014-06-12 13:22 - 2014-06-12 13:10 - 00000000 ____D () C:\Windows\erdnt

2014-06-12 13:21 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini

2014-06-12 12:57 - 2014-06-12 12:57 - 00001270 _____ () C:\Users\HP\Desktop\Revo Uninstaller.lnk

2014-06-12 12:57 - 2014-06-12 12:57 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group

2014-06-12 11:32 - 2014-05-25 20:22 - 00000000 ____D () C:\Users\Tom\Desktop\Abschlusszeitung

2014-06-09 15:02 - 2014-06-09 15:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes

2014-06-09 15:02 - 2014-06-09 15:00 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69

2014-06-09 15:02 - 2014-06-09 15:00 - 00000000 ____D () C:\Program Files\iTunes

2014-06-09 15:02 - 2014-06-09 15:00 - 00000000 ____D () C:\Program Files (x86)\iTunes

2014-06-09 15:02 - 2012-09-16 13:19 - 00001785 _____ () C:\Users\Public\Desktop\iTunes.lnk

2014-06-09 15:00 - 2014-06-09 15:00 - 00000000 ____D () C:\Program Files\iPod

2014-06-08 11:13 - 2014-06-12 11:32 - 00506368 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-06-08 11:08 - 2014-06-12 11:32 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-06-07 14:23 - 2014-06-07 14:23 - 00000000 ____D () C:\Users\Tom\Documents\Wizards of the Coast

2014-06-07 14:23 - 2012-04-28 17:50 - 00000000 ____D () C:\Program Files (x86)\Steam

2014-06-07 13:50 - 2014-06-07 13:50 - 00000222 _____ () C:\Users\Tom\Desktop\Magic 2014.url

2014-06-05 15:44 - 2014-06-05 15:44 - 00000000 ____D () C:\Users\Tom\AppData\Local\SniperV2

2014-06-05 15:41 - 2012-04-28 19:22 - 00326304 _____ () C:\Windows\DirectX.log

2014-06-05 14:10 - 2014-06-05 14:10 - 00000221 _____ () C:\Users\Tom\Desktop\Sniper Elite V2.url

2014-06-04 20:59 - 2012-03-24 16:35 - 00000868 _____ () C:\Users\Tom\Desktop\CCleaner.lnk

2014-05-30 12:21 - 2014-06-12 11:35 - 23414784 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-05-30 12:02 - 2014-06-12 11:36 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-05-30 12:02 - 2014-06-12 11:36 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-05-30 11:45 - 2014-06-12 11:36 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-05-30 11:39 - 2014-06-12 11:36 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-05-30 11:39 - 2014-06-12 11:35 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-05-30 11:38 - 2014-06-12 11:36 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-05-30 11:28 - 2014-06-12 11:35 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-05-30 11:27 - 2014-06-12 11:35 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-05-30 11:24 - 2014-06-12 11:35 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-05-30 11:21 - 2014-06-12 11:36 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-05-30 11:21 - 2014-06-12 11:35 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-05-30 11:20 - 2014-06-12 11:35 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-05-30 11:18 - 2014-06-12 11:36 - 17271296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-05-30 11:11 - 2014-06-12 11:35 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-05-30 11:08 - 2014-06-12 11:35 - 05782528 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-05-30 11:06 - 2014-06-12 11:36 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-05-30 11:02 - 2014-06-12 11:36 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-05-30 10:55 - 2014-06-12 11:36 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-05-30 10:49 - 2014-06-12 11:35 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-05-30 10:46 - 2014-06-12 11:35 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-05-30 10:44 - 2014-06-12 11:35 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-05-30 10:44 - 2014-06-12 11:35 - 00295424 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-05-30 10:43 - 2014-06-12 11:36 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-05-30 10:42 - 2014-06-12 11:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-05-30 10:38 - 2014-06-12 11:36 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-05-30 10:35 - 2014-06-12 11:36 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-05-30 10:34 - 2014-06-12 11:36 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-05-30 10:33 - 2014-06-12 11:36 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-05-30 10:30 - 2014-06-12 11:36 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-05-30 10:29 - 2014-06-12 11:36 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-05-30 10:28 - 2014-06-12 11:35 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-05-30 10:27 - 2014-06-12 11:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-05-30 10:24 - 2014-06-12 11:35 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2014-05-30 10:23 - 2014-06-12 11:36 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-05-30 10:16 - 2014-06-12 11:36 - 00368128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2014-05-30 10:10 - 2014-06-12 11:36 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2014-05-30 10:06 - 2014-06-12 11:35 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-05-30 10:04 - 2014-06-12 11:36 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-05-30 10:02 - 2014-06-12 11:36 - 00242688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-05-30 09:56 - 2014-06-12 11:35 - 04244992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-05-30 09:56 - 2014-06-12 11:35 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-05-30 09:54 - 2014-06-12 11:36 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-05-30 09:50 - 2014-06-12 11:36 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2014-05-30 09:49 - 2014-06-12 11:36 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-05-30 09:43 - 2014-06-12 11:35 - 13522944 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-05-30 09:40 - 2014-06-12 11:36 - 11725312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-05-30 09:30 - 2014-06-12 11:36 - 01398272 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-05-30 09:21 - 2014-06-12 11:35 - 01790976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-05-30 09:15 - 2014-06-12 11:36 - 01143296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-05-30 09:13 - 2014-06-12 11:35 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-05-30 09:13 - 2014-06-12 11:35 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-05-29 17:09 - 2013-06-04 17:32 - 00000000 ____D () C:\Users\Tom\Documents\Stronghold Legends

2014-05-29 15:43 - 2014-05-25 20:28 - 00000000 ____D () C:\Users\Tom\Desktop\Holland Dreas

2014-05-28 22:44 - 2014-05-28 22:36 - 00000000 ____D () C:\Users\Tom\Documents\Battlefield 2

2014-05-28 22:38 - 2014-05-28 22:38 - 00000000 ____D () C:\Users\HP\Documents\Battlefield 2

2014-05-28 22:38 - 2010-02-26 23:22 - 00000000 ____D () C:\Users\HP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games

2014-05-28 22:36 - 2012-08-23 17:51 - 00000000 ____D () C:\Users\Tom\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games

2014-05-28 22:35 - 2014-05-28 22:34 - 00000000 ____D () C:\Program Files (x86)\Battlefield 2

2014-05-28 22:08 - 2012-06-22 16:45 - 00000000 ____D () C:\Program Files (x86)\Diablo III

2014-05-28 21:44 - 2012-12-15 19:43 - 00000000 ____D () C:\Users\Tom\Documents\my games

2014-05-28 21:42 - 2012-06-22 16:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Diablo III

2014-05-27 16:12 - 2014-05-25 19:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation

2014-05-27 16:12 - 2010-01-20 14:32 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation

2014-05-27 15:56 - 2014-05-25 19:51 - 00000000 ____D () C:\Users\Tom\AppData\Local\NVIDIA

2014-05-25 20:22 - 2014-05-25 20:21 - 00000000 ____D () C:\Users\Tom\Desktop\Absolventen Fotos

2014-05-25 20:21 - 2012-03-30 18:14 - 00000000 ____D () C:\Users\Tom\Desktop\Desktopverknüpfungen

2014-05-25 19:56 - 2014-05-25 19:55 - 00000000 ____D () C:\Users\HP\AppData\Local\NVIDIA

2014-05-25 19:55 - 2014-05-25 19:55 - 00000000 ____D () C:\Users\Tom\AppData\Local\NVIDIA Corporation

2014-05-25 19:55 - 2010-10-01 15:20 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation

2014-05-25 19:51 - 2010-01-20 14:31 - 00000000 ____D () C:\Program Files\NVIDIA Corporation

2014-05-25 19:50 - 2014-05-25 19:50 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies

2014-05-24 16:22 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache

2014-05-24 15:06 - 2010-01-20 14:30 - 00000000 ____D () C:\NVIDIA

2014-05-24 15:02 - 2014-05-24 13:46 - 00000000 ____D () C:\Users\Tom\.phase-6

2014-05-24 13:48 - 2012-03-25 10:49 - 209760560 _____ (NVIDIA Corporation) C:\Users\HP\Downloads\296.10-desktop-win7-winvista-64bit-international-whql.exe

2014-05-24 13:46 - 2014-05-24 13:46 - 00000000 ____D () C:\Users\Tom\AppData\Roaming\Phase6

2014-05-24 13:46 - 2014-05-24 13:46 - 00000000 ____D () C:\Users\Tom\.swt

2014-05-24 13:46 - 2012-03-24 18:20 - 00000000 ____D () C:\Users\Tom\AppData\Roaming\Mozilla

2014-05-24 13:46 - 2010-08-07 20:06 - 00000000 ____D () C:\Users\Tom

2014-05-24 13:45 - 2014-05-24 13:44 - 85744960 _____ () C:\Users\HP\Downloads\phase-6-desktop-2.3.4-windows-installer.exe

2014-05-24 13:43 - 2014-05-24 13:43 - 00001119 _____ () C:\Users\Public\Desktop\phase-6 desktop.lnk

2014-05-24 13:43 - 2014-05-24 13:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\phase-6

2014-05-24 13:43 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup

2014-05-24 13:32 - 2012-12-15 16:53 - 00000000 ____D () C:\Users\Tom\Desktop\Games

2014-05-24 13:32 - 2012-12-15 16:53 - 00000000 ____D () C:\Users\Tom\Desktop\Foto

2014-05-24 13:25 - 2014-05-24 13:25 - 00001075 _____ () C:\Users\Tom\Downloads\Bilder - Verknüpfung.lnk

2014-05-22 16:15 - 2010-08-07 20:06 - 00001324 __RSH () C:\Users\Tom\ntuser.pol

2014-05-22 16:15 - 2010-08-07 20:06 - 00000000 ___RD () C:\Users\Tom\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

2014-05-22 16:15 - 2010-08-07 20:06 - 00000000 ___RD () C:\Users\Tom\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools

2014-05-20 04:44 - 2014-05-27 16:07 - 31387936 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 25256224 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 24025376 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 17561544 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 17480432 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 16003912 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 12688328 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys

2014-05-20 04:44 - 2014-05-27 16:07 - 11644928 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 11599072 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 09735256 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 09697640 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 03141976 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 02953672 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 02785568 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvenc.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 02412376 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvenc.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 01889112 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6433788.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 01541576 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6433788.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 00895776 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 00892704 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 00867784 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 00861128 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 00837056 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 00354016 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 00305600 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 00166568 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 00146480 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll

2014-05-20 04:44 - 2014-05-24 15:03 - 14434704 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll

2014-05-20 04:44 - 2013-02-26 00:32 - 18531568 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll

2014-05-20 04:44 - 2013-02-26 00:32 - 03109248 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll

2014-05-20 04:44 - 2013-02-26 00:32 - 02730208 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll

2014-05-20 04:44 - 2013-02-26 00:32 - 00952952 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll

2014-05-20 04:44 - 2010-01-20 14:30 - 00026069 _____ () C:\Windows\system32\nvinfo.pb

2014-05-20 03:25 - 2010-07-09 16:17 - 06769096 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll

2014-05-20 03:25 - 2010-07-09 16:17 - 03514144 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll

2014-05-20 03:25 - 2010-07-09 16:17 - 02560968 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll

2014-05-20 03:25 - 2010-07-09 16:17 - 00927520 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe

2014-05-20 03:25 - 2010-07-09 16:17 - 00387528 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll

2014-05-20 03:25 - 2009-06-26 17:00 - 00062808 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll

2014-05-20 01:10 - 2014-05-27 16:12 - 00601432 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
 

Some content of TEMP:

====================

C:\Users\HP\AppData\Local\temp\Quarantine.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-06-09 15:25
 

==================== End Of Log ============================

--- --- ---

Code:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.1.4 (04.06.2014:1)

OS: Windows 7 Home Premium x64

Ran by HP on 17.06.2014 at 21:55:06,84

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 

~~~ Services
 
 
 

~~~ Registry Values
 
 
 

~~~ Registry Keys
 

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{47ABFDCF-C2DC-40DD-A9EE-874F51A4D939}

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{D81DF4A5-2989-4677-8D95-BC3A4221F70F}

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{FA7B8497-781C-489C-B5B7-A24024F2DC7B}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{D81DF4A5-2989-4677-8D95-BC3A4221F70F}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{FA7B8497-781C-489C-B5B7-A24024F2DC7B}
 
 
 

~~~ Files
 
 
 

~~~ Folders
 
 
 

~~~ FireFox
 

Emptied folder: C:\Users\HP\AppData\Roaming\mozilla\firefox\profiles\2e4xqkik.default\minidumps [6 files]
 
 
 

~~~ Event Viewer Logs were cleared
 
 
 
 
 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 17.06.2014 at 22:08:07,78

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

schrauber

18.06.2014 18:00

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

tombo11

19.06.2014 10:47

Code:

ESETSmartInstaller@High as downloader log:

all ok

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.7587

# api_version=3.0.2

# EOSSerial=ac40fba18007d74c94fa8c1352dc83a4

# engine=18777

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=true

# antistealth_checked=true

# utc_time=2014-06-19 04:12:43

# local_time=2014-06-19 06:12:43 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1031

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode_1='Microsoft Security Essentials'

# compatibility_mode=5895 16777213 100 100 6527947 97328773 0 0

# scanned=463133

# found=9

# cleaned=0

# scan_time=20438

sh=7A5B168BB2B8C06B2A9134B656BBF195830D21C2 ft=1 fh=55d4f387d8566cf4 vn="Variante von Win32/PriceGong.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Tom\AppData\LocalLow\DVDVideoSoftTB\plugins\{5E1360DC-8FA8-40df-A8CD-FC3831B3634B}\3.1.1\bin\PriceGongIE.dll.vir"

sh=7A5B168BB2B8C06B2A9134B656BBF195830D21C2 ft=1 fh=55d4f387d8566cf4 vn="Variante von Win32/PriceGong.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\AppData\LocalLow\DVDVideoSoftTB\plugins\{5E1360DC-8FA8-40df-A8CD-FC3831B3634B}\3.1.1\bin\PriceGongIE.dll"

sh=5ED9D072C5DF064745F1690678CE20E9DC43ABF2 ft=0 fh=0000000000000000 vn="Java/Exploit.CVE-2011-3544.AY Trojaner" ac=I fn="C:\Users\HP\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0\69d36700-70594663"

sh=66651E9250F706E8E70F10C510C5F1AB57295742 ft=1 fh=aef15b2f08e31d9d vn="Variante von Win32/Downloader.JooSoft.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\HP\Downloads\dxwebsetup.exe"

sh=75E3233E4183BE45DBC44573BA4F1E9F7C66E708 ft=0 fh=0000000000000000 vn="Variante von Win32/Bundled.Toolbar.Ask potenziell unsichere Anwendung" ac=I fn="C:\Windows\Installer\27443e9.msi"

sh=40E49124AD0B55A25F947333CA88E9D0BC30A7E3 ft=1 fh=e26ad988592b2af9 vn="Variante von Win32/Bundled.Toolbar.Ask potenziell unsichere Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FZG8CKJ5\ApnIC[2].0"

sh=40E49124AD0B55A25F947333CA88E9D0BC30A7E3 ft=1 fh=e26ad988592b2af9 vn="Variante von Win32/Bundled.Toolbar.Ask potenziell unsichere Anwendung" ac=I fn="C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FZG8CKJ5\ApnIC[2].0"

sh=7CFAF7221B7932D38B8C6FECDF7ACCC53D3EA193 ft=1 fh=2de9f51c2c405c06 vn="Win32/OpenCandy potenziell unsichere Anwendung" ac=I fn="E:\Downloads\Tools\FreeYouTubeToMP3Converter-3.12.4.622.exe"

sh=D4940DCBB2B2C0E5E35CCF040E8C7D251E304B76 ft=1 fh=2e478b1981bce40d vn="Variante von Win32/AdWare.iBryte.Q Anwendung" ac=I fn="E:\Downloads\Tools\Setup emtec.exe"

Code:

 Results of screen317's Security Check version 0.99.83  

 Windows 7 Service Pack 1 x64 (UAC is enabled)  

 Internet Explorer 11  
 ``````````````Antivirus/Firewall Check:`````````````` 

Microsoft Security Essentials   

  (On Access scanning disabled!) 

 Error obtaining update status for antivirus!  
 `````````Anti-malware/Other Utilities Check:````````` 

 Call of Duty: Ghosts  

 Call of Duty: Ghosts - Multiplayer 

 Adobe Flash Player 13.0.0.214  

 Adobe Reader 9 Adobe Reader out of Date! 

 Mozilla Firefox 14.0.1 Firefox out of Date!  
 ````````Process Check: objlist.exe by Laurent````````  

 Microsoft Security Essentials MSMpEng.exe 

 Microsoft Security Essentials msseces.exe 

 Malwarebytes Anti-Malware mbamservice.exe  

 Malwarebytes Anti-Malware mbam.exe  

 Malwarebytes Anti-Malware mbamscheduler.exe   
 `````````````````System Health check````````````````` 

 Total Fragmentation on Drive C:  
 ````````````````````End of Log``````````````````````

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 18-06-2014

Ran by Tom (ATTENTION: The logged in user is not administrator) on HP-PC on 19-06-2014 11:41:08

Running from C:\Users\Tom\Desktop\Trojaner

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11

Boot Mode: Normal
 
 
 

==================== Processes (Whitelisted) =================
 

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(Hewlett-Packard) C:\Program Files (x86)\hp\HP Software Update\hpwuschd2.exe

(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe

(CyberLink) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe

(CyberLink Corp.) C:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-04] (Intel Corporation)

HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1271072 2014-03-11] (Microsoft Corporation)

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2234144 2014-02-05] (NVIDIA Corporation)

HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\nvspcap64.dll [1179576 2014-02-05] (NVIDIA Corporation)

HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-12] (Apple Inc.)

HKLM-x32\...\Run: [AppleSyncNotifier] => C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [59240 2011-09-27] (Apple Inc.)

HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)

HKLM-x32\...\Run: [] => [X]

HKLM-x32\...\Run: [Easybits Recovery] => C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe [612872 2014-01-03] (EasyBits Software AS)

HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)

HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-05-26] (Apple Inc.)

HKLM\...\RunOnce: [*WerKernelReporting] - %SYSTEMROOT%\SYSTEM32\WerFault.exe -k -rq [415232 2009-07-14] (Microsoft Corporation)

HKLM-x32\...\RunOnce: [Malwarebytes Anti-Malware (cleanup)] - "C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\mbamdor.exe" "C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware" [54072 2014-05-12] (Malwarebytes Corporation)

Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)

HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1

HKU\S-1-5-21-3866226941-2986741872-3141305892-1003\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)

HKU\S-1-5-21-3866226941-2986741872-3141305892-1003\...\Policies\system: [LogonHoursAction] 2

HKU\S-1-5-21-3866226941-2986741872-3141305892-1003\...\Policies\system: [DontDisplayLogonHoursWarnings] 1

HKU\S-1-5-21-3866226941-2986741872-3141305892-1003\...\MountPoints2: {0a4b6134-e52d-11e0-8b58-4061860db83a} - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL G:\index.html

HKU\S-1-5-21-3866226941-2986741872-3141305892-1003\...\MountPoints2: {92a9deeb-9e4e-11df-82b3-4061860db83a} - G:\LaunchU3.exe -a

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\phase-6 Reminder.lnk

ShortcutTarget: phase-6 Reminder.lnk -> C:\Program Files (x86)\phase-6\phase-6\reminder\reminder.exe (phase-6)

GroupPolicyUsers\S-1-5-21-3866226941-2986741872-3141305892-1003\User: Group Policy restriction detected <======= ATTENTION
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_DE&c=94&bd=Pavilion&pf=cndt

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

SearchScopes: HKLM - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = 

SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKLM - {55569AE9-E080-4075-8F4C-198D43C36528} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008

SearchScopes: HKLM - {D81DF4A5-2989-4677-8D95-BC3A4221F70F} URL = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcndtie7-de-de

SearchScopes: HKLM - {FA7B8497-781C-489C-B5B7-A24024F2DC7B} URL = hxxp://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933

SearchScopes: HKLM-x32 - DefaultScope value is missing.

SearchScopes: HKLM-x32 - {55569AE9-E080-4075-8F4C-198D43C36528} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008

SearchScopes: HKCU - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} URL = hxxp://www.crawler.com/search/dispatcher.aspx?tp=bs&qkw={searchTerms}&tbid=66019

SearchScopes: HKCU - {55569AE9-E080-4075-8F4C-198D43C36528} URL = 

SearchScopes: HKCU - {571635C1-C94C-4553-A47B-3794ECB5F688} URL = hxxp://www.google.de/#hl=de&q={searchTerms}&aq=f&aqi=g10&aql=&oq=&gs_rfai=&fp=340825e95a231672

BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll No File

Toolbar: HKCU - No Name - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} -  No File

Toolbar: HKCU - No Name - {DE9C389F-3316-41A7-809B-AA305ED9D922} -  No File

Toolbar: HKCU - No Name - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} -  No File

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} -  No File

Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

ShellExecuteHooks:  - {E54729E8-643D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook64.dll [773192 2014-03-20] ()

ShellExecuteHooks-x32:  - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook32.dll [484936 2014-03-20] ()

Winsock: Catalog5 09 C:\Windows\system32\d3dy1v1jk.dll File Not found ()

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
 

FireFox:

========

FF ProfilePath: C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\1s9wump8.default

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()

FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)

FF Plugin-x32: @esn/esnlaunch,version=1.104.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.104.0\npesnlaunch.dll No File

FF Plugin-x32: @esn/esnlaunch,version=1.116.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.116.0\npesnlaunch.dll No File

FF Plugin-x32: @esn/esnlaunch,version=1.122.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.122.0\npesnlaunch.dll No File

FF Plugin-x32: @esn/esnlaunch,version=1.140.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.140.0\npesnlaunch.dll No File

FF Plugin-x32: @esn/esnlaunch,version=1.96.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.96.0\npesnlaunch.dll No File

FF Plugin-x32: @esn/esnlaunch,version=2.1.3 - C:\Program Files (x86)\Battlelog Web Plugins\2.1.3\npesnlaunch.dll No File

FF Plugin-x32: @esn/npbattlelog,version=2.3.2 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.2\npbattlelog.dll (EA Digital Illusions CE AB)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2011-11-25]
 

==================== Services (Whitelisted) =================
 

R2 Dnscache; C:\Windows\System32\pouarljul.dll [354816 2012-06-09] (Parental Solutions Inc.) [File not signed]

R2 ezSharedSvc; C:\Windows\SysWOW64\ezsvc7.dll [129584 2009-02-22] (EasyBits Sofware AS) [File not signed]

R2 Fabs; C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [1253376 2009-08-27] (MAGIX AG) [File not signed]

S3 FirebirdServerMAGIXInstance; C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [3276800 2008-08-07] (MAGIX®) [File not signed]

S4 HerculesDJControlMP3; C:\Program Files\Hercules\Audio\DJ Console Series\HerculesDJControlMP3.EXE [20480 2007-11-21] () [File not signed]

R2 HP Health Check Service; C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe [124928 2009-07-09] (Hewlett-Packard) [File not signed]

S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [69632 2005-11-14] (Macrovision Corporation) [File not signed]

R2 LightScribeService; c:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2009-05-18] (Hewlett-Packard Company) [File not signed]

R2 lmhosts; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)

R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2014-03-11] (Microsoft Corporation)

S3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [347872 2014-03-11] (Microsoft Corporation)

R2 NlaSvc; C:\Windows\System32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)

R2 nsi; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)

R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1593632 2014-02-05] (NVIDIA Corporation)

R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [16941856 2014-02-05] (NVIDIA Corporation)

R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-03-26] ()

R2 ezSharedSvc; C:\Windows\System32\ezsvc7.dll [X]

R2 Update-Service; %SystemRoot%\System32\UpdSvc.dll [X]
 

==================== Drivers (Whitelisted) ====================
 

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)

R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2010-01-22] ()

S3 Bulk; C:\Windows\System32\Drivers\HDJBulk.sys [154112 2009-10-02] (© Guillemot R&D, 2009. All rights reserved.)

S3 Cardex; C:\Windows\SysWOW64\drivers\TBPANELX64.SYS [15648 2007-03-16] (Windows (R) Server 2003 DDK provider)

S3 HDJMidi; C:\Windows\System32\DRIVERS\HDJMidi.sys [144896 2009-10-02] (© Guillemot R&D, 2009. All rights reserved.)

R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2010-01-22] ()

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)

S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-06-17] (Malwarebytes Corporation)

R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation)

R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [268512 2014-01-25] (Microsoft Corporation)

S3 Netaapl; C:\Windows\System32\DRIVERS\netaapl64.sys [22528 2011-05-10] (Apple Inc.) [File not signed]

S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133928 2014-03-11] (Microsoft Corporation)

R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-27] (NVIDIA Corporation)

S3 s0017bus; C:\Windows\System32\DRIVERS\s0017bus.sys [113704 2008-10-21] (MCCI Corporation)

S3 s0017mdfl; C:\Windows\System32\DRIVERS\s0017mdfl.sys [19496 2008-10-21] (MCCI Corporation)

S3 s0017mdm; C:\Windows\System32\DRIVERS\s0017mdm.sys [152616 2008-10-21] (MCCI Corporation)

S3 s0017obex; C:\Windows\System32\DRIVERS\s0017obex.sys [128552 2008-10-21] (MCCI Corporation)

S3 s0017unic; C:\Windows\System32\DRIVERS\s0017unic.sys [145960 2008-10-21] (MCCI Corporation)

S3 s3017bus; C:\Windows\System32\DRIVERS\s3017bus.sys [109096 2007-12-10] (MCCI Corporation)

S3 s3017mdfl; C:\Windows\System32\DRIVERS\s3017mdfl.sys [19496 2007-12-10] (MCCI Corporation)

S3 s3017mdm; C:\Windows\System32\DRIVERS\s3017mdm.sys [146984 2007-12-10] (MCCI Corporation)

S3 s3017mgmt; C:\Windows\System32\DRIVERS\s3017mgmt.sys [130600 2007-12-10] (MCCI Corporation)

S3 s3017nd5; C:\Windows\System32\DRIVERS\s3017nd5.sys [34344 2007-12-10] (MCCI Corporation)

S3 s3017obex; C:\Windows\System32\DRIVERS\s3017obex.sys [125480 2007-12-10] (MCCI Corporation)

S3 s3017unic; C:\Windows\System32\DRIVERS\s3017unic.sys [144936 2007-12-10] (MCCI Corporation)

R3 seehcri; C:\Windows\System32\DRIVERS\seehcri.sys [34032 2008-01-09] (Sony Ericsson Mobile Communications)

S3 Serial; C:\Windows\system32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)

S2 TBPanel; No ImagePath

R2 {55662437-DA8C-40c0-AADA-2C816A897A49}; c:\Program Files (x86)\Hewlett-Packard\Media\DVD\000.fcl [146928 2009-10-20] (CyberLink Corp.)

S3 catchme; \??\C:\ComboFix\catchme.sys [X]

S3 PCDSRVC{4942F9C0-0B403F17-06000000}_0; \??\c:\pcdr5\pcdsrvc_x64.pkms [X]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-06-19 11:09 - 2014-06-19 11:09 - 00854367 _____ () C:\Users\Tom\Desktop\SecurityCheck.exe

2014-06-19 00:27 - 2014-06-19 00:27 - 00000000 ____D () C:\Program Files (x86)\ESET

2014-06-19 00:22 - 2014-06-19 00:22 - 02347384 _____ (ESET) C:\Users\Tom\Desktop\esetsmartinstaller_deu.exe

2014-06-17 22:08 - 2014-06-17 22:08 - 00001479 _____ () C:\Users\HP\Desktop\JRT.txt

2014-06-17 21:55 - 2014-06-17 21:55 - 00000000 ____D () C:\Windows\ERUNT

2014-06-17 21:54 - 2014-06-17 21:54 - 01016261 _____ (Thisisu) C:\Users\Tom\Desktop\JRT.exe

2014-06-17 21:39 - 2014-06-17 21:42 - 00000000 ____D () C:\AdwCleaner

2014-06-17 21:38 - 2014-06-17 21:38 - 01333465 _____ () C:\Users\Tom\Desktop\adwcleaner_3.212.exe

2014-06-17 21:37 - 2014-06-17 21:37 - 00001813 _____ () C:\Users\Tom\Desktop\mbam.txt.txt

2014-06-17 21:12 - 2014-06-17 21:12 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-06-17 21:12 - 2014-06-17 21:12 - 00001108 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-06-17 21:12 - 2014-06-17 21:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-06-17 21:12 - 2014-06-17 21:12 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-06-17 21:12 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-06-17 21:12 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-06-17 21:12 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-06-12 13:23 - 2014-06-12 13:23 - 00023976 _____ () C:\ComboFix.txt

2014-06-12 13:10 - 2014-06-12 13:23 - 00000000 ____D () C:\Qoobox

2014-06-12 13:10 - 2014-06-12 13:22 - 00000000 ____D () C:\Windows\erdnt

2014-06-12 13:10 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe

2014-06-12 13:10 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe

2014-06-12 13:10 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2014-06-12 13:10 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2014-06-12 13:10 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2014-06-12 13:10 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe

2014-06-12 13:10 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe

2014-06-12 13:10 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe

2014-06-12 12:57 - 2014-06-12 12:57 - 00001270 _____ () C:\Users\HP\Desktop\Revo Uninstaller.lnk

2014-06-12 12:57 - 2014-06-12 12:57 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group

2014-06-12 11:36 - 2014-05-30 12:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-06-12 11:36 - 2014-05-30 12:02 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-06-12 11:36 - 2014-05-30 11:45 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-06-12 11:36 - 2014-05-30 11:39 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-06-12 11:36 - 2014-05-30 11:38 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-06-12 11:36 - 2014-05-30 11:21 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-06-12 11:36 - 2014-05-30 11:18 - 17271296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-06-12 11:36 - 2014-05-30 11:06 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-06-12 11:36 - 2014-05-30 11:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-06-12 11:36 - 2014-05-30 10:55 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-06-12 11:36 - 2014-05-30 10:43 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-06-12 11:36 - 2014-05-30 10:42 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-06-12 11:36 - 2014-05-30 10:38 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-06-12 11:36 - 2014-05-30 10:35 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-06-12 11:36 - 2014-05-30 10:34 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-06-12 11:36 - 2014-05-30 10:33 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-06-12 11:36 - 2014-05-30 10:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-06-12 11:36 - 2014-05-30 10:29 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-06-12 11:36 - 2014-05-30 10:27 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-06-12 11:36 - 2014-05-30 10:23 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-06-12 11:36 - 2014-05-30 10:16 - 00368128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2014-06-12 11:36 - 2014-05-30 10:10 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2014-06-12 11:36 - 2014-05-30 10:04 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-06-12 11:36 - 2014-05-30 10:02 - 00242688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-06-12 11:36 - 2014-05-30 09:54 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-06-12 11:36 - 2014-05-30 09:50 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2014-06-12 11:36 - 2014-05-30 09:49 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-06-12 11:36 - 2014-05-30 09:40 - 11725312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-06-12 11:36 - 2014-05-30 09:30 - 01398272 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-06-12 11:36 - 2014-05-30 09:15 - 01143296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-06-12 11:36 - 2014-04-25 04:34 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll

2014-06-12 11:36 - 2014-04-25 04:06 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll

2014-06-12 11:36 - 2014-04-05 04:47 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys

2014-06-12 11:36 - 2014-04-05 04:47 - 00288192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS

2014-06-12 11:36 - 2014-03-26 16:44 - 02002432 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll

2014-06-12 11:36 - 2014-03-26 16:44 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll

2014-06-12 11:36 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll

2014-06-12 11:36 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll

2014-06-12 11:36 - 2014-03-26 16:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll

2014-06-12 11:36 - 2014-03-26 16:27 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll

2014-06-12 11:36 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll

2014-06-12 11:36 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll

2014-06-12 11:35 - 2014-05-30 12:21 - 23414784 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-06-12 11:35 - 2014-05-30 11:39 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-06-12 11:35 - 2014-05-30 11:28 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-06-12 11:35 - 2014-05-30 11:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-06-12 11:35 - 2014-05-30 11:24 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-06-12 11:35 - 2014-05-30 11:21 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-06-12 11:35 - 2014-05-30 11:20 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-06-12 11:35 - 2014-05-30 11:11 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-06-12 11:35 - 2014-05-30 11:08 - 05782528 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-06-12 11:35 - 2014-05-30 10:49 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-06-12 11:35 - 2014-05-30 10:46 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-06-12 11:35 - 2014-05-30 10:44 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-06-12 11:35 - 2014-05-30 10:44 - 00295424 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-06-12 11:35 - 2014-05-30 10:28 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-06-12 11:35 - 2014-05-30 10:24 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2014-06-12 11:35 - 2014-05-30 10:06 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-06-12 11:35 - 2014-05-30 09:56 - 04244992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-06-12 11:35 - 2014-05-30 09:56 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-06-12 11:35 - 2014-05-30 09:43 - 13522944 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-06-12 11:35 - 2014-05-30 09:21 - 01790976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-06-12 11:35 - 2014-05-30 09:13 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-06-12 11:35 - 2014-05-30 09:13 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-06-12 11:33 - 2014-06-19 11:41 - 00000000 ____D () C:\Users\Tom\Desktop\Trojaner

2014-06-12 11:32 - 2014-06-19 11:41 - 00000000 ____D () C:\FRST

2014-06-12 11:32 - 2014-06-08 11:13 - 00506368 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-06-12 11:32 - 2014-06-08 11:08 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-06-09 15:02 - 2014-06-09 15:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes

2014-06-09 15:00 - 2014-06-09 15:02 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69

2014-06-09 15:00 - 2014-06-09 15:02 - 00000000 ____D () C:\Program Files\iTunes

2014-06-09 15:00 - 2014-06-09 15:02 - 00000000 ____D () C:\Program Files (x86)\iTunes

2014-06-09 15:00 - 2014-06-09 15:00 - 00000000 ____D () C:\Program Files\iPod

2014-06-07 14:23 - 2014-06-07 14:23 - 00000000 ____D () C:\Users\Tom\Documents\Wizards of the Coast

2014-06-07 13:50 - 2014-06-07 13:50 - 00000222 _____ () C:\Users\Tom\Desktop\Magic 2014.url

2014-06-05 15:44 - 2014-06-05 15:44 - 00000000 ____D () C:\Users\Tom\AppData\Local\SniperV2

2014-06-05 14:10 - 2014-06-05 14:10 - 00000221 _____ () C:\Users\Tom\Desktop\Sniper Elite V2.url

2014-05-28 22:38 - 2014-05-28 22:38 - 00000000 ____D () C:\Users\HP\Documents\Battlefield 2

2014-05-28 22:36 - 2014-05-28 22:44 - 00000000 ____D () C:\Users\Tom\Documents\Battlefield 2

2014-05-28 22:34 - 2014-05-28 22:35 - 00000000 ____D () C:\Program Files (x86)\Battlefield 2

2014-05-27 16:12 - 2014-05-20 01:10 - 00601432 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe

2014-05-27 16:07 - 2014-05-20 04:44 - 31387936 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 25256224 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 24025376 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 17561544 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 17480432 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 16003912 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 12688328 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys

2014-05-27 16:07 - 2014-05-20 04:44 - 11644928 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 11599072 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 09735256 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 09697640 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 03141976 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 02953672 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 02785568 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvenc.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 02412376 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvenc.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 01889112 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6433788.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 01541576 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6433788.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 00895776 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 00892704 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 00867784 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 00861128 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 00837056 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 00354016 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 00305600 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 00166568 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll

2014-05-27 16:07 - 2014-05-20 04:44 - 00146480 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll

2014-05-25 20:28 - 2014-05-29 15:43 - 00000000 ____D () C:\Users\Tom\Desktop\Holland Dreas

2014-05-25 20:22 - 2014-06-12 11:32 - 00000000 ____D () C:\Users\Tom\Desktop\Abschlusszeitung

2014-05-25 20:21 - 2014-05-25 20:22 - 00000000 ____D () C:\Users\Tom\Desktop\Absolventen Fotos

2014-05-25 19:55 - 2014-05-25 19:56 - 00000000 ____D () C:\Users\HP\AppData\Local\NVIDIA

2014-05-25 19:55 - 2014-05-25 19:55 - 00000000 ____D () C:\Users\Tom\AppData\Local\NVIDIA Corporation

2014-05-25 19:51 - 2014-05-27 15:56 - 00000000 ____D () C:\Users\Tom\AppData\Local\NVIDIA

2014-05-25 19:51 - 2014-02-05 11:31 - 01048152 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll

2014-05-25 19:51 - 2014-02-05 11:30 - 01179576 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll

2014-05-25 19:50 - 2014-05-27 16:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation

2014-05-25 19:50 - 2014-05-25 19:50 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies

2014-05-25 19:46 - 2014-03-04 16:35 - 01885472 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6433523.dll

2014-05-25 19:46 - 2014-03-04 16:35 - 01516488 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6433523.dll

2014-05-25 19:46 - 2013-12-27 20:42 - 00039200 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys

2014-05-25 19:46 - 2013-12-27 20:42 - 00035104 _____ (NVIDIA Corporation) C:\Windows\system32\nvaudcap64v.dll

2014-05-25 19:46 - 2013-12-27 20:42 - 00033056 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll

2014-05-25 19:46 - 2013-11-28 15:38 - 00197408 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys

2014-05-25 19:46 - 2013-11-28 15:38 - 00031520 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll

2014-05-24 15:03 - 2014-05-20 04:44 - 14434704 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll

2014-05-24 15:03 - 2012-03-01 02:02 - 01466176 _____ (NVIDIA Corporation) C:\Windows\system32\nvgenco64.dll

2014-05-24 15:03 - 2012-03-01 02:02 - 00364352 _____ (NVIDIA Corporation) C:\Windows\system32\nvdecodemft.dll

2014-05-24 15:03 - 2012-03-01 02:02 - 00301376 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvdecodemft.dll

2014-05-24 15:03 - 2012-03-01 02:02 - 00068928 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll

2014-05-24 15:03 - 2012-03-01 02:02 - 00061248 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll

2014-05-24 13:46 - 2014-05-24 15:02 - 00000000 ____D () C:\Users\Tom\.phase-6

2014-05-24 13:46 - 2014-05-24 13:46 - 00000000 ____D () C:\Users\Tom\AppData\Roaming\Phase6

2014-05-24 13:46 - 2014-05-24 13:46 - 00000000 ____D () C:\Users\Tom\.swt

2014-05-24 13:44 - 2014-05-24 13:45 - 85744960 _____ () C:\Users\HP\Downloads\phase-6-desktop-2.3.4-windows-installer.exe

2014-05-24 13:43 - 2014-05-24 13:43 - 00001119 _____ () C:\Users\Public\Desktop\phase-6 desktop.lnk

2014-05-24 13:43 - 2014-05-24 13:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\phase-6

2014-05-24 13:25 - 2014-05-24 13:25 - 00001075 _____ () C:\Users\Tom\Downloads\Bilder - Verknüpfung.lnk
 

==================== One Month Modified Files and Folders =======
 

2014-06-19 11:41 - 2014-06-12 11:33 - 00000000 ____D () C:\Users\Tom\Desktop\Trojaner

2014-06-19 11:41 - 2014-06-12 11:32 - 00000000 ____D () C:\FRST

2014-06-19 11:26 - 2010-12-09 16:17 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-06-19 11:17 - 2012-04-02 10:22 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-06-19 11:09 - 2014-06-19 11:09 - 00854367 _____ () C:\Users\Tom\Desktop\SecurityCheck.exe

2014-06-19 03:00 - 2010-01-20 14:23 - 01970442 _____ () C:\Windows\WindowsUpdate.log

2014-06-19 00:28 - 2009-09-25 02:14 - 02340094 _____ () C:\Windows\system32\perfh007.dat

2014-06-19 00:28 - 2009-09-25 02:14 - 00658678 _____ () C:\Windows\system32\perfc007.dat

