Trovi.com entfernen in Windows 8.1

Wannekakki · 14.12.2014, 00:04

Hallo zusammen,

ich komm beim Start meines Browsers automatisch auf Trovi.com
Kann mir jemand helfen das wieder los zu werden?
Betriebssystem ist Windows 8.1

Hab das System komplett zurück gesetzt, was leider auch nichts gebracht hat und das System lahmt sehr, trotz keinerlei Installierter Programme.

Vielen Dank im Voraus

schrauber · 14.12.2014, 10:33

hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Wannekakki · 14.12.2014, 15:37

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-12-2014
Ran by Carsten (administrator) on CarstenLaptop on 14-12-2014 11:53:29
Running from C:\Users\Carsten\Desktop
Loaded Profile: Carsten (Available profiles: Carsten)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\afwServ.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Avast Software) C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\ng\ngservice.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5225064 2014-12-13] (AVAST Software)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-60830840-568542779-2265190336-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-12-13]

Chrome: 
=======
CHR HomePage: Default -> hxxp://www.google.com/
CHR StartupUrls: Default -> "hxxp://www.trovi.com/?gd=&ctid=CT3321557&octid=EB_ORIGINAL_CTID&ISID=MAD461719-FCEC-4165-B7E5-84A6366152BE&SearchSource=55&CUI=&UM=6&UP=SP9D1E4C60-0D59-4491-BECA-20D7E6F88308&SSPV=", "hxxp://www.google.com/"
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}
CHR Profile: C:\Users\Carsten\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Präsentationen) - C:\Users\Carsten\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-12-13]
CHR Extension: (Google Docs) - C:\Users\Carsten\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-12-13]
CHR Extension: (Google Drive) - C:\Users\Carsten\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-12-13]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Carsten\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-12-13]
CHR Extension: (YouTube) - C:\Users\Carsten\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-12-13]
CHR Extension: (Google-Suche) - C:\Users\Carsten\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-12-13]
CHR Extension: (Google Tabellen) - C:\Users\Carsten\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-12-13]
CHR Extension: (Vollbild-Flash) - C:\Users\Carsten\AppData\Local\Google\Chrome\User Data\Default\Extensions\gejijbmhbanhbllpkhfojmimfolkjgdl [2014-12-13]
CHR Extension: (Avast Online Security) - C:\Users\Carsten\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-12-13]
CHR Extension: (Google Wallet) - C:\Users\Carsten\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-12-13]
CHR Extension: (Google Mail) - C:\Users\Carsten\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-12-13]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-12-13]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-12-13] (AVAST Software)
R2 avast! Firewall; C:\Program Files\AVAST Software\Avast\afwServ.exe [104416 2014-12-13] (AVAST Software)
R3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [4012248 2014-12-13] (Avast Software)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-09-24] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-09-24] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-12-13] ()
R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [28184 2014-12-13] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [83280 2014-12-13] (AVAST Software)
R0 aswNdisFlt; C:\Windows\System32\DRIVERS\aswNdisFlt.sys [449936 2014-12-13] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-12-13] (AVAST Software)
S0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-12-13] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1050432 2014-12-13] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [436624 2014-12-13] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [116728 2014-12-13] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [267632 2014-12-13] ()
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-09-24] (Microsoft Corporation)
R2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [271752 2014-12-13] (Avast Software)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-09-24] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-14 11:53 - 2014-12-14 11:54 - 00008386 _____ () C:\Users\Carsten\Desktop\FRST.txt
2014-12-14 11:53 - 2014-12-14 11:53 - 00000000 ____D () C:\FRST
2014-12-14 11:52 - 2014-12-14 11:52 - 02119168 _____ (Farbar) C:\Users\Carsten\Desktop\FRST64.exe
2014-12-13 22:56 - 2014-12-13 22:56 - 00000247 _____ () C:\WINDOWS\system32\2014-12-13-21-56-01.078-aswFe.exe-4548.log
2014-12-13 22:52 - 2014-12-13 22:55 - 00000247 _____ () C:\WINDOWS\system32\2014-12-13-21-52-15.096-aswFe.exe-5644.log
2014-12-13 22:52 - 2014-12-13 22:52 - 00000197 _____ () C:\WINDOWS\system32\2014-12-13-21-52-14.092-AvastVBoxSVC.exe-4576.log
2014-12-13 22:51 - 2014-12-13 22:51 - 00007680 ___SH () C:\Users\Carsten\Desktop\Thumbs.db
2014-12-13 22:49 - 2014-12-13 22:49 - 00000000 ____D () C:\Users\Carsten\AppData\Roaming\AVAST Software
2014-12-13 22:48 - 2014-12-14 11:45 - 00001146 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2014-12-13 22:48 - 2014-12-13 22:53 - 00004122 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2014-12-13 22:48 - 2014-12-13 22:53 - 00003886 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2014-12-13 22:48 - 2014-12-13 22:53 - 00002195 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-12-13 22:48 - 2014-12-13 22:53 - 00001150 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2014-12-13 22:48 - 2014-12-13 22:49 - 00004182 _____ () C:\WINDOWS\System32\Tasks\avast! Emergency Update
2014-12-13 22:48 - 2014-12-13 22:49 - 00000000 ____D () C:\WINDOWS\SysWOW64\vbox
2014-12-13 22:48 - 2014-12-13 22:49 - 00000000 ____D () C:\WINDOWS\system32\vbox
2014-12-13 22:48 - 2014-12-13 22:48 - 01050432 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswsnx.sys
2014-12-13 22:48 - 2014-12-13 22:48 - 00002026 _____ () C:\Users\Public\Desktop\Avast SafeZone.lnk
2014-12-13 22:48 - 2014-12-13 22:48 - 00001966 _____ () C:\Users\Public\Desktop\Avast Premier.lnk
2014-12-13 22:48 - 2014-12-13 22:48 - 00000000 ____D () C:\Users\Carsten\AppData\Local\Google
2014-12-13 22:48 - 2014-12-13 22:48 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-12-13 22:48 - 2014-12-13 22:48 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2014-12-13 22:48 - 2014-12-13 22:48 - 00000000 ____D () C:\Program Files (x86)\Google
2014-12-13 22:48 - 2014-12-13 22:47 - 01050432 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswsnx.sys.1418507327031
2014-12-13 22:48 - 2014-12-13 22:47 - 00436624 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSP.sys
2014-12-13 22:48 - 2014-12-13 22:47 - 00267632 _____ () C:\WINDOWS\system32\Drivers\aswVmm.sys
2014-12-13 22:48 - 2014-12-13 22:47 - 00116728 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswStm.sys
2014-12-13 22:48 - 2014-12-13 22:47 - 00093568 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswRdr2.sys
2014-12-13 22:48 - 2014-12-13 22:47 - 00083280 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswMonFlt.sys
2014-12-13 22:48 - 2014-12-13 22:47 - 00065776 _____ () C:\WINDOWS\system32\Drivers\aswRvrt.sys
2014-12-13 22:48 - 2014-12-13 22:47 - 00029208 _____ () C:\WINDOWS\system32\Drivers\aswHwid.sys
2014-12-13 22:48 - 2014-12-13 22:47 - 00028184 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswKbd.sys
2014-12-13 22:47 - 2014-12-13 22:47 - 00449936 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswNdisFlt.sys
2014-12-13 22:47 - 2014-12-13 22:47 - 00364512 _____ (AVAST Software) C:\WINDOWS\system32\aswBoot.exe
2014-12-13 22:47 - 2014-12-13 22:47 - 00043152 _____ (AVAST Software) C:\WINDOWS\avastSS.scr
2014-12-13 22:46 - 2014-12-13 22:46 - 00000000 ____D () C:\Program Files\AVAST Software
2014-12-13 22:45 - 2014-12-13 22:46 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-12-13 22:41 - 2014-12-13 22:41 - 00000000 ____D () C:\Program Files\Intel
2014-12-13 22:41 - 2014-12-13 22:41 - 00000000 ____D () C:\Program Files (x86)\Intel
2014-12-13 22:41 - 2014-12-13 22:41 - 00000000 ____D () C:\Intel
2014-12-13 22:41 - 2014-03-20 07:53 - 00064000 _____ (Khronos Group) C:\WINDOWS\system32\OpenCL.DLL
2014-12-13 22:41 - 2014-03-20 07:53 - 00060416 _____ (Khronos Group) C:\WINDOWS\SysWOW64\OpenCL.DLL
2014-12-13 22:39 - 2014-12-14 11:48 - 00003958 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{150BF4F5-0CEB-4DB9-A07E-FB016EBD3A38}
2014-12-13 22:39 - 2014-12-13 22:39 - 00000424 _____ () C:\Users\Carsten\Desktop\Dieser PC - Verknüpfung.lnk
2014-12-13 22:39 - 2014-12-13 22:39 - 00000000 __SHD () C:\Users\Carsten\AppData\Local\EmieUserList
2014-12-13 22:39 - 2014-12-13 22:39 - 00000000 __SHD () C:\Users\Carsten\AppData\Local\EmieSiteList
2014-12-13 22:39 - 2014-12-13 22:39 - 00000000 ____D () C:\Users\Carsten\AppData\Roaming\Macromedia
2014-12-13 22:38 - 2014-12-13 22:39 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
2014-12-13 22:38 - 2014-12-13 22:38 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation
2014-12-13 22:38 - 2014-12-13 22:38 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2014-12-13 22:36 - 2014-12-14 00:17 - 00003594 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-60830840-568542779-2265190336-1001
2014-12-13 22:35 - 2014-12-13 22:35 - 00000000 ____D () C:\Program Files\Common Files\Atheros
2014-12-13 22:34 - 2014-12-14 11:46 - 00000000 ___RD () C:\Users\Carsten\OneDrive
2014-12-13 22:31 - 2014-12-13 23:38 - 00000000 ____D () C:\Users\Carsten\AppData\Local\Packages
2014-12-13 22:31 - 2014-12-13 22:31 - 00001446 _____ () C:\Users\Carsten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-12-13 22:31 - 2014-12-13 22:31 - 00000000 ____D () C:\Users\Carsten\AppData\Roaming\Adobe
2014-12-13 22:31 - 2014-12-13 22:31 - 00000000 ____D () C:\Users\Carsten\AppData\Local\VirtualStore
2014-12-13 22:30 - 2014-12-13 22:34 - 00000000 ____D () C:\Users\Carsten
2014-12-13 22:30 - 2014-12-13 22:30 - 00000020 ___SH () C:\Users\Carsten\ntuser.ini
2014-12-13 22:30 - 2014-12-13 22:30 - 00000000 _SHDL () C:\Users\Carsten\Vorlagen
2014-12-13 22:30 - 2014-12-13 22:30 - 00000000 _SHDL () C:\Users\Carsten\Startmenü
2014-12-13 22:30 - 2014-12-13 22:30 - 00000000 _SHDL () C:\Users\Carsten\Netzwerkumgebung
2014-12-13 22:30 - 2014-12-13 22:30 - 00000000 _SHDL () C:\Users\Carsten\Lokale Einstellungen
2014-12-13 22:30 - 2014-12-13 22:30 - 00000000 _SHDL () C:\Users\Carsten\Eigene Dateien
2014-12-13 22:30 - 2014-12-13 22:30 - 00000000 _SHDL () C:\Users\Carsten\Druckumgebung
2014-12-13 22:30 - 2014-12-13 22:30 - 00000000 _SHDL () C:\Users\Carsten\Documents\Eigene Musik
2014-12-13 22:30 - 2014-12-13 22:30 - 00000000 _SHDL () C:\Users\Carsten\Documents\Eigene Bilder
2014-12-13 22:30 - 2014-12-13 22:30 - 00000000 _SHDL () C:\Users\Carsten\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-12-13 22:30 - 2014-12-13 22:30 - 00000000 _SHDL () C:\Users\Carsten\AppData\Local\Verlauf
2014-12-13 22:30 - 2014-12-13 22:30 - 00000000 _SHDL () C:\Users\Carsten\AppData\Local\Anwendungsdaten
2014-12-13 22:30 - 2014-12-13 22:30 - 00000000 _SHDL () C:\Users\Carsten\Anwendungsdaten
2014-12-13 22:30 - 2014-09-24 08:43 - 00000000 ___RD () C:\Users\Carsten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-12-13 22:30 - 2014-09-24 08:43 - 00000000 ___RD () C:\Users\Carsten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2014-12-13 22:30 - 2014-09-24 07:18 - 00000369 _____ () C:\Users\Carsten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pictures.lnk
2014-12-13 22:30 - 2014-09-24 07:18 - 00000369 _____ () C:\Users\Carsten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Documents.lnk
2014-12-13 22:30 - 2013-08-22 16:36 - 00000000 ___RD () C:\Users\Carsten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-12-13 22:30 - 2013-08-22 16:36 - 00000000 ____D () C:\Users\Carsten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-12-13 21:53 - 2014-12-13 23:57 - 01337113 _____ () C:\WINDOWS\WindowsUpdate.log
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Users\Public\Documents\Eigene Musik
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Users\Public\Documents\Eigene Bilder
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Users\Default\Vorlagen
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Users\Default\Startmenü
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Users\Default\Netzwerkumgebung
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Users\Default\Lokale Einstellungen
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Users\Default\Eigene Dateien
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Users\Default\Druckumgebung
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Users\Default\Documents\Eigene Musik
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Users\Default\Documents\Eigene Bilder
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Users\Default\AppData\Local\Verlauf
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Users\Default\AppData\Local\Anwendungsdaten
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Users\Default\Anwendungsdaten
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Users\Default User\Documents\Eigene Musik
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Users\Default User\Documents\Eigene Bilder
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Users\Default User\AppData\Local\Verlauf
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Users\Default User\AppData\Local\Anwendungsdaten
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Programme
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\ProgramData\Vorlagen
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\ProgramData\Startmenü
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\ProgramData\Microsoft\Windows\Start Menu\Programme
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\ProgramData\Dokumente
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\ProgramData\Anwendungsdaten
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Program Files\Gemeinsame Dateien
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Dokumente und Einstellungen
2014-12-13 21:42 - 2014-12-13 21:42 - 00000000 ____H () C:\WINDOWS\system32\Drivers\Msft_User_WpdFs_01_11_00.Wdf
2014-12-13 21:40 - 2014-12-13 22:31 - 00000000 ____D () C:\WINDOWS\Panther
2014-12-12 14:25 - 2014-12-13 21:28 - 00000000 ____D () C:\Windows.old

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-14 00:02 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2014-12-13 23:43 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2014-12-13 23:36 - 2013-08-22 16:20 - 00000000 ____D () C:\WINDOWS\CbsTemp
2014-12-13 22:46 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\restore
2014-12-13 22:42 - 2014-09-24 07:17 - 01686150 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2014-12-13 22:42 - 2014-09-24 06:43 - 00727930 _____ () C:\WINDOWS\system32\perfh007.dat
2014-12-13 22:42 - 2014-09-24 06:43 - 00151586 _____ () C:\WINDOWS\system32\perfc007.dat
2014-12-13 22:41 - 2013-08-22 15:46 - 00012953 _____ () C:\WINDOWS\setupact.log
2014-12-13 21:49 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\rescache
2014-12-13 21:47 - 2013-08-22 16:36 - 00000000 ____D () C:\Program Files\Windows NT
2014-12-13 21:47 - 2013-08-22 15:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2014-12-13 21:47 - 2013-08-22 14:36 - 00000000 __RHD () C:\Users\Default
2014-12-13 21:45 - 2013-08-22 16:37 - 00002664 _____ () C:\WINDOWS\DtcInstall.log
2014-12-13 21:45 - 2013-08-22 14:25 - 00262144 ___SH () C:\WINDOWS\system32\config\BBI
2014-12-13 21:41 - 2013-08-22 15:44 - 00338016 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2014-12-13 21:40 - 2014-09-23 22:06 - 00002496 _____ () C:\WINDOWS\PFRO.log
2014-12-13 21:39 - 2013-10-19 00:00 - 00000000 ____D () C:\Recovery
2014-12-13 21:39 - 2013-08-22 16:36 - 00262144 _____ () C:\WINDOWS\system32\config\BCD-Template
2014-12-13 21:39 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\Recovery

