| |
| |||||||
Log-Analyse und Auswertung: Firefox Startseite wird geändert und Avira Echtzeitscan findet laufend etwasWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
25.05.2015, 19:49
| #1 |
| |  Firefox Startseite wird geändert und Avira Echtzeitscan findet laufend etwas Hallo Trojaner-Board Team Seit ein paar Tagen findet der Echtzeitscan von Avira kurz nach dem Neustart verdächtige Dateien. Unter anderem immer wieder eine Datai Namens 5.exe. Ausserdem wird meine Firefox Startseite immer wieder geändert. Ich habe die Anweisungen auf eurer Seite befolgt. Es wurde auch einiges gefunden. Hier die Logfiles: Edit: Nachdem die Scans durchgelaufen waren ist beim Neustarten nichts verdächtiges gewesen... Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 24-05-2015 01
Ran by Pandur (administrator) on BABY on 25-05-2015 19:06:34
Running from C:\Users\Pandur\Downloads
Loaded Profiles: Pandur (Available Profiles: Pandur)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(ESET) C:\Program Files (x86)\ESET\ESET Online Scanner\OnlineScannerApp.exe
() C:\Program Files (x86)\ESET\ESET Online Scanner\OnlineCmdLineScanner.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_188.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_188.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7174728 2013-03-29] (Realtek Semiconductor)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2199840 2014-04-30] (NVIDIA Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [728312 2015-05-05] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [106496 2010-01-22] (NEC Electronics Corporation)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [129272 2015-03-16] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-4083855489-4222839378-707726563-1000\...\Run: [Spybot-S&D Cleaning] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe [4566952 2014-06-24] (Safer-Networking Ltd.)
HKU\S-1-5-21-4083855489-4222839378-707726563-1000\...\MountPoints2: {3de4b6f5-7cc8-11e4-bce8-485b39cad99c} - V:\setup.exe
HKU\S-1-5-21-4083855489-4222839378-707726563-1000\...\MountPoints2: {3de4b6ff-7cc8-11e4-bce8-485b39cad99c} - V:\setup.exe
HKU\S-1-5-21-4083855489-4222839378-707726563-1000\...\MountPoints2: {3de4b704-7cc8-11e4-bce8-485b39cad99c} - W:\setup.exe
HKU\S-1-5-21-4083855489-4222839378-707726563-1000\...\MountPoints2: {3de4b709-7cc8-11e4-bce8-485b39cad99c} - W:\setup.exe
HKU\S-1-5-21-4083855489-4222839378-707726563-1000\...\MountPoints2: {3f9b1343-f6f7-11e4-8ac6-485b39cad99c} - W:\setup.exe
HKU\S-1-5-21-4083855489-4222839378-707726563-1000\...\MountPoints2: {3f9b1350-f6f7-11e4-8ac6-485b39cad99c} - W:\setup.exe
HKU\S-1-5-21-4083855489-4222839378-707726563-1000\...\MountPoints2: {59641cbf-c0ee-11e4-98c2-485b39cad99c} - W:\setup.exe
HKU\S-1-5-21-4083855489-4222839378-707726563-1000\...\MountPoints2: {6f12ebd9-7fb0-11e4-a167-485b39cad99c} - W:\setup.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Ralink Wireless Utility.lnk [2015-05-03]
ShortcutTarget: Ralink Wireless Utility.lnk -> C:\Program Files (x86)\Ralink\Common\RaUI.exe (Ralink Technology, Corp.)