2014-06-19 00:28 - 2009-07-14 07:13 - 00006264 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-06-19 00:27 - 2014-06-19 00:27 - 00000000 ____D () C:\Program Files (x86)\ESET

2014-06-19 00:22 - 2014-06-19 00:22 - 02347384 _____ (ESET) C:\Users\Tom\Desktop\esetsmartinstaller_deu.exe

2014-06-19 00:07 - 2013-05-12 12:24 - 00000000 ____D () C:\Users\Tom\Documents\FIFA 11

2014-06-18 21:13 - 2009-07-14 06:45 - 00015568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-06-18 21:13 - 2009-07-14 06:45 - 00015568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-06-18 21:08 - 2012-03-24 16:41 - 00122263 _____ () C:\Windows\setupact.log

2014-06-18 20:26 - 2010-12-09 16:17 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-06-18 14:24 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache

2014-06-18 13:14 - 2009-09-24 16:26 - 00000000 ____D () C:\ProgramData\NVIDIA

2014-06-18 13:14 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-06-17 22:08 - 2014-06-17 22:08 - 00001479 _____ () C:\Users\HP\Desktop\JRT.txt

2014-06-17 21:55 - 2014-06-17 21:55 - 00000000 ____D () C:\Windows\ERUNT

2014-06-17 21:54 - 2014-06-17 21:54 - 01016261 _____ (Thisisu) C:\Users\Tom\Desktop\JRT.exe

2014-06-17 21:43 - 2012-03-24 16:41 - 00374038 _____ () C:\Windows\PFRO.log

2014-06-17 21:42 - 2014-06-17 21:39 - 00000000 ____D () C:\AdwCleaner

2014-06-17 21:38 - 2014-06-17 21:38 - 01333465 _____ () C:\Users\Tom\Desktop\adwcleaner_3.212.exe

2014-06-17 21:37 - 2014-06-17 21:37 - 00001813 _____ () C:\Users\Tom\Desktop\mbam.txt.txt

2014-06-17 21:31 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\Vss

2014-06-17 21:12 - 2014-06-17 21:12 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-06-17 21:12 - 2014-06-17 21:12 - 00001108 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-06-17 21:12 - 2014-06-17 21:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-06-17 21:12 - 2014-06-17 21:12 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-06-17 21:09 - 2012-03-24 18:00 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-06-12 14:59 - 2012-05-10 16:30 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

2014-06-12 13:54 - 2010-01-27 20:48 - 00000000 ____D () C:\ProgramData\Microsoft Help

2014-06-12 13:53 - 2014-05-07 18:22 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-06-12 13:27 - 2011-11-21 17:05 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-06-12 13:23 - 2014-06-12 13:23 - 00023976 _____ () C:\ComboFix.txt

2014-06-12 13:23 - 2014-06-12 13:10 - 00000000 ____D () C:\Qoobox

2014-06-12 13:23 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default

2014-06-12 13:22 - 2014-06-12 13:10 - 00000000 ____D () C:\Windows\erdnt

2014-06-12 13:21 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini

2014-06-12 12:57 - 2014-06-12 12:57 - 00001270 _____ () C:\Users\HP\Desktop\Revo Uninstaller.lnk

2014-06-12 12:57 - 2014-06-12 12:57 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group

2014-06-12 11:32 - 2014-05-25 20:22 - 00000000 ____D () C:\Users\Tom\Desktop\Abschlusszeitung

2014-06-09 15:02 - 2014-06-09 15:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes

2014-06-09 15:02 - 2014-06-09 15:00 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69

2014-06-09 15:02 - 2014-06-09 15:00 - 00000000 ____D () C:\Program Files\iTunes

2014-06-09 15:02 - 2014-06-09 15:00 - 00000000 ____D () C:\Program Files (x86)\iTunes

2014-06-09 15:02 - 2012-09-16 13:19 - 00001785 _____ () C:\Users\Public\Desktop\iTunes.lnk

2014-06-09 15:00 - 2014-06-09 15:00 - 00000000 ____D () C:\Program Files\iPod

2014-06-08 11:13 - 2014-06-12 11:32 - 00506368 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-06-08 11:08 - 2014-06-12 11:32 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-06-07 14:23 - 2014-06-07 14:23 - 00000000 ____D () C:\Users\Tom\Documents\Wizards of the Coast

2014-06-07 14:23 - 2012-04-28 17:50 - 00000000 ____D () C:\Program Files (x86)\Steam

2014-06-07 13:50 - 2014-06-07 13:50 - 00000222 _____ () C:\Users\Tom\Desktop\Magic 2014.url

2014-06-05 15:44 - 2014-06-05 15:44 - 00000000 ____D () C:\Users\Tom\AppData\Local\SniperV2

2014-06-05 15:41 - 2012-04-28 19:22 - 00326304 _____ () C:\Windows\DirectX.log

2014-06-05 14:10 - 2014-06-05 14:10 - 00000221 _____ () C:\Users\Tom\Desktop\Sniper Elite V2.url

2014-06-04 20:59 - 2012-03-24 16:35 - 00000868 _____ () C:\Users\Tom\Desktop\CCleaner.lnk

2014-05-30 12:21 - 2014-06-12 11:35 - 23414784 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-05-30 12:02 - 2014-06-12 11:36 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-05-30 12:02 - 2014-06-12 11:36 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-05-30 11:45 - 2014-06-12 11:36 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-05-30 11:39 - 2014-06-12 11:36 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-05-30 11:39 - 2014-06-12 11:35 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-05-30 11:38 - 2014-06-12 11:36 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-05-30 11:28 - 2014-06-12 11:35 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-05-30 11:27 - 2014-06-12 11:35 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-05-30 11:24 - 2014-06-12 11:35 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-05-30 11:21 - 2014-06-12 11:36 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-05-30 11:21 - 2014-06-12 11:35 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-05-30 11:20 - 2014-06-12 11:35 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-05-30 11:18 - 2014-06-12 11:36 - 17271296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-05-30 11:11 - 2014-06-12 11:35 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-05-30 11:08 - 2014-06-12 11:35 - 05782528 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-05-30 11:06 - 2014-06-12 11:36 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-05-30 11:02 - 2014-06-12 11:36 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-05-30 10:55 - 2014-06-12 11:36 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-05-30 10:49 - 2014-06-12 11:35 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-05-30 10:46 - 2014-06-12 11:35 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-05-30 10:44 - 2014-06-12 11:35 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-05-30 10:44 - 2014-06-12 11:35 - 00295424 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-05-30 10:43 - 2014-06-12 11:36 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-05-30 10:42 - 2014-06-12 11:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-05-30 10:38 - 2014-06-12 11:36 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-05-30 10:35 - 2014-06-12 11:36 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-05-30 10:34 - 2014-06-12 11:36 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-05-30 10:33 - 2014-06-12 11:36 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-05-30 10:30 - 2014-06-12 11:36 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-05-30 10:29 - 2014-06-12 11:36 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-05-30 10:28 - 2014-06-12 11:35 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-05-30 10:27 - 2014-06-12 11:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-05-30 10:24 - 2014-06-12 11:35 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2014-05-30 10:23 - 2014-06-12 11:36 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-05-30 10:16 - 2014-06-12 11:36 - 00368128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2014-05-30 10:10 - 2014-06-12 11:36 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2014-05-30 10:06 - 2014-06-12 11:35 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-05-30 10:04 - 2014-06-12 11:36 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-05-30 10:02 - 2014-06-12 11:36 - 00242688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-05-30 09:56 - 2014-06-12 11:35 - 04244992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-05-30 09:56 - 2014-06-12 11:35 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-05-30 09:54 - 2014-06-12 11:36 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-05-30 09:50 - 2014-06-12 11:36 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2014-05-30 09:49 - 2014-06-12 11:36 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-05-30 09:43 - 2014-06-12 11:35 - 13522944 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-05-30 09:40 - 2014-06-12 11:36 - 11725312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-05-30 09:30 - 2014-06-12 11:36 - 01398272 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-05-30 09:21 - 2014-06-12 11:35 - 01790976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-05-30 09:15 - 2014-06-12 11:36 - 01143296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-05-30 09:13 - 2014-06-12 11:35 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-05-30 09:13 - 2014-06-12 11:35 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-05-29 17:09 - 2013-06-04 17:32 - 00000000 ____D () C:\Users\Tom\Documents\Stronghold Legends

2014-05-29 15:43 - 2014-05-25 20:28 - 00000000 ____D () C:\Users\Tom\Desktop\Holland Dreas

2014-05-28 22:44 - 2014-05-28 22:36 - 00000000 ____D () C:\Users\Tom\Documents\Battlefield 2

2014-05-28 22:38 - 2014-05-28 22:38 - 00000000 ____D () C:\Users\HP\Documents\Battlefield 2

2014-05-28 22:38 - 2010-02-26 23:22 - 00000000 ____D () C:\Users\HP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games

2014-05-28 22:36 - 2012-08-23 17:51 - 00000000 ____D () C:\Users\Tom\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games

2014-05-28 22:35 - 2014-05-28 22:34 - 00000000 ____D () C:\Program Files (x86)\Battlefield 2

2014-05-28 22:08 - 2012-06-22 16:45 - 00000000 ____D () C:\Program Files (x86)\Diablo III

2014-05-28 21:44 - 2012-12-15 19:43 - 00000000 ____D () C:\Users\Tom\Documents\my games

2014-05-28 21:42 - 2012-06-22 16:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Diablo III

2014-05-27 16:12 - 2014-05-25 19:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation

2014-05-27 16:12 - 2010-01-20 14:32 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation

2014-05-27 15:56 - 2014-05-25 19:51 - 00000000 ____D () C:\Users\Tom\AppData\Local\NVIDIA

2014-05-25 20:22 - 2014-05-25 20:21 - 00000000 ____D () C:\Users\Tom\Desktop\Absolventen Fotos

2014-05-25 20:21 - 2012-03-30 18:14 - 00000000 ____D () C:\Users\Tom\Desktop\Desktopverknüpfungen

2014-05-25 19:56 - 2014-05-25 19:55 - 00000000 ____D () C:\Users\HP\AppData\Local\NVIDIA

2014-05-25 19:55 - 2014-05-25 19:55 - 00000000 ____D () C:\Users\Tom\AppData\Local\NVIDIA Corporation

2014-05-25 19:55 - 2010-10-01 15:20 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation

2014-05-25 19:51 - 2010-01-20 14:31 - 00000000 ____D () C:\Program Files\NVIDIA Corporation

2014-05-25 19:50 - 2014-05-25 19:50 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies

2014-05-24 15:06 - 2010-01-20 14:30 - 00000000 ____D () C:\NVIDIA

2014-05-24 15:02 - 2014-05-24 13:46 - 00000000 ____D () C:\Users\Tom\.phase-6

2014-05-24 13:48 - 2012-03-25 10:49 - 209760560 _____ (NVIDIA Corporation) C:\Users\HP\Downloads\296.10-desktop-win7-winvista-64bit-international-whql.exe

2014-05-24 13:46 - 2014-05-24 13:46 - 00000000 ____D () C:\Users\Tom\AppData\Roaming\Phase6

2014-05-24 13:46 - 2014-05-24 13:46 - 00000000 ____D () C:\Users\Tom\.swt

2014-05-24 13:46 - 2012-03-24 18:20 - 00000000 ____D () C:\Users\Tom\AppData\Roaming\Mozilla

2014-05-24 13:46 - 2010-08-07 20:06 - 00000000 ____D () C:\Users\Tom

2014-05-24 13:45 - 2014-05-24 13:44 - 85744960 _____ () C:\Users\HP\Downloads\phase-6-desktop-2.3.4-windows-installer.exe

2014-05-24 13:43 - 2014-05-24 13:43 - 00001119 _____ () C:\Users\Public\Desktop\phase-6 desktop.lnk

2014-05-24 13:43 - 2014-05-24 13:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\phase-6

2014-05-24 13:32 - 2012-12-15 16:53 - 00000000 ____D () C:\Users\Tom\Desktop\Games

2014-05-24 13:32 - 2012-12-15 16:53 - 00000000 ____D () C:\Users\Tom\Desktop\Foto

2014-05-24 13:25 - 2014-05-24 13:25 - 00001075 _____ () C:\Users\Tom\Downloads\Bilder - Verknüpfung.lnk

2014-05-22 16:15 - 2010-08-07 20:06 - 00001324 __RSH () C:\Users\Tom\ntuser.pol

2014-05-20 04:44 - 2014-05-27 16:07 - 31387936 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 25256224 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 24025376 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 17561544 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 17480432 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 16003912 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 12688328 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys

2014-05-20 04:44 - 2014-05-27 16:07 - 11644928 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 11599072 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 09735256 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 09697640 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 03141976 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 02953672 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 02785568 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvenc.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 02412376 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvenc.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 01889112 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6433788.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 01541576 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6433788.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 00895776 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 00892704 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 00867784 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 00861128 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 00837056 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 00354016 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 00305600 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 00166568 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll

2014-05-20 04:44 - 2014-05-27 16:07 - 00146480 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll

2014-05-20 04:44 - 2014-05-24 15:03 - 14434704 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll

2014-05-20 04:44 - 2013-02-26 00:32 - 18531568 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll

2014-05-20 04:44 - 2013-02-26 00:32 - 03109248 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll

2014-05-20 04:44 - 2013-02-26 00:32 - 02730208 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll

2014-05-20 04:44 - 2013-02-26 00:32 - 00952952 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll

2014-05-20 04:44 - 2010-01-20 14:30 - 00026069 _____ () C:\Windows\system32\nvinfo.pb

2014-05-20 03:25 - 2010-07-09 16:17 - 06769096 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll

2014-05-20 03:25 - 2010-07-09 16:17 - 03514144 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll

2014-05-20 03:25 - 2010-07-09 16:17 - 02560968 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll

2014-05-20 03:25 - 2010-07-09 16:17 - 00927520 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe

2014-05-20 03:25 - 2010-07-09 16:17 - 00387528 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll

2014-05-20 03:25 - 2009-06-26 17:00 - 00062808 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll

2014-05-20 01:10 - 2014-05-27 16:12 - 00601432 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
 

Some content of TEMP:

====================

C:\Users\HP\AppData\Local\Temp\Quarantine.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 

==================== End Of Log ============================

--- --- ---

--- --- ---

Vielen herzlichen Dank schon mal :))

Woher weiß ich denn ob von meinem Email-Acc. aus noch Spams verschickt werden, habe ja keinen Indikator dafür :)?

schrauber

20.06.2014 07:02

wir müssen noch was checken:

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die OTL.exe.
Kopiere nun den Inhalt aus der Codebox in die http://larusso.trojaner-board.de/Images/otlfix.jpg Textbox.

Code:

HKEY_LOCAL_MACHINE\software\microsoft\Windows\CurrentVersion\Telephony\Providers

HKEY_LOCAL_MACHINE\software\microsoft\Windows\CurrentVersion\Telephony\Providers /64

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation /S /64

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Dnscache /S /64

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost /64

HKEY_LOCAL_MACHINE\SOFTWARE\Joosoft.com

HKEY_LOCAL_MACHINE\SOFTWARE\Joosoft.com /64

%SystemRoot%\system32\*.tsp

%SystemRoot%\system32\*.tsp /64

C:\Windows\system32\*.dll /800

C:\Windows\system32\*.dll /800 /64

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Kopiere nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread

tombo11

20.06.2014 11:25

Code:

OTL Extras logfile created on: 20.06.2014 12:06:31 - Run 1

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Tom\Desktop

64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.11.9600.17126)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

7,99 Gb Total Physical Memory | 5,38 Gb Available Physical Memory | 67,38% Memory free

15,98 Gb Paging File | 13,35 Gb Available in Paging File | 83,53% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 684,15 Gb Total Space | 15,78 Gb Free Space | 2,31% Space Free | Partition Type: NTFS

Drive D: | 14,39 Gb Total Space | 2,52 Gb Free Space | 17,54% Space Free | Partition Type: NTFS

Drive E: | 698,64 Gb Total Space | 57,76 Gb Free Space | 8,27% Space Free | Partition Type: NTFS

Drive F: | 6,31 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF

Drive G: | 3,80 Gb Total Space | 3,80 Gb Free Space | 99,99% Space Free | Partition Type: FAT32

 

Computer Name: HP-PC | User Name: HP | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.html[@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)

.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

 

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

 
 ========== Shell Spawning ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)

InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~2\Office12\ONENOTE.EXE "%L"

Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~2\Office12\ONENOTE.EXE "%L"

Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error.

 
 ========== Security Center Settings ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

"FirewallDisableNotify" = 0

"AntiVirusDisableNotify" = 0

"UpdatesDisableNotify" = 0

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

 
 ========== System Restore Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]

"DisableSR" = 0

 
 ========== Firewall Settings ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"DisableNotifications" = 0

"EnableFirewall" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"DisableNotifications" = 0

"EnableFirewall" = 0

 
 ========== Authorized Applications List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

 

 
 ========== Vista Active Open Ports Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{043F8427-FB3B-4524-9CB0-3BE64D65B839}" = lport=2869 | protocol=6 | dir=in | app=system | 

"{3888FBE2-4AF2-4E0B-A774-1D437511692B}" = lport=10243 | protocol=6 | dir=in | app=system | 

"{3F0A71C1-2DEF-48FA-968D-812903D0E01A}" = lport=445 | protocol=6 | dir=in | app=system | 

"{4143167B-58E1-4BF7-AE69-2E4D2E22B1D1}" = rport=10243 | protocol=6 | dir=out | app=system | 

"{41C865E2-B9AE-4BCE-A4A5-BB7AAE355C3F}" = lport=47987 | protocol=6 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamsvc.exe | 

"{43A6918D-2F90-47BB-8475-5B925A5114C6}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 

"{4881AD76-F92D-40ED-9DEB-03191DDB7074}" = rport=138 | protocol=17 | dir=out | app=system | 

"{4A7B9C74-A2CC-409A-8777-50EDF658CC24}" = lport=48000 | protocol=17 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamer.exe | 

"{584DC0AC-E570-4EFC-9492-E64F6D2A0B51}" = lport=80 | protocol=6 | dir=in | app=c:\program files (x86)\nvidia corporation\netservice\nvnetworkservice.exe | 

"{6C0129F6-E4D2-42EA-8286-E5AC719B4266}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{6C196455-8DF7-45CE-ACFC-28E6CCDD8748}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{70409084-5463-45A0-95C5-533330465506}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{75013437-733F-4021-991B-A322C3767C4B}" = rport=139 | protocol=6 | dir=out | app=system | 

"{7EECB5CE-914A-4E9B-8299-BA02EC0BBCDF}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{849AC16B-414B-40FE-8F9C-3BCB32F1B399}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{9060014A-9440-44FD-8792-45AFC9449C5B}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{9B8703C7-CA01-4DF7-A9F1-75DDF5F0A25F}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{9FCE64EB-C8EC-4759-9FB6-3972CB7EE095}" = lport=139 | protocol=6 | dir=in | app=system | 

"{A8301DC6-7347-4B5E-953C-33B9426D06A0}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 

"{AE70B8FB-798C-4009-8526-C00652E87224}" = lport=443 | protocol=6 | dir=in | app=c:\program files (x86)\nvidia corporation\netservice\nvnetworkservice.exe | 

"{B881B939-33BC-4987-B1C8-799D159815E7}" = lport=138 | protocol=17 | dir=in | app=system | 

"{C04D489E-B3C2-4A50-B4FF-1B6147793E58}" = lport=5353 | protocol=17 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamsvc.exe | 

"{CD99C204-62AC-4B0B-B3A0-72240E8975B5}" = rport=137 | protocol=17 | dir=out | app=system | 

"{D1BA930C-DF55-4307-94C9-24D1613931DA}" = lport=3724 | protocol=6 | dir=in | name=blizzard downloader: 3724 | 

"{D81AE2EC-AFA3-44AF-8EC0-FA5A02C3DCF9}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{DE886994-3399-4701-8C81-15BC2564BF68}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{E0F2CE29-CEFE-4E0B-A81D-D2524E8638B9}" = lport=137 | protocol=17 | dir=in | app=system | 

"{F5799EEA-4A89-4F26-B328-90D9C59C9DFD}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{F936AED3-44A1-4AB3-8B29-EC3E5822ABA6}" = lport=47991 | protocol=6 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamer.exe | 

"{FE7DE088-0DCA-41AE-95F8-6B536CC05721}" = rport=445 | protocol=6 | dir=out | app=system | 

 
 ========== Vista Active Application Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{02A05E5A-FC01-4A86-809E-DAF02D0A26FA}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\farcry 3\bin\fc3updater.exe | 

"{0537C1A1-26F3-407F-AEB3-68D6B80F5427}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{06D58C98-EEE4-4299-B1CA-98BA0E367AAC}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\related designs\anno 1404\anno4.exe | 

"{0CE7DC4D-90AF-4C46-B2D2-CF252D2A4D15}" = protocol=17 | dir=in | app=c:\program files (x86)\firefly studios\stronghold legends\strongholdlegends.exe | 

"{0DCB7587-6978-4376-9B43-12890FD2793F}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed\assassinscreed_launcher.exe | 

"{100B1EB5-1EDC-40BF-A946-D667B3A46E16}" = dir=in | app=c:\program files (x86)\hewlett-packard\touchsmart\media\hptouchsmartmusic.exe | 

"{110834B5-E250-45DF-B00F-AE8A2DE06222}" = protocol=17 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.4\sonarhost.exe | 

"{1321DD73-1192-43BC-9A8B-8A2E8FC3DD92}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\farcry 3\bin\fc3updater.exe | 

"{16113928-0D40-4642-95E8-0BF6340A90A0}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.954\agent.exe | 

"{16A10581-F93B-48F8-8381-FC11A802D68C}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed\assassinscreed_launcher.exe | 

"{1725D297-A023-4850-A69C-9FE45935E39D}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{19C07A1C-6B2F-4F39-A2EF-3EF65117F54E}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\james cameron's avatar - das spiel\bin\avatarlauncher.exe | 

"{1AF449EC-6EF8-4FB7-93F6-7311B5684730}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 

"{1C847A08-12BF-41B4-B8EB-D5B4346436A4}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed revelations\acrmp.exe | 

"{1DA4070D-4399-49FD-98A3-657C8C62AB84}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\csgo.exe | 

"{1EE07F16-577A-43EC-9D03-EF5A0A083EEC}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed ii\assassinscreediigame.exe | 

"{2061E621-DA10-4DE3-9D47-8FF49807A200}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | 

"{22195376-93B2-4BA8-85D5-7D22568727A2}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | 

"{25EC53AA-AB0B-4DBB-A56E-AFE0CC645E81}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed brotherhood\assassinscreedbrotherhood.exe | 

"{268BE301-6B2D-4018-86AE-E70215DC24D5}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty ghosts\iw6sp64_ship.exe | 

"{2890641E-8822-4E71-B00E-E84DB100487D}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1363\agent.exe | 

"{28A8AA9B-C672-4474-906E-A229ABB8F751}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\farcry 3\bin\fc3editor.exe | 

"{2ABE467F-E1E9-42C5-94E0-B4DAAA12023F}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{2AF8DD07-4C98-4950-A9F4-CEBED1007330}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 

"{2B6A70AA-A5A8-4305-A1F2-DDEA0B56ADB8}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed ii\uplaybrowser.exe | 

"{2D11EA14-1F38-4C7B-8388-67CE32EB4147}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\related designs\anno 1404\tools\benchmark.exe | 

"{2F0F8AD3-90F2-425E-B2D8-70644A1F45DC}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe | 

"{2F9A7472-36BB-43CA-987C-0621E8A3DC75}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1737\agent.exe | 

"{32DF5851-E3C3-4845-A4C2-415207D00289}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1363\agent.exe | 

"{33CB68AA-377F-4A11-9DE9-ADB0FDD0B437}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed ii\assassinscreedii.exe | 

"{35CC1F6C-8FAB-4795-8BA4-9A55493F4129}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\skyrim\skyrimlauncher.exe | 

"{3A07F70B-8667-4C18-BF64-5B7421C3FA6B}" = dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 

"{3A20AC15-3F2D-4102-9BBC-F0A38BFBB48A}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty ghosts\iw6mp64_ship.exe | 

"{3A32A131-74EE-47DE-9D3A-EE73B479C637}" = protocol=17 | dir=in | app=c:\users\public\games\world of warcraft\launcher.patch.exe | 

"{3B59CA1A-9808-4ED9-8CAD-4BB0C3BBFB23}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\farcry 3\bin\farcry3.exe | 

"{3BB9EAAC-C761-43AB-9BF0-14ECF23A2406}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 

"{3C026912-94E3-41EB-9D17-B851D7F6EC00}" = protocol=17 | dir=in | app=c:\users\public\games\world of warcraft\launcher.exe | 

"{3D0A0313-6FD1-483C-842F-7C84749B43EB}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed\assassinscreed_dx10.exe | 

"{3EBBBF61-2CD2-47B0-AB24-151EBB257799}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed iii\assassinscreed3.exe | 

"{42A76C0D-B96F-403B-BB0B-29D1D12F9DFF}" = protocol=17 | dir=in | app=c:\program files (x86)\rockstar games\grand theft auto iv\launchgtaiv.exe | 

"{435E3CE1-2508-4358-B84F-F088B8A054DB}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed revelations\assassinscreedrevelations.exe | 

"{43A6F7E7-36B2-48C0-9545-65A0075775D0}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed iii\ac3sp.exe | 

"{4434C0C4-5372-44FA-BA6F-C7721B6BBA47}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed iii\ac3sp.exe | 

"{44537DC8-1B20-41CE-A218-507C7C2364BB}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed brotherhood\acbsp.exe | 

"{4669B171-0D2A-492A-96B7-C73245452EE7}" = protocol=17 | dir=in | app=c:\program files (x86)\origin games\dead space\dead space.exe | 

"{467710EC-D0D9-4FDC-857F-E1BEE352FCF2}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 

"{4738E5ED-0E44-4A42-ADF2-E07B7FD31D35}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{495097D0-56EC-416C-9D49-972E0AFA9CD7}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\sniper elite v2\bin\sniperelitev2.exe | 

"{49C81A9B-45AB-411B-9551-BED4F2CEC246}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\skyrim\skyrimlauncher.exe | 

"{4CBF1F25-5AFB-4E36-986D-C733DD7AF299}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\yuuuuh11\counter-strike\hl.exe | 

"{4D58933F-290C-40EB-AC0E-63F106BAF4A0}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty ghosts\iw6sp64_ship.exe | 

"{4E076060-983E-41B7-8D0B-2FFCB4A4B256}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{4E2A2DF0-E48D-4814-A4E9-D423D8F5C674}" = protocol=6 | dir=in | app=c:\program files (x86)\firefly studios\stronghold legends\strongholdlegends.exe | 

"{52089318-D864-4BF2-8FF3-C128E8E936B9}" = dir=in | app=c:\program files (x86)\hewlett-packard\touchsmart\media\hptouchsmartphoto.exe | 

"{52C12609-B952-46ED-9844-9628DA677961}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1040\agent.exe | 

"{547E7E7D-C0C2-4AF2-BB11-7D5F350656DA}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{55D55448-E13B-4396-BA26-2AE829B96E85}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steam.exe | 

"{5690390D-BEAF-412F-8302-58B3BF90C647}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\bioshock infinite\binaries\win32\bioshockinfinite.exe | 

"{578C72BB-137F-4A6D-960B-DEAEC8C7D160}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty ghosts\iw6sp64_ship.exe | 

"{58DA6A8C-4402-4412-9E85-68D2C60C4EDE}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\bin\sdklauncher.exe | 

"{5A5B02AF-8289-40A1-9C15-3A8A974203E8}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\related designs\anno 1404\tools\benchmark.exe | 

"{5EBBD456-6D99-42DE-A5FF-35C7BE7A04D6}" = protocol=17 | dir=in | app=c:\program files (x86)\electronic arts\need for speed(tm) hot pursuit\launcher.exe | 

"{60A96914-974B-473B-A2D2-B53B0C4DD608}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\csgo.exe | 

"{64B28CAA-EBC4-4219-8217-0F7F8FB813E4}" = dir=in | app=c:\program files (x86)\cyberlink\powerdirector\pdr.exe | 

"{671F568A-F4FB-42D6-9CBB-6BEAA443407A}" = protocol=58 | dir=out | name=@iphlpsvc.dll,-503 | 

"{67CA6936-F3B7-484E-8FF4-0A7EAF4DF4B0}" = protocol=6 | dir=in | app=c:\users\public\games\world of warcraft\launcher.patch.exe | 

"{6A257B2D-C804-4195-BB92-151D35E8C34D}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{6C8648BA-64F7-46BB-8A70-C272755F1346}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\related designs\anno 1404\anno4.exe | 

"{6D81D14A-8485-4C1E-A511-59E35164BD0C}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1225\agent.exe | 

"{6F0B24C0-FBBD-4E54-A453-02E02F1B6753}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.2787\agent.exe | 

"{708ADD9E-60E4-4FFD-9B2E-1F99AE561862}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\bioshock infinite\binaries\win32\benchmark.bat | 

"{7091E4E9-2334-4EE7-A180-0496E4B2DFC7}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\bioshock infinite\binaries\win32\benchmark.bat | 

"{71D9AEE2-48D5-4A97-890F-D6C5EB3699AD}" = dir=in | app=%programfiles% (x86)\origin\origin.exe | 

"{723A3B51-F4A4-46FB-A944-6470431608C3}" = dir=in | app=c:\program files (x86)\hewlett-packard\touchsmart\media\tsmagent.exe | 

"{728CC36D-70A8-4BC5-8D95-17EF18C36B93}" = protocol=6 | dir=out | app=system | 

"{73A34E5C-5070-4905-A65A-6B859293BFD7}" = protocol=58 | dir=in | app=system | 

"{73DBD5B9-3C9C-42C1-B347-2AFF4FDE84C1}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 

"{77492CEE-221E-4F18-8CBF-580964D539FF}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 

"{7AA0EFF4-A02E-43E6-9A93-85EDD887B6EE}" = protocol=6 | dir=in | app=c:\users\public\games\world of warcraft\launcher.exe | 

"{7DE4B39E-4C09-4F66-B977-AD7F79E641B1}" = protocol=6 | dir=in | app=c:\users\public\games\world of warcraft\wow-x.x.x.x-4.0.0.12911-eu-downloader.exe | 

"{7E634EEB-4FB6-4745-B643-52D832CA9F4B}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\james cameron's avatar - das spiel\bin\avatar.exe | 

"{7F28A81D-727B-4B74-A755-B6C8844E9390}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steam.exe | 

"{81025E11-7C96-4374-95BB-E896EFFFEAF2}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\james cameron's avatar - das spiel\bin\avatarlauncher.exe | 

"{81ADCFC4-CE17-4A5B-A9EA-2B4EDD3304B8}" = dir=in | app=c:\program files (x86)\hewlett-packard\media\dvd\hpdvdsmart.exe | 

"{81AED2B4-3551-4FA3-98A9-E8A8E595FD94}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\related designs\anno 1404\tools\anno4web.exe | 

"{84E1E562-C9B7-4794-A691-E18B5AB69880}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed brotherhood\uplaybrowser.exe | 

"{85894D76-5F07-4A2D-95E6-ED8ABEFF9C49}" = dir=in | app=c:\program files\hp\hp photosmart 5520 series\bin\hpnetworkcommunicatorcom.exe | 

"{86BD140F-B630-4DC3-9C6E-7CC7198E6C42}" = protocol=17 | dir=in | app=c:\users\public\games\world of warcraft\wow-x.x.x.x-4.0.0.12911-eu-downloader.exe | 

"{86E931FC-A7F5-4D82-ADA3-05926BA267C0}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\ubisoft game launcher\ubisoftgamelauncher.exe | 

"{8770DCEB-71C6-4AC2-A5DE-EE11167CFF5C}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\yuuuuh11\counter-strike\hl.exe | 

"{87DE307A-9B6C-423B-8D62-EC28B6C44045}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\bin\sdklauncher.exe | 

"{880CA24D-7948-48E5-9BB8-521ACA719AD4}" = dir=in | app=c:\program files\hp\hp photosmart 5520 series\bin\hpnetworkcommunicator.exe | 

"{8829DB4A-F2D2-40CF-9A5B-90E68A322CB1}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed revelations\acrsp.exe | 

"{883F39E3-0EB7-434F-B2D5-41464077872B}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed brotherhood\uplaybrowser.exe | 

"{885D1FFF-5271-4F5C-9748-98D2E784AB5E}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.2880\agent.exe | 

"{88F96A94-A058-4C1F-A29C-FAB975541741}" = protocol=6 | dir=in | app=c:\program files (x86)\origin games\battlefield 1942\bf1942.exe | 

"{8AB9517E-C93F-490D-A1A7-63884A393728}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\farcry 3\bin\farcry3_d3d11.exe | 

"{8BEAEE9A-ACD4-41CB-A815-7650D7A9B4AD}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed revelations\acrsp.exe | 

"{8E2076DB-C7E7-4F99-8B0E-755E45E5A26A}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed brotherhood\acbmp.exe | 

"{90AF5069-1EAB-43A4-8D54-2F5727155051}" = protocol=6 | dir=in | app=c:\program files (x86)\diablo iii\diablo iii.exe | 

"{92C695C3-6A25-472A-826B-3FC2FFBB9729}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\farcry 3\bin\fc3editor.exe | 

"{94F78C43-D2A8-4FB4-9D7E-83C6CCD5B402}" = protocol=17 | dir=in | app=c:\program files (x86)\codemasters\of dragon rising\ofdr.exe | 

"{958A40E1-76B8-4AFB-AF09-53C92BEAE484}" = protocol=6 | dir=in | app=c:\program files (x86)\electronic arts\need for speed(tm) hot pursuit\launcher.exe | 

"{97C12AFC-E535-4396-A01E-A02DD6FEC407}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed revelations\acrmp.exe | 

"{988E30B3-93FB-431E-B57A-C705367B2C92}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 

"{994D064A-9D52-44B4-B5C0-7AB9973BA1C6}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.954\agent.exe | 

"{99695BF2-7E9F-4BA6-94A4-7332A3BC6431}" = protocol=17 | dir=in | app=c:\program files (x86)\origin games\battlefield 3\bf3.exe | 

"{998CA41B-B4F5-4939-AF26-9616ADDEFF9A}" = protocol=6 | dir=in | app=c:\program files (x86)\codemasters\of dragon rising\ofdr.exe | 

"{9A019872-3EFA-4207-B615-6CB5385ED754}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed ii\uplaybrowser.exe | 

"{9B2616DB-C074-4A4A-8773-05B4DEB50470}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed\assassinscreed_dx10.exe | 

"{A162EF76-08FF-491F-AAD7-A1218CEB3F40}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1737\agent.exe | 

"{A18D07E3-17C9-4763-92FC-D2E5DAE199AC}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe | 

"{A19061EA-0354-4F2C-B3B1-CF544C700524}" = dir=in | app=c:\program files (x86)\hewlett-packard\touchsmart\media\kernel\clml\clmlsvc.exe | 

"{A4A34700-E298-481E-9599-CFAAA234BB63}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1225\agent.exe | 

"{A4D3DAFE-547A-4680-BEAF-1971E82B8C0C}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty ghosts\iw6mp64_ship.exe | 

"{A4E3E100-1F06-4FDC-A35E-482CE6634B80}" = protocol=6 | dir=in | app=c:\program files (x86)\origin games\dead space\dead space.exe | 

"{A6AD0422-784F-41F2-85A5-801BFF848453}" = dir=in | app=c:\program files\hp\hp photosmart 5520 series\bin\devicesetup.exe | 

"{A7621EEF-E471-4CA5-AA9F-78445C84DB27}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 

"{A8A9A0B0-AEC7-4230-A56E-C4C7AC996E12}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed revelations\assassinscreedrevelations.exe | 

"{A908595F-B1B6-4B2C-84D6-BF5088D86C01}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty ghosts\iw6mp64_ship.exe | 

"{A9D41D7C-2DB7-4649-B5D2-9F7F1382F128}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | 

"{AA16CC3B-6765-493D-9A05-2E70D531CACA}" = protocol=6 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.4\sonarhost.exe | 

"{AAA95F7C-86BB-4C7F-9A66-97708B3B8884}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\farcry 3\bin\farcry3.exe | 

"{AAFFEC09-F0BB-4684-8AD7-42983B184787}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed ii\assassinscreedii.exe | 

"{AB8FD6BE-F175-4E23-A90D-85C47AAB4AD8}" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\starcraft ii.exe | 

"{AC054020-7B60-4881-BC25-A2C1F74B4FF4}" = dir=in | app=c:\program files (x86)\hewlett-packard\touchsmart\media\kernel\clml\clmlsvc.exe | 

"{ACDE5EA4-E93D-440D-8523-14C2BF103E88}" = dir=in | app=c:\program files (x86)\hewlett-packard\touchsmart\media\hptouchsmartmusic.exe | 

"{AE253D6B-A725-45BD-8949-BC8B7CAA2242}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed iii\ac3mp.exe | 

"{AE902DC2-3775-4CB2-A98E-8AA126732302}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{AE9A1A53-1D9C-4B93-8F8A-C038E585E33B}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | 

"{AED36728-A7F8-4FFA-9928-87B33FC38A75}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 

"{AF91FE15-FC7B-49F1-A4C0-1E8BEC32EF88}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\james cameron's avatar - das spiel\bin\avatar.exe | 

"{B025A2F6-EC78-4E24-AE03-F47BE5C7CC42}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed brotherhood\acbmp.exe | 

"{B20C666E-20BA-4DCE-97B7-621433A19EB1}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed iii\assassinscreed3.exe | 

"{B55EDC41-5D3E-406E-9545-DC9E1FF5CEAE}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed\assassinscreed_dx9.exe | 

"{BE31F825-2697-4B38-8A47-2BF1FD5820BB}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\farcry 3\bin\farcry3_d3d11.exe | 

"{BE447641-B6EF-4614-9A97-876EAA39E02F}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty ghosts\iw6sp64_ship.exe | 

"{BF6E8508-6C00-4875-B146-50058D8381B6}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 

"{C089E7DE-F645-4595-88E5-85A8D4285E80}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{C1ADCB00-B565-46DF-A932-2169781C3B87}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.2880\agent.exe | 

"{C3357FCA-5779-4A3C-BBE4-41DDE794B555}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 

"{C4AAD791-A541-4FBC-93A4-72A38CF95245}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 

"{C5214F56-4B8A-45CD-A9AD-49076EA92430}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed iii\ac3mp.exe | 

"{C5BC6814-8339-4338-8B15-02CA16BB61A3}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 

"{C810A83D-470C-4AE1-80D2-3C8DAA1782BC}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed ii\assassinscreediigame.exe | 

"{C98050FD-1FA4-48D7-9E95-AA97E696CF15}" = dir=in | app=c:\windows\system32\ezsharedsvchost.exe | 

"{CAC27865-E1F5-4F44-8379-F6DDD8C2F21D}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty ghosts\iw6mp64_ship.exe | 

"{CACB6593-E05E-4607-9BE4-4933BC476580}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\sniper elite v2\bin\sniperelitev2.exe | 

"{CCE020FB-7923-4709-ABF8-97C6DBE41E7B}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\magic 2014\dotp_d14.exe | 

"{CE08F604-EA79-4243-9558-6D6595DAF597}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed brotherhood\acbsp.exe | 

"{CFB1631D-64E1-4F88-8B61-9F4605CF5290}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed brotherhood\assassinscreedbrotherhood.exe | 

"{D0D64601-A202-486C-9F52-25EC96350E05}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\magic 2014\dotp_d14.exe | 

"{D202B67D-38FA-407F-92C6-7C270D0B2D7A}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\related designs\anno 1404\tools\anno4web.exe | 

"{DA68B0C6-D23E-4789-B0BD-1FE298876157}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 

"{DB62506B-E570-4C55-BE9B-495765D417FE}" = dir=in | app=c:\program files (x86)\hewlett-packard\touchsmart\media\hptouchsmartvideo.exe | 

"{DB97E06D-979A-4E0A-A0EB-A3C4199A39A1}" = protocol=17 | dir=in | app=c:\program files (x86)\origin games\battlefield 1942\bf1942.exe | 