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-12-13 21:40

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 13-12-2014
Ran by Carsten at 2014-12-14 11:54:25
Running from C:\Users\Carsten\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
FW: avast! Antivirus (Enabled) {2F96FC65-F07D-9D1E-5A6E-3DA5C487EAF0}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Avast Premier (HKLM-x32\...\Avast) (Version: 10.0.2208 - AVAST Software)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 39.0.2171.95 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3368 - Intel Corporation)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

13-12-2014 21:46:15 avast! antivirus system restore point

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {34F325D3-C95A-4549-81B9-81201AFB8A9C} - System32\Tasks\Microsoft\Windows\SetupSQMTask => C:\WINDOWS\SYSTEM32\OOBE\SETUPSQM.EXE [2013-08-22] (Microsoft Corporation)
Task: {7C99CB09-E527-4787-AA46-54092A71085F} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-12-13] (Google Inc.)
Task: {C2DA47A6-8C56-41E9-BE45-546F0EA809C3} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-12-13] (Google Inc.)
Task: {E24AF55C-D20B-4888-8E9F-A834D42CEBA0} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-12-13] (AVAST Software)
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2014-12-13 22:47 - 2014-12-13 22:47 - 00388208 _____ () C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxDDU.dll
2014-12-13 22:47 - 2014-12-13 22:47 - 05851328 _____ () C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxRT.dll
2014-03-20 07:53 - 2014-03-20 07:53 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2014-12-13 22:48 - 2014-12-13 22:48 - 02908160 _____ () C:\Program Files\AVAST Software\Avast\defs\14121301\algo.dll
2014-12-13 22:47 - 2014-12-13 22:47 - 04495336 _____ () C:\Program Files\AVAST Software\Avast\ng\vbox\x86\VBoxRT-x86.dll
2014-12-13 22:47 - 2014-12-13 22:47 - 38562088 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2014-12-13 22:48 - 2014-12-06 02:50 - 01077064 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.95\libglesv2.dll
2014-12-13 22:48 - 2014-12-06 02:50 - 00211272 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.95\libegl.dll
2014-12-13 22:48 - 2014-12-06 02:50 - 09009480 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.95\pdf.dll
2014-12-13 22:48 - 2014-12-06 02:50 - 01677128 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.95\ffmpegsumo.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Users\Carsten\OneDrive:ms-properties

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


========================= Accounts: ==========================

Administrator (S-1-5-21-60830840-568542779-2265190336-500 - Administrator - Disabled)
Carsten (S-1-5-21-60830840-568542779-2265190336-1001 - Administrator - Enabled) => C:\Users\Carsten
Gast (S-1-5-21-60830840-568542779-2265190336-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-60830840-568542779-2265190336-1003 - Limited - Enabled)

==================== Faulty Device Manager Devices =============

Name: NVIDIA GeForce 710M
Description: NVIDIA GeForce 710M
Class Guid: {4d36e968-e325-11ce-bfc1-08002be10318}
Manufacturer: NVIDIA
Service: nvlddmkm
Problem: : This device cannot work properly until you restart your computer. (Code14)
Resolution: Restart your computer.

Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (12/13/2014 10:38:56 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: CarstenLaptop)
Description: Bei der Aktivierung der App „Microsoft.SkypeApp_kzf8qxf38zg5c!App“ ist folgender Fehler aufgetreten: -2144927142. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (12/13/2014 10:38:56 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm wwahost.exe, Version 6.3.9600.17031 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1040

Startzeit: 01d0171d20670b6e

Endzeit: 4294967295

Anwendungspfad: C:\WINDOWS\syswow64\wwahost.exe

Berichts-ID: 69eecdc7-8310-11e4-8250-1867b065a584

Vollständiger Name des fehlerhaften Pakets: Microsoft.SkypeApp_3.0.0.1002_x86__kzf8qxf38zg5c

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: App

Error: (12/13/2014 10:38:41 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: CarstenLaptop)
Description: Die App „Microsoft.SkypeApp_3.0.0.1002_x86__kzf8qxf38zg5c+App“ wurde nicht innerhalb der vorgesehenen Zeit gestartet.

Error: (12/13/2014 10:35:00 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: WSHost.exe, Version: 6.3.9600.17093, Zeitstempel: 0x534765e9
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.3.9600.17031, Zeitstempel: 0x530895af
Ausnahmecode: 0xc0000374
Fehleroffset: 0x00000000000f8c9c
ID des fehlerhaften Prozesses: 0xe54
Startzeit der fehlerhaften Anwendung: 0xWSHost.exe0
Pfad der fehlerhaften Anwendung: WSHost.exe1
Pfad des fehlerhaften Moduls: WSHost.exe2
Berichtskennung: WSHost.exe3
Vollständiger Name des fehlerhaften Pakets: WSHost.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: WSHost.exe5


System errors:
=============
Error: (12/13/2014 11:28:43 PM) (Source: DCOM) (EventID: 10010) (User: CarstenLaptop)
Description: {4AA0A5C4-1B9B-4F2E-99D7-99C6AEC83474}

Error: (12/13/2014 10:34:05 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert und an den Remoteendpunkt gesendet. Dies kann dazu führen, dass die Verbindung beendet wird. Die schwerwiegende Warnung hat folgenden für das TLS-Protokoll definierten Code: 70. Der Windows-SChannel-Fehlerstatus lautet: 105.

Error: (12/13/2014 09:44:03 PM) (Source: DCOM) (EventID: 10010) (User: NT-AUTORITÄT)
Description: {A47979D2-C419-11D9-A5B4-001185AD2B89}

Error: (12/13/2014 09:42:03 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Netzwerklistendienst" wurde mit folgendem Fehler beendet: 
%%21

Error: (12/13/2014 09:41:47 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "IP-Hilfsdienst" wurde mit folgendem Fehler beendet: 
%%1058

Error: (12/13/2014 09:39:51 PM) (Source: volmgr) (EventID: 46) (User: )
Description: Die Initialisierung des Speicherabbildes ist fehlgeschlagen.


Microsoft Office Sessions:
=========================
Error: (12/13/2014 10:38:56 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: CarstenLaptop)
Description: Microsoft.SkypeApp_kzf8qxf38zg5c!App-2144927142

Error: (12/13/2014 10:38:56 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: wwahost.exe6.3.9600.17031104001d0171d20670b6e4294967295C:\WINDOWS\syswow64\wwahost.exe69eecdc7-8310-11e4-8250-1867b065a584Microsoft.SkypeApp_3.0.0.1002_x86__kzf8qxf38zg5cApp

Error: (12/13/2014 10:38:41 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: CarstenLaptop)
Description: Microsoft.SkypeApp_3.0.0.1002_x86__kzf8qxf38zg5c+App

Error: (12/13/2014 10:35:00 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: WSHost.exe6.3.9600.17093534765e9ntdll.dll6.3.9600.17031530895afc000037400000000000f8c9ce5401d0171c4a08a270C:\WINDOWS\WinStore\WSHost.exeC:\WINDOWS\SYSTEM32\ntdll.dlle387cd08-830f-11e4-8250-1867b065a584


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i5-3230M CPU @ 2.60GHz
Percentage of memory in use: 16%
Total physical RAM: 8065.73 MB
Available physical RAM: 6704.13 MB
Total Pagefile: 9985.74 MB
Available Pagefile: 8484.44 MB
Total Virtual: 131072 MB
Available Virtual: 131071.8 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:100.66 GB) (Free:75.68 GB) NTFS
Drive d: (Dateien) (Fixed) (Total:573.04 GB) (Free:296.04 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 698.6 GB) (Disk ID: 30DC1DCB)

Partition: GPT Partition Type.

==================== End Of Log ============================

Und nun?

schrauber · 14.12.2014, 23:33

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

Wannekakki · 15.12.2014, 23:06

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 15.12.2014
Suchlauf-Zeit: 21:52:41
Logdatei: mbam.txt
Administrator: Ja

Version: 2.00.4.1028
Malware Datenbank: v2014.12.15.05
Rootkit Datenbank: v2014.12.14.01
Lizenz: Testversion
Malware Schutz: Aktiviert
Bösartiger Webseiten Schutz: Aktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 8.1
CPU: x64
Dateisystem: NTFS
Benutzer: Carsten

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 308489
Verstrichene Zeit: 10 Min, 5 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente erkannt)

Module: 0
(Keine schädliche Elemente erkannt)

Registrierungsschlüssel: 0
(Keine schädliche Elemente erkannt)

Registrierungswerte: 0
(Keine schädliche Elemente erkannt)

Registrierungsdaten: 0
(Keine schädliche Elemente erkannt)

Ordner: 0
(Keine schädliche Elemente erkannt)

Dateien: 0
(Keine schädliche Elemente erkannt)

Physische Sektoren: 0
(Keine schädliche Elemente erkannt)


(end)

Code:

ATTFilter

# AdwCleaner v4.105 - Bericht erstellt am 15/12/2014 um 22:42:31
# Aktualisiert 08/12/2014 von Xplode
# Database : 2014-12-13.4 [Live]
# Betriebssystem : Windows 8.1  (64 bits)
# Benutzername : Carsten - CarstenLaptop
# Gestartet von : C:\Users\Carsten\Desktop\AdwCleaner_4.105.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****


***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17126


-\\ Google Chrome v39.0.2171.95

[C:\Users\Carsten\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://de.ask.com/web?q={searchTerms}

*************************

AdwCleaner[R0].txt - [902 octets] - [15/12/2014 22:35:06]
AdwCleaner[S0].txt - [824 octets] - [15/12/2014 22:42:31]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [883 octets] ##########

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.0 (11.29.2014:1)
OS: Windows 8.1 x64
Ran by Carsten on 15.12.2014 at 22:52:02,96
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 15.12.2014 at 22:57:34,89
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-12-2014
Ran by Carsten (administrator) on CARSTENLAPTOP on 15-12-2014 22:59:48
Running from C:\Users\Carsten\Desktop
Loaded Profile: Carsten (Available profiles: Carsten)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\afwServ.exe
(Intel Corporation) C:\Windows\SysWOW64\IntelCpHeciSvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Avast Software) C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\ng\ngservice.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\WWAHost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5227112 2014-12-13] (AVAST Software)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-60830840-568542779-2265190336-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-12-13]