BootExecute: autocheck autochk * sdnclean64.exe
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_45\bin\ssv.dll [2015-04-14] (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-04-14] (Oracle Corporation)
BHO-x32: No Name -> {120A8821-2BEE-4C29-BCDA-62C577781992} -> No File
BHO-x32: ArcPluginIEBHO Class -> {84BFE29A-8139-402a-B2A4-C23AE9E1A75F} -> C:\Program Files (x86)\Perfect World Entertainment\Arc\Plugins\ArcPluginIE.dll [2014-07-02] (Perfect World Entertainment Inc)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.192.1
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
FireFox:
========
FF ProfilePath: C:\Users\Pandur\AppData\Roaming\Mozilla\Firefox\Profiles\1olm1qcv.default-1432326152348
FF Homepage: https://www.google.de/
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_188.dll [2015-05-19] ()
FF Plugin: @esn/npbattlelog,version=2.6.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.6.2\npbattlelogx64.dll [2015-01-13] (EA Digital Illusions CE AB)
FF Plugin: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-04-14] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-04-14] (Oracle Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_188.dll [2015-05-19] ()
FF Plugin-x32: @esn/npbattlelog,version=2.4.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.4.0\npbattlelog.dll No File
FF Plugin-x32: @esn/npbattlelog,version=2.6.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.6.2\npbattlelog.dll [2015-01-13] (EA Digital Illusions CE AB)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2015-02-05] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2015-02-05] (NVIDIA Corporation)
FF Plugin-x32: @perfectworld.com/npArcPlayNowPlugin -> C:\Program Files (x86)\Perfect World Entertainment\Arc\Plugins\npArcPluginFF.dll [2014-07-02] (Perfect World Entertainment Inc)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)
FF Extension: Recorder Toolbar - C:\Program Files (x86)\Mozilla Firefox\extensions\{10743931-94DF-476f-A987-4391233C17A2} [2015-05-18]
StartMenuInternet: FIREFOX.EXE - firefox.exe
Chrome:
=======
CHR Profile: C:\Users\Pandur\AppData\Local\Google\Chrome\User Data\Default
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [827640 2015-05-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [434424 2015-05-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [434424 2015-05-05] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1185584 2015-05-05] (Avira Operations GmbH & Co. KG)
S3 ArcService; C:\Program Files (x86)\Perfect World Entertainment\Arc\ArcService.exe [88400 2014-07-02] (Perfect World Entertainment Inc)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [201008 2015-03-16] (Avira Operations GmbH & Co. KG)
S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [448384 2014-12-06] ()
S3 BRSptSvc; C:\ProgramData\BitRaider\BRSptSvc.exe [477960 2014-07-08] (BitRaider, LLC)
R2 DiagTrack; C:\Windows\system32\diagtrack.dll [1254400 2015-04-27] (Microsoft Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
S2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1618888 2014-04-30] (NVIDIA Corporation)
S2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [21009352 2014-04-30] (NVIDIA Corporation)
S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [1910128 2015-01-27] (Electronic Arts)
S2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [76152 2014-07-10] ()
S2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76152 2015-02-03] ()
S3 RaMediaServer; C:\Program Files (x86)\Ralink\Common\RaMediaServer.exe [1863680 2012-07-06] (Ralink) []
S2 Realtek11nSU; C:\Program Files (x86)\REALTEK\11n USB Wireless LAN Utility\RtlService.exe [36864 2010-04-16] (Realtek) []
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
S3 TunngleService; D:\Program Files (x86)\Tunngle\TnglCtrl.exe [792016 2015-02-09] (Tunngle.net GmbH)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2009-08-04] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [152744 2015-05-05] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132120 2015-05-05] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [44088 2015-03-10] (Avira Operations GmbH & Co. KG)
S3 BRDriver64; C:\ProgramData\BitRaider\BRDriver64.sys [75048 2014-07-08] (BitRaider)