"{DD30C301-41F1-4354-8EB6-729A95AE1CA3}" = dir=in | app=c:\program files (x86)\easybits for kids\ezdesktop.exe | 

"{DD83F012-1537-4979-B5F9-2B2E887659F0}" = protocol=6 | dir=in | app=c:\program files (x86)\rockstar games\grand theft auto iv\launchgtaiv.exe | 

"{DF0F017A-6E3F-4D80-BEE2-BDAFE55CC75A}" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\starcraft ii.exe | 

"{DF9182FF-E458-409A-B241-05E6BDD1E4B6}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 

"{DF95017B-20DF-43A9-9C3C-3A9F42430D07}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | 

"{E21B106E-A07F-4DE7-A978-7EA8B7BAC7CE}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 

"{E232FFF4-07C8-4D3A-BB46-E534368C4190}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty ghosts\iw6mp64_ship.exe | 

"{E278EE4F-E07D-4679-9FF7-3F443500F435}" = dir=in | app=c:\program files (x86)\hewlett-packard\touchsmart\media\hptouchsmartphoto.exe | 

"{E52AFD0B-C25A-4250-910F-FDAC4BECCA3B}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1040\agent.exe | 

"{E53624E0-EBF1-4BA3-B372-7BA06365C4B4}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty ghosts\iw6mp64_ship.exe | 

"{E8708FC8-7ED0-4C42-9C27-46B7F7AF9E7E}" = dir=in | app=c:\program files (x86)\hewlett-packard\touchsmart\media\tsmagent.exe | 

"{EB5A4544-EAD4-4E36-82D5-006C2A798756}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe | 

"{EEE536F2-5376-41F1-93BF-D29DF86ADAAD}" = protocol=6 | dir=in | app=c:\program files (x86)\origin games\battlefield 3\bf3.exe | 

"{EF45CE6F-2E3D-441A-874B-45C0278F46EA}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\ubisoft game launcher\ubisoftgamelauncher.exe | 

"{F2D1E829-1B84-4646-8387-91E43D54258F}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\bioshock infinite\binaries\win32\bioshockinfinite.exe | 

"{F844B2C8-5B63-49D9-A0F1-CFFE4E48B108}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.2787\agent.exe | 

"{FACE8E53-F0A2-4477-951A-EE802BE7E8D6}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 

"{FC400D01-BC94-4F86-9241-A951E4D05DAE}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed\assassinscreed_dx9.exe | 

"{FCA79AD4-26F7-4A3F-A9CE-38ECDCA462DA}" = protocol=17 | dir=in | app=c:\program files (x86)\diablo iii\diablo iii.exe | 

"{FE3B3945-CBA1-408B-8180-D69012ED41A9}" = dir=in | app=c:\program files (x86)\hewlett-packard\touchsmart\media\hptouchsmartvideo.exe | 

"TCP Query User{1EB872D1-CD88-4130-8048-B2BA512BE109}C:\program files (x86)\starcraft ii\support\blizzarddownloader.exe" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\support\blizzarddownloader.exe | 

"TCP Query User{248C1CC5-A38D-4E62-9B62-9435AC2BD560}F:\setupwizard\stinstall.exe" = protocol=6 | dir=in | app=f:\setupwizard\stinstall.exe | 

"TCP Query User{2F9C8134-3C88-44AB-AC11-A10C4DB2BAA1}C:\users\public\games\world of warcraft\temp\wow-4.3-5.0.15890-enus-downloader.exe" = protocol=6 | dir=in | app=c:\users\public\games\world of warcraft\temp\wow-4.3-5.0.15890-enus-downloader.exe | 

"TCP Query User{37AF6950-5185-4BC0-85E5-E4B07D5B9520}C:\program files (x86)\starcraft ii\versions\base17326\sc2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base17326\sc2.exe | 

"TCP Query User{39FCEA05-E912-4D29-99F8-DE975FC674E7}C:\program files (x86)\rockstar games\grand theft auto iv\gtaiv.exe" = protocol=6 | dir=in | app=c:\program files (x86)\rockstar games\grand theft auto iv\gtaiv.exe | 

"TCP Query User{49D059D9-30FA-4EDE-B1F8-BB247F5F3B9F}C:\program files (x86)\the witcher 2\bin\witcher2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\the witcher 2\bin\witcher2.exe | 

"TCP Query User{4A92458C-E889-46B1-85A0-78BF775CEA60}C:\program files (x86)\steam\steamapps\common\counter-strike global offensive\csgo.exe" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\csgo.exe | 

"TCP Query User{59353B46-F55F-49FC-8963-BCDFD202357F}C:\program files (x86)\origin games\battlefield 1942\bf1942.exe" = protocol=6 | dir=in | app=c:\program files (x86)\origin games\battlefield 1942\bf1942.exe | 

"TCP Query User{70320FA8-F988-4066-8E76-DBD9FFEEEC86}C:\program files (x86)\starcraft ii\versions\base18574\sc2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base18574\sc2.exe | 

"TCP Query User{7FB40FE2-7F97-4711-84D9-E2ABD626C7C3}C:\program files (x86)\starcraft ii\versions\base18574\sc2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base18574\sc2.exe | 

"TCP Query User{83800A32-FC24-4DCF-9C47-72009CA92536}C:\program files (x86)\electronic arts\need for speed(tm) hot pursuit\nfs11.exe" = protocol=6 | dir=in | app=c:\program files (x86)\electronic arts\need for speed(tm) hot pursuit\nfs11.exe | 

"TCP Query User{84B4756B-F953-4E86-A352-337E04A7F563}C:\program files (x86)\starcraft ii\versions\base18092\sc2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base18092\sc2.exe | 

"TCP Query User{922F2CB6-E33F-4560-8220-4B7E9EF53D57}M:\spiele\so drauf\call of duty 2\cod2mp_s.exe" = protocol=6 | dir=in | app=m:\spiele\so drauf\call of duty 2\cod2mp_s.exe | 

"TCP Query User{990F4031-7799-4567-B844-69139D9284A1}C:\program files (x86)\steam\steamapps\yuuuuh11\counterstrike source beta\hl2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\yuuuuh11\counterstrike source beta\hl2.exe | 

"TCP Query User{9B4E6A87-A746-40B9-AA04-315CE2FE39B2}C:\program files (x86)\codemasters\of dragon rising\ofdr.exe" = protocol=6 | dir=in | app=c:\program files (x86)\codemasters\of dragon rising\ofdr.exe | 

"TCP Query User{A99074A3-9EA0-43C2-B0EF-7822942AF622}C:\program files (x86)\ubisoft\assassin's creed iii\ac3mp.exe" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed iii\ac3mp.exe | 

"TCP Query User{AB0F3F9B-9728-4EFC-9311-21F92930492A}C:\program files (x86)\rockstar games\grand theft auto iv\gtaiv.exe" = protocol=6 | dir=in | app=c:\program files (x86)\rockstar games\grand theft auto iv\gtaiv.exe | 

"TCP Query User{B19493C1-ABF7-4D08-ABE9-376A47F1B0E3}C:\program files (x86)\the witcher 2\bin\witcher2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\the witcher 2\bin\witcher2.exe | 

"TCP Query User{B2016BD3-50AC-45B9-BF16-69040E9957F5}C:\program files (x86)\ea games\need for speed underground 2\speed2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\ea games\need for speed underground 2\speed2.exe | 

"TCP Query User{BC88872B-9B8D-4365-9D62-8E7FF602C2D1}C:\programdata\battle.net\agent\agent.1199\agent.exe" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1199\agent.exe | 

"TCP Query User{D1E05D2B-83BB-4C32-8436-05792D331E14}M:\spiele\call of duty 2 (neumaier)\cod2mp_s.exe" = protocol=6 | dir=in | app=m:\spiele\call of duty 2 (neumaier)\cod2mp_s.exe | 

"TCP Query User{DF0EC77A-A755-43D3-97F5-43F083EC55D3}C:\program files (x86)\steam\steamapps\yuuuuh11\counter-strike source\hl2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\yuuuuh11\counter-strike source\hl2.exe | 

"TCP Query User{E1D759B4-C25F-4D82-B677-C856C1081EF3}C:\program files (x86)\starcraft ii\versions\base17326\sc2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base17326\sc2.exe | 

"TCP Query User{E3D6096F-D687-4391-802F-9C8E504BDA38}C:\program files (x86)\ea sports\fifa 11\game\fifa.exe" = protocol=6 | dir=in | app=c:\program files (x86)\ea sports\fifa 11\game\fifa.exe | 

"TCP Query User{ECC7901A-04D7-4701-B950-5494EF18BAD1}C:\program files (x86)\ea sports\fifa 11\game\fifa.exe" = protocol=6 | dir=in | app=c:\program files (x86)\ea sports\fifa 11\game\fifa.exe | 

"TCP Query User{EE326966-D45D-48DB-A695-B88696C58807}C:\program files (x86)\steam\steamapps\common\bioshock infinite\binaries\win32\bioshockinfinite.exe" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\bioshock infinite\binaries\win32\bioshockinfinite.exe | 

"TCP Query User{EE632739-DFAA-439F-9A20-7EED4ADBFA5C}C:\program files (x86)\steam\steamapps\yuuuuh11\counter-strike source\hl2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\yuuuuh11\counter-strike source\hl2.exe | 

"TCP Query User{F31A2084-C4A7-465A-B09E-BBAFDE9971D5}C:\program files (x86)\starcraft ii\sc2-x.x.x.x-1.5.0.22342-enus-downloader.exe" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\sc2-x.x.x.x-1.5.0.22342-enus-downloader.exe | 

"TCP Query User{F5F84042-871C-4532-B9AF-CB9F7D370EB5}C:\program files (x86)\starcraft ii\versions\base19132\sc2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base19132\sc2.exe | 

"UDP Query User{178F9112-6F01-42FC-B274-8654CD51C608}C:\program files (x86)\steam\steamapps\common\bioshock infinite\binaries\win32\bioshockinfinite.exe" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\bioshock infinite\binaries\win32\bioshockinfinite.exe | 

"UDP Query User{1F1CB82C-6E49-405D-BE1E-9EC973BEEF5A}M:\spiele\so drauf\call of duty 2\cod2mp_s.exe" = protocol=17 | dir=in | app=m:\spiele\so drauf\call of duty 2\cod2mp_s.exe | 

"UDP Query User{260A372E-EE4C-4862-A97D-0223D5F94EDC}F:\setupwizard\stinstall.exe" = protocol=17 | dir=in | app=f:\setupwizard\stinstall.exe | 

"UDP Query User{27E483E9-106D-4E40-97FA-F8BFF3FDA6A1}C:\program files (x86)\ubisoft\assassin's creed iii\ac3mp.exe" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed iii\ac3mp.exe | 

"UDP Query User{29E9169F-E73D-40BF-AA76-8F5582629A18}C:\program files (x86)\starcraft ii\sc2-x.x.x.x-1.5.0.22342-enus-downloader.exe" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\sc2-x.x.x.x-1.5.0.22342-enus-downloader.exe | 

"UDP Query User{2C4E56DE-C0FD-44EF-AF18-DB115E133F8D}C:\program files (x86)\starcraft ii\support\blizzarddownloader.exe" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\support\blizzarddownloader.exe | 

"UDP Query User{2E114C20-2B5D-456F-B383-FEB81745E173}C:\program files (x86)\steam\steamapps\common\counter-strike global offensive\csgo.exe" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\csgo.exe | 

"UDP Query User{3ECE4BEA-701B-497F-8771-A896DF7A1F42}M:\spiele\call of duty 2 (neumaier)\cod2mp_s.exe" = protocol=17 | dir=in | app=m:\spiele\call of duty 2 (neumaier)\cod2mp_s.exe | 

"UDP Query User{4E1E6155-E885-4D42-A94D-F93B54D76A37}C:\program files (x86)\codemasters\of dragon rising\ofdr.exe" = protocol=17 | dir=in | app=c:\program files (x86)\codemasters\of dragon rising\ofdr.exe | 

"UDP Query User{5315EDC1-945D-4B71-B497-0C73E96B1432}C:\program files (x86)\ea sports\fifa 11\game\fifa.exe" = protocol=17 | dir=in | app=c:\program files (x86)\ea sports\fifa 11\game\fifa.exe | 

"UDP Query User{5514A6A0-0688-490A-97A0-06525A5B999C}C:\program files (x86)\electronic arts\need for speed(tm) hot pursuit\nfs11.exe" = protocol=17 | dir=in | app=c:\program files (x86)\electronic arts\need for speed(tm) hot pursuit\nfs11.exe | 

"UDP Query User{558FD2C1-66A9-443D-8EFE-46FB8C739D8B}C:\program files (x86)\ea games\need for speed underground 2\speed2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\ea games\need for speed underground 2\speed2.exe | 

"UDP Query User{597E7464-9711-40A6-8F2D-ABFD3F825925}C:\program files (x86)\ea sports\fifa 11\game\fifa.exe" = protocol=17 | dir=in | app=c:\program files (x86)\ea sports\fifa 11\game\fifa.exe | 

"UDP Query User{62B97DAF-1AFE-4D94-9611-CE823378FECF}C:\program files (x86)\steam\steamapps\yuuuuh11\counter-strike source\hl2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\yuuuuh11\counter-strike source\hl2.exe | 

"UDP Query User{70720D35-8096-40F7-866A-790CBD486174}C:\program files (x86)\starcraft ii\versions\base18574\sc2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base18574\sc2.exe | 

"UDP Query User{78F5B67F-11CB-46A2-AD8D-E8859DE9425A}C:\programdata\battle.net\agent\agent.1199\agent.exe" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1199\agent.exe | 

"UDP Query User{7BC4321F-2D3E-44B6-8637-798D9FF4736D}C:\program files (x86)\starcraft ii\versions\base19132\sc2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base19132\sc2.exe | 

"UDP Query User{7C27881F-2A14-4A1F-862C-09344309B7D7}C:\program files (x86)\starcraft ii\versions\base17326\sc2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base17326\sc2.exe | 

"UDP Query User{88B53D91-E233-4F7A-95A7-9B4926F8F2AE}C:\users\public\games\world of warcraft\temp\wow-4.3-5.0.15890-enus-downloader.exe" = protocol=17 | dir=in | app=c:\users\public\games\world of warcraft\temp\wow-4.3-5.0.15890-enus-downloader.exe | 

"UDP Query User{8FF1FFD0-5479-47E8-A73A-7B76CE1D5364}C:\program files (x86)\the witcher 2\bin\witcher2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\the witcher 2\bin\witcher2.exe | 

"UDP Query User{9D310639-C854-4B79-8722-9B0F91DC0786}C:\program files (x86)\starcraft ii\versions\base17326\sc2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base17326\sc2.exe | 

"UDP Query User{A2B4E3BA-2AC9-4716-8B0D-4CF9AB718F0F}C:\program files (x86)\steam\steamapps\yuuuuh11\counterstrike source beta\hl2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\yuuuuh11\counterstrike source beta\hl2.exe | 

"UDP Query User{C0A09F95-33AD-4B48-A362-AF9A2FDB5765}C:\program files (x86)\origin games\battlefield 1942\bf1942.exe" = protocol=17 | dir=in | app=c:\program files (x86)\origin games\battlefield 1942\bf1942.exe | 

"UDP Query User{C2CAB9E6-3A57-47CA-BF46-BE9F0AC902BC}C:\program files (x86)\rockstar games\grand theft auto iv\gtaiv.exe" = protocol=17 | dir=in | app=c:\program files (x86)\rockstar games\grand theft auto iv\gtaiv.exe | 

"UDP Query User{C3AA19AB-0ED7-41B9-AC8C-4D4508F1DEFC}C:\program files (x86)\the witcher 2\bin\witcher2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\the witcher 2\bin\witcher2.exe | 

"UDP Query User{EB2A2B0F-C8B1-41ED-93F1-7805EF692F6F}C:\program files (x86)\starcraft ii\versions\base18574\sc2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base18574\sc2.exe | 

"UDP Query User{EC540408-EF04-4076-A76D-5EB6A4014AB5}C:\program files (x86)\steam\steamapps\yuuuuh11\counter-strike source\hl2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\yuuuuh11\counter-strike source\hl2.exe | 

"UDP Query User{F9E6553D-BBB1-414E-809F-0C5B4A735E3A}C:\program files (x86)\starcraft ii\versions\base18092\sc2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base18092\sc2.exe | 

"UDP Query User{FD67ACAB-6102-4671-A9CE-EFDA71A540FD}C:\program files (x86)\rockstar games\grand theft auto iv\gtaiv.exe" = protocol=17 | dir=in | app=c:\program files (x86)\rockstar games\grand theft auto iv\gtaiv.exe | 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)

"{1280E900-35DA-4E08-A700-B79A5B2B8532}" = Microsoft Antimalware Service DE-DE Language Pack

"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219

"{26280024-DFB7-4967-90DB-7F9C6660D01E}" = HP MediaSmart SmartMenu

"{2EDC2FA3-1F34-34E5-9085-588C9EFD1CC6}" = Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610

"{4F396B08-301D-4E53-A372-95A7E93ABD04}" = HP Photosmart 5520 series - Grundlegende Software für das Gerät

"{5A68A656-979F-4168-8795-E2E368AA4DC2}" = iTunes

"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161

"{6DD01FF3-63CE-436B-96DB-61363EAA4EB8}" = MobileMe Control Panel

"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour

"{764384C5-BCA9-307C-9AAC-FD443662686A}" = Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610

"{787136D2-F0F8-4625-AA3F-72D7795AC842}" = Apple Mobile Device Support

"{7DEBE4EB-6B40-3766-BB35-5CBBC385DA37}" = Microsoft .NET Framework 4.5.1

"{81E20D41-C277-4526-934D-F2380AF91B78}" = iCloud

"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17

"{8338783A-0968-3B85-AFC7-BAAE0A63DC50}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570

"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight

"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007

"{90120000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2007

"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager

"{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033" = Microsoft .NET Framework 4.5.1

"{9B48B0AC-C813-4174-9042-476A887592C7}" = Windows Live ID Sign-in Assistant

"{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}" = Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175

"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 337.88

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 337.88

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 337.88

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience" = NVIDIA GeForce Experience 1.8.2.1

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller-Treiber 337.88

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.13.1220

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 11.10.13

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_GFExperience.LEDVisualizer" = NVIDIA LED Visualizer 1.0

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_GFExperience.NvStreamC" = GeForce Experience NvStream Client Components

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_GFExperience.NvStreamSrv" = SHIELD Streaming

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD-Audiotreiber 1.3.30.1

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Network.Service" = NVIDIA Network Service

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_ShadowPlay" = NVIDIA ShadowPlay 11.10.13

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Update.Core" = NVIDIA Update Core

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_VirtualAudio.Driver" = NVIDIA Virtual Audio 1.2.20

"{B3B750C0-8C22-439D-B7CE-67F3ED99CC2B}" = Microsoft Xbox 360 Accessories 1.2

"{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053

"{BFAE8D5B-F918-486F-B74E-90762DF11C5C}" = Microsoft Security Client

"{DC911ADF-7B60-40F2-A112-FB1EB6402D07}" = Microsoft Security Client DE-DE Language Pack

"{EE936C7A-EA40-31D5-9B65-8E3E089C3828}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148

"CCleaner" = CCleaner

"Defraggler" = Defraggler

"GIMP-2_is1" = GIMP 2.8.2

"Microsoft Security Client" = Microsoft Security Essentials

"NVIDIA Display Control Panel" = NVIDIA Display Control Panel

"sp6" = Logitech SetPoint 6.32

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{025A585C-0C66-413D-80D2-4C05CB699771}" = Dead Space

"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam

"{086BADF8-9B1F-4E89-B207-2EDA520972D6}" = Grand Theft Auto San Andreas

"{0E532C84-4275-41B3-9D81-D4A1A20D8EE7}" = PlayStation(R)Store

"{0EDBEB2B-7C8D-42E6-8312-0F84394A3223}" = Windows Media Center Add-in for Silverlight

"{111EE7DF-FC45-40C7-98A7-753AC46B12FB}" = QuickTime 7

"{155F4A0E-76ED-45A2-91FB-FF2A2133C31A}" = Risen

"{1A4052AB-BA77-44F7-8EE7-9F9131BFD7A6}" = OF Dragon Rising

"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite Deluxe

"{254C37AA-6B72-4300-84F6-98A82419187E}" = ActiveCheck component for HP Active Support Library

"{3023EBDA-BF1B-4831-B347-E5018555F26E}" = HP MediaSmart Movie Themes

"{33999F1F-EA46-4E55-A239-1BA803235396}" = Hercules DJ Products Series drivers

"{33A22B2D-55BA-4508-B767-BF2E9C21A73F}" = Assassin's Creed Revelations 1.03

"{34EB6245-C8D0-4D8A-B8D8-EEBFF7A91485}" = Firebird SQL Server - MAGIX Edition

"{39D0E034-1042-4905-BECB-5502909FCB7C}" = Microsoft Works

"{3D6AD258-61EA-35F5-812C-B7A02152996E}" = Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610

"{3D9CF3CA-3AB0-4A82-9853-D7C43FD1D775}" = ANNO 1404

"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = eReg

"{3FEA6CD1-EA13-4CE7-A74E-A74A4A0A7B5C}" = FIFA 11

"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go

"{44B2A0AB-412E-4F8C-B058-D1E8AECCDFF5}" = PowerRecover

"{4CB0307C-565E-4441-86BE-0DF2E4FB828C}" = Microsoft Games for Windows Marketplace

"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.11

"{4F46FDB9-B906-47BF-B3D5-C62E01B3C5EE}" = HP Support Assistant

"{5454083B-1308-4485-BF17-1110000D8301}" = Grand Theft Auto IV

"{579BA58C-F33D-4970-9953-B94B43768AC3}" = Grand Theft Auto IV

"{5B295588-59C1-4386-9F85-BB4BEDCB0D22}" = HP Customer Experience Enhancements

"{5BE7BD06-512B-43bf-AD78-3BD2A5F5F7B3}" = Battlefield 1942™

"{5E1375CB-6792-4464-8715-CC3EC83D48FA}" = VirtualDJ Home FREE

"{640A03B3-4E6B-4440-A350-E6A8D6348F12}" = HP Photosmart 5520 series Hilfe

"{669D4A35-146B-4314-89F1-1AC3D7B88367}" = HPAsset component for HP Active Support Library

"{66A405D2-BA14-4594-BF36-B3B544F0754E}" = Stronghold Legends

"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729

"{6F1C00D2-25C2-4CBA-8126-AE9A6E2E9CD5}" = HP Update

"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable

"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable

"{76285C16-411A-488A-BCE3-C83CB933D8CF}" = Battlefield 3™

"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update

"{7E19B002-4CA3-4C9F-BA92-91D101B97219}" = James Cameron's AVATAR(tm): DAS SPIEL

"{7FA32C2E-E218-4A04-966D-DECCB0B9C81E}" = MAGIX Speed 2 (MSI)

"{80407BA7-7763-4395-AB98-5233F1B34E65}" = NVIDIA PhysX

"{815D1E58-17F7-4DF4-BF8E-59D2EE575FCA}" = MAGIX Video deluxe 16 Plus Sonderedition

"{832D9DE0-8AFC-4689-9819-4DBBDEBD3E4F}" = Microsoft Games for Windows - LIVE Redistributable

"{83A606F5-BF6F-42ED-9F33-B9F74297CDED}" = Need for Speed(TM) Hot Pursuit

"{8570BEE8-0CA3-4977-9AB1-80ED93F0513C}" = Assassin's Creed II

"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570

"{886F91D5-4B45-45DC-938E-6B0276C6B015}" = Solid Edge V20

"{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher

"{8CFA9151-6404-409A-AF22-4632D04582FD}" = Assassin's Creed

"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007

"{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007

"{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007

"{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007

"{90120000-001F-0407-0000-0000000FF1CE}_HOMESTUDENTR_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007

"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007

"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007

"{90120000-001F-0410-0000-0000000FF1CE}_HOMESTUDENTR_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System

"{90120000-002A-0000-1000-0000000FF1CE}_HOMESTUDENTR_{664655D8-B9BB-455D-8A58-7EAF7B0B2862}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-002A-0407-1000-0000000FF1CE}_HOMESTUDENTR_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007

"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007

"{90120000-006E-0407-0000-0000000FF1CE}_HOMESTUDENTR_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007

"{90120000-00A1-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In

"{907B4640-266B-4A21-92FB-CD1A86CD0F63}" = RollerCoaster Tycoon 3

"{909F8EBC-EC7F-48FF-0085-475D818F0F31}" = Need for Speed Underground 2

"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007

"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German)

"{95716cce-fc71-413f-8ad5-56c2892d4b3a}" = Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610

"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

"{9D15E813-0C26-41E7-ABC5-3EB06FF1B3CF}" = Assassin's Creed(R) III v1.05

"{9D318C86-AF4C-409F-A6AC-7183FF4CF424}" = Internet-TV für Windows Media Center

"{a1909659-0a08-4554-8af1-2175904903a1}" = Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610

"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper

"{AC76BA86-7AD7-1031-7B44-A95000000001}" = Adobe Reader 9.5.2 - Deutsch

"{B2EE25B9-5B00-4ACF-94F0-92433C28C39E}" = HP MediaSmart Music/Photo/Video

"{B6659DD8-00A7-4A24-BBFB-C1F6982E5D66}" = PlayStation(R)Network Downloader

"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call

"{B8AC1A89-FFD1-4F97-8051-E505A160F562}" = HP Odometer

"{B9A03B7B-E0FF-4FB3-BA83-762E58A1B0AA}" = HP Support Information

"{BE4BA698-8533-4F77-9559-C7F3F78C0B05}" = Assassin's Creed Brotherhood

"{C37DA51B-6B40-418C-BF7B-0E8DF8E80608}" = Anno 1404

"{C57BCDE1-7CB9-467D-B3BA-7E119916CDC1}" = Norton Online Backup aktivieren

"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint

"{C611CF88-969D-43E6-A877-D6D6439DD081}" = HP Remote Solution

"{C779648B-410E-4BBA-B75B-5815BCEFE71D}" = Safari

"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector

"{D845DAF3-B887-4D5E-BFF8-8441FCF6F468}" = Tune Sweeper

"{D9DAD0FF-495A-472B-9F10-BAE430A26682}" = Apple Application Support

"{DCCAD079-F92C-44DA-B258-624FC6517A5A}" = HP MediaSmart DVD

"{DD6C316A-FE75-4FBB-9D22-4C1920232B72}" = LightScribe System Software

"{E3B9C5A9-BD7A-4B56-B754-FAEA7DD6FA88}" = Far Cry 3

"{E7D4E834-93EB-351F-B8FB-82CDAE623003}" = Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610

"{E9E34215-82EF-4909-BE2F-F581F0DC9062}" = DirectX for Managed Code Update (Summer 2004)

"{F0A209B7-7F85-4BDD-8F1F-B98EEAD9E04B}" = The Witcher 2

"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219

"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver

"{F31C9A68-7F07-4B96-AC58-F71D5DF3DA89}" = MAGIX Screenshare

"{F3B912F5-EB57-45AA-B3D1-EB532BCF6EF8}" = HP Setup

"Adobe Flash Player ActiveX" = Adobe Flash Player 13 ActiveX

"Adobe Flash Player Plugin" = Adobe Flash Player 13 Plugin

"Battlelog Web Plugins" = Battlelog Web Plugins

"Diablo III" = Diablo III

"EasyBits Magic Desktop" = Magic Desktop

"ESN Sonar-0.70.4" = ESN Sonar

"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.12.4.622

"HOMESTUDENTR" = Microsoft Office Home and Student 2007

"HP Photo Creations" = HP Photo Creations

"HP Remote Solution" = HP Remote Solution

"InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite Deluxe

"InstallShield_{3023EBDA-BF1B-4831-B347-E5018555F26E}" = HP MediaSmart Movie Themes

"InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go

"InstallShield_{B2EE25B9-5B00-4ACF-94F0-92433C28C39E}" = HP MediaSmart Music/Photo/Video

"InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint

"InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector

"InstallShield_{DCCAD079-F92C-44DA-B258-624FC6517A5A}" = HP MediaSmart DVD

"MAGIX_MSI_Videodeluxe16_plus" = MAGIX Video deluxe 16 Plus Sonderedition

"Malwarebytes Anti-Malware_is1" = Malwarebytes Anti-Malware Version 2.0.2.1012

"Mozilla Firefox 14.0.1 (x86 de)" = Mozilla Firefox 14.0.1 (x86 de)

"MozillaMaintenanceService" = Mozilla Maintenance Service

"MySSID_is1" = Vtune 7.11

"NVIDIA StereoUSB Driver" = NVIDIA 3D Vision Controller Driver

"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver

"Origin" = Origin

"phase-6" = phase-6 2.3.1

"PunkBusterSvc" = PunkBuster Services

"Revo Uninstaller" = Revo Uninstaller 1.95

"SpeedFan" = SpeedFan (remove only)

"StarCraft II" = StarCraft II

"Steam App 10" = Counter-Strike

"Steam App 100" = Counter-Strike: Condition Zero Deleted Scenes

"Steam App 209160" = Call of Duty: Ghosts

"Steam App 209170" = Call of Duty: Ghosts - Multiplayer

"Steam App 213850" = Magic 2014 

"Steam App 240" = Counter-Strike: Source

"Steam App 260" = Counter-Strike: Source Beta

"Steam App 63380" = Sniper Elite V2

"Steam App 72850" = The Elder Scrolls V: Skyrim

"Steam App 730" = Counter-Strike: Global Offensive

"Steam App 745" = Counter-Strike: Global Offensive - SDK

"Steam App 80" = Counter-Strike: Condition Zero

"Uplay" = Uplay

"Virtual DJ - Atomix Productions" = Virtual DJ - Atomix Productions

"VLC media player" = VLC media player 1.1.11

"WildTangent hp Master Uninstall" = HP Games

"World of Warcraft" = World of Warcraft

 
 ========== Last 20 Event Log Errors ==========

 

[ Application Events ]

Error - 18.06.2014 18:26:53 | Computer Name = HP-PC | Source = SideBySide | ID = 16842832

Description = Fehler beim Generieren des Aktivierungskontexts für "C:\Users\Tom\Desktop\esetsmartinstaller_deu.exe".

 Fehler in  Manifest- oder Richtliniendatei "" in Zeile .  Eine für die Anwendung erforderliche

 Komponentenversion steht in Konflikt mit  einer anderen, bereits aktiven Komponentenversion.

In

 Konflikt stehende Komponenten:.  Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente

 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

 

Error - 18.06.2014 18:27:06 | Computer Name = HP-PC | Source = SideBySide | ID = 16842832

Description = Fehler beim Generieren des Aktivierungskontexts für "C:\Users\Tom\Desktop\esetsmartinstaller_deu.exe".

 Fehler in  Manifest- oder Richtliniendatei "" in Zeile .  Eine für die Anwendung erforderliche

 Komponentenversion steht in Konflikt mit  einer anderen, bereits aktiven Komponentenversion.

In

 Konflikt stehende Komponenten:.  Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente

 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

 

Error - 18.06.2014 18:28:08 | Computer Name = HP-PC | Source = Microsoft-Windows-LoadPerf | ID = 3012

Description = Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung

 werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter

 ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste

 DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich

 und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

 

Error - 18.06.2014 18:28:08 | Computer Name = HP-PC | Source = Microsoft-Windows-LoadPerf | ID = 3012

Description = Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung

 werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter

 ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste

 DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich

 und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

 

Error - 18.06.2014 18:28:08 | Computer Name = HP-PC | Source = Microsoft-Windows-LoadPerf | ID = 3011

Description = Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren

 für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.

 

Error - 18.06.2014 18:34:06 | Computer Name = HP-PC | Source = SideBySide | ID = 16842832

Description = Fehler beim Generieren des Aktivierungskontexts für "C:\Program Files

 (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe". Fehler in  Manifest- oder

 Richtliniendatei "" in Zeile .  Eine für die Anwendung erforderliche Komponentenversion

 steht in Konflikt mit  einer anderen, bereits aktiven Komponentenversion.  In Konflikt

 stehende Komponenten:.  Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente

 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

 

Error - 20.06.2014 05:58:07 | Computer Name = HP-PC | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: svchost.exe_stisvc, Version: 6.1.7600.16385,

 Zeitstempel: 0x4a5bc3c1  Name des fehlerhaften Moduls: wiaservc.dll, Version: 6.1.7601.17514,

 Zeitstempel: 0x4ce7ca0f  Ausnahmecode: 0x40000015  Fehleroffset: 0x0000000000047a6b

ID

 des fehlerhaften Prozesses: 0x84c  Startzeit der fehlerhaften Anwendung: 0x01cf8c6e206ec26d

Pfad

 der fehlerhaften Anwendung: C:\Windows\system32\svchost.exe  Pfad des fehlerhaften

 Moduls: c:\windows\system32\wiaservc.dll  Berichtskennung: 60b5ce9a-f861-11e3-9057-4061860db83a

 

Error - 20.06.2014 06:04:22 | Computer Name = HP-PC | Source = Microsoft-Windows-LoadPerf | ID = 3012

Description = Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung

 werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter

 ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste

 DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich

 und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

 

Error - 20.06.2014 06:04:23 | Computer Name = HP-PC | Source = Microsoft-Windows-LoadPerf | ID = 3012

Description = Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung

 werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter

 ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste

 DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich

 und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

 

Error - 20.06.2014 06:04:23 | Computer Name = HP-PC | Source = Microsoft-Windows-LoadPerf | ID = 3011

Description = Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren

 für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.

 

[ Hewlett-Packard Events ]

Error - 26.02.2010 14:45:48 | Computer Name = HP-PC | Source = Hewlett-Packard | ID = 0

Description = de-DE Der Objektverweis wurde nicht auf eine Objektinstanz festgelegt.

HPSF
 

   bei HPAssistant.Pages.MaintainAnalyzing.MaintainAnalyzing_Unloaded(Object sender,

 RoutedEventArgs e)     bei System.Windows.RoutedEventHandlerInfo.InvokeHandler(Object

 target, RoutedEventArgs routedEventArgs)     bei System.Windows.EventRoute.InvokeHandlersImpl(Object

 source, RoutedEventArgs args, Boolean reRaised)     bei System.Windows.UIElement.RaiseEventImpl(DependencyObject

 sender, RoutedEventArgs args)     bei System.Windows.UIElement.RaiseEvent(RoutedEventArgs

 e)     bei System.Windows.BroadcastEventHelper.BroadcastEvent(DependencyObject root,

 RoutedEvent routedEvent)     bei System.Windows.BroadcastEventHelper.BroadcastUnloadedEvent(Object

 root)     bei MS.Internal.LoadedOrUnloadedOperation.DoWork()     bei System.Windows.Media.MediaContext.FireLoadedPendingCallbacks()
 

   bei System.Windows.Media.MediaContext.FireInvokeOnRenderCallbacks()     bei System.Windows.Media.MediaContext.RenderMessageHandlerCore(Object

 resizedCompositionTarget)     bei System.Windows.Media.MediaContext.RenderMessageHandler(Object

 resizedCompositionTarget)     bei System.Windows.Threading.ExceptionWrapper.InternalRealCall(Delegate

 callback, Object args, Boolean isSingleParameter)     bei System.Windows.Threading.ExceptionWrapper.TryCatchWhen(Object

 source, Delegate callback, Object args, Boolean isSingleParameter, Delegate catchHandler)
 

 

Error - 20.04.2010 11:29:22 | Computer Name = HP-PC | Source = Hewlett-Packard | ID = 0

Description = de-DE Der Objektverweis wurde nicht auf eine Objektinstanz festgelegt.

HPSF
 

   bei HPAssistant.Pages.MaintainAnalyzing.MaintainAnalyzing_Unloaded(Object sender,

 RoutedEventArgs e)     bei System.Windows.RoutedEventHandlerInfo.InvokeHandler(Object

 target, RoutedEventArgs routedEventArgs)     bei System.Windows.EventRoute.InvokeHandlersImpl(Object

 source, RoutedEventArgs args, Boolean reRaised)     bei System.Windows.UIElement.RaiseEventImpl(DependencyObject

 sender, RoutedEventArgs args)     bei System.Windows.UIElement.RaiseEvent(RoutedEventArgs

 e)     bei System.Windows.BroadcastEventHelper.BroadcastEvent(DependencyObject root,

 RoutedEvent routedEvent)     bei System.Windows.BroadcastEventHelper.BroadcastUnloadedEvent(Object

 root)     bei MS.Internal.LoadedOrUnloadedOperation.DoWork()     bei System.Windows.Media.MediaContext.FireLoadedPendingCallbacks()
 

   bei System.Windows.Media.MediaContext.FireInvokeOnRenderCallbacks()     bei System.Windows.Media.MediaContext.RenderMessageHandlerCore(Object

 resizedCompositionTarget)     bei System.Windows.Media.MediaContext.AnimatedRenderMessageHandler(Object

 resizedCompositionTarget)     bei System.Windows.Threading.ExceptionWrapper.InternalRealCall(Delegate

 callback, Object args, Boolean isSingleParameter)     bei System.Windows.Threading.ExceptionWrapper.TryCatchWhen(Object

 source, Delegate callback, Object args, Boolean isSingleParameter, Delegate catchHandler)
 

 

Error - 20.06.2010 12:40:13 | Computer Name = HP-PC | Source = Hewlett-Packard | ID = 0

Description = de-DE Der Objektverweis wurde nicht auf eine Objektinstanz festgelegt.

HPSF
 

   bei HPAssistant.Pages.MaintainAnalyzing.MaintainAnalyzing_Unloaded(Object sender,

 RoutedEventArgs e)     bei System.Windows.RoutedEventHandlerInfo.InvokeHandler(Object

 target, RoutedEventArgs routedEventArgs)     bei System.Windows.EventRoute.InvokeHandlersImpl(Object

 source, RoutedEventArgs args, Boolean reRaised)     bei System.Windows.UIElement.RaiseEventImpl(DependencyObject

 sender, RoutedEventArgs args)     bei System.Windows.UIElement.RaiseEvent(RoutedEventArgs

 e)     bei System.Windows.BroadcastEventHelper.BroadcastEvent(DependencyObject root,

 RoutedEvent routedEvent)     bei System.Windows.BroadcastEventHelper.BroadcastUnloadedEvent(Object

 root)     bei MS.Internal.LoadedOrUnloadedOperation.DoWork()     bei System.Windows.Media.MediaContext.FireLoadedPendingCallbacks()
 

   bei System.Windows.Media.MediaContext.FireInvokeOnRenderCallbacks()     bei System.Windows.Media.MediaContext.RenderMessageHandlerCore(Object

 resizedCompositionTarget)     bei System.Windows.Media.MediaContext.RenderMessageHandler(Object

 resizedCompositionTarget)     bei System.Windows.Threading.ExceptionWrapper.InternalRealCall(Delegate

 callback, Object args, Boolean isSingleParameter)     bei System.Windows.Threading.ExceptionWrapper.TryCatchWhen(Object

 source, Delegate callback, Object args, Boolean isSingleParameter, Delegate catchHandler)
 

 

Error - 24.06.2010 07:57:47 | Computer Name = HP-PC | Source = Hewlett-Packard | ID = 0

Description = de-DE Der Objektverweis wurde nicht auf eine Objektinstanz festgelegt.