Chrome: 
=======
CHR HomePage: Default -> hxxp://www.google.com/
CHR StartupUrls: Default -> "hxxp://www.trovi.com/?gd=&ctid=CT3321557&octid=EB_ORIGINAL_CTID&ISID=MAD461719-FCEC-4165-B7E5-84A6366152BE&SearchSource=55&CUI=&UM=6&UP=SP9D1E4C60-0D59-4491-BECA-20D7E6F88308&SSPV=", "hxxp://www.google.com/"
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}
CHR Profile: C:\Users\Carsten\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Präsentationen) - C:\Users\Carsten\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-12-13]
CHR Extension: (Google Docs) - C:\Users\Carsten\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-12-13]
CHR Extension: (Google Drive) - C:\Users\Carsten\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-12-13]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Carsten\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-12-13]
CHR Extension: (YouTube) - C:\Users\Carsten\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-12-13]
CHR Extension: (Google-Suche) - C:\Users\Carsten\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-12-13]
CHR Extension: (Google Tabellen) - C:\Users\Carsten\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-12-13]
CHR Extension: (Vollbild-Flash) - C:\Users\Carsten\AppData\Local\Google\Chrome\User Data\Default\Extensions\gejijbmhbanhbllpkhfojmimfolkjgdl [2014-12-13]
CHR Extension: (Avast Online Security) - C:\Users\Carsten\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-12-13]
CHR Extension: (Google Wallet) - C:\Users\Carsten\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-12-13]
CHR Extension: (Google Mail) - C:\Users\Carsten\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-12-13]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-12-13]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-12-13] (AVAST Software)
R2 avast! Firewall; C:\Program Files\AVAST Software\Avast\afwServ.exe [104416 2014-12-13] (AVAST Software)
R3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [4012248 2014-12-13] (Avast Software)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-09-24] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-09-24] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-12-13] ()
R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [28184 2014-12-13] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [83280 2014-12-13] (AVAST Software)
R0 aswNdisFlt; C:\Windows\System32\DRIVERS\aswNdisFlt.sys [449936 2014-12-13] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-12-13] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-12-13] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1050432 2014-12-13] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [436624 2014-12-13] (AVAST Software)
S2 aswStm; C:\Windows\system32\drivers\aswStm.sys [116728 2014-12-13] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [267632 2014-12-13] ()
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-09-24] (Microsoft Corporation)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [129752 2014-12-15] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2014-11-21] (Malwarebytes Corporation)
R2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [271752 2014-12-13] (Avast Software)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-09-24] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-15 22:57 - 2014-12-15 22:57 - 00000616 _____ () C:\Users\Carsten\Desktop\JRT.txt
2014-12-15 22:52 - 2014-12-15 22:52 - 00000000 ____D () C:\WINDOWS\ERUNT
2014-12-15 22:49 - 2014-12-15 22:49 - 01707646 _____ (Thisisu) C:\Users\Carsten\Desktop\JRT.exe
2014-12-15 22:47 - 2014-12-15 22:47 - 00000197 _____ () C:\WINDOWS\system32\2014-12-15-21-47-11.055-AvastVBoxSVC.exe-4948.log
2014-12-15 22:46 - 2014-12-15 22:46 - 00000962 _____ () C:\Users\Carsten\Desktop\AdwCleaner[S0].txt
2014-12-15 22:26 - 2014-12-15 22:42 - 00000000 ____D () C:\AdwCleaner
2014-12-15 22:25 - 2014-12-15 22:25 - 02166272 _____ () C:\Users\Carsten\Desktop\AdwCleaner_4.105.exe
2014-12-15 22:24 - 2014-12-15 22:24 - 00001189 _____ () C:\Users\Carsten\Desktop\mbam.txt
2014-12-15 21:51 - 2014-12-15 22:45 - 00129752 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-12-15 21:50 - 2014-12-15 21:50 - 00001110 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-12-15 21:50 - 2014-12-15 21:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-12-15 21:50 - 2014-12-15 21:50 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-12-15 21:50 - 2014-12-15 21:50 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-12-15 21:50 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2014-12-15 21:50 - 2014-11-21 06:14 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2014-12-15 21:50 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2014-12-15 21:48 - 2014-12-15 21:48 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Carsten\Desktop\mbam-setup-2.0.4.1028.exe
2014-12-14 17:36 - 2014-12-14 17:36 - 00000000 ____D () C:\Users\Carsten\AppData\Local\Intel_Corporation
2014-12-14 11:54 - 2014-12-14 11:54 - 00011138 _____ () C:\Users\Carsten\Desktop\Addition.txt
2014-12-14 11:53 - 2014-12-15 22:59 - 00009398 _____ () C:\Users\Carsten\Desktop\FRST.txt
2014-12-14 11:53 - 2014-12-15 22:59 - 00000000 ____D () C:\FRST
2014-12-14 11:52 - 2014-12-14 11:52 - 02119168 _____ (Farbar) C:\Users\Carsten\Desktop\FRST64.exe
2014-12-13 22:56 - 2014-12-13 22:56 - 00000247 _____ () C:\WINDOWS\system32\2014-12-13-21-56-01.078-aswFe.exe-4548.log
2014-12-13 22:52 - 2014-12-13 22:55 - 00000247 _____ () C:\WINDOWS\system32\2014-12-13-21-52-15.096-aswFe.exe-5644.log
2014-12-13 22:52 - 2014-12-13 22:52 - 00000197 _____ () C:\WINDOWS\system32\2014-12-13-21-52-14.092-AvastVBoxSVC.exe-4576.log
2014-12-13 22:51 - 2014-12-13 22:51 - 00007680 ___SH () C:\Users\Carsten\Desktop\Thumbs.db
2014-12-13 22:49 - 2014-12-13 22:49 - 00000000 ____D () C:\Users\Carsten\AppData\Roaming\AVAST Software
2014-12-13 22:48 - 2014-12-15 22:58 - 00001146 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2014-12-13 22:48 - 2014-12-15 22:45 - 00004182 _____ () C:\WINDOWS\System32\Tasks\avast! Emergency Update
2014-12-13 22:48 - 2014-12-13 22:53 - 00004122 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2014-12-13 22:48 - 2014-12-13 22:53 - 00003886 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2014-12-13 22:48 - 2014-12-13 22:53 - 00002195 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-12-13 22:48 - 2014-12-13 22:53 - 00001150 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2014-12-13 22:48 - 2014-12-13 22:49 - 00000000 ____D () C:\WINDOWS\SysWOW64\vbox
2014-12-13 22:48 - 2014-12-13 22:49 - 00000000 ____D () C:\WINDOWS\system32\vbox
2014-12-13 22:48 - 2014-12-13 22:49 - 00000000 ____D () C:\Users\Carsten\AppData\Local\Google
2014-12-13 22:48 - 2014-12-13 22:48 - 01050432 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswsnx.sys
2014-12-13 22:48 - 2014-12-13 22:48 - 00002026 _____ () C:\Users\Public\Desktop\Avast SafeZone.lnk
2014-12-13 22:48 - 2014-12-13 22:48 - 00001966 _____ () C:\Users\Public\Desktop\Avast Premier.lnk
2014-12-13 22:48 - 2014-12-13 22:48 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-12-13 22:48 - 2014-12-13 22:48 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2014-12-13 22:48 - 2014-12-13 22:48 - 00000000 ____D () C:\Program Files (x86)\Google
2014-12-13 22:48 - 2014-12-13 22:47 - 00436624 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSP.sys
2014-12-13 22:48 - 2014-12-13 22:47 - 00267632 _____ () C:\WINDOWS\system32\Drivers\aswVmm.sys
2014-12-13 22:48 - 2014-12-13 22:47 - 00116728 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswStm.sys
2014-12-13 22:48 - 2014-12-13 22:47 - 00093568 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswRdr2.sys
2014-12-13 22:48 - 2014-12-13 22:47 - 00083280 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswMonFlt.sys
2014-12-13 22:48 - 2014-12-13 22:47 - 00065776 _____ () C:\WINDOWS\system32\Drivers\aswRvrt.sys
2014-12-13 22:48 - 2014-12-13 22:47 - 00029208 _____ () C:\WINDOWS\system32\Drivers\aswHwid.sys
2014-12-13 22:48 - 2014-12-13 22:47 - 00028184 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswKbd.sys
2014-12-13 22:47 - 2014-12-13 22:47 - 00449936 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswNdisFlt.sys
2014-12-13 22:47 - 2014-12-13 22:47 - 00364512 _____ (AVAST Software) C:\WINDOWS\system32\aswBoot.exe
2014-12-13 22:47 - 2014-12-13 22:47 - 00043152 _____ (AVAST Software) C:\WINDOWS\avastSS.scr
2014-12-13 22:46 - 2014-12-13 22:46 - 00000000 ____D () C:\Program Files\AVAST Software
2014-12-13 22:45 - 2014-12-13 22:46 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-12-13 22:41 - 2014-12-13 22:41 - 00000000 ____D () C:\Program Files\Intel
2014-12-13 22:41 - 2014-12-13 22:41 - 00000000 ____D () C:\Program Files (x86)\Intel
2014-12-13 22:41 - 2014-12-13 22:41 - 00000000 ____D () C:\Intel
2014-12-13 22:41 - 2014-03-20 07:53 - 00064000 _____ (Khronos Group) C:\WINDOWS\system32\OpenCL.DLL
2014-12-13 22:41 - 2014-03-20 07:53 - 00060416 _____ (Khronos Group) C:\WINDOWS\SysWOW64\OpenCL.DLL
2014-12-13 22:39 - 2014-12-15 22:55 - 00003958 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{150BF4F5-0CEB-4DB9-A07E-FB016EBD3A38}
2014-12-13 22:39 - 2014-12-13 22:39 - 00000424 _____ () C:\Users\Carsten\Desktop\Dieser PC - Verknüpfung.lnk
2014-12-13 22:39 - 2014-12-13 22:39 - 00000000 __SHD () C:\Users\Carsten\AppData\Local\EmieUserList
2014-12-13 22:39 - 2014-12-13 22:39 - 00000000 __SHD () C:\Users\Carsten\AppData\Local\EmieSiteList
2014-12-13 22:39 - 2014-12-13 22:39 - 00000000 ____D () C:\Users\Carsten\AppData\Roaming\Macromedia
2014-12-13 22:38 - 2014-12-13 22:39 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
2014-12-13 22:38 - 2014-12-13 22:38 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation
2014-12-13 22:38 - 2014-12-13 22:38 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2014-12-13 22:36 - 2014-12-15 22:02 - 00003594 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-60830840-568542779-2265190336-1001
2014-12-13 22:35 - 2014-12-13 22:35 - 00000000 ____D () C:\Program Files\Common Files\Atheros
2014-12-13 22:34 - 2014-12-15 22:45 - 00000000 ___RD () C:\Users\Carsten\OneDrive
2014-12-13 22:31 - 2014-12-13 23:38 - 00000000 ____D () C:\Users\Carsten\AppData\Local\Packages
2014-12-13 22:31 - 2014-12-13 22:31 - 00001446 _____ () C:\Users\Carsten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-12-13 22:31 - 2014-12-13 22:31 - 00000000 ____D () C:\Users\Carsten\AppData\Roaming\Adobe
2014-12-13 22:31 - 2014-12-13 22:31 - 00000000 ____D () C:\Users\Carsten\AppData\Local\VirtualStore
2014-12-13 22:30 - 2014-12-13 22:34 - 00000000 ____D () C:\Users\Carsten
2014-12-13 22:30 - 2014-12-13 22:30 - 00000020 ___SH () C:\Users\Carsten\ntuser.ini
2014-12-13 22:30 - 2014-12-13 22:30 - 00000000 _SHDL () C:\Users\Carsten\Vorlagen
2014-12-13 22:30 - 2014-12-13 22:30 - 00000000 _SHDL () C:\Users\Carsten\Startmenü
2014-12-13 22:30 - 2014-12-13 22:30 - 00000000 _SHDL () C:\Users\Carsten\Netzwerkumgebung
2014-12-13 22:30 - 2014-12-13 22:30 - 00000000 _SHDL () C:\Users\Carsten\Lokale Einstellungen
2014-12-13 22:30 - 2014-12-13 22:30 - 00000000 _SHDL () C:\Users\Carsten\Eigene Dateien
2014-12-13 22:30 - 2014-12-13 22:30 - 00000000 _SHDL () C:\Users\Carsten\Druckumgebung
2014-12-13 22:30 - 2014-12-13 22:30 - 00000000 _SHDL () C:\Users\Carsten\Documents\Eigene Musik
2014-12-13 22:30 - 2014-12-13 22:30 - 00000000 _SHDL () C:\Users\Carsten\Documents\Eigene Bilder
2014-12-13 22:30 - 2014-12-13 22:30 - 00000000 _SHDL () C:\Users\Carsten\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-12-13 22:30 - 2014-12-13 22:30 - 00000000 _SHDL () C:\Users\Carsten\AppData\Local\Verlauf
2014-12-13 22:30 - 2014-12-13 22:30 - 00000000 _SHDL () C:\Users\Carsten\AppData\Local\Anwendungsdaten
2014-12-13 22:30 - 2014-12-13 22:30 - 00000000 _SHDL () C:\Users\Carsten\Anwendungsdaten
2014-12-13 22:30 - 2014-09-24 08:43 - 00000000 ___RD () C:\Users\Carsten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-12-13 22:30 - 2014-09-24 08:43 - 00000000 ___RD () C:\Users\Carsten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2014-12-13 22:30 - 2014-09-24 07:18 - 00000369 _____ () C:\Users\Carsten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pictures.lnk
2014-12-13 22:30 - 2014-09-24 07:18 - 00000369 _____ () C:\Users\Carsten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Documents.lnk
2014-12-13 22:30 - 2013-08-22 16:36 - 00000000 ___RD () C:\Users\Carsten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-12-13 22:30 - 2013-08-22 16:36 - 00000000 ____D () C:\Users\Carsten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-12-13 21:53 - 2014-12-15 22:58 - 01445613 _____ () C:\WINDOWS\WindowsUpdate.log
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Users\Public\Documents\Eigene Musik
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Users\Public\Documents\Eigene Bilder
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Users\Default\Vorlagen
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Users\Default\Startmenü
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Users\Default\Netzwerkumgebung
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Users\Default\Lokale Einstellungen
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Users\Default\Eigene Dateien
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Users\Default\Druckumgebung
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Users\Default\Documents\Eigene Musik
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Users\Default\Documents\Eigene Bilder
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Users\Default\AppData\Local\Verlauf
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Users\Default\AppData\Local\Anwendungsdaten
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Users\Default\Anwendungsdaten
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Users\Default User\Documents\Eigene Musik
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Users\Default User\Documents\Eigene Bilder
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Users\Default User\AppData\Local\Verlauf
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Users\Default User\AppData\Local\Anwendungsdaten
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Programme
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\ProgramData\Vorlagen
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\ProgramData\Startmenü
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\ProgramData\Microsoft\Windows\Start Menu\Programme
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\ProgramData\Dokumente
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\ProgramData\Anwendungsdaten
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Program Files\Gemeinsame Dateien
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Dokumente und Einstellungen
2014-12-13 21:42 - 2014-12-13 21:42 - 00000000 ____H () C:\WINDOWS\system32\Drivers\Msft_User_WpdFs_01_11_00.Wdf
2014-12-13 21:40 - 2014-12-13 22:31 - 00000000 ____D () C:\WINDOWS\Panther
2014-12-12 14:25 - 2014-12-13 21:28 - 00000000 ____D () C:\Windows.old

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-15 23:00 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2014-12-15 22:49 - 2014-09-24 07:17 - 01686150 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2014-12-15 22:49 - 2014-09-24 06:43 - 00727930 _____ () C:\WINDOWS\system32\perfh007.dat
2014-12-15 22:49 - 2014-09-24 06:43 - 00151586 _____ () C:\WINDOWS\system32\perfc007.dat
2014-12-15 22:43 - 2014-09-23 22:06 - 00003782 _____ () C:\WINDOWS\PFRO.log
2014-12-15 22:43 - 2013-08-22 15:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2014-12-15 22:42 - 2013-08-22 14:25 - 00262144 ___SH () C:\WINDOWS\system32\config\BBI
2014-12-14 16:23 - 2013-08-22 15:46 - 00014543 _____ () C:\WINDOWS\setupact.log
2014-12-13 23:43 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2014-12-13 23:36 - 2013-08-22 16:20 - 00000000 ____D () C:\WINDOWS\CbsTemp
2014-12-13 22:46 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\restore
2014-12-13 21:49 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\rescache
2014-12-13 21:47 - 2013-08-22 16:36 - 00000000 ____D () C:\Program Files\Windows NT
2014-12-13 21:47 - 2013-08-22 14:36 - 00000000 __RHD () C:\Users\Default
2014-12-13 21:45 - 2013-08-22 16:37 - 00002664 _____ () C:\WINDOWS\DtcInstall.log
2014-12-13 21:41 - 2013-08-22 15:44 - 00338016 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2014-12-13 21:39 - 2013-10-19 00:00 - 00000000 ____D () C:\Recovery
2014-12-13 21:39 - 2013-08-22 16:36 - 00262144 _____ () C:\WINDOWS\system32\config\BCD-Template
2014-12-13 21:39 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\Recovery

Some content of TEMP:
====================
C:\Users\Carsten\AppData\Local\Temp\Quarantine.exe
C:\Users\Carsten\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-12-13 21:40

==================== End Of Log ============================

--- --- ---

schrauber · 16.12.2014, 21:19

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

Wannekakki · 17.12.2014, 00:07

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=dcff155066cfea40ab363e514554ac0f
# engine=21584
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-12-16 10:26:17
# local_time=2014-12-16 11:26:17 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.2.9200 NT 
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 7224168 43650070 0 0
# scanned=270010
# found=0
# cleaned=0
# scan_time=3461

Code:

ATTFilter

 Results of screen317's Security Check version 0.99.91  
   x64 (UAC is enabled)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:`````````````` 
Windows Defender   
avast! Antivirus   
 Antivirus up to date!  (On Access scanning disabled!) 
`````````Anti-malware/Other Utilities Check:````````` 
 Google Chrome (39.0.2171.95) 
````````Process Check: objlist.exe by Laurent````````  
 Malwarebytes Anti-Malware mbamservice.exe  
 Malwarebytes Anti-Malware mbam.exe  
 Malwarebytes Anti-Malware mbamscheduler.exe   
 AVAST Software Avast AvastSvc.exe  
 AVAST Software Avast afwServ.exe  
 AVAST Software Avast ng vbox\AvastVBoxSVC.exe 
 AVAST Software Avast ng ngservice.exe 
 AVAST Software Avast avastui.exe  
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  % 
````````````````````End of Log``````````````````````

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-12-2014
Ran by Carsten (administrator) on CARSTENLAPTOP on 16-12-2014 23:34:11
Running from C:\Users\Carsten\Desktop
Loaded Profile: Carsten (Available profiles: Carsten)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\afwServ.exe
(Intel Corporation) C:\Windows\SysWOW64\IntelCpHeciSvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(Avast Software) C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\ng\ngservice.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5227112 2014-12-13] (AVAST Software)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-60830840-568542779-2265190336-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-12-13]

Chrome: 
=======
CHR HomePage: Default -> hxxp://www.google.com/
CHR StartupUrls: Default -> "hxxp://www.trovi.com/?gd=&ctid=CT3321557&octid=EB_ORIGINAL_CTID&ISID=MAD461719-FCEC-4165-B7E5-84A6366152BE&SearchSource=55&CUI=&UM=6&UP=SP9D1E4C60-0D59-4491-BECA-20D7E6F88308&SSPV=", "hxxp://www.google.com/"
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}
CHR Profile: C:\Users\Carsten\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Präsentationen) - C:\Users\Carsten\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-12-13]
CHR Extension: (Google Docs) - C:\Users\Carsten\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-12-13]
CHR Extension: (Google Drive) - C:\Users\Carsten\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-12-13]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Carsten\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-12-13]
CHR Extension: (YouTube) - C:\Users\Carsten\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-12-13]
CHR Extension: (Google-Suche) - C:\Users\Carsten\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-12-13]
CHR Extension: (Google Tabellen) - C:\Users\Carsten\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-12-13]
CHR Extension: (Vollbild-Flash) - C:\Users\Carsten\AppData\Local\Google\Chrome\User Data\Default\Extensions\gejijbmhbanhbllpkhfojmimfolkjgdl [2014-12-13]
CHR Extension: (Avast Online Security) - C:\Users\Carsten\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-12-13]
CHR Extension: (Google Wallet) - C:\Users\Carsten\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-12-13]
CHR Extension: (Google Mail) - C:\Users\Carsten\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-12-13]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-12-13]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-12-13] (AVAST Software)
R2 avast! Firewall; C:\Program Files\AVAST Software\Avast\afwServ.exe [104416 2014-12-13] (AVAST Software)
R3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [4012248 2014-12-13] (Avast Software)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-09-24] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-09-24] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-12-13] ()
R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [28184 2014-12-13] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [83280 2014-12-13] (AVAST Software)
R0 aswNdisFlt; C:\Windows\System32\DRIVERS\aswNdisFlt.sys [449936 2014-12-13] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-12-13] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-12-13] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1050432 2014-12-13] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [436624 2014-12-13] (AVAST Software)
S2 aswStm; C:\Windows\system32\drivers\aswStm.sys [116728 2014-12-13] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [267632 2014-12-13] ()
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-09-24] (Microsoft Corporation)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [129752 2014-12-16] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2014-11-21] (Malwarebytes Corporation)
R2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [271752 2014-12-13] (Avast Software)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-09-24] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-16 23:33 - 2014-12-16 23:33 - 00000972 _____ () C:\Users\Carsten\Desktop\checkup.txt
2014-12-16 22:17 - 2014-12-16 22:17 - 02347384 _____ (ESET) C:\Users\Carsten\Desktop\esetsmartinstaller_deu.exe
2014-12-16 22:17 - 2014-12-16 22:17 - 00852490 _____ () C:\Users\Carsten\Desktop\SecurityCheck.exe
2014-12-15 22:57 - 2014-12-15 22:57 - 00000616 _____ () C:\Users\Carsten\Desktop\JRT.txt
2014-12-15 22:52 - 2014-12-15 22:52 - 00000000 ____D () C:\WINDOWS\ERUNT
2014-12-15 22:49 - 2014-12-15 22:49 - 01707646 _____ (Thisisu) C:\Users\Carsten\Desktop\JRT.exe
2014-12-15 22:47 - 2014-12-15 22:47 - 00000197 _____ () C:\WINDOWS\system32\2014-12-15-21-47-11.055-AvastVBoxSVC.exe-4948.log
2014-12-15 22:46 - 2014-12-15 22:46 - 00000962 _____ () C:\Users\Carsten\Desktop\AdwCleaner[S0].txt
2014-12-15 22:26 - 2014-12-15 22:42 - 00000000 ____D () C:\AdwCleaner
2014-12-15 22:25 - 2014-12-15 22:25 - 02166272 _____ () C:\Users\Carsten\Desktop\AdwCleaner_4.105.exe
2014-12-15 22:24 - 2014-12-15 22:24 - 00001189 _____ () C:\Users\Carsten\Desktop\mbam.txt
2014-12-15 21:51 - 2014-12-16 22:12 - 00129752 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-12-15 21:50 - 2014-12-15 21:50 - 00001110 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-12-15 21:50 - 2014-12-15 21:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-12-15 21:50 - 2014-12-15 21:50 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-12-15 21:50 - 2014-12-15 21:50 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-12-15 21:50 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2014-12-15 21:50 - 2014-11-21 06:14 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2014-12-15 21:50 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2014-12-15 21:48 - 2014-12-15 21:48 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Carsten\Desktop\mbam-setup-2.0.4.1028.exe
2014-12-14 17:36 - 2014-12-14 17:36 - 00000000 ____D () C:\Users\Carsten\AppData\Local\Intel_Corporation
2014-12-14 11:54 - 2014-12-14 11:54 - 00011138 _____ () C:\Users\Carsten\Desktop\Addition.txt
2014-12-14 11:53 - 2014-12-16 23:34 - 00009398 _____ () C:\Users\Carsten\Desktop\FRST.txt
2014-12-14 11:53 - 2014-12-16 23:34 - 00000000 ____D () C:\FRST
2014-12-14 11:52 - 2014-12-14 11:52 - 02119168 _____ (Farbar) C:\Users\Carsten\Desktop\FRST64.exe
2014-12-13 22:56 - 2014-12-13 22:56 - 00000247 _____ () C:\WINDOWS\system32\2014-12-13-21-56-01.078-aswFe.exe-4548.log
2014-12-13 22:52 - 2014-12-13 22:55 - 00000247 _____ () C:\WINDOWS\system32\2014-12-13-21-52-15.096-aswFe.exe-5644.log
2014-12-13 22:52 - 2014-12-13 22:52 - 00000197 _____ () C:\WINDOWS\system32\2014-12-13-21-52-14.092-AvastVBoxSVC.exe-4576.log
2014-12-13 22:51 - 2014-12-13 22:51 - 00007680 ___SH () C:\Users\Carsten\Desktop\Thumbs.db
2014-12-13 22:49 - 2014-12-13 22:49 - 00000000 ____D () C:\Users\Carsten\AppData\Roaming\AVAST Software
2014-12-13 22:48 - 2014-12-16 22:58 - 00001146 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2014-12-13 22:48 - 2014-12-15 22:45 - 00004182 _____ () C:\WINDOWS\System32\Tasks\avast! Emergency Update
2014-12-13 22:48 - 2014-12-13 22:53 - 00004122 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2014-12-13 22:48 - 2014-12-13 22:53 - 00003886 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2014-12-13 22:48 - 2014-12-13 22:53 - 00002195 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-12-13 22:48 - 2014-12-13 22:53 - 00001150 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2014-12-13 22:48 - 2014-12-13 22:49 - 00000000 ____D () C:\WINDOWS\SysWOW64\vbox
2014-12-13 22:48 - 2014-12-13 22:49 - 00000000 ____D () C:\WINDOWS\system32\vbox
2014-12-13 22:48 - 2014-12-13 22:49 - 00000000 ____D () C:\Users\Carsten\AppData\Local\Google
2014-12-13 22:48 - 2014-12-13 22:48 - 01050432 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswsnx.sys
2014-12-13 22:48 - 2014-12-13 22:48 - 00002026 _____ () C:\Users\Public\Desktop\Avast SafeZone.lnk
2014-12-13 22:48 - 2014-12-13 22:48 - 00001966 _____ () C:\Users\Public\Desktop\Avast Premier.lnk
2014-12-13 22:48 - 2014-12-13 22:48 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-12-13 22:48 - 2014-12-13 22:48 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2014-12-13 22:48 - 2014-12-13 22:48 - 00000000 ____D () C:\Program Files (x86)\Google
2014-12-13 22:48 - 2014-12-13 22:47 - 00436624 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSP.sys
2014-12-13 22:48 - 2014-12-13 22:47 - 00267632 _____ () C:\WINDOWS\system32\Drivers\aswVmm.sys
2014-12-13 22:48 - 2014-12-13 22:47 - 00116728 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswStm.sys
2014-12-13 22:48 - 2014-12-13 22:47 - 00093568 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswRdr2.sys
2014-12-13 22:48 - 2014-12-13 22:47 - 00083280 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswMonFlt.sys
2014-12-13 22:48 - 2014-12-13 22:47 - 00065776 _____ () C:\WINDOWS\system32\Drivers\aswRvrt.sys
2014-12-13 22:48 - 2014-12-13 22:47 - 00029208 _____ () C:\WINDOWS\system32\Drivers\aswHwid.sys
2014-12-13 22:48 - 2014-12-13 22:47 - 00028184 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswKbd.sys
2014-12-13 22:47 - 2014-12-13 22:47 - 00449936 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswNdisFlt.sys
2014-12-13 22:47 - 2014-12-13 22:47 - 00364512 _____ (AVAST Software) C:\WINDOWS\system32\aswBoot.exe
2014-12-13 22:47 - 2014-12-13 22:47 - 00043152 _____ (AVAST Software) C:\WINDOWS\avastSS.scr
2014-12-13 22:46 - 2014-12-13 22:46 - 00000000 ____D () C:\Program Files\AVAST Software
2014-12-13 22:45 - 2014-12-13 22:46 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-12-13 22:41 - 2014-12-13 22:41 - 00000000 ____D () C:\Program Files\Intel
2014-12-13 22:41 - 2014-12-13 22:41 - 00000000 ____D () C:\Program Files (x86)\Intel
2014-12-13 22:41 - 2014-12-13 22:41 - 00000000 ____D () C:\Intel
2014-12-13 22:41 - 2014-03-20 07:53 - 00064000 _____ (Khronos Group) C:\WINDOWS\system32\OpenCL.DLL
2014-12-13 22:41 - 2014-03-20 07:53 - 00060416 _____ (Khronos Group) C:\WINDOWS\SysWOW64\OpenCL.DLL
2014-12-13 22:39 - 2014-12-16 23:33 - 00003958 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{150BF4F5-0CEB-4DB9-A07E-FB016EBD3A38}
2014-12-13 22:39 - 2014-12-13 22:39 - 00000424 _____ () C:\Users\Carsten\Desktop\Dieser PC - Verknüpfung.lnk
2014-12-13 22:39 - 2014-12-13 22:39 - 00000000 __SHD () C:\Users\Carsten\AppData\Local\EmieUserList
2014-12-13 22:39 - 2014-12-13 22:39 - 00000000 __SHD () C:\Users\Carsten\AppData\Local\EmieSiteList
2014-12-13 22:39 - 2014-12-13 22:39 - 00000000 ____D () C:\Users\Carsten\AppData\Roaming\Macromedia
2014-12-13 22:38 - 2014-12-13 22:39 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
2014-12-13 22:38 - 2014-12-13 22:38 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation
2014-12-13 22:38 - 2014-12-13 22:38 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2014-12-13 22:36 - 2014-12-16 22:17 - 00003592 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-60830840-568542779-2265190336-1001
2014-12-13 22:35 - 2014-12-13 22:35 - 00000000 ____D () C:\Program Files\Common Files\Atheros
2014-12-13 22:34 - 2014-12-16 22:14 - 00000000 ___RD () C:\Users\Carsten\OneDrive
2014-12-13 22:31 - 2014-12-13 23:38 - 00000000 ____D () C:\Users\Carsten\AppData\Local\Packages
2014-12-13 22:31 - 2014-12-13 22:31 - 00001446 _____ () C:\Users\Carsten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-12-13 22:31 - 2014-12-13 22:31 - 00000000 ____D () C:\Users\Carsten\AppData\Roaming\Adobe
2014-12-13 22:31 - 2014-12-13 22:31 - 00000000 ____D () C:\Users\Carsten\AppData\Local\VirtualStore
2014-12-13 22:30 - 2014-12-13 22:34 - 00000000 ____D () C:\Users\Carsten
2014-12-13 22:30 - 2014-12-13 22:30 - 00000020 ___SH () C:\Users\Carsten\ntuser.ini
2014-12-13 22:30 - 2014-12-13 22:30 - 00000000 _SHDL () C:\Users\Carsten\Vorlagen
2014-12-13 22:30 - 2014-12-13 22:30 - 00000000 _SHDL () C:\Users\Carsten\Startmenü
2014-12-13 22:30 - 2014-12-13 22:30 - 00000000 _SHDL () C:\Users\Carsten\Netzwerkumgebung
2014-12-13 22:30 - 2014-12-13 22:30 - 00000000 _SHDL () C:\Users\Carsten\Lokale Einstellungen
2014-12-13 22:30 - 2014-12-13 22:30 - 00000000 _SHDL () C:\Users\Carsten\Eigene Dateien
2014-12-13 22:30 - 2014-12-13 22:30 - 00000000 _SHDL () C:\Users\Carsten\Druckumgebung
2014-12-13 22:30 - 2014-12-13 22:30 - 00000000 _SHDL () C:\Users\Carsten\Documents\Eigene Musik
2014-12-13 22:30 - 2014-12-13 22:30 - 00000000 _SHDL () C:\Users\Carsten\Documents\Eigene Bilder
2014-12-13 22:30 - 2014-12-13 22:30 - 00000000 _SHDL () C:\Users\Carsten\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-12-13 22:30 - 2014-12-13 22:30 - 00000000 _SHDL () C:\Users\Carsten\AppData\Local\Verlauf
2014-12-13 22:30 - 2014-12-13 22:30 - 00000000 _SHDL () C:\Users\Carsten\AppData\Local\Anwendungsdaten
2014-12-13 22:30 - 2014-12-13 22:30 - 00000000 _SHDL () C:\Users\Carsten\Anwendungsdaten
2014-12-13 22:30 - 2014-09-24 08:43 - 00000000 ___RD () C:\Users\Carsten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-12-13 22:30 - 2014-09-24 08:43 - 00000000 ___RD () C:\Users\Carsten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2014-12-13 22:30 - 2014-09-24 07:18 - 00000369 _____ () C:\Users\Carsten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pictures.lnk
2014-12-13 22:30 - 2014-09-24 07:18 - 00000369 _____ () C:\Users\Carsten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Documents.lnk
2014-12-13 22:30 - 2013-08-22 16:36 - 00000000 ___RD () C:\Users\Carsten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-12-13 22:30 - 2013-08-22 16:36 - 00000000 ____D () C:\Users\Carsten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-12-13 21:53 - 2014-12-16 23:31 - 01488488 _____ () C:\WINDOWS\WindowsUpdate.log
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Users\Public\Documents\Eigene Musik
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Users\Public\Documents\Eigene Bilder
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Users\Default\Vorlagen
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Users\Default\Startmenü
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Users\Default\Netzwerkumgebung
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Users\Default\Lokale Einstellungen
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Users\Default\Eigene Dateien
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Users\Default\Druckumgebung