HPSF
 

   bei HPAssistant.Pages.MaintainAnalyzing.MaintainAnalyzing_Unloaded(Object sender,

 RoutedEventArgs e)     bei System.Windows.RoutedEventHandlerInfo.InvokeHandler(Object

 target, RoutedEventArgs routedEventArgs)     bei System.Windows.EventRoute.InvokeHandlersImpl(Object

 source, RoutedEventArgs args, Boolean reRaised)     bei System.Windows.UIElement.RaiseEventImpl(DependencyObject

 sender, RoutedEventArgs args)     bei System.Windows.UIElement.RaiseEvent(RoutedEventArgs

 e)     bei System.Windows.BroadcastEventHelper.BroadcastEvent(DependencyObject root,

 RoutedEvent routedEvent)     bei System.Windows.BroadcastEventHelper.BroadcastUnloadedEvent(Object

 root)     bei MS.Internal.LoadedOrUnloadedOperation.DoWork()     bei System.Windows.Media.MediaContext.FireLoadedPendingCallbacks()
 

   bei System.Windows.Media.MediaContext.FireInvokeOnRenderCallbacks()     bei System.Windows.Media.MediaContext.RenderMessageHandlerCore(Object

 resizedCompositionTarget)     bei System.Windows.Media.MediaContext.AnimatedRenderMessageHandler(Object

 resizedCompositionTarget)     bei System.Windows.Threading.ExceptionWrapper.InternalRealCall(Delegate

 callback, Object args, Boolean isSingleParameter)     bei System.Windows.Threading.ExceptionWrapper.TryCatchWhen(Object

 source, Delegate callback, Object args, Boolean isSingleParameter, Delegate catchHandler)
 

 

Error - 21.07.2010 08:28:34 | Computer Name = HP-PC | Source = Hewlett-Packard | ID = 0

Description = de-DE Der Objektverweis wurde nicht auf eine Objektinstanz festgelegt.

HPSF
 

   bei HPAssistant.Pages.MaintainAnalyzing.MaintainAnalyzing_Unloaded(Object sender,

 RoutedEventArgs e)     bei System.Windows.RoutedEventHandlerInfo.InvokeHandler(Object

 target, RoutedEventArgs routedEventArgs)     bei System.Windows.EventRoute.InvokeHandlersImpl(Object

 source, RoutedEventArgs args, Boolean reRaised)     bei System.Windows.UIElement.RaiseEventImpl(DependencyObject

 sender, RoutedEventArgs args)     bei System.Windows.UIElement.RaiseEvent(RoutedEventArgs

 e)     bei System.Windows.BroadcastEventHelper.BroadcastEvent(DependencyObject root,

 RoutedEvent routedEvent)     bei System.Windows.BroadcastEventHelper.BroadcastUnloadedEvent(Object

 root)     bei MS.Internal.LoadedOrUnloadedOperation.DoWork()     bei System.Windows.Media.MediaContext.FireLoadedPendingCallbacks()
 

   bei System.Windows.Media.MediaContext.FireInvokeOnRenderCallbacks()     bei System.Windows.Media.MediaContext.RenderMessageHandlerCore(Object

 resizedCompositionTarget)     bei System.Windows.Media.MediaContext.AnimatedRenderMessageHandler(Object

 resizedCompositionTarget)     bei System.Windows.Threading.ExceptionWrapper.InternalRealCall(Delegate

 callback, Object args, Boolean isSingleParameter)     bei System.Windows.Threading.ExceptionWrapper.TryCatchWhen(Object

 source, Delegate callback, Object args, Boolean isSingleParameter, Delegate catchHandler)
 

 

Error - 19.11.2010 09:33:57 | Computer Name = HP-PC | Source = Hewlett-Packard | ID = 0

Description = de-DE Der Objektverweis wurde nicht auf eine Objektinstanz festgelegt.

HPSF
 

   bei HPAssistant.Pages.MaintainAnalyzing.MaintainAnalyzing_Unloaded(Object sender,

 RoutedEventArgs e)     bei System.Windows.RoutedEventHandlerInfo.InvokeHandler(Object

 target, RoutedEventArgs routedEventArgs)     bei System.Windows.EventRoute.InvokeHandlersImpl(Object

 source, RoutedEventArgs args, Boolean reRaised)     bei System.Windows.UIElement.RaiseEventImpl(DependencyObject

 sender, RoutedEventArgs args)     bei System.Windows.UIElement.RaiseEvent(RoutedEventArgs

 e)     bei System.Windows.BroadcastEventHelper.BroadcastEvent(DependencyObject root,

 RoutedEvent routedEvent)     bei System.Windows.BroadcastEventHelper.BroadcastUnloadedEvent(Object

 root)     bei MS.Internal.LoadedOrUnloadedOperation.DoWork()     bei System.Windows.Media.MediaContext.FireLoadedPendingCallbacks()
 

   bei System.Windows.Media.MediaContext.FireInvokeOnRenderCallbacks()     bei System.Windows.Media.MediaContext.RenderMessageHandlerCore(Object

 resizedCompositionTarget)     bei System.Windows.Media.MediaContext.RenderMessageHandler(Object

 resizedCompositionTarget)     bei System.Windows.Threading.ExceptionWrapper.InternalRealCall(Delegate

 callback, Object args, Boolean isSingleParameter)     bei System.Windows.Threading.ExceptionWrapper.TryCatchWhen(Object

 source, Delegate callback, Object args, Boolean isSingleParameter, Delegate catchHandler)
 

 

Error - 30.12.2010 15:06:02 | Computer Name = HP-PC | Source = Hewlett-Packard | ID = 0

Description = de-DE Der Objektverweis wurde nicht auf eine Objektinstanz festgelegt.

HPSF
 

   bei HPAssistant.Pages.MaintainAnalyzing.MaintainAnalyzing_Unloaded(Object sender,

 RoutedEventArgs e)     bei System.Windows.RoutedEventHandlerInfo.InvokeHandler(Object

 target, RoutedEventArgs routedEventArgs)     bei System.Windows.EventRoute.InvokeHandlersImpl(Object

 source, RoutedEventArgs args, Boolean reRaised)     bei System.Windows.UIElement.RaiseEventImpl(DependencyObject

 sender, RoutedEventArgs args)     bei System.Windows.UIElement.RaiseEvent(RoutedEventArgs

 e)     bei System.Windows.BroadcastEventHelper.BroadcastEvent(DependencyObject root,

 RoutedEvent routedEvent)     bei System.Windows.BroadcastEventHelper.BroadcastUnloadedEvent(Object

 root)     bei MS.Internal.LoadedOrUnloadedOperation.DoWork()     bei System.Windows.Media.MediaContext.FireLoadedPendingCallbacks()
 

   bei System.Windows.Media.MediaContext.FireInvokeOnRenderCallbacks()     bei System.Windows.Media.MediaContext.RenderMessageHandlerCore(Object

 resizedCompositionTarget)     bei System.Windows.Media.MediaContext.AnimatedRenderMessageHandler(Object

 resizedCompositionTarget)     bei System.Windows.Threading.ExceptionWrapper.InternalRealCall(Delegate

 callback, Object args, Boolean isSingleParameter)     bei System.Windows.Threading.ExceptionWrapper.TryCatchWhen(Object

 source, Delegate callback, Object args, Boolean isSingleParameter, Delegate catchHandler)
 

 

Error - 30.12.2010 15:07:13 | Computer Name = HP-PC | Source = Hewlett-Packard | ID = 0

Description = de-DE Ein Aufrufziel hat einen Ausnahmefehler verursacht. mscorlib   

 bei System.RuntimeMethodHandle._InvokeMethodFast(Object target, Object[] arguments,

 SignatureStruct& sig, MethodAttributes methodAttributes, RuntimeTypeHandle typeOwner)
 

   bei System.RuntimeMethodHandle.InvokeMethodFast(Object target, Object[] arguments,

 Signature sig, MethodAttributes methodAttributes, RuntimeTypeHandle typeOwner)   

  bei System.Reflection.RuntimeMethodInfo.Invoke(Object obj, BindingFlags invokeAttr,

 Binder binder, Object[] parameters, CultureInfo culture, Boolean skipVisibilityChecks)
 

   bei System.Delegate.DynamicInvokeImpl(Object[] args)     bei System.Windows.Threading.ExceptionWrapper.InternalRealCall(Delegate

 callback, Object args, Boolean isSingleParameter)     bei System.Windows.Threading.ExceptionWrapper.TryCatchWhen(Object

 source, Delegate callback, Object args, Boolean isSingleParameter, Delegate catchHandler)

Der

 Objektverweis wurde nicht auf eine Objektinstanz festgelegt.

 

Error - 20.03.2011 15:06:52 | Computer Name = HP-PC | Source = Hewlett-Packard | ID = 0

Description = de-DE Der Objektverweis wurde nicht auf eine Objektinstanz festgelegt.

HPSF
 

   bei HPAssistant.Pages.MaintainAnalyzing.MaintainAnalyzing_Unloaded(Object sender,

 RoutedEventArgs e)     bei System.Windows.RoutedEventHandlerInfo.InvokeHandler(Object

 target, RoutedEventArgs routedEventArgs)     bei System.Windows.EventRoute.InvokeHandlersImpl(Object

 source, RoutedEventArgs args, Boolean reRaised)     bei System.Windows.UIElement.RaiseEventImpl(DependencyObject

 sender, RoutedEventArgs args)     bei System.Windows.UIElement.RaiseEvent(RoutedEventArgs

 e)     bei System.Windows.BroadcastEventHelper.BroadcastEvent(DependencyObject root,

 RoutedEvent routedEvent)     bei System.Windows.BroadcastEventHelper.BroadcastUnloadedEvent(Object

 root)     bei MS.Internal.LoadedOrUnloadedOperation.DoWork()     bei System.Windows.Media.MediaContext.FireLoadedPendingCallbacks()
 

   bei System.Windows.Media.MediaContext.FireInvokeOnRenderCallbacks()     bei System.Windows.Media.MediaContext.RenderMessageHandlerCore(Object

 resizedCompositionTarget)     bei System.Windows.Media.MediaContext.AnimatedRenderMessageHandler(Object

 resizedCompositionTarget)     bei System.Windows.Threading.ExceptionWrapper.InternalRealCall(Delegate

 callback, Object args, Boolean isSingleParameter)     bei System.Windows.Threading.ExceptionWrapper.TryCatchWhen(Object

 source, Delegate callback, Object args, Boolean isSingleParameter, Delegate catchHandler)
 

 

[ OSession Events ]

Error - 07.02.2012 14:02:53 | Computer Name = HP-PC | Source = Microsoft Office 12 Sessions | ID = 7001

Description = ID: 0, Application Name: Microsoft Office Word, Application Version:

 12.0.6612.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 5931

 seconds with 2040 seconds of active time.  This session ended with a crash.

 

Error - 27.11.2013 14:26:18 | Computer Name = HP-PC | Source = Microsoft Office 12 Sessions | ID = 7001

Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:

 12.0.6683.5002, Microsoft Office Version: 12.0.6612.1000. This session lasted 6871

 seconds with 5520 seconds of active time.  This session ended with a crash.

 

[ System Events ]

Error - 18.06.2014 07:14:17 | Computer Name = HP-PC | Source = Service Control Manager | ID = 7000

Description = Der Dienst "TBPanel" wurde aufgrund folgenden Fehlers nicht gestartet:

   %%2

 

Error - 18.06.2014 07:15:24 | Computer Name = HP-PC | Source = DCOM | ID = 10016

Description = 

 

Error - 18.06.2014 07:15:27 | Computer Name = HP-PC | Source = DCOM | ID = 10016

Description = 

 

Error - 20.06.2014 05:57:59 | Computer Name = HP-PC | Source = Service Control Manager | ID = 7000

Description = Der Dienst "TBPanel" wurde aufgrund folgenden Fehlers nicht gestartet:

   %%2

 

Error - 20.06.2014 05:58:09 | Computer Name = HP-PC | Source = Service Control Manager | ID = 7034

Description = Dienst "Windows-Bilderfassung (WIA)" wurde unerwartet beendet. Dies

 ist bereits 1 Mal passiert.

 

Error - 20.06.2014 05:59:07 | Computer Name = HP-PC | Source = DCOM | ID = 10016

Description = 

 

Error - 20.06.2014 06:00:15 | Computer Name = HP-PC | Source = DCOM | ID = 10010

Description = 

 

Error - 20.06.2014 06:00:43 | Computer Name = HP-PC | Source = DCOM | ID = 10010

Description = 

 

 

< End of report >

tombo11

20.06.2014 11:25

Code:

OTL logfile created on: 20.06.2014 12:06:31 - Run 1

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Tom\Desktop

64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.11.9600.17126)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

7,99 Gb Total Physical Memory | 5,38 Gb Available Physical Memory | 67,38% Memory free

15,98 Gb Paging File | 13,35 Gb Available in Paging File | 83,53% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 684,15 Gb Total Space | 15,78 Gb Free Space | 2,31% Space Free | Partition Type: NTFS

Drive D: | 14,39 Gb Total Space | 2,52 Gb Free Space | 17,54% Space Free | Partition Type: NTFS

Drive E: | 698,64 Gb Total Space | 57,76 Gb Free Space | 8,27% Space Free | Partition Type: NTFS

Drive F: | 6,31 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF

Drive G: | 3,80 Gb Total Space | 3,80 Gb Free Space | 99,99% Space Free | Partition Type: FAT32

 

Computer Name: HP-PC | User Name: HP | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2014.06.20 12:04:45 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Tom\Desktop\OTL.exe

PRC - [2014.05.20 01:10:40 | 000,413,128 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

PRC - [2014.05.12 07:24:42 | 000,860,472 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe

PRC - [2014.05.12 07:24:40 | 001,809,720 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe

PRC - [2014.05.12 07:24:34 | 006,970,168 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe

PRC - [2014.02.05 11:32:47 | 002,234,144 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe

PRC - [2014.02.05 11:32:34 | 001,593,632 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

PRC - [2013.03.26 18:49:14 | 000,076,888 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe

PRC - [2009.12.01 20:49:52 | 000,210,216 | ---- | M] (CyberLink) -- c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe

PRC - [2009.10.20 14:50:34 | 000,128,296 | ---- | M] (CyberLink Corp.) -- c:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe

PRC - [2009.08.27 18:09:10 | 001,253,376 | ---- | M] (MAGIX AG) -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe

PRC - [2009.06.04 19:03:32 | 000,186,904 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe

PRC - [2009.06.04 19:03:06 | 000,354,840 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2014.02.12 20:58:32 | 000,073,544 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll

MOD - [2014.02.12 20:58:10 | 001,044,808 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll

MOD - [2009.12.01 20:49:50 | 000,931,112 | ---- | M] () -- c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMediaLibrary.dll

 

 
 ========== Services (SafeList) ==========

 

SRV:64bit: - [2014.05.30 11:21:05 | 000,111,616 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\IEEtwCollector.exe -- (IEEtwCollectorService)

SRV:64bit: - [2012.06.09 19:54:41 | 000,354,816 | ---- | M] (Parental Solutions Inc.) [Auto | Running] -- C:\Windows\SysNative\pouarljul.dll -- (Dnscache)

SRV - [2014.06.12 13:27:56 | 000,113,120 | ---- | M] (Mozilla Foundation) [Disabled | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)

SRV - [2014.05.29 19:36:52 | 000,543,424 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)

SRV - [2014.05.20 01:10:40 | 000,413,128 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)

SRV - [2014.05.15 19:18:04 | 000,257,712 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)

SRV - [2014.05.12 07:24:42 | 000,860,472 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe -- (MBAMService)

SRV - [2014.05.12 07:24:40 | 001,809,720 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)

SRV - [2014.03.11 12:34:10 | 000,347,872 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Microsoft Security Client\NisSrv.exe -- (NisSrv)

SRV - [2014.03.11 12:34:10 | 000,023,808 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)

SRV - [2014.02.05 11:32:34 | 001,593,632 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe -- (NvNetworkService)

SRV - [2014.02.05 11:32:24 | 016,941,856 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Programme\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe -- (NvStreamSvc)

SRV - [2013.10.23 09:15:08 | 000,172,192 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)

SRV - [2013.09.11 22:21:54 | 000,105,144 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)

SRV - [2013.03.26 18:49:14 | 000,076,888 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)

SRV - [2011.12.05 15:55:08 | 000,114,000 | ---- | M] (Joosoft.com GmbH) [Auto | Running] -- C:\Windows\SysWOW64\UpdSvc.dll -- (Update-Service)

SRV - [2011.09.27 21:04:08 | 000,359,192 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Programme\Common Files\Logishrd\Bluetooth\LBTServ.exe -- (LBTServ)

SRV - [2010.06.19 03:59:12 | 000,246,520 | ---- | M] (WildTangent, Inc.) [Disabled | Stopped] -- C:\Program Files (x86)\HP Games\HP Game Console\GameConsoleService.exe -- (GameConsoleService)

SRV - [2009.08.27 18:09:10 | 001,253,376 | ---- | M] (MAGIX AG) [Auto | Running] -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe -- (Fabs)

SRV - [2009.08.18 12:48:02 | 002,291,568 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)

SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

SRV - [2009.06.04 19:03:06 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe -- (IAANTMON)

SRV - [2009.02.22 12:00:00 | 000,129,584 | ---- | M] (EasyBits Sofware AS) [Auto | Running] -- C:\Windows\SysWOW64\ezsvc7.dll -- (ezSharedSvc)

SRV - [2008.08.07 12:10:02 | 003,276,800 | ---- | M] (MAGIX®) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe -- (FirebirdServerMAGIXInstance)

SRV - [2007.11.21 13:16:02 | 000,020,480 | ---- | M] () [Disabled | Stopped] -- C:\Programme\Hercules\Audio\DJ Console Series\HerculesDJControlMP3.EXE -- (HerculesDJControlMP3)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - [2014.06.17 21:12:55 | 000,122,584 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\MBAMSwissArmy.sys -- (MBAMSwissArmy)

DRV:64bit: - [2014.05.12 07:26:10 | 000,063,704 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\mwac.sys -- (MBAMWebAccessControl)

DRV:64bit: - [2014.05.12 07:25:56 | 000,025,816 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)

DRV:64bit: - [2014.03.11 09:52:30 | 000,133,928 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NisDrvWFP.sys -- (NisDrv)

DRV:64bit: - [2013.12.27 20:42:26 | 000,039,200 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvvad64v.sys -- (nvvad_WaveExtensible)

DRV:64bit: - [2013.11.28 15:38:18 | 000,197,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)

DRV:64bit: - [2012.12.13 14:50:36 | 000,054,784 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)

DRV:64bit: - [2012.08.21 13:01:20 | 000,033,240 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)

DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)

DRV:64bit: - [2011.09.02 08:30:36 | 000,060,696 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LMouFilt.Sys -- (LMouFilt)

DRV:64bit: - [2011.09.02 08:30:24 | 000,066,840 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LHidFilt.Sys -- (LHidFilt)

DRV:64bit: - [2011.05.10 08:06:14 | 000,022,528 | ---- | M] (Apple Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\netaapl64.sys -- (Netaapl)

DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)

DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)

DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)

DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV:64bit: - [2010.01.22 15:43:21 | 000,314,016 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\atksgt.sys -- (atksgt)

DRV:64bit: - [2010.01.22 15:43:21 | 000,043,680 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\lirsgt.sys -- (lirsgt)

DRV:64bit: - [2009.10.02 11:33:12 | 000,144,896 | ---- | M] (© Guillemot R&D, 2009. All rights reserved.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HDJMidi.sys -- (HDJMidi)

DRV:64bit: - [2009.10.02 11:33:06 | 000,154,112 | ---- | M] (© Guillemot R&D, 2009. All rights reserved.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HDJBulk.sys -- (Bulk)

DRV:64bit: - [2009.08.21 10:52:09 | 000,079,976 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\xusb21.sys -- (xusb21)

DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)

DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)

DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)

DRV:64bit: - [2009.07.14 02:39:20 | 000,023,040 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WSDPrint.sys -- (WSDPrintDevice)

DRV:64bit: - [2009.07.14 02:35:37 | 000,025,088 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WSDScan.sys -- (WSDScan)

DRV:64bit: - [2009.07.14 02:35:32 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\serscan.sys -- (StillCam)

DRV:64bit: - [2009.07.13 16:31:42 | 000,233,472 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)

DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)

DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)

DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)

DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)

DRV:64bit: - [2009.06.04 20:54:36 | 000,408,600 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)

DRV:64bit: - [2008.10.21 09:22:44 | 000,145,960 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s0017unic.sys -- (s0017unic)

DRV:64bit: - [2008.10.21 09:22:44 | 000,128,552 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s0017obex.sys -- (s0017obex)

DRV:64bit: - [2008.10.21 09:22:42 | 000,152,616 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s0017mdm.sys -- (s0017mdm)

DRV:64bit: - [2008.10.21 09:22:42 | 000,019,496 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s0017mdfl.sys -- (s0017mdfl)

DRV:64bit: - [2008.10.21 09:22:40 | 000,113,704 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s0017bus.sys -- (s0017bus)

DRV:64bit: - [2008.01.09 12:28:20 | 000,034,032 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\seehcri.sys -- (seehcri)

DRV:64bit: - [2007.12.10 15:22:10 | 000,144,936 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s3017unic.sys -- (s3017unic)

DRV:64bit: - [2007.12.10 15:22:06 | 000,125,480 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s3017obex.sys -- (s3017obex)

DRV:64bit: - [2007.12.10 15:22:04 | 000,034,344 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s3017nd5.sys -- (s3017nd5)

DRV:64bit: - [2007.12.10 15:22:02 | 000,130,600 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s3017mgmt.sys -- (s3017mgmt)

DRV:64bit: - [2007.12.10 15:22:00 | 000,146,984 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s3017mdm.sys -- (s3017mdm)

DRV:64bit: - [2007.12.10 15:22:00 | 000,019,496 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s3017mdfl.sys -- (s3017mdfl)

DRV:64bit: - [2007.12.10 15:21:56 | 000,109,096 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s3017bus.sys -- (s3017bus)

DRV - [2009.10.20 14:50:12 | 000,146,928 | ---- | M] (CyberLink Corp.) [2010/05/20 17:15:44] [Kernel | Auto | Running] -- c:\Program Files (x86)\Hewlett-Packard\Media\DVD\000.fcl -- ({55662437-DA8C-40c0-AADA-2C816A897A49})

DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

DRV - [2007.03.16 10:11:20 | 000,015,648 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\TBPanelx64.sys -- (Cardex)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}

IE:64bit: - HKLM\..\SearchScopes\{55569AE9-E080-4075-8F4C-198D43C36528}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008

IE:64bit: - HKLM\..\SearchScopes\{D81DF4A5-2989-4677-8D95-BC3A4221F70F}: "URL" = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcndtie7-de-de

IE:64bit: - HKLM\..\SearchScopes\{FA7B8497-781C-489C-B5B7-A24024F2DC7B}: "URL" = hxxp://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\..\SearchScopes,DefaultScope = 

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKLM\..\SearchScopes\{55569AE9-E080-4075-8F4C-198D43C36528}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/

IE - HKCU\..\SearchScopes,DefaultScope = 

IE - HKCU\..\SearchScopes\{55569AE9-E080-4075-8F4C-198D43C36528}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008

IE - HKCU\..\SearchScopes\{6A6F49A0-7205-4700-A462-71F06F221962}: "URL" = hxxp://www.google.de/search?q={searchTerms}

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

 
 ========== FireFox ==========

 

FF - user.js - File not found

 

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.4: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)

FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.104.0: C:\Program Files (x86)\Battlelog Web Plugins\1.104.0\npesnlaunch.dll File not found

FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.116.0: C:\Program Files (x86)\Battlelog Web Plugins\1.116.0\npesnlaunch.dll File not found

FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.122.0: C:\Program Files (x86)\Battlelog Web Plugins\1.122.0\npesnlaunch.dll File not found

FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.140.0: C:\Program Files (x86)\Battlelog Web Plugins\1.140.0\npesnlaunch.dll File not found

FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.96.0: C:\Program Files (x86)\Battlelog Web Plugins\1.96.0\npesnlaunch.dll File not found

FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=2.1.3: C:\Program Files (x86)\Battlelog Web Plugins\2.1.3\npesnlaunch.dll File not found

FF - HKLM\Software\MozillaPlugins\@esn/npbattlelog,version=2.3.2: C:\Program Files (x86)\Battlelog Web Plugins\2.3.2\npbattlelog.dll (EA Digital Illusions CE AB)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2014.06.12 13:27:57 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

 

[2011.11.21 17:06:36 | 000,000,000 | ---D | M] (No name found) -- C:\Users\HP\AppData\Roaming\mozilla\Extensions

[2014.04.14 18:22:27 | 000,000,000 | ---D | M] (No name found) -- C:\Users\HP\AppData\Roaming\mozilla\Firefox\Profiles\2e4xqkik.default\extensions

[2011.11.25 20:40:39 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions

[2011.11.25 20:40:39 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}

[2014.06.12 13:27:56 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll

[2012.03.05 14:34:12 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

[2012.03.05 14:34:12 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml

[2012.03.05 14:34:12 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

[2012.03.05 14:34:12 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

[2012.03.05 14:34:12 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml

[2012.03.05 14:34:12 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2014.06.12 13:21:19 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll File not found

O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.

O4:64bit: - HKLM..\Run: [IAAnotif] C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe (Intel Corporation)

O4:64bit: - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)

O4:64bit: - HKLM..\Run: [NvBackend] C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe (NVIDIA Corporation)

O4:64bit: - HKLM..\Run: [ShadowPlay] C:\Windows\SysNative\nvspcap64.dll (NVIDIA Corporation)

O4 - HKLM..\Run: []  File not found

O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)

O4 - HKLM..\Run: [Easybits Recovery] C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe (EasyBits Software AS)

O4:64bit: - HKLM..\RunOnce: [*WerKernelReporting] C:\Windows\SysNative\WerFault.exe (Microsoft Corporation)

O4 - HKLM..\RunOnce: [Malwarebytes Anti-Malware (cleanup)] C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\mbamdor.exe (Malwarebytes Corporation)

O4 - HKCU..\RunOnce: [FlashPlayerUpdate] C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_13_0_0_214_Plugin.exe (Adobe Systems Incorporated)

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: EnableShellExecuteHooks = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1

O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\HP\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm File not found

O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000 File not found

O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\HP\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm File not found

O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000 File not found

O9 - Extra Button: HP Smart Print - {22CC3EBD-C286-43aa-B8E6-06B115F74162} - C:\Program Files (x86)\Hewlett-Packard\Smart Print 2.0\smartprintsetup.exe (Hewlett-Packard)

O9 - Extra 'Tools' menuitem : HP Smart Print - {22CC3EBD-C286-43aa-B8E6-06B115F74162} - C:\Program Files (x86)\Hewlett-Packard\Smart Print 2.0\smartprintsetup.exe (Hewlett-Packard)

O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL (Microsoft Corporation)

O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)

O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)

O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000010 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Windows\system32\d3dy1v1jk.dll File not found

O13 - gopher Prefix: missing

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FA7AE09C-7813-4011-8037-998009C97D5C}: DhcpNameServer = 192.168.2.1

O18:64bit: - Protocol\Handler\ms-help - No CLSID value found

O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found

O18:64bit: - Protocol\Handler\skype4com - No CLSID value found

O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)

O20:64bit: - Winlogon\Notify\LBTWlgn: DllName - (c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll) - c:\Programme\Common Files\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O28:64bit: - HKLM ShellExecuteHooks: {E54729E8-643D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook64.dll ()

O28 - HKLM ShellExecuteHooks: {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook32.dll ()

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2010.09.10 23:33:59 | 000,000,000 | R--D | M] - F:\AutoRun -- [ UDF ]

O32 - AutoRun File - [2010.09.10 23:34:03 | 000,439,056 | R--- | M] (Electronic Arts) - F:\AutoRun.exe -- [ UDF ]

O32 - AutoRun File - [2010.09.10 23:34:02 | 007,864,832 | R--- | M] () - F:\autorun.dat -- [ UDF ]

O32 - AutoRun File - [2010.09.10 23:33:38 | 000,000,141 | R--- | M] () - F:\autorun.inf -- [ UDF ]

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2014.06.17 21:55:02 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT

[2014.06.17 21:39:36 | 000,000,000 | ---D | C] -- C:\AdwCleaner

[2014.06.17 21:12:55 | 000,122,584 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\MBAMSwissArmy.sys

[2014.06.17 21:12:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

[2014.06.17 21:12:28 | 000,091,352 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbamchameleon.sys

[2014.06.17 21:12:28 | 000,063,704 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mwac.sys

[2014.06.17 21:12:28 | 000,025,816 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys

[2014.06.17 21:12:28 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes Anti-Malware

[2014.06.12 13:24:03 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN

[2014.06.12 13:23:55 | 000,000,000 | ---D | C] -- C:\Windows\temp

[2014.06.12 13:23:55 | 000,000,000 | ---D | C] -- C:\Users\HP\AppData\Local\temp

[2014.06.12 13:10:52 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe

[2014.06.12 13:10:52 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe

[2014.06.12 13:10:51 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe

[2014.06.12 13:10:37 | 000,000,000 | ---D | C] -- C:\Qoobox

[2014.06.12 13:10:22 | 000,000,000 | ---D | C] -- C:\Windows\erdnt

[2014.06.12 12:57:47 | 000,000,000 | ---D | C] -- C:\Users\HP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller

[2014.06.12 12:57:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\VS Revo Group

[2014.06.12 11:32:58 | 000,000,000 | ---D | C] -- C:\FRST

[2014.06.09 15:02:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes

[2014.06.09 15:00:55 | 000,000,000 | ---D | C] -- C:\Program Files\iPod

[2014.06.09 15:00:54 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes

[2014.06.09 15:00:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\iTunes

[2014.06.09 15:00:54 | 000,000,000 | ---D | C] -- C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69

[2014.05.28 22:38:44 | 000,000,000 | ---D | C] -- C:\Users\HP\Documents\Battlefield 2

[2014.05.28 22:34:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Battlefield 2

[2014.05.25 19:55:30 | 000,000,000 | ---D | C] -- C:\Users\HP\AppData\Local\NVIDIA

[2014.05.25 19:50:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AGEIA Technologies

[2014.05.25 19:50:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation

[2014.05.24 15:03:48 | 000,068,928 | ---- | C] (Khronos Group) -- C:\Windows\SysNative\OpenCL.dll

[2014.05.24 15:03:48 | 000,061,248 | ---- | C] (Khronos Group) -- C:\Windows\SysWow64\OpenCL.dll

[2014.05.24 13:43:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\phase-6

[2 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2014.06.20 12:08:02 | 000,015,568 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2014.06.20 12:08:02 | 000,015,568 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2014.06.20 12:04:26 | 002,354,636 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat

[2014.06.20 12:04:26 | 001,136,894 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2014.06.20 12:04:26 | 000,663,196 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat

[2014.06.20 12:04:26 | 000,583,938 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2014.06.20 12:04:26 | 000,006,264 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2014.06.20 11:58:43 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2014.06.20 11:57:48 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2014.06.20 11:57:44 | 2140,467,199 | -HS- | M] () -- C:\hiberfil.sys

[2014.06.19 11:26:00 | 000,001,102 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2014.06.19 11:17:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2014.06.17 21:12:55 | 000,122,584 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\MBAMSwissArmy.sys

[2014.06.17 21:12:33 | 000,001,108 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2014.06.12 13:21:19 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts

[2014.06.12 12:57:47 | 000,001,270 | ---- | M] () -- C:\Users\HP\Desktop\Revo Uninstaller.lnk

[2014.06.09 15:02:21 | 000,001,785 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk

[2014.05.24 13:43:08 | 000,001,275 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\phase-6 Reminder.lnk

[2014.05.24 13:43:06 | 000,001,119 | ---- | M] () -- C:\Users\Public\Desktop\phase-6 desktop.lnk

[2 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2014.06.17 21:12:33 | 000,001,108 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2014.06.12 13:10:52 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe

[2014.06.12 13:10:52 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe

[2014.06.12 13:10:52 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe

[2014.06.12 13:10:52 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe

[2014.06.12 13:10:52 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe

[2014.06.12 12:57:47 | 000,001,270 | ---- | C] () -- C:\Users\HP\Desktop\Revo Uninstaller.lnk

[2014.05.24 13:43:08 | 000,001,275 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\phase-6 Reminder.lnk

[2014.05.24 13:43:06 | 000,001,119 | ---- | C] () -- C:\Users\Public\Desktop\phase-6 desktop.lnk

[2014.03.20 20:51:21 | 000,773,192 | ---- | C] () -- C:\Windows\SysWow64\ezUPBHook64.dll

[2014.03.20 20:51:21 | 000,484,936 | ---- | C] () -- C:\Windows\SysWow64\ezUPBHook32.dll

[2014.01.15 21:54:51 | 000,000,057 | ---- | C] () -- C:\ProgramData\Ament.ini

[2011.11.01 20:05:55 | 000,007,601 | ---- | C] () -- C:\Users\HP\AppData\Local\Resmon.ResmonCfg

[2011.06.25 21:47:56 | 000,000,000 | ---- | C] () -- C:\Users\HP\AppData\Local\{567718F3-5F26-4E9A-8C5D-952C36B9190A}

[2011.05.25 13:51:25 | 000,000,000 | ---- | C] () -- C:\Users\HP\AppData\Local\{8EED7A26-20F8-4BD4-A5BB-A53A3471B2DE}

[2011.05.08 11:18:08 | 000,000,000 | ---- | C] () -- C:\Users\HP\AppData\Local\{DF089CB1-4CC5-451B-B766-994D63ED2547}

[2010.08.07 19:43:48 | 000,000,680 | RHS- | C] () -- C:\Users\HP\ntuser.pol

[2010.08.07 18:43:20 | 000,066,774 | ---- | C] () -- C:\Users\HP\AppData\Local\tmpDSC00034.0

[2010.08.07 18:43:20 | 000,054,357 | ---- | C] () -- C:\Users\HP\AppData\Local\tmpDSC00034.JPG

[2010.06.13 09:26:26 | 000,028,353 | ---- | C] () -- C:\Users\HP\AppData\Roaming\OFMissionEditorConfig.xml

 
 ========== ZeroAccess Check ==========

 

[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

 

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

 

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

"" = C:\Windows\SysNative\shell32.dll -- [2014.03.25 04:43:12 | 014,175,744 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

"" = %SystemRoot%\system32\shell32.dll -- [2014.03.25 04:09:54 | 012,874,240 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 14:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Both

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

 
 ========== LOP Check ==========

 

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 
 < HKEY_LOCAL_MACHINE\software\microsoft\Windows\CurrentVersion\Telephony\Providers >

"ProviderID0" = 1

"ProviderID1" = 2

"ProviderID2" = 3

"ProviderID3" = 4

"NextProviderID" = 5

"ProviderFileName0" = unimdm.tsp -- [2010.11.20 14:16:53 | 000,281,088 | ---- | M] (Microsoft Corporation)

"ProviderFileName1" = kmddsp.tsp -- [2009.07.14 03:14:11 | 000,038,912 | ---- | M] (Microsoft Corporation)

"ProviderFileName2" = ndptsp.tsp -- [2009.07.14 03:14:11 | 000,050,688 | ---- | M] (Microsoft Corporation)

"ProviderFileName3" = hidphone.tsp -- [2009.07.14 03:14:11 | 000,030,720 | ---- | M] (Microsoft Corporation)

"NumProviders" = 4

 
 < HKEY_LOCAL_MACHINE\software\microsoft\Windows\CurrentVersion\Telephony\Providers /64 >

"ProviderID0" = 1

"ProviderID1" = 2

"ProviderID2" = 3

"ProviderID3" = 4

"NextProviderID" = 6

"ProviderFileName0" = C:\Windows\SysNative\unimdm.tsp -- [2010.11.20 15:24:24 | 000,321,536 | ---- | M] (Microsoft Corporation)

"ProviderFileName1" = C:\Windows\SysNative\kmddsp.tsp -- [2009.07.14 03:38:54 | 000,047,104 | ---- | M] (Microsoft Corporation)

"ProviderFileName2" = C:\Windows\SysNative\ndptsp.tsp -- [2009.07.14 03:38:54 | 000,060,928 | ---- | M] (Microsoft Corporation)

"ProviderFileName3" = C:\Windows\SysNative\hidphone.tsp -- [2009.07.14 03:38:54 | 000,038,912 | ---- | M] (Microsoft Corporation)

"NumProviders" = 5

"ProviderID4" = 5

"ProviderFilename4" = xpt8036x.tsp

 
 < HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation /S /64 >

"DisplayName" = @%systemroot%\system32\wkssvc.dll,-100

"Group" = NetworkProvider

"ImagePath" = C:\Windows\SysNative\svchost.exe -- [2009.07.14 03:39:46 | 000,027,136 | ---- | M] (Microsoft Corporation)

"Description" = @%systemroot%\system32\wkssvc.dll,-101

"ObjectName" = NT AUTHORITY\NetworkService

"ErrorControl" = 1

"Start" = 2

"Type" = 32

"DependOnService" = BowserMRxSmb10MRxSmb20NSI [binary data]

"ServiceSidType" = 1

"RequiredPrivileges" = SeChangeNotifyPrivilegeSeImperson [Binary data over 200 bytes]

"FailureActions" = 80 51 01 00 00 00 00 00 00 00 00 00 03 00 00 00 14 00 00 00 01 00 00 00 60 EA 00 00 01 00 00 00 C0 D4 01 00 00 00 00 00 00 00 00 00  [binary data]
 64bit: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Linkage]

"Bind" = \Device\Smb_Tcpip_{B0AB2B6B-5995-4 [Binary data over 200 bytes]

"Route" = "Smb" "Tcpip" "{B0AB2B6B-5995-48F3 [Binary data over 200 bytes]

"Export" = \Device\LanmanWorkstation_Smb_Tcpi [Binary data over 200 bytes]
 64bit: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\NetworkProvider]

"DeviceName" = \Device\LanmanRedirector

"Name" = Microsoft Windows Network

"DisplayName" = @%systemroot%\system32\wkssvc.dll,-102

"ProviderPath" = C:\Windows\SysNative\ntlanman.dll -- [2010.11.20 15:27:23 | 000,129,536 | ---- | M] (Microsoft Corporation)
 64bit: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters]

"ServiceDll" = C:\Windows\SysNative\wkssvc.dll -- [2010.11.20 15:27:28 | 000,118,784 | ---- | M] (Microsoft Corporation)

"ServiceDllUnloadOnStop" = 1

"EnablePlainTextPassword" = 0

"EnableSecuritySignature" = 1

"RequireSecuritySignature" = 0

"OtherDomains" =  [binary data]

 
 < HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Dnscache /S /64 >

"DisplayName" = @%SystemRoot%\System32\dnsapi.dll,-101

"Group" = TDI

"ImagePath" = C:\Windows\SysNative\svchost.exe -- [2009.07.14 03:39:46 | 000,027,136 | ---- | M] (Microsoft Corporation)

"Description" = @%SystemRoot%\System32\dnsapi.dll,-102

"ObjectName" = NT AUTHORITY\NetworkService

"ErrorControl" = 1

"Start" = 2

"Type" = 32

"DependOnService" = Tdxnsi [binary data]

"ServiceSidType" = 1

"RequiredPrivileges" = SeChangeNotifyPrivilegeSeCreateGlobalPrivilege [binary data]

"FailureActions" = 80 51 01 00 00 00 00 00 00 00 00 00 03 00 00 00 14 00 00 00 01 00 00 00 C0 D4 01 00 01 00 00 00 E0 93 04 00 00 00 00 00 00 00 00 00  [binary data]
 64bit: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Dnscache\Parameters]

"ServiceDll" = C:\Windows\SysNative\pouarljul.dll -- [2012.06.09 19:54:41 | 000,354,816 | ---- | M] (Parental Solutions Inc.)

"ServiceDllUnloadOnStop" = 1

"extension" = C:\Windows\SysNative\dnsext.dll -- [2009.07.14 03:40:31 | 000,008,192 | ---- | M] (Microsoft Corporation)

"ServiceMain" = SetAccessPolicy
 64bit: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Dnscache\Parameters\DnsCache]

"ShutdownOnIdle" = 0
 64bit: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Dnscache\Security]

"Security" = 01 00 14 80 F8 00 00 00 04 01 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 C8 00 08 00 00 00 00 02 18 00 9D 01 02 00 01 02 00 00 00 00 00 05 20 00 00 00 21 02 00 00 00 02 18 00 FF 01 0F 00 01 02 00 00 00 00 00 05 20 00 00 00 20 02 00 00 00 02 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 14 00 8D 01 02 00 01 01 00 00 00 00 00 05 04 00 00 00 00 02 14 00 8D 00 02 00 01 01 00 00 00 00 00 05 14 00 00 00 00 02 14 00 8D 00 02 00 01 01 00 00 00 00 00 05 13 00 00 00 00 02 18 00 CD 00 02 00 01 02 00 00 00 00 00 05 20 00 00 00 2C 02 00 00 00 02 28 00 CD 01 02 00 01 06 00 00 00 00 00 05 50 00 00 00 04 C9 44 AF 94 D9 D3 E5 2B E1 B7 1C 17 84 87 13 6E 1A FA 65 01 01 00 00 00 00 00 05 12 00 00 00 01 01 00 00 00 00 00 05 12 00 00 00  [Binary data over 200 bytes]
 64bit: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Dnscache\TriggerInfo]
 64bit: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Dnscache\TriggerInfo\0]

"Type" = 4

"Action" = 1

"GUID" = 07 9E 56 B7 21 84 E0 4E AD 10 86 91 5A FD AD 09  [binary data]

"Data0" = 5355UDP [binary data]

"DataType0" = 2

 
 < HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost >

"netsvcs" = AeLookupSvcCertPropSvcSCPolicySv [Binary data over 200 bytes]

"LocalService" = RemoteRegistryWinHttpAutoProxySvc [Binary data over 200 bytes]

"LocalSystemNetworkRestricted" = NetmanAudioEndpointBuilderdot3sv [Binary data over 200 bytes]

"LocalServiceNoNetwork" = PLA [binary data] -- [2010.11.20 14:20:54 | 001,508,864 | ---- | M] (Microsoft Corporation)

"rpcss" = RpcSs [binary data]

"LocalServiceNetworkRestricted" = AudioSrvBthHFSrvLmHostswscsvcWPCSvc [binary data]

"LocalServiceAndNoImpersonation" = SSDPSRVupnphostSCardSvrTBSQWAVEwcncsvc [binary data]

"DcomLaunch" = PowerPlugPlayDcomLaunch [binary data]

"NetworkService" = CryptSvcDHCPTermServiceDNSCache [Binary data over 200 bytes]

"imgsvc" = StiSvc [binary data]

"wcssvc" = WcsPlugInService [binary data] -- [2009.07.14 03:16:18 | 000,032,768 | ---- | M] (Microsoft Corporation)

"Update-Service-Installer-Service" = Update-Service-Installer-Service [binary data]

"Update-Service" = Update-Service [binary data]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\LocalService]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\LocalServiceAndNoImpersonation]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\LocalServiceNetworkRestricted]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\LocalServiceNoNetwork]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\LocalSystemNetworkRestricted]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\netsvcs]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\NetworkService]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\NetworkServiceRemoteDesktopHyperVAgent]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\NetworkServiceRemoteDesktopPublishing]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\termsvcs]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\wcssvc]

 
 < HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost /64 >

"RPCSS" = RpcEptMapperRpcSs [binary data]

"defragsvc" = C:\Windows\SysNative\defragsvc.dll -- [2009.07.14 03:40:28 | 000,291,328 | ---- | M] (Microsoft Corporation)

"LocalSystemNetworkRestricted" = UxSmsWdiSystemHostNetmantrkwks [Binary data over 200 bytes]

"LocalService" = nsiWdiServiceHostw32timeEventSy [Binary data over 200 bytes]

"netsvcs" = AeLookupSvcCertPropSvcSCPolicySv [Binary data over 200 bytes]

"WerSvcGroup" = C:\Windows\SysNative\wersvc.dll -- [2009.07.14 03:41:56 | 000,076,800 | ---- | M] (Microsoft Corporation)

"LocalServiceNoNetwork" = DPSPLABFEmpssvcWwanSvc [binary data]

"termsvcs" = TermService [binary data]

"swprv" = C:\Windows\SysNative\swprv.dll -- [2009.07.14 03:41:54 | 000,524,288 | ---- | M] (Microsoft Corporation)

"LocalServiceNetworkRestricted" = DHCPeventlogAudioSrvBthHFSrvLm [Binary data over 200 bytes]

"LocalServicePeerNet" = PNRPSvcp2pimsvcp2psvcPnrpAutoReg [binary data]

"NetworkServiceAndNoImpersonation" = KtmRm [binary data]

"regsvc" = RemoteRegistry [binary data]

"LocalServiceAndNoImpersonation" = SSDPSRVupnphostSCardSvrTBSfdre [Binary data over 200 bytes]

"DcomLaunch" = PowerPlugPlayDcomLaunch [binary data]

"NetworkServiceNetworkRestricted" = PolicyAgent [binary data]

"NetworkService" = CryptSvcDHCPTermServiceDNSCache [Binary data over 200 bytes]

"sdrsvc" = C:\Windows\SysNative\sdrsvc.dll -- [2010.11.20 15:27:25 | 000,170,496 | ---- | M] (Microsoft Corporation)

"WbioSvcGroup" = C:\Windows\SysNative\WbioSrvc.dll -- [2009.07.14 03:41:56 | 000,202,240 | ---- | M] (Microsoft Corporation)

"imgsvc" = StiSvc [binary data]

"wcssvc" = C:\Windows\SysNative\WcsPlugInService.dll -- [2009.07.14 03:41:56 | 000,040,960 | ---- | M] (Microsoft Corporation)

"AxInstSVGroup" = C:\Windows\SysNative\AxInstSV.dll -- [2010.11.20 15:25:44 | 000,114,688 | ---- | M] (Microsoft Corporation)

"secsvcs" = WinDefend [binary data]

"bthsvcs" = C:\Windows\SysNative\bthserv.dll -- [2009.07.14 03:40:13 | 000,083,968 | ---- | M] (Microsoft Corporation)

 
 64bit: [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\AxInstSVGroup]

 
 64bit: [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\defragsvc]

 
 64bit: [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\LocalService]

 
 64bit: [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\LocalServiceAndNoImpersonation]

 
 64bit: [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\LocalServiceNetworkRestricted]

 
 64bit: [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\LocalServiceNoNetwork]

 
 64bit: [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\LocalSystemNetworkRestricted]

 
 64bit: [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\netsvcs]

 
 64bit: [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\NetworkService]

 
 64bit: [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\NetworkServiceRemoteDesktopHyperVAgent]

 
 64bit: [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\NetworkServiceRemoteDesktopPublishing]

 
 64bit: [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\SDRSVC]

 
 64bit: [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\swprv]

 
 64bit: [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\termsvcs]

 
 64bit: [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\wcssvc]

 
 64bit: [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\wercplsupport]

 
 < HKEY_LOCAL_MACHINE\SOFTWARE\Joosoft.com >

 
 < HKEY_LOCAL_MACHINE\SOFTWARE\Joosoft.com /64 >

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Joosoft.com\UpdateClient]

 
 < %SystemRoot%\system32\*.tsp >

[2009.07.14 03:14:11 | 000,030,720 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\hidphone.tsp

[2009.07.14 03:14:11 | 000,038,912 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\kmddsp.tsp

[2009.07.14 03:14:11 | 000,050,688 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\ndptsp.tsp

[2009.07.14 03:14:11 | 000,082,432 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\remotesp.tsp

[2010.11.20 14:16:53 | 000,281,088 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\unimdm.tsp

 
 < %SystemRoot%\system32\*.tsp /64 >

[2009.07.14 03:38:54 | 000,038,912 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\hidphone.tsp

[2009.07.14 03:38:54 | 000,047,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\kmddsp.tsp

[2009.07.14 03:38:54 | 000,060,928 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ndptsp.tsp

[2009.07.14 03:38:54 | 000,102,400 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\remotesp.tsp

[2010.11.20 15:24:24 | 000,321,536 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\unimdm.tsp

[2 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]

 
 < C:\Windows\system32\*.dll /800 >

[2013.02.15 06:34:10 | 000,131,584 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\aaclient.dll

[2014.03.04 11:17:05 | 000,049,664 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\adprovider.dll

[2013.08.29 03:48:17 | 000,640,512 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\advapi32.dll

[2013.08.02 03:48:14 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll

[2013.08.02 03:48:14 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll

[2013.08.02 03:48:14 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll

[2013.08.02 03:48:14 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll

[2013.08.02 03:48:15 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll

[2013.08.02 03:48:15 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll

[2013.08.02 03:48:15 | 000,005,120 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll

[2013.08.02 03:48:15 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll

[2013.08.02 03:48:15 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll

[2013.08.02 03:48:15 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll

[2013.08.02 03:48:15 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll

[2013.08.02 03:48:15 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll

[2013.08.02 03:48:15 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll

[2013.08.02 03:48:15 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll

[2013.08.02 03:48:15 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll

[2013.08.02 03:48:15 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll

[2013.08.02 03:48:15 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll

[2013.08.02 03:48:15 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll

[2013.08.02 03:48:15 | 000,004,608 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll

[2013.08.02 03:48:15 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll

[2013.08.02 03:48:15 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll

[2013.08.02 03:48:15 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll

[2013.08.02 03:48:15 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll

[2013.08.02 03:48:15 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll

[2013.08.02 02:43:05 | 000,004,608 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll

[2013.08.02 02:43:05 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll

[2013.08.02 02:43:05 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll

[2013.01.13 23:16:42 | 000,010,752 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll

[2013.01.13 23:12:46 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll

[2013.01.13 23:17:02 | 000,002,560 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll

[2013.01.13 23:11:08 | 000,005,632 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll

[2013.01.13 23:11:07 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll

[2013.01.13 23:17:03 | 000,009,728 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll

[2013.01.13 23:11:07 | 000,005,632 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll

[2013.01.13 23:11:21 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll

[2013.01.13 23:11:07 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0.dll

[2013.08.02 02:43:05 | 000,006,144 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll

[2013.08.02 03:48:15 | 000,006,656 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\apisetschema.dll

[2013.09.11 22:21:54 | 000,028,776 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\aspnet_counters.dll

[2013.06.09 20:53:16 | 000,164,424 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\atl110.dll

[2013.06.06 05:01:38 | 000,295,424 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\system32\atmfd.dll

[2013.06.06 05:01:26 | 000,034,304 | ---- | M] (Adobe Systems) -- C:\Windows\system32\atmlib.dll

[2013.10.04 03:56:00 | 001,796,096 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\authui.dll

[2012.07.04 23:14:34 | 000,041,984 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\browcli.dll

[2014.03.04 11:17:06 | 000,048,128 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\capiprovider.dll

[2012.06.06 07:03:06 | 000,805,376 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\cdosys.dll

[2013.05.13 05:08:06 | 000,043,008 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\certenc.dll

[2013.05.17 16:54:08 | 000,178,800 | ---- | M] (Sony DADC Austria AG.) -- C:\Windows\system32\CmdLineExt_x64.dll

[2014.03.04 11:17:07 | 000,051,200 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\cngprovider.dll

[2013.07.04 13:50:56 | 000,530,432 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\comctl32.dll

[2014.03.04 11:17:07 | 000,017,408 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\credssp.dll

[2013.10.04 03:56:25 | 000,168,960 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\credui.dll

[2013.10.05 21:57:25 | 001,168,384 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\crypt32.dll

[2013.05.10 05:20:54 | 000,024,576 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\cryptdlg.dll

[2013.07.09 06:46:31 | 000,103,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\cryptnet.dll

[2013.07.09 06:46:31 | 000,140,288 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\cryptsvc.dll

[2013.11.26 10:16:50 | 003,419,136 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\d2d1.dll

[2013.01.13 21:46:25 | 001,080,832 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\d3d10.dll

[2013.01.13 22:08:43 | 000,220,160 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\d3d10core.dll

[2013.01.13 21:54:01 | 000,604,160 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\d3d10level9.dll

[2013.12.25 01:09:41 | 001,987,584 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\d3d10warp.dll

[2013.01.13 21:48:47 | 000,161,792 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\d3d10_1.dll

[2013.01.13 22:09:00 | 000,249,856 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\d3d10_1core.dll

[2013.04.26 01:30:32 | 001,505,280 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\d3d11.dll

[2013.07.04 13:51:04 | 000,081,920 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\davclnt.dll

[2013.06.06 06:50:56 | 000,010,240 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\dciman32.dll

[2012.10.09 19:40:31 | 000,193,536 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\dhcpcore6.dll

[2012.10.09 19:40:31 | 000,044,032 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\dhcpcsvc6.dll

[2014.03.04 11:17:08 | 000,036,864 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\dimsroam.dll

[2014.03.04 11:17:08 | 000,047,616 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\dpapiprovider.dll

[2012.11.02 07:11:31 | 000,376,832 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\dpnet.dll

[2013.04.10 01:34:01 | 001,247,744 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\DWrite.dll

[2013.01.13 22:20:31 | 000,293,376 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\dxgi.dll

[2014.05.30 10:16:26 | 000,368,128 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\dxtmsft.dll

[2014.05.30 10:02:32 | 000,242,688 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\dxtrans.dll

[2013.12.14 15:03:39 | 000,194,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\elshyph.dll

[2014.01.03 13:00:00 | 001,331,200 | ---- | M] (EasyBits Software AS) -- C:\Windows\system32\ezBook7.dll

[2014.01.03 13:00:00 | 000,605,704 | ---- | M] (EasyBits Software AS) -- C:\Windows\system32\ezEMail7.dll

[2014.01.03 13:00:00 | 000,348,680 | ---- | M] (EasyBits Software AS) -- C:\Windows\system32\ezHints7.dll

[2014.01.03 13:00:00 | 000,682,504 | ---- | M] (EasyBits Software AS) -- C:\Windows\system32\ezLicPrompt7.dll

[2014.01.03 13:00:00 | 000,571,976 | ---- | M] (EasyBits Software AS) -- C:\Windows\system32\ezMenu7.dll

[2014.01.03 13:00:00 | 001,030,664 | ---- | M] (EasyBits Software AS) -- C:\Windows\system32\ezPrint7.dll

[2014.01.03 13:00:00 | 000,654,920 | ---- | M] (EasyBits Software AS) -- C:\Windows\system32\ezScore7.dll

[2014.01.03 13:00:00 | 001,376,264 | ---- | M] (EasyBits Software AS) -- C:\Windows\system32\ezShell7.dll

[2013.07.25 13:00:00 | 000,353,792 | ---- | M] (EasyBits Software AS) -- C:\Windows\system32\ezsvc7x.dll

[2014.03.20 20:51:21 | 000,484,936 | ---- | M] () -- C:\Windows\system32\ezUPBHook32.dll

[2014.03.20 20:51:21 | 000,773,192 | ---- | M] () -- C:\Windows\system32\ezUPBHook64.dll

[2014.01.03 13:00:00 | 000,750,592 | ---- | M] (EasyBits Software AS) -- C:\Windows\system32\ezUtils7.dll

[2014.01.03 13:00:00 | 000,332,296 | ---- | M] (EasyBits Software AS) -- C:\Windows\system32\ezWizard7.dll

[2013.06.06 06:51:29 | 000,070,656 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\fontsub.dll

[2013.10.12 04:01:25 | 000,216,576 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\FWPUCLNT.DLL

[2012.12.07 14:20:43 | 002,576,384 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\gameux.dll

[2013.10.03 04:00:44 | 000,311,808 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\gdi32.dll

[2012.08.21 13:01:20 | 000,106,928 | ---- | M] (GEAR Software Inc.) -- C:\Windows\system32\GEARAspi.dll

[2013.12.14 15:03:30 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\icardie.dll

[2013.12.14 15:03:28 | 000,111,616 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\IEAdvpack.dll

[2014.05.30 09:13:47 | 000,704,512 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\ieapfltr.dll

[2013.12.14 15:03:30 | 000,238,288 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\iedkcs32.dll

[2014.05.30 10:42:16 | 000,051,200 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\ieetwproxystub.dll

[2014.05.30 09:40:23 | 011,725,312 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\ieframe.dll

[2013.12.14 15:03:29 | 000,116,736 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\iepeers.dll

[2014.05.30 10:33:48 | 000,032,768 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\iernonce.dll

[2014.05.30 10:38:34 | 002,179,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\iertutil.dll

[2014.05.30 10:43:06 | 000,061,952 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\iesetup.dll

[2013.12.14 15:03:28 | 000,086,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\iesysprep.dll

[2014.05.30 10:30:43 | 000,440,832 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\ieui.dll

[2013.10.19 03:36:59 | 000,159,232 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\imagehlp.dll

[2013.12.14 15:03:29 | 000,036,352 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\imgutil.dll

[2013.12.14 15:03:29 | 000,083,456 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\inseng.dll

[2014.02.04 04:00:39 | 000,002,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\iologmsg.dll

[2014.05.30 10:10:46 | 000,032,256 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\JavaScriptCollectionAgent.dll

[2013.12.14 15:03:29 | 000,610,304 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\jscript.dll

[2014.05.30 09:56:50 | 004,244,992 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\jscript9.dll

[2014.05.30 10:27:56 | 000,592,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\jscript9diag.dll

[2013.12.14 15:03:31 | 000,645,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\jsIntl.dll

[2014.05.30 10:34:17 | 000,043,008 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\jsproxy.dll

[2014.03.04 11:17:13 | 000,550,912 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\kerberos.dll

[2014.03.04 11:16:17 | 001,114,112 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\kernel32.dll

[2014.03.04 11:16:18 | 000,274,944 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\KernelBase.dll

[2013.12.14 15:03:30 | 000,024,576 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\licmgr10.dll

[2013.06.06 06:57:01 | 000,025,600 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\lpk.dll

[2013.05.02 09:09:30 | 003,748,672 | ---- | M] (mquadr.at software engineering und consulting GmbH) -- C:\Windows\system32\M2ElevatedCalls.dll

[2013.05.02 09:08:40 | 000,962,368 | ---- | M] (mquadr.at software engineering) -- C:\Windows\system32\M2ElevatedNetworkAdapters.dll

[2013.06.09 20:53:16 | 004,421,192 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\mfc110.dll

[2013.06.09 20:53:16 | 000,046,160 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\mfc110chs.dll

[2013.06.09 20:53:16 | 000,046,160 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\mfc110cht.dll

[2013.06.09 20:53:16 | 000,074,832 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\mfc110deu.dll

[2013.06.09 20:53:16 | 000,065,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\mfc110enu.dll

[2013.06.09 20:53:16 | 000,073,808 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\mfc110esn.dll

[2013.06.09 20:53:16 | 000,074,832 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\mfc110fra.dll

[2013.06.09 20:53:16 | 000,072,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\mfc110ita.dll

[2013.06.09 20:53:16 | 000,053,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\mfc110jpn.dll

[2013.06.09 20:53:16 | 000,053,328 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\mfc110kor.dll

[2013.06.09 20:53:16 | 000,070,736 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\mfc110rus.dll

[2013.06.09 20:53:16 | 004,456,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\mfc110u.dll

[2013.06.09 20:53:16 | 000,083,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\mfcm110.dll

[2013.06.09 20:53:16 | 000,083,024 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\mfcm110u.dll

[2013.12.04 04:02:06 | 000,390,144 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\msdrm.dll

[2014.05.30 09:54:14 | 000,526,336 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\msfeeds.dll

[2013.12.14 15:03:28 | 000,043,008 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\msfeedsbs.dll

[2014.05.30 11:18:15 | 017,271,296 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\mshtml.dll

[2013.12.14 15:03:29 | 000,061,952 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\MshtmlDac.dll

[2014.05.30 10:04:20 | 000,069,632 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\mshtmled.dll

[2013.12.14 15:03:28 | 000,048,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\mshtmler.dll

[2014.05.30 09:50:09 | 001,068,032 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\mshtmlmedia.dll

[2013.10.30 04:19:52 | 000,301,568 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\msieftp.dll

[2013.12.14 15:03:30 | 000,182,272 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\msls31.dll

[2013.01.04 08:11:21 | 002,284,544 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\msmpeg2vdec.dll

[2014.05.30 10:06:06 | 000,164,864 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\msrating.dll

[2014.03.31 22:46:48 | 000,130,712 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\MSSTDFMT.DLL

[2013.02.15 06:37:10 | 003,217,408 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\mstscax.dll

[2014.03.04 11:17:17 | 000,259,584 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\msv1_0.dll

[2012.11.06 03:20:52 | 000,535,008 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\msvcp110.dll

[2013.09.11 22:21:54 | 000,501,872 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\msvcp110_clr0400.dll

[2013.09.11 22:21:54 | 000,018,000 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\msvcr100_clr0400.dll

[2012.11.06 03:20:52 | 000,875,472 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\msvcr110.dll

[2013.09.11 22:21:54 | 000,863,344 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\msvcr110_clr0400.dll

[2013.09.08 04:03:58 | 000,231,424 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\mswsock.dll

[2014.03.26 16:27:50 | 001,237,504 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\msxml3.dll

[2014.03.26 16:25:14 | 000,002,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\msxml3r.dll

[2014.03.26 16:27:50 | 001,389,056 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\msxml6.dll

[2014.03.26 16:25:14 | 000,002,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\msxml6r.dll

[2013.09.25 03:56:42 | 000,220,160 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\ncrypt.dll

[2012.10.03 18:42:23 | 000,156,672 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\ncsi.dll

[2012.07.04 23:16:56 | 000,057,344 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\netapi32.dll

[2012.10.03 18:42:24 | 000,175,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\netcorehc.dll

[2012.10.03 18:42:24 | 000,018,944 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\netevent.dll

[2013.10.12 04:03:08 | 000,656,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\nshwfp.dll

[2013.08.29 03:50:30 | 001,292,192 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\ntdll.dll

[2014.03.04 11:17:19 | 000,014,336 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\ntvdm64.dll

[2014.05.20 04:44:03 | 002,730,208 | ---- | M] (NVIDIA Corporation) -- C:\Windows\system32\nvapi.dll

[2013.12.27 20:42:16 | 000,033,056 | ---- | M] (NVIDIA Corporation) -- C:\Windows\system32\nvaudcap32v.dll

[2014.05.20 04:44:03 | 017,561,544 | ---- | M] (NVIDIA Corporation) -- C:\Windows\system32\nvcompiler.dll

[2014.05.20 04:44:03 | 009,735,256 | ---- | M] (NVIDIA Corporation) -- C:\Windows\system32\nvcuda.dll

[2014.05.20 04:44:03 | 002,412,376 | ---- | M] (NVIDIA Corporation) -- C:\Windows\system32\nvcuvenc.dll

[2014.05.20 04:44:03 | 002,953,672 | ---- | M] (NVIDIA Corporation) -- C:\Windows\system32\nvcuvid.dll

[2014.05.20 04:44:03 | 014,434,704 | ---- | M] (NVIDIA Corporation) -- C:\Windows\system32\nvd3dum.dll

[2014.05.20 04:44:03 | 000,861,128 | ---- | M] (NVIDIA Corporation) -- C:\Windows\system32\NvFBC.dll

[2014.05.20 04:44:03 | 000,867,784 | ---- | M] (NVIDIA Corporation) -- C:\Windows\system32\NvIFR.dll

[2014.05.20 04:44:03 | 000,146,480 | ---- | M] (NVIDIA Corporation) -- C:\Windows\system32\nvinit.dll

[2014.05.20 04:44:03 | 000,305,600 | ---- | M] (NVIDIA Corporation) -- C:\Windows\system32\nvoglshim32.dll

[2014.05.20 04:44:03 | 024,025,376 | ---- | M] (NVIDIA Corporation) -- C:\Windows\system32\nvoglv32.dll

[2014.05.20 04:44:03 | 009,697,640 | ---- | M] (NVIDIA Corporation) -- C:\Windows\system32\nvopencl.dll

[2014.02.05 11:31:00 | 001,048,152 | ---- | M] (NVIDIA Corporation) -- C:\Windows\system32\nvspcap.dll

[2014.05.20 04:44:03 | 000,837,056 | ---- | M] (NVIDIA Corporation) -- C:\Windows\system32\nvumdshim.dll

[2014.05.20 04:44:03 | 016,003,912 | ---- | M] (NVIDIA Corporation) -- C:\Windows\system32\nvwgf2um.dll

[2014.03.04 11:17:19 | 000,538,112 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\objsel.dll

[2013.12.14 15:03:29 | 000,127,488 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\occache.dll

[2013.12.14 15:03:29 | 000,056,832 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\pngfilt.dll

[2013.07.20 12:33:12 | 000,102,608 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll

[2014.02.04 04:04:11 | 000,509,440 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\qedit.dll

[2013.07.09 06:52:33 | 000,663,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\rpcrt4.dll

[2014.03.04 11:17:22 | 000,247,808 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\schannel.dll

[2013.10.12 04:03:31 | 000,163,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\scrrun.dll

[2013.12.04 04:03:08 | 000,428,032 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\secproc.dll

[2013.12.04 04:03:20 | 000,423,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\secproc_isv.dll

[2013.12.04 04:03:20 | 000,087,040 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\secproc_ssp.dll

[2013.12.04 04:03:20 | 000,087,040 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\secproc_ssp_isv.dll

[2014.04.12 04:12:06 | 000,022,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\secur32.dll

[2013.07.26 03:55:59 | 000,180,224 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\shdocvw.dll

[2014.03.25 04:09:54 | 012,874,240 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\shell32.dll

[2013.10.04 03:58:50 | 000,152,576 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\SmartcardCredentialProvider.dll

[2012.05.05 09:46:52 | 000,043,008 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\srclient.dll

[2013.05.21 17:20:41 | 000,249,824 | ---- | M] (mquadr.at software engineering & consulting GmbH, web: www.mquadr.at, mail: office@mquadr.at) -- C:\Windows\system32\SSDPDiscovery.dll

[2014.04.12 04:10:56 | 000,096,768 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\sspicli.dll

[2012.09.26 00:47:43 | 000,078,336 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\synceng.dll

[2013.08.29 03:50:16 | 000,619,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\tdh.dll

[2013.02.15 05:25:51 | 000,036,864 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\tsgqec.dll

[2014.03.04 11:17:26 | 000,065,536 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\TSpkg.dll

[2013.11.12 04:07:29 | 000,002,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\tzres.dll

[2013.01.13 21:53:14 | 000,187,392 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\UIAnimation.dll

[2013.12.14 15:03:30 | 000,233,472 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\url.dll

[2014.05.30 09:15:41 | 001,143,296 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\urlmon.dll

[2014.04.25 04:06:17 | 000,626,688 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\usp10.dll

[2014.05.30 10:44:28 | 000,455,168 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\vbscript.dll

[2012.11.06 03:20:52 | 000,320,976 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\vcamp110.dll

[2012.11.06 03:20:52 | 000,252,400 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\vccorlib110.dll

[2012.11.06 03:20:52 | 000,125,904 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\vcomp110.dll

[2014.03.04 11:17:27 | 000,172,032 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\wdigest.dll

[2013.12.14 15:03:29 | 000,208,384 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\webcheck.dll

[2013.07.04 13:57:28 | 000,205,824 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\WebClnt.dll

[2014.01.29 04:06:47 | 000,381,440 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\wer.dll

[2012.12.03 15:57:24 | 000,238,592 | ---- | M] (Nicomsoft Ltd.) -- C:\Windows\system32\WiFiMan.dll

[2013.04.26 06:55:21 | 000,492,544 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\win32spl.dll

[2014.03.04 11:17:38 | 000,035,328 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\wincredprovider.dll

[2014.02.04 04:04:22 | 001,230,336 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\WindowsCodecs.dll

[2013.01.13 21:53:58 | 000,207,872 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\WindowsCodecsExt.dll

[2014.05.30 09:21:10 | 001,790,976 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\wininet.dll

[2013.07.09 06:52:10 | 000,175,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\wintrust.dll

[2013.05.10 06:56:08 | 011,410,432 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\wmp.dll

[2013.11.23 20:26:20 | 000,417,792 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\WMPhoto.dll

[2013.05.10 06:56:15 | 012,625,408 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\wmploc.DLL

[2013.07.25 10:57:27 | 001,620,992 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\WMVDECOD.DLL

[2014.03.04 11:16:18 | 000,005,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\wow32.dll

[2012.12.07 14:26:17 | 000,308,736 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\Wpc.dll

[2013.01.13 20:34:58 | 000,364,544 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\XpsGdiConverter.dll

[2013.01.13 19:26:42 | 001,158,144 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\XpsPrint.dll

[2009.07.14 07:08:49 | 000,000,006 | -H-- | C] () -- C:\Windows\Tasks\SA.DAT

[2009.07.14 07:08:49 | 000,032,640 | ---- | C] () -- C:\Windows\Tasks\SCHEDLGU.TXT

[2010.12.09 16:17:11 | 000,001,098 | ---- | C] () -- C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

[2010.12.09 16:17:12 | 000,001,102 | ---- | C] () -- C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

[2012.04.02 10:22:50 | 000,000,884 | ---- | C] () -- C:\Windows\Tasks\Adobe Flash Player Updater.job

 
 < C:\Windows\system32\*.dll /800 /64 >

[2013.02.15 08:02:26 | 000,158,720 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\aaclient.dll

[2014.03.04 11:43:55 | 000,056,832 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\adprovider.dll

[2013.08.29 04:13:28 | 000,878,080 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\advapi32.dll

[2014.06.08 11:08:04 | 000,424,448 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\aeinv.dll

[2014.06.08 11:13:05 | 000,506,368 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\aepdu.dll

[2013.08.02 04:12:18 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-console-l1-1-0.dll

[2013.08.02 04:12:18 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-datetime-l1-1-0.dll

[2013.08.02 04:12:18 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-debug-l1-1-0.dll

[2013.08.02 04:12:18 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-delayload-l1-1-0.dll

[2013.08.02 04:12:18 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-errorhandling-l1-1-0.dll

[2013.08.02 04:12:18 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-fibers-l1-1-0.dll

[2013.08.02 04:12:18 | 000,005,120 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-file-l1-1-0.dll

[2013.08.02 04:12:19 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-handle-l1-1-0.dll

[2013.08.02 04:12:19 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-heap-l1-1-0.dll

[2013.08.02 04:12:19 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-interlocked-l1-1-0.dll

[2013.08.02 04:12:19 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-io-l1-1-0.dll

[2013.08.02 04:12:19 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-libraryloader-l1-1-0.dll

[2013.08.02 04:12:19 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localization-l1-1-0.dll

[2013.08.02 04:12:19 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localregistry-l1-1-0.dll

[2013.08.02 04:12:19 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-memory-l1-1-0.dll

[2013.08.02 04:12:19 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-misc-l1-1-0.dll

[2013.08.02 04:12:19 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-namedpipe-l1-1-0.dll

[2013.08.02 04:12:19 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processenvironment-l1-1-0.dll

[2013.08.02 04:12:19 | 000,004,608 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processthreads-l1-1-0.dll

[2013.08.02 04:12:19 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-profile-l1-1-0.dll

[2013.08.02 04:12:19 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-rtlsupport-l1-1-0.dll

[2013.08.02 04:12:20 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-string-l1-1-0.dll

[2013.08.02 04:12:20 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-synch-l1-1-0.dll

[2013.08.02 04:12:20 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-sysinfo-l1-1-0.dll

[2013.08.02 04:12:20 | 000,004,608 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-threadpool-l1-1-0.dll

[2013.08.02 04:12:20 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-util-l1-1-0.dll

[2013.08.02 04:12:20 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-xstate-l1-1-0.dll

[2013.01.13 22:35:18 | 000,010,752 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-advapi32-l1-1-0.dll

[2013.01.13 22:32:07 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-advapi32-l2-1-0.dll

[2013.01.13 22:35:31 | 000,002,560 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-normaliz-l1-1-0.dll

[2013.01.13 22:31:41 | 000,005,632 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-ole32-l1-1-0.dll

[2013.01.13 22:31:40 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-shell32-l1-1-0.dll

[2013.01.13 22:35:31 | 000,009,728 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-shlwapi-l1-1-0.dll

[2013.01.13 22:31:40 | 000,005,632 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-shlwapi-l2-1-0.dll

[2013.01.13 22:31:48 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-user32-l1-1-0.dll

[2013.01.13 22:31:40 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-version-l1-1-0.dll

[2013.08.02 04:12:20 | 000,006,144 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-security-base-l1-1-0.dll

[2013.08.02 04:12:20 | 000,006,656 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\apisetschema.dll

[2013.02.27 07:47:10 | 000,070,144 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\appinfo.dll

[2013.09.11 20:39:06 | 000,030,312 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\aspnet_counters.dll

[2013.06.09 16:59:36 | 000,192,584 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\atl110.dll

[2013.06.06 05:30:53 | 000,368,128 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysNative\atmfd.dll

[2013.06.06 07:47:21 | 000,046,080 | ---- | M] (Adobe Systems) -- C:\Windows\SysNative\atmlib.dll

[2013.10.04 04:24:49 | 001,930,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\authui.dll

[2012.07.05 00:13:27 | 000,059,392 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\browcli.dll

[2012.07.05 00:13:27 | 000,136,704 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\browser.dll

[2014.03.04 11:43:55 | 000,053,760 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\capiprovider.dll

[2012.06.06 08:02:54 | 001,133,568 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\cdosys.dll

[2013.05.13 07:50:40 | 000,052,224 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\certenc.dll

[2014.03.04 11:43:56 | 000,057,344 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\cngprovider.dll

[2013.07.04 14:50:39 | 000,633,856 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\comctl32.dll

[2014.03.04 11:43:56 | 000,022,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\credssp.dll

[2013.10.04 04:25:17 | 000,197,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\credui.dll

[2013.10.05 22:25:35 | 001,474,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\crypt32.dll

[2013.05.10 07:49:27 | 000,030,720 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\cryptdlg.dll

[2013.07.09 07:46:20 | 000,139,776 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\cryptnet.dll

[2013.07.09 07:46:20 | 000,184,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\cryptsvc.dll

[2013.08.02 04:12:47 | 000,043,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\csrsrv.dll

[2013.11.23 00:48:21 | 003,928,064 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\d2d1.dll

[2013.01.13 21:20:04 | 001,238,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10.dll

[2013.01.13 21:38:21 | 000,296,960 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10core.dll

[2013.01.13 21:24:33 | 000,648,192 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10level9.dll

[2013.12.25 00:48:32 | 002,565,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10warp.dll

[2013.01.13 21:20:42 | 000,194,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10_1.dll

[2013.01.13 21:38:39 | 000,333,312 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10_1core.dll

[2013.04.01 00:52:16 | 001,887,232 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\d3d11.dll

[2013.07.04 14:50:46 | 000,102,400 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\davclnt.dll

[2013.06.06 07:49:07 | 000,014,336 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\dciman32.dll

[2012.10.09 20:17:13 | 000,226,816 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\dhcpcore6.dll

[2012.10.09 20:17:13 | 000,055,296 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\dhcpcsvc6.dll

[2014.03.04 11:43:56 | 000,044,544 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\dimsroam.dll

[2014.03.04 11:43:56 | 000,052,736 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\dpapiprovider.dll

[2012.11.02 07:59:11 | 000,478,208 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\dpnet.dll

[2013.04.03 00:51:57 | 001,643,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\DWrite.dll

[2013.01.13 21:49:17 | 000,363,008 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\dxgi.dll

[2014.05.30 11:06:42 | 000,452,096 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\dxtmsft.dll

[2014.05.30 10:44:23 | 000,295,424 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\dxtrans.dll

[2013.12.14 15:03:31 | 000,235,008 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\elshyph.dll

[2013.01.13 21:58:28 | 001,175,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\FntCache.dll

[2013.06.06 07:49:52 | 000,100,864 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\fontsub.dll

[2013.10.12 04:29:08 | 000,324,096 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\FWPUCLNT.DLL

[2012.12.07 15:15:31 | 002,746,368 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\gameux.dll

[2013.10.03 04:23:48 | 000,404,480 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\gdi32.dll

[2012.08.21 13:01:20 | 000,125,872 | ---- | M] (GEAR Software Inc.) -- C:\Windows\SysNative\GEARAspi64.dll

[2012.10.17 05:31:56 | 000,741,480 | ---- | M] (Hewlett-Packard Co.) -- C:\Windows\SysNative\HPDiscoPMB111.dll

[2012.10.17 20:38:03 | 000,269,712 | ---- | M] (Hewlett-Packard Co.) -- C:\Windows\SysNative\hpinkcoiB111.dll

[2012.10.17 20:38:03 | 000,331,664 | ---- | M] (Hewlett-Packard Co.) -- C:\Windows\SysNative\hpinkstsB111LM.dll

[2013.12.14 15:03:25 | 000,081,408 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\icardie.dll

[2013.12.14 15:03:25 | 000,131,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\IEAdvpack.dll

[2014.05.30 09:13:09 | 000,846,336 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dll

[2013.12.14 15:03:25 | 000,263,376 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iedkcs32.dll

[2014.05.30 12:02:09 | 000,004,096 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwcollectorres.dll

[2014.05.30 11:38:29 | 000,048,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwproxystub.dll

[2014.05.30 09:43:35 | 013,522,944 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieframe.dll

[2013.12.14 15:03:24 | 000,135,680 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iepeers.dll

[2014.05.30 11:27:57 | 000,033,792 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll

[2014.05.30 11:45:58 | 002,768,384 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iertutil.dll

[2014.05.30 11:39:23 | 000,066,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll

[2013.12.14 15:03:25 | 000,105,984 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iesysprep.dll

[2014.05.30 11:24:28 | 000,574,976 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll

[2013.10.12 04:29:21 | 000,859,648 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\IKEEXT.DLL

[2013.10.19 04:18:57 | 000,081,408 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\imagehlp.dll

[2013.12.14 15:03:24 | 000,048,128 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\imgutil.dll

[2013.12.14 15:03:25 | 000,101,376 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\inseng.dll

[2014.02.04 04:28:36 | 000,002,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iologmsg.dll

[2012.10.03 19:42:16 | 000,569,344 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iphlpsvc.dll

[2014.05.30 10:55:36 | 000,038,400 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\JavaScriptCollectionAgent.dll

[2013.12.14 15:03:24 | 000,774,144 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll

[2014.05.30 11:08:22 | 005,782,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll

[2014.05.30 11:20:36 | 000,752,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9diag.dll

[2013.12.14 15:03:27 | 000,942,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\jsIntl.dll

[2014.05.30 11:28:59 | 000,051,200 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\jsproxy.dll

[2014.03.04 11:44:00 | 000,728,064 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\kerberos.dll

[2014.03.04 11:44:00 | 001,163,264 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\kernel32.dll

[2014.03.04 11:44:00 | 000,424,960 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\KernelBase.dll

[2013.12.14 15:03:25 | 000,030,208 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\licmgr10.dll

[2012.05.14 07:26:34 | 000,956,928 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\localspl.dll

[2013.06.06 07:50:51 | 000,041,472 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\lpk.dll

[2014.04.12 04:19:32 | 001,460,736 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\lsasrv.dll

[2013.06.09 16:59:36 | 005,592,648 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mfc110.dll

[2013.06.09 16:59:36 | 000,046,160 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mfc110chs.dll

[2013.06.09 16:59:36 | 000,046,160 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mfc110cht.dll

[2013.06.09 16:59:36 | 000,074,832 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mfc110deu.dll

[2013.06.09 16:59:36 | 000,065,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mfc110enu.dll

[2013.06.09 16:59:36 | 000,073,808 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mfc110esn.dll

[2013.06.09 16:59:36 | 000,074,832 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mfc110fra.dll

[2013.06.09 16:59:36 | 000,072,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mfc110ita.dll

[2013.06.09 16:59:36 | 000,053,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mfc110jpn.dll

[2013.06.09 16:59:36 | 000,053,328 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mfc110kor.dll

[2013.06.09 16:59:36 | 000,070,736 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mfc110rus.dll

[2013.06.09 16:59:36 | 005,619,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mfc110u.dll

[2013.06.09 16:59:36 | 000,090,184 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mfcm110.dll

[2013.06.09 16:59:36 | 000,090,192 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mfcm110u.dll

[2013.12.04 04:26:32 | 000,528,384 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msdrm.dll

[2014.05.30 10:29:31 | 000,631,808 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll

[2013.12.14 15:03:25 | 000,052,224 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msfeedsbs.dll

[2014.05.30 12:21:26 | 023,414,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mshtml.dll

[2013.12.14 15:03:24 | 000,083,968 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\MshtmlDac.dll

[2014.05.30 10:46:48 | 000,085,504 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll

[2013.12.14 15:03:25 | 000,048,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmler.dll

[2014.05.30 10:24:19 | 001,249,280 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmlmedia.dll

[2013.10.30 04:32:01 | 000,335,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msieftp.dll