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Users\Default\Documents\Eigene Musik
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Users\Default\Documents\Eigene Bilder
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Users\Default\AppData\Local\Verlauf
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Users\Default\AppData\Local\Anwendungsdaten
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Users\Default\Anwendungsdaten
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Users\Default User\Documents\Eigene Musik
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Users\Default User\Documents\Eigene Bilder
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Users\Default User\AppData\Local\Verlauf
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Users\Default User\AppData\Local\Anwendungsdaten
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Programme
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\ProgramData\Vorlagen
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\ProgramData\Startmenü
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\ProgramData\Microsoft\Windows\Start Menu\Programme
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\ProgramData\Dokumente
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\ProgramData\Anwendungsdaten
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Program Files\Gemeinsame Dateien
2014-12-13 21:47 - 2014-12-13 21:47 - 00000000 _SHDL () C:\Dokumente und Einstellungen
2014-12-13 21:42 - 2014-12-13 21:42 - 00000000 ____H () C:\WINDOWS\system32\Drivers\Msft_User_WpdFs_01_11_00.Wdf
2014-12-13 21:40 - 2014-12-13 22:31 - 00000000 ____D () C:\WINDOWS\Panther
2014-12-12 14:25 - 2014-12-13 21:28 - 00000000 ____D () C:\Windows.old

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-16 23:00 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2014-12-16 22:17 - 2014-09-24 07:17 - 01686150 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2014-12-16 22:17 - 2014-09-24 06:43 - 00727930 _____ () C:\WINDOWS\system32\perfh007.dat
2014-12-16 22:17 - 2014-09-24 06:43 - 00151586 _____ () C:\WINDOWS\system32\perfc007.dat
2014-12-16 22:13 - 2013-08-22 15:46 - 00015338 _____ () C:\WINDOWS\setupact.log
2014-12-15 22:43 - 2014-09-23 22:06 - 00003782 _____ () C:\WINDOWS\PFRO.log
2014-12-15 22:43 - 2013-08-22 15:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2014-12-15 22:42 - 2013-08-22 14:25 - 00262144 ___SH () C:\WINDOWS\system32\config\BBI
2014-12-13 23:43 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2014-12-13 23:36 - 2013-08-22 16:20 - 00000000 ____D () C:\WINDOWS\CbsTemp
2014-12-13 22:46 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\restore
2014-12-13 21:49 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\rescache
2014-12-13 21:47 - 2013-08-22 16:36 - 00000000 ____D () C:\Program Files\Windows NT
2014-12-13 21:47 - 2013-08-22 14:36 - 00000000 __RHD () C:\Users\Default
2014-12-13 21:45 - 2013-08-22 16:37 - 00002664 _____ () C:\WINDOWS\DtcInstall.log
2014-12-13 21:41 - 2013-08-22 15:44 - 00338016 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2014-12-13 21:39 - 2013-10-19 00:00 - 00000000 ____D () C:\Recovery
2014-12-13 21:39 - 2013-08-22 16:36 - 00262144 _____ () C:\WINDOWS\system32\config\BCD-Template
2014-12-13 21:39 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\Recovery

Some content of TEMP:
====================
C:\Users\Carsten\AppData\Local\Temp\Quarantine.exe
C:\Users\Carsten\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-12-13 21:40

==================== End Of Log ============================

--- --- ---

--- --- ---

leider besteht das Problem noch immer

schrauber · 17.12.2014, 20:23

In welchem Browser? Oder in allen?

Wannekakki · 18.12.2014, 12:17

Nur bei Chrome. Es öffnen sich zwei Tabs einer mit Google und einer mit:

Code:

ATTFilter

hxxp://www.trovi.com/?gd=&ctid=CT3321557&octid=EB_ORIGINAL_CTID&ISID=MAD461719-FCEC-4165-B7E5-84A6366152BE&SearchSource=55&CUI=&UM=6&UP=SP9D1E4C60-0D59-4491-BECA-20D7E6F88308&SSPV=

schrauber · 18.12.2014, 21:18

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

CHR StartupUrls: Default -> "hxxp://www.trovi.com/?gd=&ctid=CT3321557&octid=EB_ORIGINAL_CTID&ISID=MAD461719-FCEC-4165-B7E5-84A6366152BE&SearchSource=55&CUI=&UM=6&UP=SP9D1E4C60-0D59-4491-BECA-20D7E6F88308&SSPV=", "hxxp://www.google.com/"
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Wannekakki · 19.12.2014, 01:47

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 17-12-2014
Ran by Carsten at 2014-12-18 22:58:34 Run:1
Running from C:\Users\Carsten\Desktop
Loaded Profile: Carsten (Available profiles: Carsten)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
CHR StartupUrls: Default -> "hxxp://www.trovi.com/?gd=&ctid=CT3321557&octid=EB_ORIGINAL_CTID&ISID=MAD461719-FCEC-4165-B7E5-84A6366152BE&SearchSource=55&CUI=&UM=6&UP=SP9D1E4C60-0D59-4491-BECA-20D7E6F88308&SSPV=", "hxxp://www.google.com/"
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}
*****************

Chrome StartupUrls deleted successfully.
Chrome DefaultSuggestURL deleted successfully.

==== End of Fixlog ====

Geil! Kein Trovi mehr beim Browser Start!

:

Zu früh gefreut, nach Rechner Neustart wieder da

schrauber · 19.12.2014, 22:40

Verbindest Du Chrome mit einem Google Konto? Frisches FRST log bitte.

Wannekakki · 20.12.2014, 16:00

Ja, ich verbinde Chrome mit meinem Google Konto.

Die FRST Log ist was lang geworden......habe sie mal gekürzt.

Der Text, den Sie eingegeben haben, besteht aus 497149 Zeichen und ist damit zu lang. Bitte kürzen Sie den Text auf die maximale Länge von 120000 Zeichen.

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 20-12-2014
Ran by Carsten (administrator) on CARSTENLAPTOP on 20-12-2014 15:40:40
Running from C:\Users\Carsten\Desktop
Loaded Profile: Carsten (Available profiles: Carsten)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\afwServ.exe
(Samsung) C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\AllShareFrameworkManagerDMS.exe
(Samsung) C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\AllShareFrameworkDMS.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(Copyright 2013 SAMSUNG) C:\Program Files\Samsung\Samsung Link\Samsung Link.exe
(Copyright 2013 SAMSUNG) C:\Program Files\Samsung\Samsung Link\Samsung Link.exe
(Avast Software) C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\ng\ngservice.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20498_x64__8wekyb3d8bbwe\livecomm.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Copyright 2013 SAMSUNG) C:\Program Files\Samsung\Samsung Link\Samsung Link Tray Agent.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.3.9600.17477_none_fa2b7d3b9b36c7b4\TiWorker.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Samsung Link] => C:\Program Files\Samsung\Samsung Link\Samsung Link Tray Agent.exe [607584 2014-12-16] (Copyright 2013 SAMSUNG)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5227112 2014-12-13] (AVAST Software)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-60830840-568542779-2265190336-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-12-13]

Chrome: 
=======
CHR HomePage: Default -> hxxp://www.google.com/
CHR StartupUrls: Default -> "hxxp://www.google.com/", "hxxp://www.trovi.com/?gd=&ctid=CT3321557&octid=EB_ORIGINAL_CTID&ISID=MAD461719-FCEC-4165-B7E5-84A6366152BE&SearchSource=55&CUI=&UM=6&UP=SP9D1E4C60-0D59-4491-BECA-20D7E6F88308&SSPV="
CHR Profile: C:\Users\Carsten\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Präsentationen) - C:\Users\Carsten\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-12-13]
CHR Extension: (Google Docs) - C:\Users\Carsten\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-12-13]
CHR Extension: (Google Drive) - C:\Users\Carsten\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-12-13]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Carsten\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-12-13]
CHR Extension: (YouTube) - C:\Users\Carsten\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-12-13]
CHR Extension: (Google-Suche) - C:\Users\Carsten\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-12-13]
CHR Extension: (Google Tabellen) - C:\Users\Carsten\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-12-13]
CHR Extension: (Vollbild-Flash) - C:\Users\Carsten\AppData\Local\Google\Chrome\User Data\Default\Extensions\gejijbmhbanhbllpkhfojmimfolkjgdl [2014-12-13]
CHR Extension: (Avast Online Security) - C:\Users\Carsten\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-12-13]
CHR Extension: (Google Wallet) - C:\Users\Carsten\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-12-13]
CHR Extension: (Google Mail) - C:\Users\Carsten\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-12-13]
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChromeSp.crx [2014-12-13]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-12-13]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AllShare Framework DMS; C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\AllShareFrameworkManagerDMS.exe [404360 2013-12-21] (Samsung) [File not signed]
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-12-13] (AVAST Software)
R2 avast! Firewall; C:\Program Files\AVAST Software\Avast\afwServ.exe [104416 2014-12-13] (AVAST Software)
R3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [4012248 2014-12-13] (Avast Software)
S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-29] (Microsoft Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
R2 Samsung Link Service; C:\Program Files\Samsung\Samsung Link\Samsung Link.exe [616288 2014-12-16] (Copyright 2013 SAMSUNG)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-12-13] ()
R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [28184 2014-12-13] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [83280 2014-12-13] (AVAST Software)
R0 aswNdisFlt; C:\Windows\System32\DRIVERS\aswNdisFlt.sys [449936 2014-12-13] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-12-13] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-12-13] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1050432 2014-12-13] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [436624 2014-12-13] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [116728 2014-12-13] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [267632 2014-12-13] ()
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-09-24] (Microsoft Corporation)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [129752 2014-12-20] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2014-11-21] (Malwarebytes Corporation)
R2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [271752 2014-12-13] (Avast Software)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-20 15:40 - 2014-12-20 15:41 - 00010379 _____ () C:\Users\Carsten\Desktop\FRST.txt
2014-12-19 20:53 - 2014-12-19 20:54 - 00000197 _____ () C:\WINDOWS\system32\2014-12-19-19-53-05.028-AvastVBoxSVC.exe-3836.log
2014-12-19 15:48 - 2014-12-19 15:51 - 00000197 _____ () C:\WINDOWS\system32\2014-12-19-14-48-12.071-AvastVBoxSVC.exe-3952.log
2014-12-19 01:19 - 2014-10-30 23:37 - 00129536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\poqexec.exe
2014-12-19 01:19 - 2014-10-30 23:34 - 00146432 _____ (Microsoft Corporation) C:\WINDOWS\system32\poqexec.exe
2014-12-19 00:54 - 2014-12-19 00:54 - 00000000 ____D () C:\Users\Carsten\Samsung Link
2014-12-19 00:48 - 2014-12-19 00:48 - 00000000 ____D () C:\Upload
2014-12-19 00:48 - 2014-12-19 00:48 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung
2014-12-19 00:47 - 2014-12-19 00:47 - 00000000 ____D () C:\Users\Carsten\AppData\Roaming\SAMSUNG
2014-12-19 00:47 - 2014-12-19 00:47 - 00000000 ____D () C:\Users\Carsten\.swt
2014-12-19 00:47 - 2014-12-19 00:47 - 00000000 ____D () C:\ProgramData\SAMSUNG
2014-12-19 00:47 - 2014-12-19 00:47 - 00000000 ____D () C:\Program Files\Samsung
2014-12-19 00:32 - 2014-12-19 00:34 - 00000197 _____ () C:\WINDOWS\system32\2014-12-18-23-32-51.022-AvastVBoxSVC.exe-2880.log
2014-12-18 23:49 - 2014-10-29 01:52 - 15432704 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmp.dll
2014-12-18 23:49 - 2014-10-29 01:45 - 13318144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmp.dll
2014-12-18 23:48 - 2014-10-29 05:00 - 02314952 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d11.dll
2014-12-18 23:48 - 2014-10-29 05:00 - 02229168 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d9.dll
2014-12-18 23:48 - 2014-10-29 04:59 - 03460472 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSService.dll
2014-12-18 23:48 - 2014-10-29 04:59 - 02529856 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml6.dll
2014-12-18 23:48 - 2014-10-29 04:59 - 00014144 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\swenum.sys
2014-12-18 23:48 - 2014-10-29 04:58 - 00014528 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\drmkaud.sys
2014-12-18 23:48 - 2014-10-29 04:57 - 03138720 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMVCORE.DLL
2014-12-18 23:48 - 2014-10-29 04:57 - 03118096 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcMon.exe
2014-12-18 23:48 - 2014-10-29 04:57 - 02745160 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMVDECOD.DLL
2014-12-18 23:48 - 2014-10-29 04:57 - 02501368 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe
2014-12-18 23:48 - 2014-10-29 04:57 - 01286048 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSAudDecMFT.dll
2014-12-18 23:48 - 2014-10-29 04:55 - 02174976 _____ (Microsoft Corporation) C:\WINDOWS\system32\combase.dll
2014-12-18 23:48 - 2014-10-29 04:55 - 01660528 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll
2014-12-18 23:48 - 2014-10-29 04:52 - 02334080 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
2014-12-18 23:48 - 2014-10-29 04:13 - 01901240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml6.dll
2014-12-18 23:48 - 2014-10-29 04:12 - 01907384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d9.dll
2014-12-18 23:48 - 2014-10-29 04:11 - 02689392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMVCORE.DLL
2014-12-18 23:48 - 2014-10-29 04:11 - 02528760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMVDECOD.DLL
2014-12-18 23:48 - 2014-10-29 04:10 - 01564464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\combase.dll
2014-12-18 23:48 - 2014-10-29 04:07 - 02324208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll
2014-12-18 23:48 - 2014-10-29 03:59 - 03109376 _____ (Microsoft Corporation) C:\WINDOWS\system32\ExplorerFrame.dll
2014-12-18 23:48 - 2014-10-29 03:29 - 04483072 _____ (Microsoft Corporation) C:\WINDOWS\system32\UIRibbon.dll
2014-12-18 23:48 - 2014-10-29 03:24 - 04418560 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbgeng.dll
2014-12-18 23:48 - 2014-10-29 03:19 - 03320320 _____ (Microsoft Corporation) C:\WINDOWS\system32\msi.dll
2014-12-18 23:48 - 2014-10-29 03:10 - 02706432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ExplorerFrame.dll
2014-12-18 23:48 - 2014-10-29 02:57 - 02924032 _____ (Microsoft Corporation) C:\WINDOWS\system32\mmcndmgr.dll
2014-12-18 23:48 - 2014-10-29 02:56 - 03754496 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVidCtl.dll
2014-12-18 23:48 - 2014-10-29 02:51 - 00941056 _____ (Microsoft Corporation) C:\WINDOWS\system32\XpsFilt.dll