[2013.12.14 15:03:26 | 000,247,808 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msls31.dll

[2013.01.04 08:11:13 | 002,776,576 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msmpeg2vdec.dll

[2014.05.30 10:49:21 | 000,195,584 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msrating.dll

[2013.02.15 08:06:11 | 003,717,632 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mstscax.dll

[2014.03.04 11:44:03 | 000,314,880 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msv1_0.dll

[2012.11.06 00:26:22 | 000,661,456 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msvcp110.dll

[2013.09.11 20:39:06 | 000,614,000 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msvcp110_clr0400.dll

[2013.09.11 20:39:06 | 000,018,000 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msvcr100_clr0400.dll

[2012.11.06 00:26:22 | 000,849,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msvcr110.dll

[2013.09.11 20:39:06 | 000,855,664 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msvcr110_clr0400.dll

[2013.09.08 04:27:14 | 000,327,168 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mswsock.dll

[2014.03.26 16:44:48 | 001,882,112 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msxml3.dll

[2014.03.26 16:41:39 | 000,002,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msxml3r.dll

[2014.03.26 16:44:48 | 002,002,432 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msxml6.dll

[2014.03.26 16:41:39 | 000,002,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msxml6r.dll

[2013.09.25 04:21:50 | 000,307,200 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ncrypt.dll

[2012.10.03 19:44:16 | 000,216,576 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ncsi.dll

[2012.07.05 00:16:43 | 000,073,216 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\netapi32.dll

[2012.10.03 19:44:17 | 000,246,272 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\netcorehc.dll

[2012.10.03 19:44:17 | 000,018,944 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\netevent.dll

[2012.10.03 19:44:21 | 000,070,656 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\nlaapi.dll

[2012.10.03 19:44:21 | 000,303,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\nlasvc.dll

[2013.10.12 04:30:42 | 000,830,464 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\nshwfp.dll

[2013.08.29 04:16:35 | 001,732,032 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ntdll.dll

[2014.03.04 11:44:03 | 000,016,384 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ntvdm64.dll

[2014.05.20 04:44:03 | 003,109,248 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvapi64.dll

[2013.12.27 20:42:16 | 000,035,104 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvaudcap64v.dll

[2014.05.20 04:44:03 | 025,256,224 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcompiler.dll

[2014.05.20 03:25:42 | 006,769,096 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcpl.dll

[2014.05.20 04:44:03 | 011,644,928 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcuda.dll

[2014.05.20 04:44:03 | 002,785,568 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcuvenc.dll

[2014.05.20 04:44:03 | 003,141,976 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcuvid.dll

[2014.05.20 04:44:03 | 017,480,432 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvd3dumx.dll

[2014.03.04 16:35:23 | 001,885,472 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvdispco6433523.dll

[2014.05.20 04:44:03 | 001,889,112 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvdispco6433788.dll

[2013.02.26 00:32:32 | 001,510,176 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvdispgenco64.dll

[2014.03.04 16:35:23 | 001,516,488 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvdispgenco6433523.dll

[2014.05.20 04:44:03 | 001,541,576 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvdispgenco6433788.dll

[2014.05.20 04:44:03 | 000,892,704 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\NvFBC64.dll

[2013.11.22 10:36:08 | 001,515,296 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvhdagenco6420103.dll

[2013.11.28 15:38:22 | 000,031,520 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvhdap64.dll

[2014.05.20 04:44:03 | 000,895,776 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\NvIFR64.dll

[2014.05.20 04:44:03 | 000,166,568 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvinitx.dll

[2014.05.20 03:25:38 | 000,387,528 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvmctray.dll

[2014.05.20 04:44:03 | 000,354,016 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvoglshim64.dll

[2014.05.20 04:44:03 | 031,387,936 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvoglv64.dll

[2014.05.20 04:44:03 | 011,599,072 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvopencl.dll

[2014.05.20 03:25:38 | 000,062,808 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvshext.dll

[2014.02.05 11:30:41 | 001,179,576 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvspcap64.dll

[2014.05.20 03:25:42 | 003,514,144 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvsvc64.dll

[2014.05.20 03:25:38 | 002,560,968 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvsvcr.dll

[2014.05.20 04:44:03 | 000,952,952 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvumdshimx.dll

[2014.05.20 04:44:03 | 018,531,568 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvwgf2umx.dll

[2014.03.04 11:44:03 | 000,722,944 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\objsel.dll

[2013.12.14 15:03:25 | 000,147,968 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\occache.dll

[2013.12.14 15:03:25 | 000,062,464 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\pngfilt.dll

[2012.06.09 19:54:41 | 000,354,816 | ---- | M] (Parental Solutions Inc.) -- C:\Windows\SysNative\pouarljul.dll

[2013.07.20 12:33:08 | 000,124,112 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\PresentationCFFRasterizerNative_v0300.dll

[2012.05.01 07:40:20 | 000,209,920 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\profsvc.dll

[2014.02.04 04:32:12 | 000,624,128 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\qedit.dll

[2012.04.26 07:41:55 | 000,149,504 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\rdpcorekmts.dll

[2012.04.26 07:41:56 | 000,077,312 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\rdpwsx.dll

[2013.07.09 07:51:16 | 001,217,024 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\rpcrt4.dll

[2013.08.28 03:12:33 | 000,461,312 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\scavengeui.dll

[2014.03.04 11:44:06 | 000,340,992 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\schannel.dll

[2013.10.12 04:31:04 | 000,202,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\scrrun.dll

[2013.12.04 04:27:16 | 000,488,448 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\secproc.dll

[2013.12.04 04:27:33 | 000,485,888 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\secproc_isv.dll

[2013.12.04 04:27:33 | 000,123,392 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\secproc_ssp.dll

[2013.12.04 04:27:33 | 000,123,392 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\secproc_ssp_isv.dll

[2014.04.12 04:19:37 | 000,028,160 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\secur32.dll

[2013.07.26 04:24:56 | 000,197,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\shdocvw.dll

[2014.03.25 04:43:12 | 014,175,744 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\shell32.dll

[2013.10.04 04:28:31 | 000,190,464 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\SmartcardCredentialProvider.dll

[2012.05.05 10:36:55 | 000,503,808 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\srcore.dll

[2014.04.12 04:19:38 | 000,136,192 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\sspicli.dll

[2014.04.12 04:19:38 | 000,029,184 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\sspisrv.dll

[2012.09.26 00:46:17 | 000,095,744 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\synceng.dll

[2013.08.29 04:16:14 | 000,859,648 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\tdh.dll

[2013.02.15 08:08:40 | 000,044,032 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\tsgqec.dll

[2014.03.04 11:44:08 | 000,086,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\TSpkg.dll

[2013.11.12 04:23:09 | 000,002,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\tzres.dll

[2013.01.13 21:24:30 | 000,221,184 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\UIAnimation.dll

[2013.12.14 15:03:25 | 000,235,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll

[2014.05.30 09:30:50 | 001,398,272 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\urlmon.dll

[2012.12.13 14:50:38 | 006,112,864 | ---- | M] (Apple, Inc.) -- C:\Windows\SysNative\usbaaplrc.dll

[2014.04.25 04:34:59 | 000,801,280 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\usp10.dll

[2014.05.30 11:39:43 | 000,548,352 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll

[2012.11.06 00:26:22 | 000,385,488 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\vcamp110.dll

[2012.11.06 00:26:22 | 000,354,264 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\vccorlib110.dll

[2012.11.06 00:26:22 | 000,138,208 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\vcomp110.dll

[2012.07.26 04:36:08 | 000,009,728 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\Wdfres.dll

[2014.03.04 11:44:10 | 000,210,944 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wdigest.dll

[2013.12.14 15:03:25 | 000,243,200 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\webcheck.dll

[2013.07.04 14:57:22 | 000,259,584 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\WebClnt.dll

[2014.01.29 04:32:18 | 000,484,864 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wer.dll

[2012.12.03 15:58:06 | 000,279,040 | ---- | M] (Nicomsoft Ltd.) -- C:\Windows\SysNative\WiFiMan.dll

[2013.04.26 07:51:36 | 000,751,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\win32spl.dll

[2014.03.04 11:44:20 | 000,039,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wincredprovider.dll

[2014.02.04 04:32:22 | 001,424,384 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\WindowsCodecs.dll

[2013.01.13 21:25:04 | 000,245,248 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\WindowsCodecsExt.dll

[2014.05.30 09:56:56 | 002,266,112 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wininet.dll

[2013.08.02 04:14:57 | 000,215,040 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\winsrv.dll

[2013.07.09 07:52:52 | 000,224,256 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wintrust.dll

[2013.05.10 07:56:33 | 014,631,424 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wmp.dll

[2013.11.23 19:47:34 | 000,465,920 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\WMPhoto.dll

[2013.05.10 07:56:40 | 012,625,920 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wmploc.DLL

[2013.07.25 11:25:54 | 001,888,768 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\WMVDECOD.DLL

[2014.03.04 11:44:21 | 000,243,712 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wow64.dll

[2014.03.04 11:44:21 | 000,013,312 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wow64cpu.dll

[2014.03.04 11:44:21 | 000,362,496 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wow64win.dll

[2012.12.07 15:20:16 | 000,441,856 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\Wpc.dll

[2012.06.03 00:19:23 | 000,701,976 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wuapi.dll

[2012.06.03 00:19:43 | 002,428,952 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wuaueng.dll

[2012.06.03 00:15:31 | 002,622,464 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wucltux.dll

[2012.07.26 05:08:14 | 000,045,056 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\WUDFCoinstaller.dll

[2012.07.26 05:08:14 | 000,194,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\WUDFPlatform.dll

[2012.07.26 05:08:14 | 000,084,992 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\WUDFSvc.dll

[2012.07.26 05:08:14 | 000,744,448 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\WUDFx.dll

[2012.06.03 00:15:08 | 000,099,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wudriver.dll

[2012.06.03 00:19:46 | 000,038,424 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wups.dll

[2012.06.03 00:19:42 | 000,044,056 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wups2.dll

[2012.06.02 15:19:42 | 000,186,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wuwebv.dll

[2013.03.19 07:53:58 | 000,048,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wwanprotdim.dll

[2014.01.28 04:32:46 | 000,228,864 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wwansvc.dll

[2013.01.13 20:09:52 | 000,522,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\XpsGdiConverter.dll

[2013.01.13 19:05:09 | 001,682,432 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\XpsPrint.dll

[2 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]
 

< End of report >

schrauber

21.06.2014 09:16

Bitte downloade dir LSPFix

Starte die LSPFix.exe.
Windows Vista oder höher mit Rechtsklick -> Als Administrator ausführen
Markiere die Box "I know what I'm doing"
In der Keep Box solltest du eine oder mehrer dieser d3dy1v1jk.dll Dateien finden.
Wähle jede einzelne vorhandene d3dy1v1jk.dll und verschiebe diese in die Remove Box indem du den >> Button drückst.
Wenn alle Dateien verschoben wurden klicke Finish>>.

Fixen mit OTL

Starte bitte die OTL.exe.
Kopiere nun den Inhalt aus der Codebox in die Textbox.

Code:

:OTL

SRV - [2011.12.05 15:55:08 | 000,114,000 | ---- | M] (Joosoft.com GmbH) [Auto | Running] -- C:\Windows\SysWOW64\UpdSvc.dll -- (Update-Service)

SRV:64bit: - [2012.06.09 19:54:41 | 000,354,816 | ---- | M] (Parental Solutions Inc.) [Auto | Running] -- C:\Windows\SysNative\pouarljul.dll -- (Dnscache)

:files

C:\Windows\system32\d3dy1v1jk.dll

C:\Windows\SysWOW64\UpdSvc.dll

C:\Windows\SysNative\pouarljul.dll

:reg

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Dnscache\Parameters]

"ServiceDll"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\

00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\

64,00,6e,00,73,00,72,00,73,00,6c,00,76,00,72,00,2e,00,64,00,6c,00,6c,00,00,\

00

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

"Update-Service-Installer-Service"=-

"Update-Service"=-

[-HKEY_LOCAL_MACHINE\SOFTWARE\Joosoft.com]

:Commands

[emptytemp]

Solltest du deinen Benutzernamen z. B. durch "*****" unkenntlich gemacht haben, so füge an entsprechender Stelle deinen richtigen Benutzernamen ein. Andernfalls wird der Fix nicht funktionieren.
Schließe bitte nun alle Programme.
Klicke nun bitte auf den Fix Button.
OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
Nach dem Neustart findest Du ein Textdokument auf deinem Desktop.
( Auch zu finden unter C:\_OTL\MovedFiles\<Uhrzeit_Datum>.txt)
Kopiere nun den Inhalt hier in Deinen Thread

Jetzt bitte einen neuen Scan mit FRST und OTL machen (gleicher Custom scan wie oben!!) und die Logs posten.

tombo11

28.06.2014 17:58

Hey Schrauber,
sorry das es so lange gedauert hat, aber ich hab diese Woche Abschlussprüfung geschrieben.

Code:

All processes killed

========== OTL ==========

Service Update-Service stopped successfully!

Service Update-Service deleted successfully!

C:\Windows\SysWOW64\UpdSvc.dll moved successfully.

Error: Unable to stop service Dnscache!

Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache deleted successfully.

C:\Windows\SysNative\pouarljul.dll moved successfully.

========== FILES ==========

File\Folder C:\Windows\system32\d3dy1v1jk.dll not found.

File\Folder C:\Windows\SysWOW64\UpdSvc.dll not found.

File\Folder C:\Windows\SysNative\pouarljul.dll not found.

========== REGISTRY ==========

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Dnscache\Parameters\\"ServiceDll"|hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,64,00,6e,00,73,00,72,00,73,00,6c,00,76,00,72,00,2e,00,64,00,6c,00,6c,00,00,00 /E : value set successfully!

Registry value HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\\Update-Service-Installer-Service deleted successfully.

Registry value HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\\Update-Service deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Joosoft.com\ not found.

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: All Users

 

User: AppData

->Temp folder emptied: 0 bytes

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 67 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: HP

->Temp folder emptied: 3273699 bytes

->Temporary Internet Files folder emptied: 7671328 bytes

->Java cache emptied: 203127 bytes

->FireFox cache emptied: 332964871 bytes

->Apple Safari cache emptied: 126318592 bytes

->Flash cache emptied: 3001 bytes

 

User: Public

->Temp folder emptied: 0 bytes

 

User: Tom

->Temp folder emptied: 2307420 bytes

->Temporary Internet Files folder emptied: 2919741 bytes

->Java cache emptied: 0 bytes

->FireFox cache emptied: 232409724 bytes

->Apple Safari cache emptied: 0 bytes

->Flash cache emptied: 4017 bytes

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 200704 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32 (64bit) .tmp files removed: 5592064 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 4274957 bytes

%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 42321056 bytes

RecycleBin emptied: 0 bytes

 

Total Files Cleaned = 725,00 mb

 

 

OTL by OldTimer - Version 3.2.69.0 log created on 06282014_181640
 

Files\Folders moved on Reboot...

File move failed. C:\Users\Tom\AppData\Local\Temp\NVIDIA Corporation\NV_Cache\6d1026b4fa6d4c49d77d65f8805a9c0_fce8395e8fd8a86f_6229ccd76215aea1_0_0.bin scheduled to be moved on reboot.

File move failed. C:\Users\Tom\AppData\Local\Temp\NVIDIA Corporation\NV_Cache\6d1026b4fa6d4c49d77d65f8805a9c0_fce8395e8fd8a86f_6229ccd76215aea1_0_0.toc scheduled to be moved on reboot.

File move failed. C:\Users\Tom\AppData\Local\Temp\FXSAPIDebugLogFile.txt scheduled to be moved on reboot.
 

PendingFileRenameOperations files...
 

Registry entries deleted on Reboot...

Code:

OTL logfile created on: 28.06.2014 18:30:23 - Run 2

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Tom\Desktop

64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.11.9600.17126)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

7,99 Gb Total Physical Memory | 6,09 Gb Available Physical Memory | 76,23% Memory free

15,98 Gb Paging File | 14,02 Gb Available in Paging File | 87,76% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 684,15 Gb Total Space | 17,13 Gb Free Space | 2,50% Space Free | Partition Type: NTFS

Drive D: | 14,39 Gb Total Space | 2,52 Gb Free Space | 17,54% Space Free | Partition Type: NTFS

Drive E: | 698,64 Gb Total Space | 57,76 Gb Free Space | 8,27% Space Free | Partition Type: NTFS

Drive F: | 6,31 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF

 

Computer Name: HP-PC | User Name: HP | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2014.06.20 12:04:45 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Tom\Desktop\OTL.exe

PRC - [2014.05.20 01:10:40 | 000,413,128 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

PRC - [2014.05.12 07:24:42 | 000,860,472 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe

PRC - [2014.05.12 07:24:40 | 001,809,720 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe

PRC - [2014.05.12 07:24:34 | 006,970,168 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe

PRC - [2014.02.05 11:32:47 | 002,234,144 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe

PRC - [2014.02.05 11:32:34 | 001,593,632 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

PRC - [2013.03.26 18:49:14 | 000,076,888 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe

PRC - [2009.12.01 20:49:52 | 000,210,216 | ---- | M] (CyberLink) -- c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe

PRC - [2009.10.20 14:50:34 | 000,128,296 | ---- | M] (CyberLink Corp.) -- c:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe

PRC - [2009.08.27 18:09:10 | 001,253,376 | ---- | M] (MAGIX AG) -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe

PRC - [2009.06.04 19:03:32 | 000,186,904 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe

PRC - [2009.06.04 19:03:06 | 000,354,840 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2014.02.12 20:58:32 | 000,073,544 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll

MOD - [2014.02.12 20:58:10 | 001,044,808 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll

MOD - [2009.12.01 20:49:50 | 000,931,112 | ---- | M] () -- c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMediaLibrary.dll

 

 
 ========== Services (SafeList) ==========

 

SRV:64bit: - [2014.05.30 11:21:05 | 000,111,616 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\IEEtwCollector.exe -- (IEEtwCollectorService)

SRV - [2014.06.12 13:27:56 | 000,113,120 | ---- | M] (Mozilla Foundation) [Disabled | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)

SRV - [2014.05.29 19:36:52 | 000,543,424 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)

SRV - [2014.05.20 01:10:40 | 000,413,128 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)

SRV - [2014.05.15 19:18:04 | 000,257,712 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)

SRV - [2014.05.12 07:24:42 | 000,860,472 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe -- (MBAMService)

SRV - [2014.05.12 07:24:40 | 001,809,720 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)

SRV - [2014.03.11 12:34:10 | 000,347,872 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Microsoft Security Client\NisSrv.exe -- (NisSrv)

SRV - [2014.03.11 12:34:10 | 000,023,808 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)

SRV - [2014.02.05 11:32:34 | 001,593,632 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe -- (NvNetworkService)

SRV - [2014.02.05 11:32:24 | 016,941,856 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Programme\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe -- (NvStreamSvc)

SRV - [2013.10.23 09:15:08 | 000,172,192 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)

SRV - [2013.09.11 22:21:54 | 000,105,144 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)

SRV - [2013.03.26 18:49:14 | 000,076,888 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)

SRV - [2011.09.27 21:04:08 | 000,359,192 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Programme\Common Files\Logishrd\Bluetooth\LBTServ.exe -- (LBTServ)

SRV - [2010.06.19 03:59:12 | 000,246,520 | ---- | M] (WildTangent, Inc.) [Disabled | Stopped] -- C:\Program Files (x86)\HP Games\HP Game Console\GameConsoleService.exe -- (GameConsoleService)

SRV - [2009.08.27 18:09:10 | 001,253,376 | ---- | M] (MAGIX AG) [Auto | Running] -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe -- (Fabs)

SRV - [2009.08.18 12:48:02 | 002,291,568 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)

SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

SRV - [2009.06.04 19:03:06 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe -- (IAANTMON)

SRV - [2009.02.22 12:00:00 | 000,129,584 | ---- | M] (EasyBits Sofware AS) [Auto | Running] -- C:\Windows\SysWOW64\ezsvc7.dll -- (ezSharedSvc)

SRV - [2008.08.07 12:10:02 | 003,276,800 | ---- | M] (MAGIX®) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe -- (FirebirdServerMAGIXInstance)

SRV - [2007.11.21 13:16:02 | 000,020,480 | ---- | M] () [Disabled | Stopped] -- C:\Programme\Hercules\Audio\DJ Console Series\HerculesDJControlMP3.EXE -- (HerculesDJControlMP3)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - [2014.06.17 21:12:55 | 000,122,584 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\MBAMSwissArmy.sys -- (MBAMSwissArmy)

DRV:64bit: - [2014.05.12 07:26:10 | 000,063,704 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\mwac.sys -- (MBAMWebAccessControl)

DRV:64bit: - [2014.05.12 07:25:56 | 000,025,816 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)

DRV:64bit: - [2014.03.11 09:52:30 | 000,133,928 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NisDrvWFP.sys -- (NisDrv)

DRV:64bit: - [2013.12.27 20:42:26 | 000,039,200 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvvad64v.sys -- (nvvad_WaveExtensible)

DRV:64bit: - [2013.11.28 15:38:18 | 000,197,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)

DRV:64bit: - [2012.12.13 14:50:36 | 000,054,784 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)

DRV:64bit: - [2012.08.21 13:01:20 | 000,033,240 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)

DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)

DRV:64bit: - [2011.09.02 08:30:36 | 000,060,696 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LMouFilt.Sys -- (LMouFilt)

DRV:64bit: - [2011.09.02 08:30:24 | 000,066,840 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LHidFilt.Sys -- (LHidFilt)

DRV:64bit: - [2011.05.10 08:06:14 | 000,022,528 | ---- | M] (Apple Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\netaapl64.sys -- (Netaapl)

DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)

DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)

DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)

DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV:64bit: - [2010.01.22 15:43:21 | 000,314,016 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\atksgt.sys -- (atksgt)

DRV:64bit: - [2010.01.22 15:43:21 | 000,043,680 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\lirsgt.sys -- (lirsgt)

DRV:64bit: - [2009.10.02 11:33:12 | 000,144,896 | ---- | M] (© Guillemot R&D, 2009. All rights reserved.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HDJMidi.sys -- (HDJMidi)

DRV:64bit: - [2009.10.02 11:33:06 | 000,154,112 | ---- | M] (© Guillemot R&D, 2009. All rights reserved.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HDJBulk.sys -- (Bulk)

DRV:64bit: - [2009.08.21 10:52:09 | 000,079,976 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\xusb21.sys -- (xusb21)

DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)

DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)

DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)

DRV:64bit: - [2009.07.14 02:39:20 | 000,023,040 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WSDPrint.sys -- (WSDPrintDevice)

DRV:64bit: - [2009.07.14 02:35:37 | 000,025,088 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WSDScan.sys -- (WSDScan)

DRV:64bit: - [2009.07.14 02:35:32 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\serscan.sys -- (StillCam)

DRV:64bit: - [2009.07.13 16:31:42 | 000,233,472 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)

DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)

DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)

DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)

DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)

DRV:64bit: - [2009.06.04 20:54:36 | 000,408,600 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)

DRV:64bit: - [2008.10.21 09:22:44 | 000,145,960 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s0017unic.sys -- (s0017unic)

DRV:64bit: - [2008.10.21 09:22:44 | 000,128,552 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s0017obex.sys -- (s0017obex)

DRV:64bit: - [2008.10.21 09:22:42 | 000,152,616 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s0017mdm.sys -- (s0017mdm)

DRV:64bit: - [2008.10.21 09:22:42 | 000,019,496 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s0017mdfl.sys -- (s0017mdfl)

DRV:64bit: - [2008.10.21 09:22:40 | 000,113,704 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s0017bus.sys -- (s0017bus)

DRV:64bit: - [2008.01.09 12:28:20 | 000,034,032 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\seehcri.sys -- (seehcri)

DRV:64bit: - [2007.12.10 15:22:10 | 000,144,936 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s3017unic.sys -- (s3017unic)

DRV:64bit: - [2007.12.10 15:22:06 | 000,125,480 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s3017obex.sys -- (s3017obex)

DRV:64bit: - [2007.12.10 15:22:04 | 000,034,344 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s3017nd5.sys -- (s3017nd5)

DRV:64bit: - [2007.12.10 15:22:02 | 000,130,600 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s3017mgmt.sys -- (s3017mgmt)

DRV:64bit: - [2007.12.10 15:22:00 | 000,146,984 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s3017mdm.sys -- (s3017mdm)

DRV:64bit: - [2007.12.10 15:22:00 | 000,019,496 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s3017mdfl.sys -- (s3017mdfl)

DRV:64bit: - [2007.12.10 15:21:56 | 000,109,096 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s3017bus.sys -- (s3017bus)

DRV - [2009.10.20 14:50:12 | 000,146,928 | ---- | M] (CyberLink Corp.) [2010/05/20 17:15:44] [Kernel | Auto | Running] -- c:\Program Files (x86)\Hewlett-Packard\Media\DVD\000.fcl -- ({55662437-DA8C-40c0-AADA-2C816A897A49})

DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

DRV - [2007.03.16 10:11:20 | 000,015,648 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\TBPanelx64.sys -- (Cardex)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}

IE:64bit: - HKLM\..\SearchScopes\{55569AE9-E080-4075-8F4C-198D43C36528}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008

IE:64bit: - HKLM\..\SearchScopes\{D81DF4A5-2989-4677-8D95-BC3A4221F70F}: "URL" = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcndtie7-de-de

IE:64bit: - HKLM\..\SearchScopes\{FA7B8497-781C-489C-B5B7-A24024F2DC7B}: "URL" = hxxp://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\..\SearchScopes,DefaultScope = 

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKLM\..\SearchScopes\{55569AE9-E080-4075-8F4C-198D43C36528}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/

IE - HKCU\..\SearchScopes,DefaultScope = 

IE - HKCU\..\SearchScopes\{55569AE9-E080-4075-8F4C-198D43C36528}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008

IE - HKCU\..\SearchScopes\{6A6F49A0-7205-4700-A462-71F06F221962}: "URL" = hxxp://www.google.de/search?q={searchTerms}

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

 
 ========== FireFox ==========

 

FF - user.js - File not found

 

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.4: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)

FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.104.0: C:\Program Files (x86)\Battlelog Web Plugins\1.104.0\npesnlaunch.dll File not found

FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.116.0: C:\Program Files (x86)\Battlelog Web Plugins\1.116.0\npesnlaunch.dll File not found

FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.122.0: C:\Program Files (x86)\Battlelog Web Plugins\1.122.0\npesnlaunch.dll File not found

FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.140.0: C:\Program Files (x86)\Battlelog Web Plugins\1.140.0\npesnlaunch.dll File not found

FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.96.0: C:\Program Files (x86)\Battlelog Web Plugins\1.96.0\npesnlaunch.dll File not found

FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=2.1.3: C:\Program Files (x86)\Battlelog Web Plugins\2.1.3\npesnlaunch.dll File not found

FF - HKLM\Software\MozillaPlugins\@esn/npbattlelog,version=2.3.2: C:\Program Files (x86)\Battlelog Web Plugins\2.3.2\npbattlelog.dll (EA Digital Illusions CE AB)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2014.06.12 13:27:57 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

 

[2011.11.21 17:06:36 | 000,000,000 | ---D | M] (No name found) -- C:\Users\HP\AppData\Roaming\mozilla\Extensions

[2014.04.14 18:22:27 | 000,000,000 | ---D | M] (No name found) -- C:\Users\HP\AppData\Roaming\mozilla\Firefox\Profiles\2e4xqkik.default\extensions

[2011.11.25 20:40:39 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions

[2011.11.25 20:40:39 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}

[2014.06.12 13:27:56 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll

[2012.03.05 14:34:12 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

[2012.03.05 14:34:12 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml

[2012.03.05 14:34:12 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

[2012.03.05 14:34:12 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

[2012.03.05 14:34:12 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml

[2012.03.05 14:34:12 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2014.06.12 13:21:19 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll File not found

O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.

O4:64bit: - HKLM..\Run: [IAAnotif] C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe (Intel Corporation)

O4:64bit: - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)

O4:64bit: - HKLM..\Run: [NvBackend] C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe (NVIDIA Corporation)

O4:64bit: - HKLM..\Run: [ShadowPlay] C:\Windows\SysNative\nvspcap64.dll (NVIDIA Corporation)

O4 - HKLM..\Run: []  File not found

O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)

O4 - HKLM..\Run: [Easybits Recovery] C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe (EasyBits Software AS)

O4:64bit: - HKLM..\RunOnce: [*WerKernelReporting] C:\Windows\SysNative\WerFault.exe (Microsoft Corporation)

O4 - HKLM..\RunOnce: [Malwarebytes Anti-Malware (cleanup)] C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\mbamdor.exe (Malwarebytes Corporation)

O4 - HKCU..\RunOnce: [FlashPlayerUpdate] C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_13_0_0_214_Plugin.exe (Adobe Systems Incorporated)

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: EnableShellExecuteHooks = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1

O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\HP\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm File not found

O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000 File not found

O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\HP\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm File not found

O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000 File not found

O9 - Extra Button: HP Smart Print - {22CC3EBD-C286-43aa-B8E6-06B115F74162} - C:\Program Files (x86)\Hewlett-Packard\Smart Print 2.0\smartprintsetup.exe (Hewlett-Packard)

O9 - Extra 'Tools' menuitem : HP Smart Print - {22CC3EBD-C286-43aa-B8E6-06B115F74162} - C:\Program Files (x86)\Hewlett-Packard\Smart Print 2.0\smartprintsetup.exe (Hewlett-Packard)

O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL (Microsoft Corporation)

O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)

O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)

O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000010 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)

O13 - gopher Prefix: missing

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FA7AE09C-7813-4011-8037-998009C97D5C}: DhcpNameServer = 192.168.2.1

O18:64bit: - Protocol\Handler\ms-help - No CLSID value found

O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found

O18:64bit: - Protocol\Handler\skype4com - No CLSID value found

O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)

O20:64bit: - Winlogon\Notify\LBTWlgn: DllName - (c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll) - c:\Programme\Common Files\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O28:64bit: - HKLM ShellExecuteHooks: {E54729E8-643D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook64.dll ()

O28 - HKLM ShellExecuteHooks: {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook32.dll ()

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2010.09.10 23:33:59 | 000,000,000 | R--D | M] - F:\AutoRun -- [ UDF ]

O32 - AutoRun File - [2010.09.10 23:34:03 | 000,439,056 | R--- | M] (Electronic Arts) - F:\AutoRun.exe -- [ UDF ]

O32 - AutoRun File - [2010.09.10 23:34:02 | 007,864,832 | R--- | M] () - F:\autorun.dat -- [ UDF ]

O32 - AutoRun File - [2010.09.10 23:33:38 | 000,000,141 | R--- | M] () - F:\autorun.inf -- [ UDF ]

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2014.06.28 18:16:40 | 000,000,000 | ---D | C] -- C:\_OTL

[2014.06.17 21:55:02 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT

[2014.06.17 21:39:36 | 000,000,000 | ---D | C] -- C:\AdwCleaner

[2014.06.17 21:12:55 | 000,122,584 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\MBAMSwissArmy.sys

[2014.06.17 21:12:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

[2014.06.17 21:12:28 | 000,091,352 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbamchameleon.sys

[2014.06.17 21:12:28 | 000,063,704 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mwac.sys

[2014.06.17 21:12:28 | 000,025,816 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys

[2014.06.17 21:12:28 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes Anti-Malware

[2014.06.12 13:24:03 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN

[2014.06.12 13:23:55 | 000,000,000 | ---D | C] -- C:\Windows\temp

[2014.06.12 13:23:55 | 000,000,000 | ---D | C] -- C:\Users\HP\AppData\Local\temp

[2014.06.12 13:10:52 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe

[2014.06.12 13:10:52 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe

[2014.06.12 13:10:51 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe

[2014.06.12 13:10:37 | 000,000,000 | ---D | C] -- C:\Qoobox

[2014.06.12 13:10:22 | 000,000,000 | ---D | C] -- C:\Windows\erdnt

[2014.06.12 12:57:47 | 000,000,000 | ---D | C] -- C:\Users\HP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller

[2014.06.12 12:57:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\VS Revo Group

[2014.06.12 11:32:58 | 000,000,000 | ---D | C] -- C:\FRST

[2014.06.09 15:02:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes

[2014.06.09 15:00:55 | 000,000,000 | ---D | C] -- C:\Program Files\iPod

[2014.06.09 15:00:54 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes

[2014.06.09 15:00:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\iTunes

[2014.06.09 15:00:54 | 000,000,000 | ---D | C] -- C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69

 
 ========== Files - Modified Within 30 Days ==========

 

[2014.06.28 18:32:38 | 000,001,102 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2014.06.28 18:28:09 | 000,015,568 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2014.06.28 18:28:09 | 000,015,568 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2014.06.28 18:26:47 | 002,441,888 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat

[2014.06.28 18:26:47 | 001,162,406 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2014.06.28 18:26:47 | 000,690,304 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat

[2014.06.28 18:26:47 | 000,608,298 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2014.06.28 18:26:47 | 000,006,264 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2014.06.28 18:21:09 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2014.06.28 18:20:38 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2014.06.28 18:20:35 | 2140,467,199 | -HS- | M] () -- C:\hiberfil.sys

[2014.06.28 18:17:05 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2014.06.17 21:12:55 | 000,122,584 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\MBAMSwissArmy.sys

[2014.06.17 21:12:33 | 000,001,108 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2014.06.12 13:21:19 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts

[2014.06.12 12:57:47 | 000,001,270 | ---- | M] () -- C:\Users\HP\Desktop\Revo Uninstaller.lnk

[2014.06.09 15:02:21 | 000,001,785 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk

 
 ========== Files Created - No Company Name ==========

 

[2014.06.17 21:12:33 | 000,001,108 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2014.06.12 13:10:52 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe

[2014.06.12 13:10:52 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe

[2014.06.12 13:10:52 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe

[2014.06.12 13:10:52 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe

[2014.06.12 13:10:52 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe

[2014.06.12 12:57:47 | 000,001,270 | ---- | C] () -- C:\Users\HP\Desktop\Revo Uninstaller.lnk

[2014.03.20 20:51:21 | 000,773,192 | ---- | C] () -- C:\Windows\SysWow64\ezUPBHook64.dll

[2014.03.20 20:51:21 | 000,484,936 | ---- | C] () -- C:\Windows\SysWow64\ezUPBHook32.dll

[2014.01.15 21:54:51 | 000,000,057 | ---- | C] () -- C:\ProgramData\Ament.ini

[2011.11.01 20:05:55 | 000,007,601 | ---- | C] () -- C:\Users\HP\AppData\Local\Resmon.ResmonCfg

[2011.06.25 21:47:56 | 000,000,000 | ---- | C] () -- C:\Users\HP\AppData\Local\{567718F3-5F26-4E9A-8C5D-952C36B9190A}

[2011.05.25 13:51:25 | 000,000,000 | ---- | C] () -- C:\Users\HP\AppData\Local\{8EED7A26-20F8-4BD4-A5BB-A53A3471B2DE}

[2011.05.08 11:18:08 | 000,000,000 | ---- | C] () -- C:\Users\HP\AppData\Local\{DF089CB1-4CC5-451B-B766-994D63ED2547}

[2010.08.07 19:43:48 | 000,000,680 | RHS- | C] () -- C:\Users\HP\ntuser.pol

[2010.08.07 18:43:20 | 000,066,774 | ---- | C] () -- C:\Users\HP\AppData\Local\tmpDSC00034.0

[2010.08.07 18:43:20 | 000,054,357 | ---- | C] () -- C:\Users\HP\AppData\Local\tmpDSC00034.JPG

[2010.06.13 09:26:26 | 000,028,353 | ---- | C] () -- C:\Users\HP\AppData\Roaming\OFMissionEditorConfig.xml

 
 ========== ZeroAccess Check ==========

 

[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

 

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

 

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

"" = C:\Windows\SysNative\shell32.dll -- [2014.03.25 04:43:12 | 014,175,744 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

"" = %SystemRoot%\system32\shell32.dll -- [2014.03.25 04:09:54 | 012,874,240 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 14:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Both

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

 
 ========== LOP Check ==========

 

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 
 < HKEY_LOCAL_MACHINE\software\microsoft\Windows\CurrentVersion\Telephony\Providers >

"ProviderID0" = 1

"ProviderID1" = 2

"ProviderID2" = 3

"ProviderID3" = 4

"NextProviderID" = 5

"ProviderFileName0" = unimdm.tsp -- [2010.11.20 14:16:53 | 000,281,088 | ---- | M] (Microsoft Corporation)

"ProviderFileName1" = kmddsp.tsp -- [2009.07.14 03:14:11 | 000,038,912 | ---- | M] (Microsoft Corporation)

"ProviderFileName2" = ndptsp.tsp -- [2009.07.14 03:14:11 | 000,050,688 | ---- | M] (Microsoft Corporation)

"ProviderFileName3" = hidphone.tsp -- [2009.07.14 03:14:11 | 000,030,720 | ---- | M] (Microsoft Corporation)

"NumProviders" = 4

 
 < HKEY_LOCAL_MACHINE\software\microsoft\Windows\CurrentVersion\Telephony\Providers /64 >

"ProviderID0" = 1

"ProviderID1" = 2

"ProviderID2" = 3

"ProviderID3" = 4

"NextProviderID" = 6

"ProviderFileName0" = C:\Windows\SysNative\unimdm.tsp -- [2010.11.20 15:24:24 | 000,321,536 | ---- | M] (Microsoft Corporation)

"ProviderFileName1" = C:\Windows\SysNative\kmddsp.tsp -- [2009.07.14 03:38:54 | 000,047,104 | ---- | M] (Microsoft Corporation)

"ProviderFileName2" = C:\Windows\SysNative\ndptsp.tsp -- [2009.07.14 03:38:54 | 000,060,928 | ---- | M] (Microsoft Corporation)

"ProviderFileName3" = C:\Windows\SysNative\hidphone.tsp -- [2009.07.14 03:38:54 | 000,038,912 | ---- | M] (Microsoft Corporation)

"NumProviders" = 5

"ProviderID4" = 5

"ProviderFilename4" = xpt8036x.tsp

 
 < HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation /S /64 >

"DisplayName" = @%systemroot%\system32\wkssvc.dll,-100

"Group" = NetworkProvider

"ImagePath" = C:\Windows\SysNative\svchost.exe -- [2009.07.14 03:39:46 | 000,027,136 | ---- | M] (Microsoft Corporation)

"Description" = @%systemroot%\system32\wkssvc.dll,-101

"ObjectName" = NT AUTHORITY\NetworkService

"ErrorControl" = 1

"Start" = 2

"Type" = 32

"DependOnService" = BowserMRxSmb10MRxSmb20NSI [binary data]

"ServiceSidType" = 1

"RequiredPrivileges" = SeChangeNotifyPrivilegeSeImperson [Binary data over 200 bytes]

"FailureActions" = 80 51 01 00 00 00 00 00 00 00 00 00 03 00 00 00 14 00 00 00 01 00 00 00 60 EA 00 00 01 00 00 00 C0 D4 01 00 00 00 00 00 00 00 00 00  [binary data]
 64bit: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Linkage]

"Bind" = \Device\Smb_Tcpip_{B0AB2B6B-5995-4 [Binary data over 200 bytes]

"Route" = "Smb" "Tcpip" "{B0AB2B6B-5995-48F3 [Binary data over 200 bytes]

"Export" = \Device\LanmanWorkstation_Smb_Tcpi [Binary data over 200 bytes]
 64bit: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\NetworkProvider]

"DeviceName" = \Device\LanmanRedirector

"Name" = Microsoft Windows Network

"DisplayName" = @%systemroot%\system32\wkssvc.dll,-102

"ProviderPath" = C:\Windows\SysNative\ntlanman.dll -- [2010.11.20 15:27:23 | 000,129,536 | ---- | M] (Microsoft Corporation)
 64bit: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters]

"ServiceDll" = C:\Windows\SysNative\wkssvc.dll -- [2010.11.20 15:27:28 | 000,118,784 | ---- | M] (Microsoft Corporation)

"ServiceDllUnloadOnStop" = 1

"EnablePlainTextPassword" = 0

"EnableSecuritySignature" = 1

"RequireSecuritySignature" = 0

"OtherDomains" =  [binary data]

 
 < HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Dnscache /S /64 >
 64bit: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Dnscache\Parameters]

"ServiceDll" = C:\Windows\SysNative\dnsrslvr.dll -- [2011.03.03 08:24:16 | 000,183,296 | ---- | M] (Microsoft Corporation)

 
 < HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost >

"netsvcs" = AeLookupSvcCertPropSvcSCPolicySv [Binary data over 200 bytes]

"LocalService" = RemoteRegistryWinHttpAutoProxySvc [Binary data over 200 bytes]

"LocalSystemNetworkRestricted" = NetmanAudioEndpointBuilderdot3sv [Binary data over 200 bytes]

"LocalServiceNoNetwork" = PLA [binary data] -- [2010.11.20 14:20:54 | 001,508,864 | ---- | M] (Microsoft Corporation)

"rpcss" = RpcSs [binary data]

"LocalServiceNetworkRestricted" = AudioSrvBthHFSrvLmHostswscsvcWPCSvc [binary data]

"LocalServiceAndNoImpersonation" = SSDPSRVupnphostSCardSvrTBSQWAVEwcncsvc [binary data]

"DcomLaunch" = PowerPlugPlayDcomLaunch [binary data]

"NetworkService" = CryptSvcDHCPTermServiceDNSCache [Binary data over 200 bytes]

"imgsvc" = StiSvc [binary data]

"wcssvc" = WcsPlugInService [binary data] -- [2009.07.14 03:16:18 | 000,032,768 | ---- | M] (Microsoft Corporation)

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\LocalService]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\LocalServiceAndNoImpersonation]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\LocalServiceNetworkRestricted]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\LocalServiceNoNetwork]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\LocalSystemNetworkRestricted]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\netsvcs]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\NetworkService]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\NetworkServiceRemoteDesktopHyperVAgent]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\NetworkServiceRemoteDesktopPublishing]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\termsvcs]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\wcssvc]

 
 < HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost /64 >

"RPCSS" = RpcEptMapperRpcSs [binary data]

"defragsvc" = C:\Windows\SysNative\defragsvc.dll -- [2009.07.14 03:40:28 | 000,291,328 | ---- | M] (Microsoft Corporation)

"LocalSystemNetworkRestricted" = UxSmsWdiSystemHostNetmantrkwks [Binary data over 200 bytes]

"LocalService" = nsiWdiServiceHostw32timeEventSy [Binary data over 200 bytes]

"netsvcs" = AeLookupSvcCertPropSvcSCPolicySv [Binary data over 200 bytes]

"WerSvcGroup" = C:\Windows\SysNative\wersvc.dll -- [2009.07.14 03:41:56 | 000,076,800 | ---- | M] (Microsoft Corporation)

"LocalServiceNoNetwork" = DPSPLABFEmpssvcWwanSvc [binary data]

"termsvcs" = TermService [binary data]

"swprv" = C:\Windows\SysNative\swprv.dll -- [2009.07.14 03:41:54 | 000,524,288 | ---- | M] (Microsoft Corporation)

"LocalServiceNetworkRestricted" = DHCPeventlogAudioSrvBthHFSrvLm [Binary data over 200 bytes]

"LocalServicePeerNet" = PNRPSvcp2pimsvcp2psvcPnrpAutoReg [binary data]

"NetworkServiceAndNoImpersonation" = KtmRm [binary data]

"regsvc" = RemoteRegistry [binary data]

"LocalServiceAndNoImpersonation" = SSDPSRVupnphostSCardSvrTBSfdre [Binary data over 200 bytes]

"DcomLaunch" = PowerPlugPlayDcomLaunch [binary data]

"NetworkServiceNetworkRestricted" = PolicyAgent [binary data]

"NetworkService" = CryptSvcDHCPTermServiceDNSCache [Binary data over 200 bytes]

"sdrsvc" = C:\Windows\SysNative\sdrsvc.dll -- [2010.11.20 15:27:25 | 000,170,496 | ---- | M] (Microsoft Corporation)

"WbioSvcGroup" = C:\Windows\SysNative\WbioSrvc.dll -- [2009.07.14 03:41:56 | 000,202,240 | ---- | M] (Microsoft Corporation)

"imgsvc" = StiSvc [binary data]

"wcssvc" = C:\Windows\SysNative\WcsPlugInService.dll -- [2009.07.14 03:41:56 | 000,040,960 | ---- | M] (Microsoft Corporation)

"AxInstSVGroup" = C:\Windows\SysNative\AxInstSV.dll -- [2010.11.20 15:25:44 | 000,114,688 | ---- | M] (Microsoft Corporation)

"secsvcs" = WinDefend [binary data]

"bthsvcs" = C:\Windows\SysNative\bthserv.dll -- [2009.07.14 03:40:13 | 000,083,968 | ---- | M] (Microsoft Corporation)

 
 64bit: [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\AxInstSVGroup]

 
 64bit: [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\defragsvc]

 
 64bit: [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\LocalService]

 
 64bit: [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\LocalServiceAndNoImpersonation]

 
 64bit: [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\LocalServiceNetworkRestricted]

 
 64bit: [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\LocalServiceNoNetwork]

 
 64bit: [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\LocalSystemNetworkRestricted]

 
 64bit: [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\netsvcs]

 
 64bit: [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\NetworkService]

 
 64bit: [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\NetworkServiceRemoteDesktopHyperVAgent]

 
 64bit: [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\NetworkServiceRemoteDesktopPublishing]

 
 64bit: [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\SDRSVC]

 
 64bit: [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\swprv]

 
 64bit: [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\termsvcs]

 
 64bit: [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\wcssvc]

 
 64bit: [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\wercplsupport]

 
 < HKEY_LOCAL_MACHINE\SOFTWARE\Joosoft.com >

 
 < HKEY_LOCAL_MACHINE\SOFTWARE\Joosoft.com /64 >

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Joosoft.com\UpdateClient]

 
 < %SystemRoot%\system32\*.tsp >

[2009.07.14 03:14:11 | 000,030,720 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\hidphone.tsp

[2009.07.14 03:14:11 | 000,038,912 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\kmddsp.tsp

[2009.07.14 03:14:11 | 000,050,688 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\ndptsp.tsp

[2009.07.14 03:14:11 | 000,082,432 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\remotesp.tsp

[2010.11.20 14:16:53 | 000,281,088 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\unimdm.tsp

 
 < %SystemRoot%\system32\*.tsp /64 >

[2009.07.14 03:38:54 | 000,038,912 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\hidphone.tsp

[2009.07.14 03:38:54 | 000,047,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\kmddsp.tsp

[2009.07.14 03:38:54 | 000,060,928 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ndptsp.tsp

[2009.07.14 03:38:54 | 000,102,400 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\remotesp.tsp

[2010.11.20 15:24:24 | 000,321,536 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\unimdm.tsp

 
 < C:\Windows\system32\*.dll /800 >

[2013.02.15 06:34:10 | 000,131,584 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\aaclient.dll

[2014.03.04 11:17:05 | 000,049,664 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\adprovider.dll

[2013.08.29 03:48:17 | 000,640,512 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\advapi32.dll

[2013.08.02 03:48:14 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll

[2013.08.02 03:48:14 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll

[2013.08.02 03:48:14 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll

[2013.08.02 03:48:14 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll

[2013.08.02 03:48:15 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll

[2013.08.02 03:48:15 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll

[2013.08.02 03:48:15 | 000,005,120 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll

[2013.08.02 03:48:15 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll

[2013.08.02 03:48:15 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll

[2013.08.02 03:48:15 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll

[2013.08.02 03:48:15 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll

[2013.08.02 03:48:15 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll

[2013.08.02 03:48:15 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll

[2013.08.02 03:48:15 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll

[2013.08.02 03:48:15 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll

[2013.08.02 03:48:15 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll

[2013.08.02 03:48:15 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll

[2013.08.02 03:48:15 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll

[2013.08.02 03:48:15 | 000,004,608 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll

[2013.08.02 03:48:15 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll

[2013.08.02 03:48:15 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll

[2013.08.02 03:48:15 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll

[2013.08.02 03:48:15 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll

[2013.08.02 03:48:15 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll

[2013.08.02 02:43:05 | 000,004,608 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll

[2013.08.02 02:43:05 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll

[2013.08.02 02:43:05 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll

[2013.01.13 23:16:42 | 000,010,752 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll

[2013.01.13 23:12:46 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll

[2013.01.13 23:17:02 | 000,002,560 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll

[2013.01.13 23:11:08 | 000,005,632 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll

[2013.01.13 23:11:07 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll

[2013.01.13 23:17:03 | 000,009,728 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll

[2013.01.13 23:11:07 | 000,005,632 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll

[2013.01.13 23:11:21 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll

[2013.01.13 23:11:07 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0.dll

[2013.08.02 02:43:05 | 000,006,144 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll

[2013.08.02 03:48:15 | 000,006,656 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\apisetschema.dll

[2013.09.11 22:21:54 | 000,028,776 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\aspnet_counters.dll

[2013.06.09 20:53:16 | 000,164,424 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\atl110.dll

[2013.06.06 05:01:38 | 000,295,424 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\system32\atmfd.dll

[2013.06.06 05:01:26 | 000,034,304 | ---- | M] (Adobe Systems) -- C:\Windows\system32\atmlib.dll

[2013.10.04 03:56:00 | 001,796,096 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\authui.dll

[2012.07.04 23:14:34 | 000,041,984 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\browcli.dll

[2014.03.04 11:17:06 | 000,048,128 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\capiprovider.dll

[2012.06.06 07:03:06 | 000,805,376 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\cdosys.dll

[2013.05.13 05:08:06 | 000,043,008 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\certenc.dll

[2013.05.17 16:54:08 | 000,178,800 | ---- | M] (Sony DADC Austria AG.) -- C:\Windows\system32\CmdLineExt_x64.dll

[2014.03.04 11:17:07 | 000,051,200 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\cngprovider.dll

[2013.07.04 13:50:56 | 000,530,432 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\comctl32.dll

[2014.03.04 11:17:07 | 000,017,408 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\credssp.dll

[2013.10.04 03:56:25 | 000,168,960 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\credui.dll

[2013.10.05 21:57:25 | 001,168,384 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\crypt32.dll

[2013.05.10 05:20:54 | 000,024,576 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\cryptdlg.dll

[2013.07.09 06:46:31 | 000,103,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\cryptnet.dll

[2013.07.09 06:46:31 | 000,140,288 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\cryptsvc.dll

[2013.11.26 10:16:50 | 003,419,136 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\d2d1.dll

[2013.01.13 21:46:25 | 001,080,832 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\d3d10.dll

[2013.01.13 22:08:43 | 000,220,160 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\d3d10core.dll

[2013.01.13 21:54:01 | 000,604,160 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\d3d10level9.dll

[2013.12.25 01:09:41 | 001,987,584 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\d3d10warp.dll

[2013.01.13 21:48:47 | 000,161,792 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\d3d10_1.dll

[2013.01.13 22:09:00 | 000,249,856 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\d3d10_1core.dll

[2013.04.26 01:30:32 | 001,505,280 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\d3d11.dll

[2013.07.04 13:51:04 | 000,081,920 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\davclnt.dll

[2013.06.06 06:50:56 | 000,010,240 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\dciman32.dll

[2012.10.09 19:40:31 | 000,193,536 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\dhcpcore6.dll

[2012.10.09 19:40:31 | 000,044,032 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\dhcpcsvc6.dll

[2014.03.04 11:17:08 | 000,036,864 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\dimsroam.dll

[2014.03.04 11:17:08 | 000,047,616 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\dpapiprovider.dll

[2012.11.02 07:11:31 | 000,376,832 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\dpnet.dll

[2013.04.10 01:34:01 | 001,247,744 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\DWrite.dll

[2013.01.13 22:20:31 | 000,293,376 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\dxgi.dll

[2014.05.30 10:16:26 | 000,368,128 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\dxtmsft.dll

[2014.05.30 10:02:32 | 000,242,688 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\dxtrans.dll

[2013.12.14 15:03:39 | 000,194,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\elshyph.dll

[2014.01.03 13:00:00 | 001,331,200 | ---- | M] (EasyBits Software AS) -- C:\Windows\system32\ezBook7.dll

[2014.01.03 13:00:00 | 000,605,704 | ---- | M] (EasyBits Software AS) -- C:\Windows\system32\ezEMail7.dll

[2014.01.03 13:00:00 | 000,348,680 | ---- | M] (EasyBits Software AS) -- C:\Windows\system32\ezHints7.dll

[2014.01.03 13:00:00 | 000,682,504 | ---- | M] (EasyBits Software AS) -- C:\Windows\system32\ezLicPrompt7.dll

[2014.01.03 13:00:00 | 000,571,976 | ---- | M] (EasyBits Software AS) -- C:\Windows\system32\ezMenu7.dll

[2014.01.03 13:00:00 | 001,030,664 | ---- | M] (EasyBits Software AS) -- C:\Windows\system32\ezPrint7.dll

[2014.01.03 13:00:00 | 000,654,920 | ---- | M] (EasyBits Software AS) -- C:\Windows\system32\ezScore7.dll

[2014.01.03 13:00:00 | 001,376,264 | ---- | M] (EasyBits Software AS) -- C:\Windows\system32\ezShell7.dll

[2013.07.25 13:00:00 | 000,353,792 | ---- | M] (EasyBits Software AS) -- C:\Windows\system32\ezsvc7x.dll

[2014.03.20 20:51:21 | 000,484,936 | ---- | M] () -- C:\Windows\system32\ezUPBHook32.dll

[2014.03.20 20:51:21 | 000,773,192 | ---- | M] () -- C:\Windows\system32\ezUPBHook64.dll

[2014.01.03 13:00:00 | 000,750,592 | ---- | M] (EasyBits Software AS) -- C:\Windows\system32\ezUtils7.dll

[2014.01.03 13:00:00 | 000,332,296 | ---- | M] (EasyBits Software AS) -- C:\Windows\system32\ezWizard7.dll

[2013.06.06 06:51:29 | 000,070,656 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\fontsub.dll

[2013.10.12 04:01:25 | 000,216,576 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\FWPUCLNT.DLL

[2012.12.07 14:20:43 | 002,576,384 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\gameux.dll

[2013.10.03 04:00:44 | 000,311,808 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\gdi32.dll

[2012.08.21 13:01:20 | 000,106,928 | ---- | M] (GEAR Software Inc.) -- C:\Windows\system32\GEARAspi.dll

[2013.12.14 15:03:30 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\icardie.dll

[2013.12.14 15:03:28 | 000,111,616 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\IEAdvpack.dll

[2014.05.30 09:13:47 | 000,704,512 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\ieapfltr.dll

[2013.12.14 15:03:30 | 000,238,288 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\iedkcs32.dll

[2014.05.30 10:42:16 | 000,051,200 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\ieetwproxystub.dll

[2014.05.30 09:40:23 | 011,725,312 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\ieframe.dll

[2013.12.14 15:03:29 | 000,116,736 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\iepeers.dll

[2014.05.30 10:33:48 | 000,032,768 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\iernonce.dll

[2014.05.30 10:38:34 | 002,179,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\iertutil.dll

[2014.05.30 10:43:06 | 000,061,952 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\iesetup.dll

[2013.12.14 15:03:28 | 000,086,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\iesysprep.dll

[2014.05.30 10:30:43 | 000,440,832 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\ieui.dll

[2013.10.19 03:36:59 | 000,159,232 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\imagehlp.dll

[2013.12.14 15:03:29 | 000,036,352 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\imgutil.dll

[2013.12.14 15:03:29 | 000,083,456 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\inseng.dll

[2014.02.04 04:00:39 | 000,002,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\iologmsg.dll

[2014.05.30 10:10:46 | 000,032,256 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\JavaScriptCollectionAgent.dll

[2013.12.14 15:03:29 | 000,610,304 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\jscript.dll

[2014.05.30 09:56:50 | 004,244,992 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\jscript9.dll

[2014.05.30 10:27:56 | 000,592,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\jscript9diag.dll

[2013.12.14 15:03:31 | 000,645,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\jsIntl.dll

[2014.05.30 10:34:17 | 000,043,008 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\jsproxy.dll

[2014.03.04 11:17:13 | 000,550,912 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\kerberos.dll

[2014.03.04 11:16:17 | 001,114,112 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\kernel32.dll

[2014.03.04 11:16:18 | 000,274,944 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\KernelBase.dll

[2013.12.14 15:03:30 | 000,024,576 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\licmgr10.dll

[2013.06.06 06:57:01 | 000,025,600 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\lpk.dll

[2013.05.02 09:09:30 | 003,748,672 | ---- | M] (mquadr.at software engineering und consulting GmbH) -- C:\Windows\system32\M2ElevatedCalls.dll

[2013.05.02 09:08:40 | 000,962,368 | ---- | M] (mquadr.at software engineering) -- C:\Windows\system32\M2ElevatedNetworkAdapters.dll

[2013.06.09 20:53:16 | 004,421,192 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\mfc110.dll

[2013.06.09 20:53:16 | 000,046,160 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\mfc110chs.dll

[2013.06.09 20:53:16 | 000,046,160 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\mfc110cht.dll

[2013.06.09 20:53:16 | 000,074,832 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\mfc110deu.dll

[2013.06.09 20:53:16 | 000,065,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\mfc110enu.dll

[2013.06.09 20:53:16 | 000,073,808 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\mfc110esn.dll

[2013.06.09 20:53:16 | 000,074,832 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\mfc110fra.dll

[2013.06.09 20:53:16 | 000,072,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\mfc110ita.dll

[2013.06.09 20:53:16 | 000,053,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\mfc110jpn.dll

[2013.06.09 20:53:16 | 000,053,328 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\mfc110kor.dll

[2013.06.09 20:53:16 | 000,070,736 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\mfc110rus.dll

[2013.06.09 20:53:16 | 004,456,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\mfc110u.dll

[2013.06.09 20:53:16 | 000,083,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\mfcm110.dll

[2013.06.09 20:53:16 | 000,083,024 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\mfcm110u.dll

[2013.12.04 04:02:06 | 000,390,144 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\msdrm.dll

[2014.05.30 09:54:14 | 000,526,336 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\msfeeds.dll

[2013.12.14 15:03:28 | 000,043,008 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\msfeedsbs.dll

[2014.05.30 11:18:15 | 017,271,296 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\mshtml.dll

[2013.12.14 15:03:29 | 000,061,952 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\MshtmlDac.dll

[2014.05.30 10:04:20 | 000,069,632 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\mshtmled.dll

[2013.12.14 15:03:28 | 000,048,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\mshtmler.dll

[2014.05.30 09:50:09 | 001,068,032 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\mshtmlmedia.dll

[2013.10.30 04:19:52 | 000,301,568 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\msieftp.dll

[2013.12.14 15:03:30 | 000,182,272 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\msls31.dll

[2013.01.04 08:11:21 | 002,284,544 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\msmpeg2vdec.dll

[2014.05.30 10:06:06 | 000,164,864 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\msrating.dll

[2014.03.31 22:46:48 | 000,130,712 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\MSSTDFMT.DLL

[2013.02.15 06:37:10 | 003,217,408 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\mstscax.dll

[2014.03.04 11:17:17 | 000,259,584 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\msv1_0.dll

[2012.11.06 03:20:52 | 000,535,008 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\msvcp110.dll

[2013.09.11 22:21:54 | 000,501,872 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\msvcp110_clr0400.dll

[2013.09.11 22:21:54 | 000,018,000 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\msvcr100_clr0400.dll

[2012.11.06 03:20:52 | 000,875,472 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\msvcr110.dll

[2013.09.11 22:21:54 | 000,863,344 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\msvcr110_clr0400.dll

[2013.09.08 04:03:58 | 000,231,424 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\mswsock.dll

[2014.03.26 16:27:50 | 001,237,504 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\msxml3.dll

[2014.03.26 16:25:14 | 000,002,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\msxml3r.dll

[2014.03.26 16:27:50 | 001,389,056 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\msxml6.dll

[2014.03.26 16:25:14 | 000,002,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\msxml6r.dll

[2013.09.25 03:56:42 | 000,220,160 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\ncrypt.dll

[2012.10.03 18:42:23 | 000,156,672 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\ncsi.dll

[2012.07.04 23:16:56 | 000,057,344 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\netapi32.dll

[2012.10.03 18:42:24 | 000,175,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\netcorehc.dll

[2012.10.03 18:42:24 | 000,018,944 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\netevent.dll

[2013.10.12 04:03:08 | 000,656,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\nshwfp.dll

[2013.08.29 03:50:30 | 001,292,192 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\ntdll.dll

[2014.03.04 11:17:19 | 000,014,336 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\ntvdm64.dll

[2014.05.20 04:44:03 | 002,730,208 | ---- | M] (NVIDIA Corporation) -- C:\Windows\system32\nvapi.dll

[2013.12.27 20:42:16 | 000,033,056 | ---- | M] (NVIDIA Corporation) -- C:\Windows\system32\nvaudcap32v.dll

[2014.05.20 04:44:03 | 017,561,544 | ---- | M] (NVIDIA Corporation) -- C:\Windows\system32\nvcompiler.dll

[2014.05.20 04:44:03 | 009,735,256 | ---- | M] (NVIDIA Corporation) -- C:\Windows\system32\nvcuda.dll

[2014.05.20 04:44:03 | 002,412,376 | ---- | M] (NVIDIA Corporation) -- C:\Windows\system32\nvcuvenc.dll

[2014.05.20 04:44:03 | 002,953,672 | ---- | M] (NVIDIA Corporation) -- C:\Windows\system32\nvcuvid.dll

[2014.05.20 04:44:03 | 014,434,704 | ---- | M] (NVIDIA Corporation) -- C:\Windows\system32\nvd3dum.dll

[2014.05.20 04:44:03 | 000,861,128 | ---- | M] (NVIDIA Corporation) -- C:\Windows\system32\NvFBC.dll

[2014.05.20 04:44:03 | 000,867,784 | ---- | M] (NVIDIA Corporation) -- C:\Windows\system32\NvIFR.dll

[2014.05.20 04:44:03 | 000,146,480 | ---- | M] (NVIDIA Corporation) -- C:\Windows\system32\nvinit.dll

[2014.05.20 04:44:03 | 000,305,600 | ---- | M] (NVIDIA Corporation) -- C:\Windows\system32\nvoglshim32.dll

[2014.05.20 04:44:03 | 024,025,376 | ---- | M] (NVIDIA Corporation) -- C:\Windows\system32\nvoglv32.dll

[2014.05.20 04:44:03 | 009,697,640 | ---- | M] (NVIDIA Corporation) -- C:\Windows\system32\nvopencl.dll

[2014.02.05 11:31:00 | 001,048,152 | ---- | M] (NVIDIA Corporation) -- C:\Windows\system32\nvspcap.dll

[2014.05.20 04:44:03 | 000,837,056 | ---- | M] (NVIDIA Corporation) -- C:\Windows\system32\nvumdshim.dll

[2014.05.20 04:44:03 | 016,003,912 | ---- | M] (NVIDIA Corporation) -- C:\Windows\system32\nvwgf2um.dll

[2014.03.04 11:17:19 | 000,538,112 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\objsel.dll

[2013.12.14 15:03:29 | 000,127,488 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\occache.dll

[2013.12.14 15:03:29 | 000,056,832 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\pngfilt.dll

[2013.07.20 12:33:12 | 000,102,608 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll

[2014.02.04 04:04:11 | 000,509,440 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\qedit.dll

[2013.07.09 06:52:33 | 000,663,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\rpcrt4.dll

[2014.03.04 11:17:22 | 000,247,808 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\schannel.dll

[2013.10.12 04:03:31 | 000,163,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\scrrun.dll

[2013.12.04 04:03:08 | 000,428,032 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\secproc.dll

[2013.12.04 04:03:20 | 000,423,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\secproc_isv.dll

[2013.12.04 04:03:20 | 000,087,040 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\secproc_ssp.dll

[2013.12.04 04:03:20 | 000,087,040 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\secproc_ssp_isv.dll

[2014.04.12 04:12:06 | 000,022,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\secur32.dll

[2013.07.26 03:55:59 | 000,180,224 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\shdocvw.dll

[2014.03.25 04:09:54 | 012,874,240 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\shell32.dll

[2013.10.04 03:58:50 | 000,152,576 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\SmartcardCredentialProvider.dll

[2012.05.05 09:46:52 | 000,043,008 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\srclient.dll

[2013.05.21 17:20:41 | 000,249,824 | ---- | M] (mquadr.at software engineering & consulting GmbH, web: www.mquadr.at, mail: office@mquadr.at) -- C:\Windows\system32\SSDPDiscovery.dll

[2014.04.12 04:10:56 | 000,096,768 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\sspicli.dll

[2012.09.26 00:47:43 | 000,078,336 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\synceng.dll

[2013.08.29 03:50:16 | 000,619,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\tdh.dll

[2013.02.15 05:25:51 | 000,036,864 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\tsgqec.dll

[2014.03.04 11:17:26 | 000,065,536 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\TSpkg.dll

[2013.11.12 04:07:29 | 000,002,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\tzres.dll

[2013.01.13 21:53:14 | 000,187,392 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\UIAnimation.dll

[2013.12.14 15:03:30 | 000,233,472 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\url.dll

[2014.05.30 09:15:41 | 001,143,296 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\urlmon.dll

[2014.04.25 04:06:17 | 000,626,688 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\usp10.dll

[2014.05.30 10:44:28 | 000,455,168 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\vbscript.dll

[2012.11.06 03:20:52 | 000,320,976 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\vcamp110.dll

[2012.11.06 03:20:52 | 000,252,400 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\vccorlib110.dll

[2012.11.06 03:20:52 | 000,125,904 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\vcomp110.dll

[2014.03.04 11:17:27 | 000,172,032 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\wdigest.dll

[2013.12.14 15:03:29 | 000,208,384 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\webcheck.dll

[2013.07.04 13:57:28 | 000,205,824 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\WebClnt.dll

[2014.01.29 04:06:47 | 000,381,440 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\wer.dll

[2012.12.03 15:57:24 | 000,238,592 | ---- | M] (Nicomsoft Ltd.) -- C:\Windows\system32\WiFiMan.dll

[2013.04.26 06:55:21 | 000,492,544 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\win32spl.dll

[2014.03.04 11:17:38 | 000,035,328 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\wincredprovider.dll

[2014.02.04 04:04:22 | 001,230,336 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\WindowsCodecs.dll

[2013.01.13 21:53:58 | 000,207,872 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\WindowsCodecsExt.dll

[2014.05.30 09:21:10 | 001,790,976 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\wininet.dll

[2013.07.09 06:52:10 | 000,175,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\wintrust.dll

[2013.05.10 06:56:08 | 011,410,432 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\wmp.dll

[2013.11.23 20:26:20 | 000,417,792 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\WMPhoto.dll

[2013.05.10 06:56:15 | 012,625,408 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\wmploc.DLL

[2013.07.25 10:57:27 | 001,620,992 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\WMVDECOD.DLL

[2014.03.04 11:16:18 | 000,005,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\wow32.dll

[2012.12.07 14:26:17 | 000,308,736 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\Wpc.dll

[2013.01.13 20:34:58 | 000,364,544 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\XpsGdiConverter.dll

[2013.01.13 19:26:42 | 001,158,144 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\XpsPrint.dll

[2009.07.14 07:08:49 | 000,000,006 | -H-- | C] () -- C:\Windows\Tasks\SA.DAT

[2009.07.14 07:08:49 | 000,032,632 | ---- | C] () -- C:\Windows\Tasks\SCHEDLGU.TXT

[2010.12.09 16:17:11 | 000,001,098 | ---- | C] () -- C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

[2010.12.09 16:17:12 | 000,001,102 | ---- | C] () -- C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

[2012.04.02 10:22:50 | 000,000,884 | ---- | C] () -- C:\Windows\Tasks\Adobe Flash Player Updater.job

 
 < C:\Windows\system32\*.dll /800 /64 >

[2013.02.15 08:02:26 | 000,158,720 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\aaclient.dll

[2014.03.04 11:43:55 | 000,056,832 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\adprovider.dll

[2013.08.29 04:13:28 | 000,878,080 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\advapi32.dll

[2014.06.08 11:08:04 | 000,424,448 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\aeinv.dll

[2014.06.08 11:13:05 | 000,506,368 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\aepdu.dll

[2013.08.02 04:12:18 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-console-l1-1-0.dll

[2013.08.02 04:12:18 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-datetime-l1-1-0.dll

[2013.08.02 04:12:18 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-debug-l1-1-0.dll

[2013.08.02 04:12:18 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-delayload-l1-1-0.dll

[2013.08.02 04:12:18 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-errorhandling-l1-1-0.dll

[2013.08.02 04:12:18 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-fibers-l1-1-0.dll

[2013.08.02 04:12:18 | 000,005,120 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-file-l1-1-0.dll

[2013.08.02 04:12:19 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-handle-l1-1-0.dll

[2013.08.02 04:12:19 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-heap-l1-1-0.dll

[2013.08.02 04:12:19 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-interlocked-l1-1-0.dll

[2013.08.02 04:12:19 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-io-l1-1-0.dll

[2013.08.02 04:12:19 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-libraryloader-l1-1-0.dll

[2013.08.02 04:12:19 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localization-l1-1-0.dll

[2013.08.02 04:12:19 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localregistry-l1-1-0.dll

[2013.08.02 04:12:19 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-memory-l1-1-0.dll

[2013.08.02 04:12:19 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-misc-l1-1-0.dll

[2013.08.02 04:12:19 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-namedpipe-l1-1-0.dll

[2013.08.02 04:12:19 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processenvironment-l1-1-0.dll

[2013.08.02 04:12:19 | 000,004,608 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processthreads-l1-1-0.dll

[2013.08.02 04:12:19 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-profile-l1-1-0.dll

[2013.08.02 04:12:19 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-rtlsupport-l1-1-0.dll

[2013.08.02 04:12:20 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-string-l1-1-0.dll

[2013.08.02 04:12:20 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-synch-l1-1-0.dll

[2013.08.02 04:12:20 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-sysinfo-l1-1-0.dll

[2013.08.02 04:12:20 | 000,004,608 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-threadpool-l1-1-0.dll

[2013.08.02 04:12:20 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-util-l1-1-0.dll

[2013.08.02 04:12:20 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-xstate-l1-1-0.dll

[2013.01.13 22:35:18 | 000,010,752 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-advapi32-l1-1-0.dll

[2013.01.13 22:32:07 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-advapi32-l2-1-0.dll

[2013.01.13 22:35:31 | 000,002,560 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-normaliz-l1-1-0.dll

[2013.01.13 22:31:41 | 000,005,632 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-ole32-l1-1-0.dll

[2013.01.13 22:31:40 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-shell32-l1-1-0.dll

[2013.01.13 22:35:31 | 000,009,728 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-shlwapi-l1-1-0.dll

[2013.01.13 22:31:40 | 000,005,632 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-shlwapi-l2-1-0.dll

[2013.01.13 22:31:48 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-user32-l1-1-0.dll

[2013.01.13 22:31:40 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-version-l1-1-0.dll

[2013.08.02 04:12:20 | 000,006,144 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-security-base-l1-1-0.dll

[2013.08.02 04:12:20 | 000,006,656 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\apisetschema.dll

[2013.02.27 07:47:10 | 000,070,144 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\appinfo.dll

[2013.09.11 20:39:06 | 000,030,312 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\aspnet_counters.dll

[2013.06.09 16:59:36 | 000,192,584 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\atl110.dll

[2013.06.06 05:30:53 | 000,368,128 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysNative\atmfd.dll

[2013.06.06 07:47:21 | 000,046,080 | ---- | M] (Adobe Systems) -- C:\Windows\SysNative\atmlib.dll

[2013.10.04 04:24:49 | 001,930,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\authui.dll

[2012.07.05 00:13:27 | 000,059,392 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\browcli.dll

[2012.07.05 00:13:27 | 000,136,704 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\browser.dll

[2014.03.04 11:43:55 | 000,053,760 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\capiprovider.dll

[2012.06.06 08:02:54 | 001,133,568 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\cdosys.dll

[2013.05.13 07:50:40 | 000,052,224 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\certenc.dll

[2014.03.04 11:43:56 | 000,057,344 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\cngprovider.dll

[2013.07.04 14:50:39 | 000,633,856 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\comctl32.dll

[2014.03.04 11:43:56 | 000,022,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\credssp.dll

[2013.10.04 04:25:17 | 000,197,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\credui.dll

[2013.10.05 22:25:35 | 001,474,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\crypt32.dll

[2013.05.10 07:49:27 | 000,030,720 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\cryptdlg.dll

[2013.07.09 07:46:20 | 000,139,776 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\cryptnet.dll

[2013.07.09 07:46:20 | 000,184,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\cryptsvc.dll

[2013.08.02 04:12:47 | 000,043,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\csrsrv.dll

[2013.11.23 00:48:21 | 003,928,064 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\d2d1.dll

[2013.01.13 21:20:04 | 001,238,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10.dll

[2013.01.13 21:38:21 | 000,296,960 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10core.dll

[2013.01.13 21:24:33 | 000,648,192 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10level9.dll

[2013.12.25 00:48:32 | 002,565,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10warp.dll

[2013.01.13 21:20:42 | 000,194,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10_1.dll

[2013.01.13 21:38:39 | 000,333,312 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10_1core.dll

[2013.04.01 00:52:16 | 001,887,232 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\d3d11.dll

[2013.07.04 14:50:46 | 000,102,400 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\davclnt.dll

[2013.06.06 07:49:07 | 000,014,336 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\dciman32.dll

[2012.10.09 20:17:13 | 000,226,816 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\dhcpcore6.dll

[2012.10.09 20:17:13 | 000,055,296 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\dhcpcsvc6.dll

[2014.03.04 11:43:56 | 000,044,544 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\dimsroam.dll

[2014.03.04 11:43:56 | 000,052,736 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\dpapiprovider.dll

[2012.11.02 07:59:11 | 000,478,208 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\dpnet.dll

[2013.04.03 00:51:57 | 001,643,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\DWrite.dll

[2013.01.13 21:49:17 | 000,363,008 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\dxgi.dll

[2014.05.30 11:06:42 | 000,452,096 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\dxtmsft.dll

[2014.05.30 10:44:23 | 000,295,424 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\dxtrans.dll

[2013.12.14 15:03:31 | 000,235,008 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\elshyph.dll

[2013.01.13 21:58:28 | 001,175,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\FntCache.dll

[2013.06.06 07:49:52 | 000,100,864 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\fontsub.dll

[2013.10.12 04:29:08 | 000,324,096 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\FWPUCLNT.DLL

[2012.12.07 15:15:31 | 002,746,368 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\gameux.dll

[2013.10.03 04:23:48 | 000,404,480 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\gdi32.dll

[2012.08.21 13:01:20 | 000,125,872 | ---- | M] (GEAR Software Inc.) -- C:\Windows\SysNative\GEARAspi64.dll

[2012.10.17 05:31:56 | 000,741,480 | ---- | M] (Hewlett-Packard Co.) -- C:\Windows\SysNative\HPDiscoPMB111.dll

[2012.10.17 20:38:03 | 000,269,712 | ---- | M] (Hewlett-Packard Co.) -- C:\Windows\SysNative\hpinkcoiB111.dll

[2012.10.17 20:38:03 | 000,331,664 | ---- | M] (Hewlett-Packard Co.) -- C:\Windows\SysNative\hpinkstsB111LM.dll

[2013.12.14 15:03:25 | 000,081,408 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\icardie.dll

[2013.12.14 15:03:25 | 000,131,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\IEAdvpack.dll

[2014.05.30 09:13:09 | 000,846,336 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dll

[2013.12.14 15:03:25 | 000,263,376 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iedkcs32.dll

[2014.05.30 12:02:09 | 000,004,096 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwcollectorres.dll

[2014.05.30 11:38:29 | 000,048,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwproxystub.dll

[2014.05.30 09:43:35 | 013,522,944 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieframe.dll

[2013.12.14 15:03:24 | 000,135,680 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iepeers.dll

[2014.05.30 11:27:57 | 000,033,792 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll

[2014.05.30 11:45:58 | 002,768,384 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iertutil.dll

[2014.05.30 11:39:23 | 000,066,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll

[2013.12.14 15:03:25 | 000,105,984 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iesysprep.dll

[2014.05.30 11:24:28 | 000,574,976 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll

[2013.10.12 04:29:21 | 000,859,648 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\IKEEXT.DLL

[2013.10.19 04:18:57 | 000,081,408 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\imagehlp.dll

[2013.12.14 15:03:24 | 000,048,128 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\imgutil.dll

[2013.12.14 15:03:25 | 000,101,376 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\inseng.dll

[2014.02.04 04:28:36 | 000,002,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iologmsg.dll

[2012.10.03 19:42:16 | 000,569,344 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iphlpsvc.dll

[2014.05.30 10:55:36 | 000,038,400 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\JavaScriptCollectionAgent.dll

[2013.12.14 15:03:24 | 000,774,144 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll

[2014.05.30 11:08:22 | 005,782,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll

[2014.05.30 11:20:36 | 000,752,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9diag.dll

[2013.12.14 15:03:27 | 000,942,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\jsIntl.dll

[2014.05.30 11:28:59 | 000,051,200 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\jsproxy.dll

[2014.03.04 11:44:00 | 000,728,064 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\kerberos.dll

[2014.03.04 11:44:00 | 001,163,264 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\kernel32.dll

[2014.03.04 11:44:00 | 000,424,960 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\KernelBase.dll

[2013.12.14 15:03:25 | 000,030,208 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\licmgr10.dll

[2012.05.14 07:26:34 | 000,956,928 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\localspl.dll

[2013.06.06 07:50:51 | 000,041,472 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\lpk.dll

[2014.04.12 04:19:32 | 001,460,736 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\lsasrv.dll

[2013.06.09 16:59:36 | 005,592,648 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mfc110.dll

[2013.06.09 16:59:36 | 000,046,160 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mfc110chs.dll

[2013.06.09 16:59:36 | 000,046,160 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mfc110cht.dll

[2013.06.09 16:59:36 | 000,074,832 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mfc110deu.dll

[2013.06.09 16:59:36 | 000,065,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mfc110enu.dll

[2013.06.09 16:59:36 | 000,073,808 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mfc110esn.dll

[2013.06.09 16:59:36 | 000,074,832 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mfc110fra.dll

[2013.06.09 16:59:36 | 000,072,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mfc110ita.dll

[2013.06.09 16:59:36 | 000,053,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mfc110jpn.dll

[2013.06.09 16:59:36 | 000,053,328 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mfc110kor.dll

[2013.06.09 16:59:36 | 000,070,736 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mfc110rus.dll

[2013.06.09 16:59:36 | 005,619,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mfc110u.dll

[2013.06.09 16:59:36 | 000,090,184 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mfcm110.dll

[2013.06.09 16:59:36 | 000,090,192 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mfcm110u.dll

[2013.12.04 04:26:32 | 000,528,384 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msdrm.dll

[2014.05.30 10:29:31 | 000,631,808 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll

[2013.12.14 15:03:25 | 000,052,224 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msfeedsbs.dll

[2014.05.30 12:21:26 | 023,414,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mshtml.dll

[2013.12.14 15:03:24 | 000,083,968 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\MshtmlDac.dll

[2014.05.30 10:46:48 | 000,085,504 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll

[2013.12.14 15:03:25 | 000,048,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmler.dll

[2014.05.30 10:24:19 | 001,249,280 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmlmedia.dll

[2013.10.30 04:32:01 | 000,335,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msieftp.dll

[2013.12.14 15:03:26 | 000,247,808 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msls31.dll

[2013.01.04 08:11:13 | 002,776,576 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msmpeg2vdec.dll

[2014.05.30 10:49:21 | 000,195,584 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msrating.dll

[2013.02.15 08:06:11 | 003,717,632 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mstscax.dll

[2014.03.04 11:44:03 | 000,314,880 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msv1_0.dll

[2012.11.06 00:26:22 | 000,661,456 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msvcp110.dll