2014-12-18 23:48 - 2014-10-29 02:45 - 03607040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msi.dll
2014-12-18 23:48 - 2014-10-29 02:45 - 00165888 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpinput.exe
2014-12-18 23:48 - 2014-10-29 02:44 - 02984448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbgeng.dll
2014-12-18 23:48 - 2014-10-29 02:43 - 07075328 _____ (Microsoft Corporation) C:\WINDOWS\system32\glcndFilter.dll
2014-12-18 23:48 - 2014-10-29 02:42 - 01999872 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWrite.dll
2014-12-18 23:48 - 2014-10-29 02:40 - 00360448 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpclip.exe
2014-12-18 23:48 - 2014-10-29 02:39 - 02896384 _____ (Microsoft Corporation) C:\WINDOWS\system32\esent.dll
2014-12-18 23:48 - 2014-10-29 02:38 - 04690432 _____ (Microsoft Corporation) C:\WINDOWS\system32\xpsrchvw.exe
2014-12-18 23:48 - 2014-10-29 02:35 - 04709888 _____ (Microsoft Corporation) C:\WINDOWS\system32\d2d1.dll
2014-12-18 23:48 - 2014-10-29 02:35 - 03256320 _____ (Microsoft Corporation) C:\WINDOWS\system32\Wpc.dll
2014-12-18 23:48 - 2014-10-29 02:34 - 03097088 _____ (Microsoft Corporation) C:\WINDOWS\system32\msftedit.dll
2014-12-18 23:48 - 2014-10-29 02:31 - 02941952 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcWebSync.dll
2014-12-18 23:48 - 2014-10-29 02:28 - 03820544 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcore.dll
2014-12-18 23:48 - 2014-10-29 02:28 - 00048128 _____ (Microsoft Corporation) C:\WINDOWS\system32\atlthunk.dll
2014-12-18 23:48 - 2014-10-29 02:26 - 03561984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UIRibbon.dll
2014-12-18 23:48 - 2014-10-29 02:24 - 02464768 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d10warp.dll
2014-12-18 23:48 - 2014-10-29 02:22 - 03633664 _____ (Microsoft Corporation) C:\WINDOWS\system32\tquery.dll
2014-12-18 23:48 - 2014-10-29 02:16 - 05267968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\glcndFilter.dll
2014-12-18 23:48 - 2014-10-29 02:15 - 02259456 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
2014-12-18 23:48 - 2014-10-29 02:12 - 02749952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tquery.dll
2014-12-18 23:48 - 2014-10-29 02:10 - 02344960 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml3.dll
2014-12-18 23:48 - 2014-10-29 02:08 - 02608640 _____ (Microsoft Corporation) C:\WINDOWS\system32\WsmSvc.dll
2014-12-18 23:48 - 2014-10-29 02:08 - 02542080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\esent.dll
2014-12-18 23:48 - 2014-10-29 02:08 - 02174976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d10warp.dll
2014-12-18 23:48 - 2014-10-29 02:05 - 03273216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpcore.dll
2014-12-18 23:48 - 2014-10-29 02:03 - 04067840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d2d1.dll
2014-12-18 23:48 - 2014-10-29 02:02 - 14354944 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2014-12-18 23:48 - 2014-10-29 02:02 - 02484736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msftedit.dll
2014-12-18 23:48 - 2014-10-29 01:54 - 07784960 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll
2014-12-18 23:48 - 2014-10-29 01:52 - 02554880 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssrch.dll
2014-12-18 23:48 - 2014-10-29 01:52 - 02170368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WsmSvc.dll
2014-12-18 23:48 - 2014-10-29 01:52 - 01275904 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchFolder.dll
2014-12-18 23:48 - 2014-10-29 01:50 - 12749824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2014-12-18 23:48 - 2014-10-29 01:48 - 03056128 _____ (Microsoft Corporation) C:\WINDOWS\system32\xpsservices.dll
2014-12-18 23:48 - 2014-10-29 01:46 - 09530368 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Search.dll
2014-12-18 23:48 - 2014-10-29 01:46 - 01919488 _____ (Microsoft Corporation) C:\WINDOWS\system32\XpsPrint.dll
2014-12-18 23:48 - 2014-10-29 01:43 - 05264384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll
2014-12-18 23:48 - 2014-10-29 01:42 - 01922560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssrch.dll
2014-12-18 23:48 - 2014-10-29 01:38 - 07032320 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll
2014-12-18 23:48 - 2014-10-29 01:37 - 06386176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Search.dll
2014-12-18 23:48 - 2014-10-29 01:37 - 03547648 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll
2014-12-18 23:48 - 2014-10-29 01:33 - 06213632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
2014-12-18 23:48 - 2014-10-15 09:32 - 02025792 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys
2014-12-18 23:48 - 2014-10-07 07:45 - 03307112 _____ (Microsoft Corporation) C:\WINDOWS\system32\msmpeg2vdec.dll
2014-12-18 23:48 - 2014-10-07 04:44 - 02890296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msmpeg2vdec.dll
2014-12-18 23:47 - 2014-10-29 05:10 - 01816008 _____ (Microsoft Corporation) C:\WINDOWS\system32\taskschd.dll
2014-12-18 23:47 - 2014-10-29 05:09 - 01950280 _____ (Microsoft Corporation) C:\WINDOWS\system32\setupapi.dll
2014-12-18 23:47 - 2014-10-29 05:00 - 01540696 _____ (Microsoft Corporation) C:\WINDOWS\system32\user32.dll
2014-12-18 23:47 - 2014-10-29 05:00 - 01385216 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32.dll
2014-12-18 23:47 - 2014-10-29 04:57 - 02450216 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMVENCOD.DLL
2014-12-18 23:47 - 2014-10-29 04:57 - 01576312 _____ (Microsoft Corporation) C:\WINDOWS\system32\propsys.dll
2014-12-18 23:47 - 2014-10-29 04:57 - 01210176 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMADMOD.DLL
2014-12-18 23:47 - 2014-10-29 04:57 - 00723072 _____ (Microsoft Corporation) C:\WINDOWS\system32\SHCore.dll
2014-12-18 23:47 - 2014-10-29 04:57 - 00643064 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinapi.appcore.dll
2014-12-18 23:47 - 2014-10-29 04:55 - 01543768 _____ (Microsoft Corporation) C:\WINDOWS\system32\webservices.dll
2014-12-18 23:47 - 2014-10-29 04:55 - 01133200 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll
2014-12-18 23:47 - 2014-10-29 04:55 - 00789184 _____ (Microsoft Corporation) C:\WINDOWS\system32\oleaut32.dll
2014-12-18 23:47 - 2014-10-29 04:52 - 01518504 _____ (Microsoft Corporation) C:\WINDOWS\system32\winmde.dll
2014-12-18 23:47 - 2014-10-29 04:52 - 01509688 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmpmde.dll
2014-12-18 23:47 - 2014-10-29 04:52 - 01288096 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfnetsrc.dll
2014-12-18 23:47 - 2014-10-29 04:52 - 01165744 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfasfsrcsnk.dll
2014-12-18 23:47 - 2014-10-29 04:52 - 01064720 _____ (Microsoft Corporation) C:\WINDOWS\system32\drmv2clt.dll
2014-12-18 23:47 - 2014-10-29 04:52 - 00988544 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsrcsnk.dll
2014-12-18 23:47 - 2014-10-29 04:52 - 00850656 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfnetcore.dll
2014-12-18 23:47 - 2014-10-29 04:52 - 00821696 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmpeg2srcsnk.dll
2014-12-18 23:47 - 2014-10-29 04:52 - 00734448 _____ (Microsoft Corporation) C:\WINDOWS\system32\evr.dll
2014-12-18 23:47 - 2014-10-29 04:52 - 00634768 _____ (Microsoft Corporation) C:\WINDOWS\system32\mf.dll
2014-12-18 23:47 - 2014-10-29 04:52 - 00580024 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmdrmdev.dll
2014-12-18 23:47 - 2014-10-29 04:51 - 01310912 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcrt4.dll
2014-12-18 23:47 - 2014-10-29 04:18 - 01782912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\setupapi.dll
2014-12-18 23:47 - 2014-10-29 04:18 - 00848568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\taskschd.dll
2014-12-18 23:47 - 2014-10-29 04:18 - 00016504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\psapi.dll
2014-12-18 23:47 - 2014-10-29 04:12 - 01946144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d11.dll
2014-12-18 23:47 - 2014-10-29 04:11 - 02447104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMVENCOD.DLL
2014-12-18 23:47 - 2014-10-29 04:11 - 01037656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMADMOD.DLL
2014-12-18 23:47 - 2014-10-29 04:11 - 01024200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSAudDecMFT.dll
2014-12-18 23:47 - 2014-10-29 04:10 - 02207488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe
2014-12-18 23:47 - 2014-10-29 04:10 - 01287112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\propsys.dll
2014-12-18 23:47 - 2014-10-29 04:10 - 01209624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll
2014-12-18 23:47 - 2014-10-29 04:10 - 01178104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webservices.dll
2014-12-18 23:47 - 2014-10-29 04:10 - 00560392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SHCore.dll
2014-12-18 23:47 - 2014-10-29 04:08 - 00602768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\oleaut32.dll
2014-12-18 23:47 - 2014-10-29 04:07 - 01321192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winmde.dll
2014-12-18 23:47 - 2014-10-29 04:07 - 01115104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfnetsrc.dll
2014-12-18 23:47 - 2014-10-29 04:07 - 00959112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfasfsrcsnk.dll
2014-12-18 23:47 - 2014-10-29 04:07 - 00857384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsrcsnk.dll
2014-12-18 23:47 - 2014-10-29 04:07 - 00705008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmpeg2srcsnk.dll
2014-12-18 23:47 - 2014-10-29 04:07 - 00700328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfnetcore.dll
2014-12-18 23:47 - 2014-10-29 04:07 - 00584120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\evr.dll
2014-12-18 23:47 - 2014-10-29 04:07 - 00551064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mf.dll
2014-12-18 23:47 - 2014-10-29 04:07 - 00482360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmdrmdev.dll
2014-12-18 23:47 - 2014-10-29 04:05 - 00890128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\drmv2clt.dll
2014-12-18 23:47 - 2014-10-29 03:56 - 01164288 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSMPEG2ENC.DLL
2014-12-18 23:47 - 2014-10-29 03:50 - 01192960 _____ (Microsoft Corporation) C:\WINDOWS\system32\uxtheme.dll
2014-12-18 23:47 - 2014-10-29 03:43 - 00685056 _____ (Microsoft Corporation) C:\WINDOWS\system32\riched20.dll
2014-12-18 23:47 - 2014-10-29 03:31 - 00971264 _____ (Microsoft Corporation) C:\WINDOWS\system32\sqlceqp40.dll
2014-12-18 23:47 - 2014-10-29 03:29 - 01246720 _____ (Microsoft Corporation) C:\WINDOWS\system32\ogldrv.dll
2014-12-18 23:47 - 2014-10-29 03:28 - 01502208 _____ (Microsoft Corporation) C:\WINDOWS\system32\xpssvcs.dll
2014-12-18 23:47 - 2014-10-29 03:26 - 00771584 _____ (Microsoft Corporation) C:\WINDOWS\system32\odbc32.dll
2014-12-18 23:47 - 2014-10-29 03:25 - 00785920 _____ (Microsoft Corporation) C:\WINDOWS\system32\blackbox.dll
2014-12-18 23:47 - 2014-10-29 03:17 - 02003456 _____ (Microsoft Corporation) C:\WINDOWS\system32\mmc.exe
2014-12-18 23:47 - 2014-10-29 03:17 - 00537088 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2014-12-18 23:47 - 2014-10-29 03:08 - 01540096 _____ (Microsoft Corporation) C:\WINDOWS\system32\diagperf.dll
2014-12-18 23:47 - 2014-10-29 03:08 - 00670208 _____ (Microsoft Corporation) C:\WINDOWS\system32\qedit.dll
2014-12-18 23:47 - 2014-10-29 03:08 - 00458752 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmdrmnet.dll
2014-12-18 23:47 - 2014-10-29 03:07 - 06692352 _____ (Microsoft Corporation) C:\WINDOWS\system32\mspaint.exe
2014-12-18 23:47 - 2014-10-29 03:04 - 00070144 _____ (Microsoft Corporation) C:\WINDOWS\system32\WavDest.dll
2014-12-18 23:47 - 2014-10-29 03:03 - 00862720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll
2014-12-18 23:47 - 2014-10-29 03:00 - 02162176 _____ (Microsoft Corporation) C:\WINDOWS\system32\SRH.dll
2014-12-18 23:47 - 2014-10-29 02:59 - 00564224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\riched20.dll
2014-12-18 23:47 - 2014-10-29 02:56 - 01526784 _____ (Microsoft Corporation) C:\WINDOWS\system32\pla.dll
2014-12-18 23:47 - 2014-10-29 02:56 - 00603648 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfds.dll
2014-12-18 23:47 - 2014-10-29 02:55 - 01697280 _____ (Microsoft Corporation) C:\WINDOWS\system32\quartz.dll
2014-12-18 23:47 - 2014-10-29 02:53 - 01101824 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdvidcrl.dll
2014-12-18 23:47 - 2014-10-29 02:53 - 01065984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d8.dll
2014-12-18 23:47 - 2014-10-29 02:53 - 00881152 _____ (Microsoft Corporation) C:\WINDOWS\system32\printfilterpipelinesvc.exe
2014-12-18 23:47 - 2014-10-29 02:50 - 01289216 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMNetMgr.dll
2014-12-18 23:47 - 2014-10-29 02:49 - 00742400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sqlceqp40.dll
2014-12-18 23:47 - 2014-10-29 02:48 - 01080832 _____ (Microsoft Corporation) C:\WINDOWS\system32\sbe.dll
2014-12-18 23:47 - 2014-10-29 02:48 - 00780288 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsm.dll
2014-12-18 23:47 - 2014-10-29 02:47 - 02072064 _____ (Microsoft Corporation) C:\WINDOWS\system32\OpcServices.dll
2014-12-18 23:47 - 2014-10-29 02:47 - 01096192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ogldrv.dll
2014-12-18 23:47 - 2014-10-29 02:46 - 01497600 _____ (Microsoft Corporation) C:\WINDOWS\system32\RecoveryDrive.exe
2014-12-18 23:47 - 2014-10-29 02:45 - 00717312 _____ (Microsoft Corporation) C:\WINDOWS\system32\comdlg32.dll
2014-12-18 23:47 - 2014-10-29 02:45 - 00618496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\blackbox.dll
2014-12-18 23:47 - 2014-10-29 02:43 - 01092608 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdosys.dll
2014-12-18 23:47 - 2014-10-29 02:43 - 00933376 _____ (Microsoft Corporation) C:\WINDOWS\system32\qmgr.dll
2014-12-18 23:47 - 2014-10-29 02:42 - 03724800 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinSAT.exe
2014-12-18 23:47 - 2014-10-29 02:42 - 00852480 _____ (Microsoft Corporation) C:\WINDOWS\system32\PurchaseWindowsLicense.dll
2014-12-18 23:47 - 2014-10-29 02:40 - 02067968 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpdshext.dll
2014-12-18 23:47 - 2014-10-29 02:39 - 00898048 _____ (Microsoft Corporation) C:\WINDOWS\system32\CPFilters.dll
2014-12-18 23:47 - 2014-10-29 02:37 - 01563136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mmc.exe
2014-12-18 23:47 - 2014-10-29 02:37 - 01436160 _____ (Microsoft Corporation) C:\WINDOWS\system32\wdc.dll
2014-12-18 23:47 - 2014-10-29 02:34 - 01114624 _____ (Microsoft Corporation) C:\WINDOWS\system32\termsrv.dll
2014-12-18 23:47 - 2014-10-29 02:34 - 01037824 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSWorkspace.dll
2014-12-18 23:47 - 2014-10-29 02:33 - 01056768 _____ (Microsoft Corporation) C:\WINDOWS\system32\WebcamUi.dll
2014-12-18 23:47 - 2014-10-29 02:32 - 01843712 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMPDMC.exe
2014-12-18 23:47 - 2014-10-29 02:32 - 01390080 _____ (Microsoft Corporation) C:\WINDOWS\system32\FntCache.dll
2014-12-18 23:47 - 2014-10-29 02:31 - 01441792 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2014-12-18 23:47 - 2014-10-29 02:30 - 06465536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mspaint.exe