[2013.09.11 20:39:06 | 000,614,000 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msvcp110_clr0400.dll

[2013.09.11 20:39:06 | 000,018,000 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msvcr100_clr0400.dll

[2012.11.06 00:26:22 | 000,849,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msvcr110.dll

[2013.09.11 20:39:06 | 000,855,664 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msvcr110_clr0400.dll

[2013.09.08 04:27:14 | 000,327,168 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mswsock.dll

[2014.03.26 16:44:48 | 001,882,112 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msxml3.dll

[2014.03.26 16:41:39 | 000,002,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msxml3r.dll

[2014.03.26 16:44:48 | 002,002,432 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msxml6.dll

[2014.03.26 16:41:39 | 000,002,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msxml6r.dll

[2013.09.25 04:21:50 | 000,307,200 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ncrypt.dll

[2012.10.03 19:44:16 | 000,216,576 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ncsi.dll

[2012.07.05 00:16:43 | 000,073,216 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\netapi32.dll

[2012.10.03 19:44:17 | 000,246,272 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\netcorehc.dll

[2012.10.03 19:44:17 | 000,018,944 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\netevent.dll

[2012.10.03 19:44:21 | 000,070,656 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\nlaapi.dll

[2012.10.03 19:44:21 | 000,303,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\nlasvc.dll

[2013.10.12 04:30:42 | 000,830,464 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\nshwfp.dll

[2013.08.29 04:16:35 | 001,732,032 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ntdll.dll

[2014.03.04 11:44:03 | 000,016,384 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ntvdm64.dll

[2014.05.20 04:44:03 | 003,109,248 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvapi64.dll

[2013.12.27 20:42:16 | 000,035,104 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvaudcap64v.dll

[2014.05.20 04:44:03 | 025,256,224 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcompiler.dll

[2014.05.20 03:25:42 | 006,769,096 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcpl.dll

[2014.05.20 04:44:03 | 011,644,928 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcuda.dll

[2014.05.20 04:44:03 | 002,785,568 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcuvenc.dll

[2014.05.20 04:44:03 | 003,141,976 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcuvid.dll

[2014.05.20 04:44:03 | 017,480,432 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvd3dumx.dll

[2014.03.04 16:35:23 | 001,885,472 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvdispco6433523.dll

[2014.05.20 04:44:03 | 001,889,112 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvdispco6433788.dll

[2013.02.26 00:32:32 | 001,510,176 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvdispgenco64.dll

[2014.03.04 16:35:23 | 001,516,488 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvdispgenco6433523.dll

[2014.05.20 04:44:03 | 001,541,576 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvdispgenco6433788.dll

[2014.05.20 04:44:03 | 000,892,704 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\NvFBC64.dll

[2013.11.22 10:36:08 | 001,515,296 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvhdagenco6420103.dll

[2013.11.28 15:38:22 | 000,031,520 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvhdap64.dll

[2014.05.20 04:44:03 | 000,895,776 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\NvIFR64.dll

[2014.05.20 04:44:03 | 000,166,568 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvinitx.dll

[2014.05.20 03:25:38 | 000,387,528 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvmctray.dll

[2014.05.20 04:44:03 | 000,354,016 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvoglshim64.dll

[2014.05.20 04:44:03 | 031,387,936 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvoglv64.dll

[2014.05.20 04:44:03 | 011,599,072 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvopencl.dll

[2014.05.20 03:25:38 | 000,062,808 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvshext.dll

[2014.02.05 11:30:41 | 001,179,576 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvspcap64.dll

[2014.05.20 03:25:42 | 003,514,144 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvsvc64.dll

[2014.05.20 03:25:38 | 002,560,968 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvsvcr.dll

[2014.05.20 04:44:03 | 000,952,952 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvumdshimx.dll

[2014.05.20 04:44:03 | 018,531,568 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvwgf2umx.dll

[2014.03.04 11:44:03 | 000,722,944 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\objsel.dll

[2013.12.14 15:03:25 | 000,147,968 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\occache.dll

[2013.12.14 15:03:25 | 000,062,464 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\pngfilt.dll

[2013.07.20 12:33:08 | 000,124,112 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\PresentationCFFRasterizerNative_v0300.dll

[2012.05.01 07:40:20 | 000,209,920 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\profsvc.dll

[2014.02.04 04:32:12 | 000,624,128 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\qedit.dll

[2012.04.26 07:41:55 | 000,149,504 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\rdpcorekmts.dll

[2012.04.26 07:41:56 | 000,077,312 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\rdpwsx.dll

[2013.07.09 07:51:16 | 001,217,024 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\rpcrt4.dll

[2013.08.28 03:12:33 | 000,461,312 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\scavengeui.dll

[2014.03.04 11:44:06 | 000,340,992 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\schannel.dll

[2013.10.12 04:31:04 | 000,202,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\scrrun.dll

[2013.12.04 04:27:16 | 000,488,448 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\secproc.dll

[2013.12.04 04:27:33 | 000,485,888 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\secproc_isv.dll

[2013.12.04 04:27:33 | 000,123,392 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\secproc_ssp.dll

[2013.12.04 04:27:33 | 000,123,392 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\secproc_ssp_isv.dll

[2014.04.12 04:19:37 | 000,028,160 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\secur32.dll

[2013.07.26 04:24:56 | 000,197,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\shdocvw.dll

[2014.03.25 04:43:12 | 014,175,744 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\shell32.dll

[2013.10.04 04:28:31 | 000,190,464 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\SmartcardCredentialProvider.dll

[2012.05.05 10:36:55 | 000,503,808 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\srcore.dll

[2014.04.12 04:19:38 | 000,136,192 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\sspicli.dll

[2014.04.12 04:19:38 | 000,029,184 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\sspisrv.dll

[2012.09.26 00:46:17 | 000,095,744 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\synceng.dll

[2013.08.29 04:16:14 | 000,859,648 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\tdh.dll

[2013.02.15 08:08:40 | 000,044,032 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\tsgqec.dll

[2014.03.04 11:44:08 | 000,086,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\TSpkg.dll

[2013.11.12 04:23:09 | 000,002,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\tzres.dll

[2013.01.13 21:24:30 | 000,221,184 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\UIAnimation.dll

[2013.12.14 15:03:25 | 000,235,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll

[2014.05.30 09:30:50 | 001,398,272 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\urlmon.dll

[2012.12.13 14:50:38 | 006,112,864 | ---- | M] (Apple, Inc.) -- C:\Windows\SysNative\usbaaplrc.dll

[2014.04.25 04:34:59 | 000,801,280 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\usp10.dll

[2014.05.30 11:39:43 | 000,548,352 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll

[2012.11.06 00:26:22 | 000,385,488 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\vcamp110.dll

[2012.11.06 00:26:22 | 000,354,264 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\vccorlib110.dll

[2012.11.06 00:26:22 | 000,138,208 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\vcomp110.dll

[2012.07.26 04:36:08 | 000,009,728 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\Wdfres.dll

[2014.03.04 11:44:10 | 000,210,944 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wdigest.dll

[2013.12.14 15:03:25 | 000,243,200 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\webcheck.dll

[2013.07.04 14:57:22 | 000,259,584 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\WebClnt.dll

[2014.01.29 04:32:18 | 000,484,864 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wer.dll

[2012.12.03 15:58:06 | 000,279,040 | ---- | M] (Nicomsoft Ltd.) -- C:\Windows\SysNative\WiFiMan.dll

[2013.04.26 07:51:36 | 000,751,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\win32spl.dll

[2014.03.04 11:44:20 | 000,039,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wincredprovider.dll

[2014.02.04 04:32:22 | 001,424,384 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\WindowsCodecs.dll

[2013.01.13 21:25:04 | 000,245,248 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\WindowsCodecsExt.dll

[2014.05.30 09:56:56 | 002,266,112 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wininet.dll

[2013.08.02 04:14:57 | 000,215,040 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\winsrv.dll

[2013.07.09 07:52:52 | 000,224,256 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wintrust.dll

[2013.05.10 07:56:33 | 014,631,424 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wmp.dll

[2013.11.23 19:47:34 | 000,465,920 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\WMPhoto.dll

[2013.05.10 07:56:40 | 012,625,920 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wmploc.DLL

[2013.07.25 11:25:54 | 001,888,768 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\WMVDECOD.DLL

[2014.03.04 11:44:21 | 000,243,712 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wow64.dll

[2014.03.04 11:44:21 | 000,013,312 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wow64cpu.dll

[2014.03.04 11:44:21 | 000,362,496 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wow64win.dll

[2012.12.07 15:20:16 | 000,441,856 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\Wpc.dll

[2012.06.03 00:19:23 | 000,701,976 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wuapi.dll

[2012.06.03 00:19:43 | 002,428,952 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wuaueng.dll

[2012.06.03 00:15:31 | 002,622,464 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wucltux.dll

[2012.07.26 05:08:14 | 000,045,056 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\WUDFCoinstaller.dll

[2012.07.26 05:08:14 | 000,194,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\WUDFPlatform.dll

[2012.07.26 05:08:14 | 000,084,992 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\WUDFSvc.dll

[2012.07.26 05:08:14 | 000,744,448 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\WUDFx.dll

[2012.06.03 00:15:08 | 000,099,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wudriver.dll

[2012.06.03 00:19:46 | 000,038,424 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wups.dll

[2012.06.03 00:19:42 | 000,044,056 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wups2.dll

[2012.06.02 15:19:42 | 000,186,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wuwebv.dll

[2013.03.19 07:53:58 | 000,048,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wwanprotdim.dll

[2014.01.28 04:32:46 | 000,228,864 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wwansvc.dll

[2013.01.13 20:09:52 | 000,522,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\XpsGdiConverter.dll

[2013.01.13 19:05:09 | 001,682,432 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\XpsPrint.dll
 

< End of report >

tombo11

28.06.2014 17:59

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 28-06-2014 02

Ran by Tom (ATTENTION: The logged in user is not administrator) on HP-PC on 28-06-2014 18:25:19

Running from C:\Users\Tom\Desktop\Trojaner

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11

Boot Mode: Normal
 
 

==================== Processes (Whitelisted) =================
 

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe

(Hewlett-Packard) C:\Program Files (x86)\hp\HP Software Update\hpwuschd2.exe

(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(CyberLink) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe

(CyberLink Corp.) C:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-04] (Intel Corporation)

HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1271072 2014-03-11] (Microsoft Corporation)

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2234144 2014-02-05] (NVIDIA Corporation)

HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\nvspcap64.dll [1179576 2014-02-05] (NVIDIA Corporation)

HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-12] (Apple Inc.)

HKLM-x32\...\Run: [AppleSyncNotifier] => C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [59240 2011-09-27] (Apple Inc.)

HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)

HKLM-x32\...\Run: [] => [X]

HKLM-x32\...\Run: [Easybits Recovery] => C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe [612872 2014-01-03] (EasyBits Software AS)

HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)

HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-05-26] (Apple Inc.)

HKLM\...\RunOnce: [*WerKernelReporting] - %SYSTEMROOT%\SYSTEM32\WerFault.exe -k -rq [415232 2009-07-14] (Microsoft Corporation)

HKLM-x32\...\RunOnce: [Malwarebytes Anti-Malware (cleanup)] - "C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\mbamdor.exe" "C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware" [54072 2014-05-12] (Malwarebytes Corporation)

HKLM-x32\...\RunOnce: [OTL] - "C:\Users\Tom\Desktop\OTL.exe" [602112 2014-06-20] (OldTimer Tools)

Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)

HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1

HKU\S-1-5-21-3866226941-2986741872-3141305892-1003\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)

HKU\S-1-5-21-3866226941-2986741872-3141305892-1003\...\Policies\system: [LogonHoursAction] 2

HKU\S-1-5-21-3866226941-2986741872-3141305892-1003\...\Policies\system: [DontDisplayLogonHoursWarnings] 1

HKU\S-1-5-21-3866226941-2986741872-3141305892-1003\...\MountPoints2: {0a4b6134-e52d-11e0-8b58-4061860db83a} - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL G:\index.html

HKU\S-1-5-21-3866226941-2986741872-3141305892-1003\...\MountPoints2: {92a9deeb-9e4e-11df-82b3-4061860db83a} - G:\LaunchU3.exe -a

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\phase-6 Reminder.lnk

ShortcutTarget: phase-6 Reminder.lnk -> C:\Program Files (x86)\phase-6\phase-6\reminder\reminder.exe (phase-6)

GroupPolicyUsers\S-1-5-21-3866226941-2986741872-3141305892-1003\User: Group Policy restriction detected <======= ATTENTION
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_DE&c=94&bd=Pavilion&pf=cndt

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

SearchScopes: HKLM - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = 

SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKLM - {55569AE9-E080-4075-8F4C-198D43C36528} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008

SearchScopes: HKLM - {D81DF4A5-2989-4677-8D95-BC3A4221F70F} URL = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcndtie7-de-de

SearchScopes: HKLM - {FA7B8497-781C-489C-B5B7-A24024F2DC7B} URL = hxxp://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933

SearchScopes: HKLM-x32 - DefaultScope value is missing.

SearchScopes: HKLM-x32 - {55569AE9-E080-4075-8F4C-198D43C36528} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008

SearchScopes: HKCU - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} URL = hxxp://www.crawler.com/search/dispatcher.aspx?tp=bs&qkw={searchTerms}&tbid=66019

SearchScopes: HKCU - {55569AE9-E080-4075-8F4C-198D43C36528} URL = 

SearchScopes: HKCU - {571635C1-C94C-4553-A47B-3794ECB5F688} URL = hxxp://www.google.de/#hl=de&q={searchTerms}&aq=f&aqi=g10&aql=&oq=&gs_rfai=&fp=340825e95a231672

BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll No File

Toolbar: HKCU - No Name - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} -  No File

Toolbar: HKCU - No Name - {DE9C389F-3316-41A7-809B-AA305ED9D922} -  No File

Toolbar: HKCU - No Name - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} -  No File

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} -  No File

Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

ShellExecuteHooks:  - {E54729E8-643D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook64.dll [773192 2014-03-20] ()

ShellExecuteHooks-x32:  - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook32.dll [484936 2014-03-20] ()

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
 

FireFox:

========

FF ProfilePath: C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\1s9wump8.default

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()

FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)

FF Plugin-x32: @esn/esnlaunch,version=1.104.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.104.0\npesnlaunch.dll No File

FF Plugin-x32: @esn/esnlaunch,version=1.116.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.116.0\npesnlaunch.dll No File

FF Plugin-x32: @esn/esnlaunch,version=1.122.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.122.0\npesnlaunch.dll No File

FF Plugin-x32: @esn/esnlaunch,version=1.140.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.140.0\npesnlaunch.dll No File

FF Plugin-x32: @esn/esnlaunch,version=1.96.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.96.0\npesnlaunch.dll No File

FF Plugin-x32: @esn/esnlaunch,version=2.1.3 - C:\Program Files (x86)\Battlelog Web Plugins\2.1.3\npesnlaunch.dll No File

FF Plugin-x32: @esn/npbattlelog,version=2.3.2 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.2\npbattlelog.dll (EA Digital Illusions CE AB)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2011-11-25]
 

==================== Services (Whitelisted) =================
 

R2 ezSharedSvc; C:\Windows\SysWOW64\ezsvc7.dll [129584 2009-02-22] (EasyBits Sofware AS) [File not signed]

R2 Fabs; C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [1253376 2009-08-27] (MAGIX AG) [File not signed]

S3 FirebirdServerMAGIXInstance; C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [3276800 2008-08-07] (MAGIX®) [File not signed]

S4 HerculesDJControlMP3; C:\Program Files\Hercules\Audio\DJ Console Series\HerculesDJControlMP3.EXE [20480 2007-11-21] () [File not signed]

R2 HP Health Check Service; C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe [124928 2009-07-09] (Hewlett-Packard) [File not signed]

S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [69632 2005-11-14] (Macrovision Corporation) [File not signed]

R2 LightScribeService; c:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2009-05-18] (Hewlett-Packard Company) [File not signed]

R2 lmhosts; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)

R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2014-03-11] (Microsoft Corporation)

S3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [347872 2014-03-11] (Microsoft Corporation)

R2 NlaSvc; C:\Windows\System32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)

R2 nsi; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)

R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1593632 2014-02-05] (NVIDIA Corporation)

R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [16941856 2014-02-05] (NVIDIA Corporation)

R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-03-26] ()

R2 ezSharedSvc; C:\Windows\System32\ezsvc7.dll [X]
 

==================== Drivers (Whitelisted) ====================
 

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)

R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2010-01-22] ()

S3 Bulk; C:\Windows\System32\Drivers\HDJBulk.sys [154112 2009-10-02] (© Guillemot R&D, 2009. All rights reserved.)

S3 Cardex; C:\Windows\SysWOW64\drivers\TBPANELX64.SYS [15648 2007-03-16] (Windows (R) Server 2003 DDK provider)

S3 HDJMidi; C:\Windows\System32\DRIVERS\HDJMidi.sys [144896 2009-10-02] (© Guillemot R&D, 2009. All rights reserved.)

R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2010-01-22] ()

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)

S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-06-17] (Malwarebytes Corporation)

R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation)

R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [268512 2014-01-25] (Microsoft Corporation)

S3 Netaapl; C:\Windows\System32\DRIVERS\netaapl64.sys [22528 2011-05-10] (Apple Inc.) [File not signed]

S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133928 2014-03-11] (Microsoft Corporation)

R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-27] (NVIDIA Corporation)

S3 s0017bus; C:\Windows\System32\DRIVERS\s0017bus.sys [113704 2008-10-21] (MCCI Corporation)

S3 s0017mdfl; C:\Windows\System32\DRIVERS\s0017mdfl.sys [19496 2008-10-21] (MCCI Corporation)

S3 s0017mdm; C:\Windows\System32\DRIVERS\s0017mdm.sys [152616 2008-10-21] (MCCI Corporation)

S3 s0017obex; C:\Windows\System32\DRIVERS\s0017obex.sys [128552 2008-10-21] (MCCI Corporation)

S3 s0017unic; C:\Windows\System32\DRIVERS\s0017unic.sys [145960 2008-10-21] (MCCI Corporation)

S3 s3017bus; C:\Windows\System32\DRIVERS\s3017bus.sys [109096 2007-12-10] (MCCI Corporation)

S3 s3017mdfl; C:\Windows\System32\DRIVERS\s3017mdfl.sys [19496 2007-12-10] (MCCI Corporation)

S3 s3017mdm; C:\Windows\System32\DRIVERS\s3017mdm.sys [146984 2007-12-10] (MCCI Corporation)

S3 s3017mgmt; C:\Windows\System32\DRIVERS\s3017mgmt.sys [130600 2007-12-10] (MCCI Corporation)

S3 s3017nd5; C:\Windows\System32\DRIVERS\s3017nd5.sys [34344 2007-12-10] (MCCI Corporation)

S3 s3017obex; C:\Windows\System32\DRIVERS\s3017obex.sys [125480 2007-12-10] (MCCI Corporation)

S3 s3017unic; C:\Windows\System32\DRIVERS\s3017unic.sys [144936 2007-12-10] (MCCI Corporation)

R3 seehcri; C:\Windows\System32\DRIVERS\seehcri.sys [34032 2008-01-09] (Sony Ericsson Mobile Communications)

S3 Serial; C:\Windows\system32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)

S2 TBPanel; No ImagePath

R2 {55662437-DA8C-40c0-AADA-2C816A897A49}; c:\Program Files (x86)\Hewlett-Packard\Media\DVD\000.fcl [146928 2009-10-20] (CyberLink Corp.)

S3 catchme; \??\C:\ComboFix\catchme.sys [X]

S3 PCDSRVC{4942F9C0-0B403F17-06000000}_0; \??\c:\pcdr5\pcdsrvc_x64.pkms [X]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-06-28 18:16 - 2014-06-28 18:16 - 00000000 ____D () C:\_OTL

2014-06-28 18:09 - 2014-06-28 18:09 - 00186880 _____ (CEXX.ORG) C:\Users\Tom\Desktop\LSPFix.exe

2014-06-20 20:30 - 2014-06-20 20:31 - 00000000 ____D () C:\Users\Tom\Documents\Witcher 2

2014-06-20 20:30 - 2014-06-20 20:30 - 00000000 ____D () C:\Users\Tom\AppData\Local\The Witcher 2

2014-06-20 12:20 - 2014-06-20 12:20 - 00227666 _____ () C:\Users\Tom\Desktop\OTL 1.Txt

2014-06-20 12:20 - 2014-06-20 12:20 - 00173860 _____ () C:\Users\Tom\Desktop\Extras.Txt

2014-06-20 12:04 - 2014-06-20 12:04 - 00602112 _____ (OldTimer Tools) C:\Users\Tom\Desktop\OTL.exe

2014-06-19 11:09 - 2014-06-19 11:09 - 00854367 _____ () C:\Users\Tom\Desktop\SecurityCheck.exe

2014-06-19 00:22 - 2014-06-19 00:22 - 02347384 _____ (ESET) C:\Users\Tom\Desktop\esetsmartinstaller_deu.exe

2014-06-17 22:08 - 2014-06-17 22:08 - 00001479 _____ () C:\Users\HP\Desktop\JRT.txt

2014-06-17 21:55 - 2014-06-17 21:55 - 00000000 ____D () C:\Windows\ERUNT

2014-06-17 21:54 - 2014-06-17 21:54 - 01016261 _____ (Thisisu) C:\Users\Tom\Desktop\JRT.exe

2014-06-17 21:39 - 2014-06-17 21:42 - 00000000 ____D () C:\AdwCleaner

2014-06-17 21:38 - 2014-06-17 21:38 - 01333465 _____ () C:\Users\Tom\Desktop\adwcleaner_3.212.exe

2014-06-17 21:37 - 2014-06-17 21:37 - 00001813 _____ () C:\Users\Tom\Desktop\mbam.txt.txt

2014-06-17 21:12 - 2014-06-17 21:12 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-06-17 21:12 - 2014-06-17 21:12 - 00001108 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-06-17 21:12 - 2014-06-17 21:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-06-17 21:12 - 2014-06-17 21:12 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-06-17 21:12 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-06-17 21:12 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-06-17 21:12 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-06-12 13:23 - 2014-06-12 13:23 - 00023976 _____ () C:\ComboFix.txt

2014-06-12 13:10 - 2014-06-12 13:23 - 00000000 ____D () C:\Qoobox

2014-06-12 13:10 - 2014-06-12 13:22 - 00000000 ____D () C:\Windows\erdnt

2014-06-12 13:10 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe

2014-06-12 13:10 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe

2014-06-12 13:10 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2014-06-12 13:10 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2014-06-12 13:10 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2014-06-12 13:10 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe

2014-06-12 13:10 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe

2014-06-12 13:10 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe

2014-06-12 12:57 - 2014-06-12 12:57 - 00001270 _____ () C:\Users\HP\Desktop\Revo Uninstaller.lnk

2014-06-12 12:57 - 2014-06-12 12:57 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group

2014-06-12 11:36 - 2014-05-30 12:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-06-12 11:36 - 2014-05-30 12:02 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-06-12 11:36 - 2014-05-30 11:45 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-06-12 11:36 - 2014-05-30 11:39 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-06-12 11:36 - 2014-05-30 11:38 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-06-12 11:36 - 2014-05-30 11:21 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-06-12 11:36 - 2014-05-30 11:18 - 17271296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-06-12 11:36 - 2014-05-30 11:06 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-06-12 11:36 - 2014-05-30 11:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-06-12 11:36 - 2014-05-30 10:55 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-06-12 11:36 - 2014-05-30 10:43 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-06-12 11:36 - 2014-05-30 10:42 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-06-12 11:36 - 2014-05-30 10:38 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-06-12 11:36 - 2014-05-30 10:35 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-06-12 11:36 - 2014-05-30 10:34 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-06-12 11:36 - 2014-05-30 10:33 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-06-12 11:36 - 2014-05-30 10:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-06-12 11:36 - 2014-05-30 10:29 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-06-12 11:36 - 2014-05-30 10:27 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-06-12 11:36 - 2014-05-30 10:23 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-06-12 11:36 - 2014-05-30 10:16 - 00368128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2014-06-12 11:36 - 2014-05-30 10:10 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2014-06-12 11:36 - 2014-05-30 10:04 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-06-12 11:36 - 2014-05-30 10:02 - 00242688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-06-12 11:36 - 2014-05-30 09:54 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-06-12 11:36 - 2014-05-30 09:50 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2014-06-12 11:36 - 2014-05-30 09:49 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-06-12 11:36 - 2014-05-30 09:40 - 11725312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-06-12 11:36 - 2014-05-30 09:30 - 01398272 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-06-12 11:36 - 2014-05-30 09:15 - 01143296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-06-12 11:36 - 2014-04-25 04:34 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll

2014-06-12 11:36 - 2014-04-25 04:06 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll

2014-06-12 11:36 - 2014-04-05 04:47 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys

2014-06-12 11:36 - 2014-04-05 04:47 - 00288192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS

2014-06-12 11:36 - 2014-03-26 16:44 - 02002432 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll

2014-06-12 11:36 - 2014-03-26 16:44 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll

2014-06-12 11:36 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll

2014-06-12 11:36 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll

2014-06-12 11:36 - 2014-03-26 16:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll

2014-06-12 11:36 - 2014-03-26 16:27 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll

2014-06-12 11:36 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll

2014-06-12 11:36 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll

2014-06-12 11:35 - 2014-05-30 12:21 - 23414784 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-06-12 11:35 - 2014-05-30 11:39 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-06-12 11:35 - 2014-05-30 11:28 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-06-12 11:35 - 2014-05-30 11:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-06-12 11:35 - 2014-05-30 11:24 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-06-12 11:35 - 2014-05-30 11:21 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-06-12 11:35 - 2014-05-30 11:20 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-06-12 11:35 - 2014-05-30 11:11 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-06-12 11:35 - 2014-05-30 11:08 - 05782528 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-06-12 11:35 - 2014-05-30 10:49 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-06-12 11:35 - 2014-05-30 10:46 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-06-12 11:35 - 2014-05-30 10:44 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-06-12 11:35 - 2014-05-30 10:44 - 00295424 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-06-12 11:35 - 2014-05-30 10:28 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-06-12 11:35 - 2014-05-30 10:24 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2014-06-12 11:35 - 2014-05-30 10:06 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-06-12 11:35 - 2014-05-30 09:56 - 04244992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-06-12 11:35 - 2014-05-30 09:56 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-06-12 11:35 - 2014-05-30 09:43 - 13522944 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-06-12 11:35 - 2014-05-30 09:21 - 01790976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-06-12 11:35 - 2014-05-30 09:13 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-06-12 11:35 - 2014-05-30 09:13 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-06-12 11:33 - 2014-06-28 18:25 - 00000000 ____D () C:\Users\Tom\Desktop\Trojaner

2014-06-12 11:32 - 2014-06-28 18:25 - 00000000 ____D () C:\FRST

2014-06-12 11:32 - 2014-06-08 11:13 - 00506368 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-06-12 11:32 - 2014-06-08 11:08 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-06-09 15:02 - 2014-06-09 15:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes

2014-06-09 15:00 - 2014-06-09 15:02 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69

2014-06-09 15:00 - 2014-06-09 15:02 - 00000000 ____D () C:\Program Files\iTunes

2014-06-09 15:00 - 2014-06-09 15:02 - 00000000 ____D () C:\Program Files (x86)\iTunes

2014-06-09 15:00 - 2014-06-09 15:00 - 00000000 ____D () C:\Program Files\iPod

2014-06-07 14:23 - 2014-06-07 14:23 - 00000000 ____D () C:\Users\Tom\Documents\Wizards of the Coast

2014-06-07 13:50 - 2014-06-07 13:50 - 00000222 _____ () C:\Users\Tom\Desktop\Magic 2014.url

2014-06-05 15:44 - 2014-06-05 15:44 - 00000000 ____D () C:\Users\Tom\AppData\Local\SniperV2

2014-06-05 14:10 - 2014-06-05 14:10 - 00000221 _____ () C:\Users\Tom\Desktop\Sniper Elite V2.url
 

==================== One Month Modified Files and Folders =======
 

2014-06-28 18:25 - 2014-06-12 11:33 - 00000000 ____D () C:\Users\Tom\Desktop\Trojaner

2014-06-28 18:25 - 2014-06-12 11:32 - 00000000 ____D () C:\FRST

2014-06-28 18:21 - 2010-12-09 16:17 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-06-28 18:20 - 2012-03-24 16:41 - 00123439 _____ () C:\Windows\setupact.log

2014-06-28 18:20 - 2009-09-24 16:26 - 00000000 ____D () C:\ProgramData\NVIDIA

2014-06-28 18:20 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-06-28 18:19 - 2010-01-20 14:23 - 01121518 _____ () C:\Windows\WindowsUpdate.log

2014-06-28 18:17 - 2012-04-02 10:22 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-06-28 18:16 - 2014-06-28 18:16 - 00000000 ____D () C:\_OTL

2014-06-28 18:14 - 2009-07-14 06:45 - 00015568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-06-28 18:14 - 2009-07-14 06:45 - 00015568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-06-28 18:11 - 2009-09-25 02:14 - 02427346 _____ () C:\Windows\system32\perfh007.dat

2014-06-28 18:11 - 2009-09-25 02:14 - 00685786 _____ () C:\Windows\system32\perfc007.dat

2014-06-28 18:11 - 2009-07-14 07:13 - 00006264 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-06-28 18:09 - 2014-06-28 18:09 - 00186880 _____ (CEXX.ORG) C:\Users\Tom\Desktop\LSPFix.exe

2014-06-25 20:32 - 2010-12-09 16:17 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-06-25 20:30 - 2014-03-20 21:49 - 00000000 ____D () C:\Users\Tom\Desktop\Schule

2014-06-25 20:11 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

2014-06-24 22:06 - 2014-05-25 20:21 - 00000000 ____D () C:\Users\Tom\Desktop\Absolventen Fotos

2014-06-20 20:36 - 2011-11-10 13:30 - 00000000 ____D () C:\ProgramData\Origin

2014-06-20 20:34 - 2011-11-24 12:36 - 00000000 ____D () C:\Program Files (x86)\Origin

2014-06-20 20:31 - 2014-06-20 20:30 - 00000000 ____D () C:\Users\Tom\Documents\Witcher 2

2014-06-20 20:30 - 2014-06-20 20:30 - 00000000 ____D () C:\Users\Tom\AppData\Local\The Witcher 2

2014-06-20 12:20 - 2014-06-20 12:20 - 00227666 _____ () C:\Users\Tom\Desktop\OTL 1.Txt

2014-06-20 12:20 - 2014-06-20 12:20 - 00173860 _____ () C:\Users\Tom\Desktop\Extras.Txt

2014-06-20 12:04 - 2014-06-20 12:04 - 00602112 _____ (OldTimer Tools) C:\Users\Tom\Desktop\OTL.exe

2014-06-19 11:09 - 2014-06-19 11:09 - 00854367 _____ () C:\Users\Tom\Desktop\SecurityCheck.exe

2014-06-19 00:22 - 2014-06-19 00:22 - 02347384 _____ (ESET) C:\Users\Tom\Desktop\esetsmartinstaller_deu.exe

2014-06-19 00:07 - 2013-05-12 12:24 - 00000000 ____D () C:\Users\Tom\Documents\FIFA 11

2014-06-18 14:24 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache

2014-06-17 22:08 - 2014-06-17 22:08 - 00001479 _____ () C:\Users\HP\Desktop\JRT.txt

2014-06-17 21:55 - 2014-06-17 21:55 - 00000000 ____D () C:\Windows\ERUNT

2014-06-17 21:54 - 2014-06-17 21:54 - 01016261 _____ (Thisisu) C:\Users\Tom\Desktop\JRT.exe

2014-06-17 21:43 - 2012-03-24 16:41 - 00374038 _____ () C:\Windows\PFRO.log

2014-06-17 21:42 - 2014-06-17 21:39 - 00000000 ____D () C:\AdwCleaner

2014-06-17 21:38 - 2014-06-17 21:38 - 01333465 _____ () C:\Users\Tom\Desktop\adwcleaner_3.212.exe

2014-06-17 21:37 - 2014-06-17 21:37 - 00001813 _____ () C:\Users\Tom\Desktop\mbam.txt.txt

2014-06-17 21:31 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\Vss

2014-06-17 21:12 - 2014-06-17 21:12 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-06-17 21:12 - 2014-06-17 21:12 - 00001108 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-06-17 21:12 - 2014-06-17 21:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-06-17 21:12 - 2014-06-17 21:12 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-06-17 21:09 - 2012-03-24 18:00 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-06-12 14:59 - 2012-05-10 16:30 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

2014-06-12 13:54 - 2010-01-27 20:48 - 00000000 ____D () C:\ProgramData\Microsoft Help

2014-06-12 13:53 - 2014-05-07 18:22 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-06-12 13:27 - 2011-11-21 17:05 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-06-12 13:23 - 2014-06-12 13:23 - 00023976 _____ () C:\ComboFix.txt

2014-06-12 13:23 - 2014-06-12 13:10 - 00000000 ____D () C:\Qoobox

2014-06-12 13:23 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default

2014-06-12 13:22 - 2014-06-12 13:10 - 00000000 ____D () C:\Windows\erdnt

2014-06-12 13:21 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini

2014-06-12 12:57 - 2014-06-12 12:57 - 00001270 _____ () C:\Users\HP\Desktop\Revo Uninstaller.lnk

2014-06-12 12:57 - 2014-06-12 12:57 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group

2014-06-12 11:32 - 2014-05-25 20:22 - 00000000 ____D () C:\Users\Tom\Desktop\Abschlusszeitung

2014-06-09 15:02 - 2014-06-09 15:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes

2014-06-09 15:02 - 2014-06-09 15:00 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69

2014-06-09 15:02 - 2014-06-09 15:00 - 00000000 ____D () C:\Program Files\iTunes

2014-06-09 15:02 - 2014-06-09 15:00 - 00000000 ____D () C:\Program Files (x86)\iTunes

2014-06-09 15:02 - 2012-09-16 13:19 - 00001785 _____ () C:\Users\Public\Desktop\iTunes.lnk

2014-06-09 15:00 - 2014-06-09 15:00 - 00000000 ____D () C:\Program Files\iPod

2014-06-08 11:13 - 2014-06-12 11:32 - 00506368 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-06-08 11:08 - 2014-06-12 11:32 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-06-07 14:23 - 2014-06-07 14:23 - 00000000 ____D () C:\Users\Tom\Documents\Wizards of the Coast

2014-06-07 14:23 - 2012-04-28 17:50 - 00000000 ____D () C:\Program Files (x86)\Steam

2014-06-07 13:50 - 2014-06-07 13:50 - 00000222 _____ () C:\Users\Tom\Desktop\Magic 2014.url

2014-06-05 15:44 - 2014-06-05 15:44 - 00000000 ____D () C:\Users\Tom\AppData\Local\SniperV2

2014-06-05 15:41 - 2012-04-28 19:22 - 00326304 _____ () C:\Windows\DirectX.log

2014-06-05 14:10 - 2014-06-05 14:10 - 00000221 _____ () C:\Users\Tom\Desktop\Sniper Elite V2.url

2014-06-04 20:59 - 2012-03-24 16:35 - 00000868 _____ () C:\Users\Tom\Desktop\CCleaner.lnk

2014-05-30 12:21 - 2014-06-12 11:35 - 23414784 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-05-30 12:02 - 2014-06-12 11:36 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-05-30 12:02 - 2014-06-12 11:36 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-05-30 11:45 - 2014-06-12 11:36 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-05-30 11:39 - 2014-06-12 11:36 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-05-30 11:39 - 2014-06-12 11:35 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-05-30 11:38 - 2014-06-12 11:36 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-05-30 11:28 - 2014-06-12 11:35 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-05-30 11:27 - 2014-06-12 11:35 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-05-30 11:24 - 2014-06-12 11:35 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-05-30 11:21 - 2014-06-12 11:36 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-05-30 11:21 - 2014-06-12 11:35 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-05-30 11:20 - 2014-06-12 11:35 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-05-30 11:18 - 2014-06-12 11:36 - 17271296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-05-30 11:11 - 2014-06-12 11:35 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-05-30 11:08 - 2014-06-12 11:35 - 05782528 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-05-30 11:06 - 2014-06-12 11:36 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-05-30 11:02 - 2014-06-12 11:36 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-05-30 10:55 - 2014-06-12 11:36 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-05-30 10:49 - 2014-06-12 11:35 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-05-30 10:46 - 2014-06-12 11:35 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-05-30 10:44 - 2014-06-12 11:35 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-05-30 10:44 - 2014-06-12 11:35 - 00295424 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-05-30 10:43 - 2014-06-12 11:36 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-05-30 10:42 - 2014-06-12 11:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-05-30 10:38 - 2014-06-12 11:36 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-05-30 10:35 - 2014-06-12 11:36 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-05-30 10:34 - 2014-06-12 11:36 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-05-30 10:33 - 2014-06-12 11:36 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-05-30 10:30 - 2014-06-12 11:36 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-05-30 10:29 - 2014-06-12 11:36 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-05-30 10:28 - 2014-06-12 11:35 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-05-30 10:27 - 2014-06-12 11:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-05-30 10:24 - 2014-06-12 11:35 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2014-05-30 10:23 - 2014-06-12 11:36 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-05-30 10:16 - 2014-06-12 11:36 - 00368128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2014-05-30 10:10 - 2014-06-12 11:36 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2014-05-30 10:06 - 2014-06-12 11:35 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-05-30 10:04 - 2014-06-12 11:36 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-05-30 10:02 - 2014-06-12 11:36 - 00242688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-05-30 09:56 - 2014-06-12 11:35 - 04244992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-05-30 09:56 - 2014-06-12 11:35 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-05-30 09:54 - 2014-06-12 11:36 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-05-30 09:50 - 2014-06-12 11:36 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2014-05-30 09:49 - 2014-06-12 11:36 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-05-30 09:43 - 2014-06-12 11:35 - 13522944 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-05-30 09:40 - 2014-06-12 11:36 - 11725312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-05-30 09:30 - 2014-06-12 11:36 - 01398272 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-05-30 09:21 - 2014-06-12 11:35 - 01790976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-05-30 09:15 - 2014-06-12 11:36 - 01143296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-05-30 09:13 - 2014-06-12 11:35 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-05-30 09:13 - 2014-06-12 11:35 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-05-29 17:09 - 2013-06-04 17:32 - 00000000 ____D () C:\Users\Tom\Documents\Stronghold Legends

2014-05-29 15:43 - 2014-05-25 20:28 - 00000000 ____D () C:\Users\Tom\Desktop\Holland Dreas
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 

==================== End Of Log ============================

--- --- ---

schrauber

29.06.2014 11:07

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

GroupPolicyUsers\S-1-5-21-3866226941-2986741872-3141305892-1003\User: Group Policy restriction detected <======= ATTENTION

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Noch Probleme?

tombo11

30.06.2014 15:01

Hallo Schrauber,
woher weiß ich denn ob ich noch probleme hab ?

Code:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 28-06-2014 02

Ran by Tom at 2014-06-30 15:50:37 Run:1

Running from C:\Users\Tom\Desktop\Trojaner

Boot Mode: Normal

==============================================
 

Content of fixlist:

*****************

GroupPolicyUsers\S-1-5-21-3866226941-2986741872-3141305892-1003\User: Group Policy restriction detected <======= ATTENTION

         

*****************
 
 

"C:\Windows\system32\GroupPolicyUsers\S-1-5-21-3866226941-2986741872-3141305892-1003\User" directory move:
 

Could not move "C:\Windows\system32\GroupPolicyUsers\S-1-5-21-3866226941-2986741872-3141305892-1003\User\Registry.pol" => Scheduled to move on reboot.

Could not move "C:\Windows\system32\GroupPolicyUsers\S-1-5-21-3866226941-2986741872-3141305892-1003\User" directory. => Scheduled to move on reboot.
 

Could not move "C:\Windows\system32\GroupPolicy\GPT.ini" => Scheduled to move on reboot.

schrauber

01.07.2014 11:20

Ich will wissen ob du noch Probleme bemerkst :)

Alle Zeitangaben in WEZ +1. Es ist jetzt 23:09 Uhr.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19