2014-12-18 23:47 - 2014-10-29 02:29 - 00833536 _____ (Microsoft Corporation) C:\WINDOWS\system32\samsrv.dll
2014-12-18 23:47 - 2014-10-29 02:27 - 01200128 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Globalization.dll
2014-12-18 23:47 - 2014-10-29 02:25 - 01812992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SRH.dll
2014-12-18 23:47 - 2014-10-29 02:25 - 01534464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\pla.dll
2014-12-18 23:47 - 2014-10-29 02:24 - 02364928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mmcndmgr.dll
2014-12-18 23:47 - 2014-10-29 02:24 - 01217024 _____ (Microsoft Corporation) C:\WINDOWS\system32\sysmain.dll
2014-12-18 23:47 - 2014-10-29 02:23 - 01500672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\quartz.dll
2014-12-18 23:47 - 2014-10-29 02:22 - 02410496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVidCtl.dll
2014-12-18 23:47 - 2014-10-29 02:21 - 01250816 _____ (Microsoft Corporation) C:\WINDOWS\system32\UIAutomationCore.dll
2014-12-18 23:47 - 2014-10-29 02:20 - 01492480 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbghelp.dll
2014-12-18 23:47 - 2014-10-29 02:19 - 00817664 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcss.dll
2014-12-18 23:47 - 2014-10-29 02:19 - 00713216 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinSync.dll
2014-12-18 23:47 - 2014-10-29 02:18 - 04180480 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_47.dll
2014-12-18 23:47 - 2014-10-29 02:18 - 01753600 _____ (Microsoft Corporation) C:\WINDOWS\system32\GdiPlus.dll
2014-12-18 23:47 - 2014-10-29 02:18 - 01050624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMNetMgr.dll
2014-12-18 23:47 - 2014-10-29 02:17 - 01402368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\OpcServices.dll
2014-12-18 23:47 - 2014-10-29 02:17 - 01360896 _____ (Microsoft Corporation) C:\WINDOWS\system32\gpsvc.dll
2014-12-18 23:47 - 2014-10-29 02:17 - 00829952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sbe.dll
2014-12-18 23:47 - 2014-10-29 02:16 - 01696256 _____ (Microsoft Corporation) C:\WINDOWS\system32\wevtsvc.dll
2014-12-18 23:47 - 2014-10-29 02:14 - 03553280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xpsrchvw.exe
2014-12-18 23:47 - 2014-10-29 02:14 - 00802816 _____ (Microsoft Corporation) C:\WINDOWS\system32\winhttp.dll
2014-12-18 23:47 - 2014-10-29 02:14 - 00737280 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapi.dll
2014-12-18 23:47 - 2014-10-29 02:14 - 00609280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\comdlg32.dll
2014-12-18 23:47 - 2014-10-29 02:12 - 00645120 _____ (Microsoft Corporation) C:\WINDOWS\system32\msTextPrediction.dll
2014-12-18 23:47 - 2014-10-29 02:12 - 00524288 _____ (Microsoft Corporation) C:\WINDOWS\system32\defragsvc.dll
2014-12-18 23:47 - 2014-10-29 02:11 - 01639424 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlidsvc.dll
2014-12-18 23:47 - 2014-10-29 02:11 - 01323008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wdc.dll
2014-12-18 23:47 - 2014-10-29 02:10 - 02469888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Wpc.dll
2014-12-18 23:47 - 2014-10-29 02:10 - 01096704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32.dll
2014-12-18 23:47 - 2014-10-29 02:09 - 01335296 _____ (Microsoft Corporation) C:\WINDOWS\system32\mispace.dll
2014-12-18 23:47 - 2014-10-29 02:09 - 00873984 _____ (Microsoft Corporation) C:\WINDOWS\system32\provcore.dll
2014-12-18 23:47 - 2014-10-29 02:09 - 00658944 _____ (Microsoft Corporation) C:\WINDOWS\system32\duser.dll
2014-12-18 23:47 - 2014-10-29 02:08 - 01822720 _____ (Microsoft Corporation) C:\WINDOWS\system32\dui70.dll
2014-12-18 23:47 - 2014-10-29 02:08 - 01560576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWrite.dll
2014-12-18 23:47 - 2014-10-29 02:08 - 01478144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMPDMC.exe
2014-12-18 23:47 - 2014-10-29 02:08 - 00881664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WebcamUi.dll
2014-12-18 23:47 - 2014-10-29 02:07 - 01396736 _____ (Microsoft Corporation) C:\WINDOWS\system32\SmartcardCredentialProvider.dll
2014-12-18 23:47 - 2014-10-29 02:07 - 01247232 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Web.Http.dll
2014-12-18 23:47 - 2014-10-29 02:07 - 00747008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rpcrt4.dll
2014-12-18 23:47 - 2014-10-29 02:06 - 00747520 _____ (Microsoft Corporation) C:\WINDOWS\system32\StructuredQuery.dll
2014-12-18 23:47 - 2014-10-29 02:04 - 00868352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Globalization.dll
2014-12-18 23:47 - 2014-10-29 02:03 - 02635264 _____ (Microsoft Corporation) C:\WINDOWS\system32\CertEnroll.dll
2014-12-18 23:47 - 2014-10-29 02:03 - 02487296 _____ (Microsoft Corporation) C:\WINDOWS\system32\storagewmi.dll
2014-12-18 23:47 - 2014-10-29 02:03 - 01547264 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlansvc.dll
2014-12-18 23:47 - 2014-10-29 02:03 - 00740352 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.OnlineId.dll
2014-12-18 23:47 - 2014-10-29 02:02 - 00911360 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2014-12-18 23:47 - 2014-10-29 02:01 - 01710592 _____ (Microsoft Corporation) C:\WINDOWS\system32\msdtctm.dll
2014-12-18 23:47 - 2014-10-29 02:01 - 00843776 _____ (Microsoft Corporation) C:\WINDOWS\system32\uDWM.dll
2014-12-18 23:47 - 2014-10-29 02:00 - 01705984 _____ (Microsoft Corporation) C:\WINDOWS\system32\comsvcs.dll
2014-12-18 23:47 - 2014-10-29 01:59 - 01636864 _____ (Microsoft Corporation) C:\WINDOWS\system32\RacEngn.dll
2014-12-18 23:47 - 2014-10-29 01:59 - 01490944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GdiPlus.dll
2014-12-18 23:47 - 2014-10-29 01:59 - 01207296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbghelp.dll
2014-12-18 23:47 - 2014-10-29 01:59 - 01021440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UIAutomationCore.dll
2014-12-18 23:47 - 2014-10-29 01:58 - 03442688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_47.dll
2014-12-18 23:47 - 2014-10-29 01:56 - 01337344 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll
2014-12-18 23:47 - 2014-10-29 01:56 - 01248256 _____ (Microsoft Corporation) C:\WINDOWS\system32\NaturalLanguage6.dll
2014-12-18 23:47 - 2014-10-29 01:56 - 01001984 _____ (Microsoft Corporation) C:\WINDOWS\system32\MsSpellCheckingFacility.dll
2014-12-18 23:47 - 2014-10-29 01:56 - 00653312 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe
2014-12-18 23:47 - 2014-10-29 01:56 - 00631808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winhttp.dll
2014-12-18 23:47 - 2014-10-29 01:55 - 00719360 _____ (Microsoft Corporation) C:\WINDOWS\system32\PortableDeviceApi.dll
2014-12-18 23:47 - 2014-10-29 01:54 - 01945600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll
2014-12-18 23:47 - 2014-10-29 01:53 - 01063424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mispace.dll
2014-12-18 23:47 - 2014-10-29 01:52 - 01461248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dui70.dll
2014-12-18 23:47 - 2014-10-29 01:52 - 01265152 _____ (Microsoft Corporation) C:\WINDOWS\system32\schedsvc.dll
2014-12-18 23:47 - 2014-10-29 01:52 - 00903168 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchIndexer.exe
2014-12-18 23:47 - 2014-10-29 01:52 - 00801792 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinapi.dll
2014-12-18 23:47 - 2014-10-29 01:51 - 01554432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml3.dll
2014-12-18 23:47 - 2014-10-29 01:51 - 00503296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StructuredQuery.dll
2014-12-18 23:47 - 2014-10-29 01:50 - 02317824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CertEnroll.dll
2014-12-18 23:47 - 2014-10-29 01:50 - 01482752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\storagewmi.dll
2014-12-18 23:47 - 2014-10-29 01:50 - 01092096 _____ (Microsoft Corporation) C:\WINDOWS\system32\localspl.dll
2014-12-18 23:47 - 2014-10-29 01:50 - 00863744 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32spl.dll
2014-12-18 23:47 - 2014-10-29 01:48 - 01344000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\comsvcs.dll
2014-12-18 23:47 - 2014-10-29 01:48 - 00949760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\uxtheme.dll
2014-12-18 23:47 - 2014-10-29 01:46 - 01348096 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2014-12-18 23:47 - 2014-10-29 01:46 - 01265152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\RacEngn.dll
2014-12-18 23:47 - 2014-10-29 01:46 - 01015808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll
2014-12-18 23:47 - 2014-10-29 01:45 - 02773504 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll
2014-12-18 23:47 - 2014-10-29 01:45 - 01725952 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Immersive.dll
2014-12-18 23:47 - 2014-10-29 01:45 - 00918016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NaturalLanguage6.dll
2014-12-18 23:47 - 2014-10-29 01:42 - 01221120 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.appcore.dll
2014-12-18 23:47 - 2014-10-29 01:42 - 00841728 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncCore.dll
2014-12-18 23:47 - 2014-10-29 01:41 - 02880000 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpccpl.dll
2014-12-18 23:47 - 2014-10-29 01:41 - 01317376 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Streaming.dll
2014-12-18 23:47 - 2014-10-29 01:41 - 00971776 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSShared.dll
2014-12-18 23:47 - 2014-10-29 01:40 - 02104832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xpsservices.dll
2014-12-18 23:47 - 2014-10-29 01:40 - 00651264 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSync.dll
2014-12-18 23:47 - 2014-10-29 01:39 - 01000448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchFolder.dll
2014-12-18 23:47 - 2014-10-29 01:38 - 01262080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XpsPrint.dll
2014-12-18 23:47 - 2014-10-29 01:37 - 00724480 _____ (Microsoft Corporation) C:\WINDOWS\system32\WWAHost.exe
2014-12-18 23:47 - 2014-10-29 01:36 - 00955392 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.dll
2014-12-18 23:47 - 2014-10-29 01:36 - 00954880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.appcore.dll
2014-12-18 23:47 - 2014-10-29 01:35 - 01668096 _____ (Microsoft Corporation) C:\WINDOWS\system32\workfolderssvc.dll
2014-12-18 23:47 - 2014-10-29 01:35 - 00811008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSShared.dll
2014-12-18 23:47 - 2014-10-29 01:35 - 00772096 _____ (Microsoft Corporation) C:\WINDOWS\system32\MrmIndexer.dll
2014-12-18 23:47 - 2014-10-29 01:35 - 00688128 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll
2014-12-18 23:47 - 2014-10-29 01:35 - 00667648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncCore.dll
2014-12-18 23:47 - 2014-10-29 01:34 - 02459136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll
2014-12-18 23:47 - 2014-10-29 01:34 - 01544192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Immersive.dll
2014-12-18 23:47 - 2014-10-29 01:33 - 01102848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Streaming.dll
2014-12-18 23:47 - 2014-10-29 01:31 - 00626176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WWAHost.exe
2014-12-18 23:47 - 2014-10-13 03:41 - 01114432 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndis.sys
2014-12-18 23:47 - 2014-10-08 23:09 - 00275968 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2014-12-18 23:47 - 2014-07-04 22:29 - 00478528 _____ (Microsoft Corporation) C:\WINDOWS\system32\mcupdate_GenuineIntel.dll
2014-12-18 23:46 - 2014-10-29 05:10 - 00430728 _____ (Microsoft Corporation) C:\WINDOWS\system32\wevtapi.dll
2014-12-18 23:46 - 2014-10-29 05:09 - 01309744 _____ (Microsoft Corporation) C:\WINDOWS\system32\kernel32.dll
2014-12-18 23:46 - 2014-10-29 05:09 - 01239576 _____ (Microsoft Corporation) C:\WINDOWS\system32\Taskmgr.exe
2014-12-18 23:46 - 2014-10-29 05:04 - 00397192 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcryptprimitives.dll
2014-12-18 23:46 - 2014-10-29 05:04 - 00324864 _____ (Microsoft Corporation) C:\WINDOWS\system32\wintrust.dll
2014-12-18 23:46 - 2014-10-29 05:03 - 00435008 _____ (Microsoft Corporation) C:\WINDOWS\system32\msv1_0.dll
2014-12-18 23:46 - 2014-10-29 05:00 - 00740664 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d10level9.dll
2014-12-18 23:46 - 2014-10-29 05:00 - 00544408 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxgi.dll
2014-12-18 23:46 - 2014-10-29 05:00 - 00530992 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll
2014-12-18 23:46 - 2014-10-29 05:00 - 00379568 _____ (Microsoft Corporation) C:\WINDOWS\system32\dcomp.dll
2014-12-18 23:46 - 2014-10-29 04:59 - 00520536 _____ (Microsoft Corporation) C:\WINDOWS\system32\WWanAPI.dll
2014-12-18 23:46 - 2014-10-29 04:59 - 00498496 _____ (Microsoft Corporation) C:\WINDOWS\system32\netcfgx.dll
2014-12-18 23:46 - 2014-10-29 04:57 - 01552704 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2014-12-18 23:46 - 2014-10-29 04:57 - 01150208 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMADMOE.DLL
2014-12-18 23:46 - 2014-10-29 04:57 - 00725672 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmpeffects.dll
2014-12-18 23:46 - 2014-10-29 04:57 - 00662120 _____ (Microsoft Corporation) C:\WINDOWS\system32\DMRServer.exe
2014-12-18 23:46 - 2014-10-29 04:57 - 00557832 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMVSDECD.DLL
2014-12-18 23:46 - 2014-10-29 04:57 - 00389952 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys
2014-12-18 23:46 - 2014-10-29 04:57 - 00295432 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMASF.DLL
2014-12-18 23:46 - 2014-10-29 04:57 - 00256744 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.MediaControl.dll
2014-12-18 23:46 - 2014-10-29 04:55 - 01063432 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinTypes.dll
2014-12-18 23:46 - 2014-10-29 04:55 - 00730824 _____ (Microsoft Corporation) C:\WINDOWS\system32\clbcatq.dll
2014-12-18 23:46 - 2014-10-29 04:55 - 00426120 _____ (Microsoft Corporation) C:\WINDOWS\system32\tsmf.dll
2014-12-18 23:46 - 2014-10-29 04:55 - 00359496 _____ (Microsoft Corporation) C:\WINDOWS\system32\winsta.dll
2014-12-18 23:46 - 2014-10-29 04:55 - 00019264 _____ (Microsoft Corporation) C:\WINDOWS\system32\dllhost.exe
2014-12-18 23:46 - 2014-10-29 04:54 - 00685408 _____ (Microsoft Corporation) C:\WINDOWS\system32\advapi32.dll
2014-12-18 23:46 - 2014-10-29 04:53 - 00411128 _____ (Microsoft Corporation) C:\WINDOWS\system32\services.exe
2014-12-18 23:46 - 2014-10-29 04:52 - 00500016 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll
2014-12-18 23:46 - 2014-10-29 04:52 - 00497936 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsvr.dll
2014-12-18 23:46 - 2014-10-29 04:52 - 00482872 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll
2014-12-18 23:46 - 2014-10-29 04:52 - 00444728 _____ (Microsoft Corporation) C:\WINDOWS\system32\MMDevAPI.dll
2014-12-18 23:46 - 2014-10-29 04:52 - 00405456 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfreadwrite.dll
2014-12-18 23:46 - 2014-10-29 04:52 - 00394120 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll
2014-12-18 23:46 - 2014-10-29 04:52 - 00356936 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFCaptureEngine.dll
2014-12-18 23:46 - 2014-10-29 04:52 - 00311448 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFPlay.dll
2014-12-18 23:46 - 2014-10-29 04:52 - 00272248 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe
2014-12-18 23:46 - 2014-10-29 04:52 - 00020160 _____ (Microsoft Corporation) C:\WINDOWS\system32\CompPkgSup.dll
2014-12-18 23:46 - 2014-10-29 04:51 - 00360992 _____ (Microsoft Corporation) C:\WINDOWS\system32\sechost.dll
2014-12-18 23:46 - 2014-10-29 04:18 - 01103768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Taskmgr.exe
2014-12-18 23:46 - 2014-10-29 04:18 - 00320736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wevtapi.dll
2014-12-18 23:46 - 2014-10-29 04:15 - 00340288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msv1_0.dll
2014-12-18 23:46 - 2014-10-29 04:15 - 00245296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wintrust.dll
2014-12-18 23:46 - 2014-10-29 04:12 - 00616704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d10level9.dll
2014-12-18 23:46 - 2014-10-29 04:12 - 00444656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll
2014-12-18 23:46 - 2014-10-29 04:12 - 00430176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxgi.dll
2014-12-18 23:46 - 2014-10-29 04:12 - 00403776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\netcfgx.dll
2014-12-18 23:46 - 2014-10-29 04:11 - 00914648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMADMOE.DLL
2014-12-18 23:46 - 2014-10-29 04:11 - 00492704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMVSDECD.DLL
2014-12-18 23:46 - 2014-10-29 04:11 - 00488064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmpeffects.dll
2014-12-18 23:46 - 2014-10-29 04:11 - 00463744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MP4SDECD.DLL
2014-12-18 23:46 - 2014-10-29 04:10 - 00569128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\clbcatq.dll
2014-12-18 23:46 - 2014-10-29 04:10 - 00547992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WinTypes.dll
2014-12-18 23:46 - 2014-10-29 04:10 - 00492232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinapi.appcore.dll
2014-12-18 23:46 - 2014-10-29 04:10 - 00367248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tsmf.dll
2014-12-18 23:46 - 2014-10-29 04:07 - 00409040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfreadwrite.dll
2014-12-18 23:46 - 2014-10-29 04:07 - 00399752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsvr.dll
2014-12-18 23:46 - 2014-10-29 04:07 - 00370424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll
2014-12-18 23:46 - 2014-10-29 04:07 - 00344536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AUDIOKSE.dll
2014-12-18 23:46 - 2014-10-29 04:07 - 00331048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MMDevAPI.dll
2014-12-18 23:46 - 2014-10-29 04:07 - 00320256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFCaptureEngine.dll
2014-12-18 23:46 - 2014-10-29 04:06 - 00800008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvcrt.dll
2014-12-18 23:46 - 2014-10-29 04:06 - 00507152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\advapi32.dll
2014-12-18 23:46 - 2014-10-29 03:48 - 00925696 _____ (Microsoft Corporation) C:\WINDOWS\system32\autoconv.exe
2014-12-18 23:46 - 2014-10-29 03:48 - 00636416 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUDFx02000.dll
2014-12-18 23:46 - 2014-10-29 03:45 - 00548864 _____ (Microsoft Corporation) C:\WINDOWS\system32\glmf32.dll
2014-12-18 23:46 - 2014-10-29 03:45 - 00254976 _____ (Microsoft Corporation) C:\WINDOWS\system32\msls31.dll
2014-12-18 23:46 - 2014-10-29 03:44 - 00564224 _____ (Microsoft Corporation) C:\WINDOWS\system32\apphelp.dll
2014-12-18 23:46 - 2014-10-29 03:42 - 01091584 _____ (Microsoft Corporation) C:\WINDOWS\system32\opengl32.dll
2014-12-18 23:46 - 2014-10-29 03:41 - 00360448 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncsi.dll
2014-12-18 23:46 - 2014-10-29 03:40 - 00610816 _____ (Microsoft Corporation) C:\WINDOWS\system32\sxs.dll
2014-12-18 23:46 - 2014-10-29 03:37 - 02329088 _____ (Microsoft Corporation) C:\WINDOWS\system32\NL7Data0404.dll
2014-12-18 23:46 - 2014-10-29 03:36 - 00546304 _____ (Microsoft Corporation) C:\WINDOWS\system32\sqlcese40.dll
2014-12-18 23:46 - 2014-10-29 03:34 - 03438592 _____ (Microsoft Corporation) C:\WINDOWS\system32\NL7Data0804.dll
2014-12-18 23:46 - 2014-10-29 03:33 - 07558144 _____ (Microsoft Corporation) C:\WINDOWS\system32\NL7Data0011.dll
2014-12-18 23:46 - 2014-10-29 03:33 - 00799744 _____ (Microsoft Corporation) C:\WINDOWS\system32\sqlsrv32.dll
2014-12-18 23:46 - 2014-10-29 03:31 - 00590848 _____ (Microsoft Corporation) C:\WINDOWS\system32\wvc.dll
2014-12-18 23:46 - 2014-10-29 03:31 - 00290816 _____ (Microsoft Corporation) C:\WINDOWS\system32\mpg2splt.ax
2014-12-18 23:46 - 2014-10-29 03:30 - 00734208 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSWB70804.dll
2014-12-18 23:46 - 2014-10-29 03:30 - 00734208 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSWB70404.dll
2014-12-18 23:46 - 2014-10-29 03:30 - 00734208 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSWB7001E.dll
2014-12-18 23:46 - 2014-10-29 03:30 - 00734208 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSWB70011.dll
2014-12-18 23:46 - 2014-10-29 03:29 - 00620544 _____ (Microsoft Corporation) C:\WINDOWS\system32\dsound.dll
2014-12-18 23:46 - 2014-10-29 03:28 - 00292864 _____ (Microsoft Corporation) C:\WINDOWS\system32\wisp.dll
2014-12-18 23:46 - 2014-10-29 03:27 - 00899584 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUDFx.dll
2014-12-18 23:46 - 2014-10-29 03:27 - 00208384 _____ (Microsoft Corporation) C:\WINDOWS\system32\XpsRasterService.dll
2014-12-18 23:46 - 2014-10-29 03:26 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\system32\SmartCardSimulator.dll
2014-12-18 23:46 - 2014-10-29 03:26 - 00308736 _____ (Microsoft Corporation) C:\WINDOWS\system32\usbmon.dll
2014-12-18 23:46 - 2014-10-29 03:25 - 00995328 _____ (Microsoft Corporation) C:\WINDOWS\system32\tapi3.dll
2014-12-18 23:46 - 2014-10-29 03:25 - 00563200 _____ (Microsoft Corporation) C:\WINDOWS\system32\sdohlp.dll
2014-12-18 23:46 - 2014-10-29 03:25 - 00289792 _____ (Microsoft Corporation) C:\WINDOWS\system32\ksproxy.ax
2014-12-18 23:46 - 2014-10-29 03:24 - 00290816 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSNP.ax
2014-12-18 23:46 - 2014-10-29 03:23 - 00295424 _____ (Microsoft Corporation) C:\WINDOWS\system32\offfilt.dll
2014-12-18 23:46 - 2014-10-29 03:22 - 00428032 _____ (Microsoft Corporation) C:\WINDOWS\system32\msihnd.dll
2014-12-18 23:46 - 2014-10-29 03:21 - 00478208 _____ (Microsoft Corporation) C:\WINDOWS\system32\iassdo.dll
2014-12-18 23:46 - 2014-10-29 03:21 - 00098816 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepic.dll
2014-12-18 23:46 - 2014-10-29 03:20 - 00397312 _____ (Microsoft Corporation) C:\WINDOWS\system32\upnp.dll
2014-12-18 23:46 - 2014-10-29 03:19 - 09732096 _____ (Microsoft Corporation) C:\WINDOWS\system32\NlsData000a.dll
2014-12-18 23:46 - 2014-10-29 03:18 - 06259712 _____ (Microsoft Corporation) C:\WINDOWS\system32\NlsData0009.dll
2014-12-18 23:46 - 2014-10-29 03:18 - 04616704 _____ (Microsoft Corporation) C:\WINDOWS\system32\NlsData001d.dll
2014-12-18 23:46 - 2014-10-29 03:18 - 02403328 _____ (Microsoft Corporation) C:\WINDOWS\system32\NlsData000c.dll
2014-12-18 23:46 - 2014-10-29 03:18 - 02140672 _____ (Microsoft Corporation) C:\WINDOWS\system32\NlsData0007.dll
2014-12-18 23:46 - 2014-10-29 03:18 - 00784384 _____ (Microsoft Corporation) C:\WINDOWS\system32\lpksetup.exe
2014-12-18 23:46 - 2014-10-29 03:17 - 04621312 _____ (Microsoft Corporation) C:\WINDOWS\system32\NlsData0414.dll
2014-12-18 23:46 - 2014-10-29 03:17 - 04620288 _____ (Microsoft Corporation) C:\WINDOWS\system32\NlsData0816.dll
2014-12-18 23:46 - 2014-10-29 03:17 - 02480128 _____ (Microsoft Corporation) C:\WINDOWS\system32\NlsData000d.dll
2014-12-18 23:46 - 2014-10-29 03:16 - 04621312 _____ (Microsoft Corporation) C:\WINDOWS\system32\NlsData0010.dll
2014-12-18 23:46 - 2014-10-29 03:16 - 04616704 _____ (Microsoft Corporation) C:\WINDOWS\system32\NlsData0416.dll
2014-12-18 23:46 - 2014-10-29 03:16 - 00546816 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.PointOfService.dll
2014-12-18 23:46 - 2014-10-29 03:11 - 01070080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSMPEG2ENC.DLL
2014-12-18 23:46 - 2014-10-29 03:11 - 00547328 _____ (Microsoft Corporation) C:\WINDOWS\system32\imapi2.dll
2014-12-18 23:46 - 2014-10-29 03:11 - 00478720 _____ (Microsoft Corporation) C:\WINDOWS\system32\sysmon.ocx
2014-12-18 23:46 - 2014-10-29 03:11 - 00435712 _____ (Microsoft Corporation) C:\WINDOWS\system32\mswmdm.dll
2014-12-18 23:46 - 2014-10-29 03:10 - 00933376 _____ (Microsoft Corporation) C:\WINDOWS\system32\calc.exe
2014-12-18 23:46 - 2014-10-29 03:10 - 00445440 _____ (Microsoft Corporation) C:\WINDOWS\system32\certcli.dll
2014-12-18 23:46 - 2014-10-29 03:09 - 00632320 _____ (Microsoft Corporation) C:\WINDOWS\system32\psisdecd.dll
2014-12-18 23:46 - 2014-10-29 03:08 - 00920064 _____ (Microsoft Corporation) C:\WINDOWS\system32\azroles.dll
2014-12-18 23:46 - 2014-10-29 03:08 - 00858624 _____ (Microsoft Corporation) C:\WINDOWS\system32\comuid.dll
2014-12-18 23:46 - 2014-10-29 03:08 - 00390656 _____ (Microsoft Corporation) C:\WINDOWS\system32\difxapi.dll
2014-12-18 23:46 - 2014-10-29 03:07 - 00468992 _____ (Microsoft Corporation) C:\WINDOWS\system32\XpsGdiConverter.dll
2014-12-18 23:46 - 2014-10-29 03:06 - 02902016 _____ (Microsoft Corporation) C:\WINDOWS\system32\themeui.dll
2014-12-18 23:46 - 2014-10-29 03:06 - 01313792 _____ (Microsoft Corporation) C:\WINDOWS\system32\vds.exe
2014-12-18 23:46 - 2014-10-29 03:06 - 00980480 _____ (Microsoft Corporation) C:\WINDOWS\system32\imapi2fs.dll
2014-12-18 23:46 - 2014-10-29 03:06 - 00235008 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSAC3ENC.DLL
2014-12-18 23:46 - 2014-10-29 03:05 - 00679424 _____ (Microsoft Corporation) C:\WINDOWS\system32\wiaaut.dll
2014-12-18 23:46 - 2014-10-29 03:03 - 02334720 _____ (Microsoft Corporation) C:\WINDOWS\system32\SyncCenter.dll
2014-12-18 23:46 - 2014-10-29 03:03 - 00832000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\autoconv.exe
2014-12-18 23:46 - 2014-10-29 03:01 - 00453632 _____ (Microsoft Corporation) C:\WINDOWS\system32\azroleui.dll
2014-12-18 23:46 - 2014-10-29 03:01 - 00270336 _____ (Microsoft Corporation) C:\WINDOWS\system32\SensorsApi.dll
2014-12-18 23:46 - 2014-10-29 03:00 - 01861632 _____ (Microsoft Corporation) C:\WINDOWS\system32\Display.dll
2014-12-18 23:46 - 2014-10-29 03:00 - 00652800 _____ (Microsoft Corporation) C:\WINDOWS\system32\FXSCOMEX.dll
2014-12-18 23:46 - 2014-10-29 03:00 - 00642560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\apphelp.dll
2014-12-18 23:46 - 2014-10-29 02:59 - 01106432 _____ (Microsoft Corporation) C:\WINDOWS\system32\gpedit.dll
2014-12-18 23:46 - 2014-10-29 02:59 - 00670720 _____ (Microsoft Corporation) C:\WINDOWS\system32\wiaservc.dll
2014-12-18 23:46 - 2014-10-29 02:59 - 00404480 _____ (Microsoft Corporation) C:\WINDOWS\system32\SyncInfrastructure.dll
2014-12-18 23:46 - 2014-10-29 02:59 - 00280576 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpencom.dll
2014-12-18 23:46 - 2014-10-29 02:58 - 01040384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kernel32.dll
2014-12-18 23:46 - 2014-10-29 02:57 - 02592256 _____ (Microsoft Corporation) C:\WINDOWS\system32\themecpl.dll
2014-12-18 23:46 - 2014-10-29 02:57 - 01479168 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsecedit.dll
2014-12-18 23:46 - 2014-10-29 02:57 - 01038336 _____ (Microsoft Corporation) C:\WINDOWS\system32\aclui.dll
2014-12-18 23:46 - 2014-10-29 02:57 - 00777728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\opengl32.dll
2014-12-18 23:46 - 2014-10-29 02:56 - 00589312 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhotoScreensaver.scr
2014-12-18 23:46 - 2014-10-29 02:56 - 00499200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sxs.dll
2014-12-18 23:46 - 2014-10-29 02:56 - 00367616 _____ (Microsoft Corporation) C:\WINDOWS\system32\WPDSp.dll
2014-12-18 23:46 - 2014-10-29 02:55 - 00669184 _____ (Microsoft Corporation) C:\WINDOWS\system32\hhctrl.ocx
2014-12-18 23:46 - 2014-10-29 02:54 - 00833536 _____ (Microsoft Corporation) C:\WINDOWS\system32\osk.exe
2014-12-18 23:46 - 2014-10-29 02:54 - 00432640 _____ (Microsoft Corporation) C:\WINDOWS\system32\msscp.dll
2014-12-18 23:46 - 2014-10-29 02:54 - 00366080 _____ (Microsoft Corporation) C:\WINDOWS\system32\MDEServer.exe
2014-12-18 23:46 - 2014-10-29 02:54 - 00287744 _____ (Microsoft Corporation) C:\WINDOWS\system32\qasf.dll
2014-12-18 23:46 - 2014-10-29 02:53 - 00468992 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssph.dll
2014-12-18 23:46 - 2014-10-29 02:53 - 00433152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sqlcese40.dll
2014-12-18 23:46 - 2014-10-29 02:52 - 02829312 _____ (Microsoft Corporation) C:\WINDOWS\system32\netshell.dll
2014-12-18 23:46 - 2014-10-29 02:52 - 00809984 _____ (Microsoft Corporation) C:\WINDOWS\system32\fvewiz.dll
2014-12-18 23:46 - 2014-10-29 02:52 - 00680960 _____ (Microsoft Corporation) C:\WINDOWS\system32\objsel.dll
2014-12-18 23:46 - 2014-10-29 02:52 - 00463872 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Usb.dll
2014-12-18 23:46 - 2014-10-29 02:52 - 00391168 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2014-12-18 23:46 - 2014-10-29 02:52 - 00082944 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdvvmtransport.dll
2014-12-18 23:46 - 2014-10-29 02:51 - 07331840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NL7Data0011.dll
2014-12-18 23:46 - 2014-10-29 02:51 - 00477184 _____ (Microsoft Corporation) C:\WINDOWS\system32\puiobj.dll
2014-12-18 23:46 - 2014-10-29 02:50 - 00711680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sqlsrv32.dll
2014-12-18 23:46 - 2014-10-29 02:50 - 00521728 _____ (Microsoft Corporation) C:\WINDOWS\system32\msdri.dll
2014-12-18 23:46 - 2014-10-29 02:49 - 02236416 _____ (Microsoft Corporation) C:\WINDOWS\system32\certmgr.dll

Some content of TEMP:
====================
C:\Users\Carsten\AppData\Local\Temp\i4jdel0.exe
C:\Users\Carsten\AppData\Local\Temp\Quarantine.exe
C:\Users\Carsten\AppData\Local\Temp\sqlite3.dll

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2014-12-13 21:40

==================== End Of Log ============================[/CODE]
--- --- ---

schrauber · 21.12.2014, 08:31

Dann synct das Konto den Mist immer wieder in den Browser. Google KOnto in Chrome verbinden, dann in die EInstellungen sowie erweiterten Einstellungen von Chrome gehen.

Alles von Hand durchsuchen und löschen. Dann mit verbundenem Konto Chrome zurücksetzen.

Wannekakki · 21.12.2014, 18:06

Super, danke das hat funktioniert.

Kann ich noch einen scan durchführen, um zu sehen ob alles weg ist?

17.12.2014, 20:23	#8
schrauber /// the machine /// TB-Ausbilder	Trovi.com entfernen in Windows 8.1 In welchem Browser? Oder in allen? __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

19.12.2014, 22:40	#12
schrauber /// the machine /// TB-Ausbilder	Trovi.com entfernen in Windows 8.1 Verbindest Du Chrome mit einem Google Konto? Frisches FRST log bitte. __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

Trovi.com entfernen in Windows 8.1

Plagegeister aller Art und deren Bekämpfung: Trovi.com entfernen in Windows 8.1