S3 cleanhlp; C:\EEK\bin\cleanhlp64.sys [57024 2015-02-09] (Emsisoft GmbH)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-04-14] (Malwarebytes Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-16] ()
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19744 2014-04-30] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [40392 2014-03-31] (NVIDIA Corporation)
R3 tap0901t; C:\Windows\System32\DRIVERS\tap0901t.sys [31232 2009-09-16] (Tunngle.net)
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
S3 MSICDSetup; \??\E:\CDriver64.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-05-25 19:06 - 2015-05-25 19:06 - 00014211 _____ () C:\Users\Pandur\Downloads\FRST.txt
2015-05-25 19:06 - 2015-05-25 19:06 - 00000000 ____D () C:\FRST
2015-05-25 19:05 - 2015-05-25 19:05 - 02108416 _____ (Farbar) C:\Users\Pandur\Downloads\FRST64.exe
2015-05-25 19:04 - 2015-05-25 19:05 - 00000474 _____ () C:\Users\Pandur\Downloads\defogger_disable.log
2015-05-25 19:04 - 2015-05-25 19:04 - 00050477 _____ () C:\Users\Pandur\Downloads\Defogger.exe
2015-05-25 19:04 - 2015-05-25 19:04 - 00000000 _____ () C:\Users\Pandur\defogger_reenable
2015-05-25 17:27 - 2015-05-25 17:10 - 00005517 _____ () C:\Users\Pandur\Desktop\AdwCleaner[S0].txt
2015-05-25 17:26 - 2015-05-25 17:26 - 00030841 _____ () C:\Users\Pandur\Desktop\mbam.txt
2015-05-25 17:20 - 2015-05-25 17:20 - 00000000 ____D () C:\Program Files (x86)\ESET
2015-05-25 17:19 - 2015-05-25 17:20 - 02347384 _____ (ESET) C:\Users\Pandur\Downloads\esetsmartinstaller_deu.exe
2015-05-25 17:19 - 2015-05-25 17:19 - 00001880 _____ () C:\Users\Pandur\Desktop\sc-cleaner.txt
2015-05-25 17:18 - 2015-05-25 17:19 - 00463688 _____ (Bleeping Computer, LLC) C:\Users\Pandur\Downloads\sc-cleaner.exe
2015-05-25 17:18 - 2015-05-25 17:18 - 00001190 _____ () C:\Users\Pandur\Desktop\JRT.txt
2015-05-25 17:16 - 2015-05-25 17:16 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-BABY-Windows-7-Professional-(64-bit).dat
2015-05-25 17:16 - 2015-05-25 17:16 - 00000000 ____D () C:\RegBackup
2015-05-25 17:15 - 2015-05-25 17:15 - 02945770 _____ (Thisisu) C:\Users\Pandur\Downloads\JRT.exe
2015-05-25 17:10 - 2015-05-25 17:10 - 01471489 _____ () C:\Users\Pandur\AppData\Roaming\5.exe
2015-05-25 17:08 - 2015-05-25 17:10 - 00000000 ____D () C:\AdwCleaner
2015-05-25 17:08 - 2015-05-25 17:08 - 02222592 _____ () C:\Users\Pandur\Downloads\AdwCleaner_4.205.exe
2015-05-25 16:49 - 2015-05-25 16:49 - 04737952 _____ () C:\Users\Pandur\Downloads\ausetup5.3.1.20.exe
2015-05-25 16:49 - 2015-05-25 16:49 - 00001230 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Absolute Uninstaller.lnk
2015-05-25 16:49 - 2015-05-25 16:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glarysoft
2015-05-25 16:49 - 2015-05-25 16:49 - 00000000 ____D () C:\Program Files (x86)\Glarysoft
2015-05-25 16:46 - 2015-05-25 17:26 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-05-25 16:46 - 2015-05-25 16:46 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\Pandur\Downloads\mbam-setup-2.1.6.1022.exe
2015-05-25 16:46 - 2015-05-25 16:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-05-25 16:46 - 2015-05-25 16:46 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-05-25 16:46 - 2015-05-25 16:46 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2015-05-25 16:46 - 2015-04-14 09:37 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-05-25 16:46 - 2015-04-14 09:37 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-05-25 16:46 - 2015-04-14 09:37 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-05-25 16:23 - 2015-05-25 16:23 - 00060965 _____ () C:\Users\Pandur\Downloads\pkeyuibx_v1.5.0.zip
2015-05-25 16:23 - 2015-05-25 16:23 - 00000000 ____D () C:\Users\Pandur\Downloads\pkeyuibx_v1.5.0
2015-05-25 16:22 - 2015-05-25 16:22 - 01196832 _____ () C:\Users\Pandur\Downloads\Windows Product Key Viewer - CHIP-Installer.exe
2015-05-25 16:06 - 2015-05-25 16:06 - 01196832 _____ () C:\Users\Pandur\Downloads\UNetbootin - CHIP-Installer.exe
2015-05-25 15:56 - 2015-05-25 18:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SARDU
2015-05-25 15:55 - 2015-05-25 16:12 - 00000000 ____D () C:\Users\Pandur\Downloads\SARDU_2.0.6.5
2015-05-25 15:54 - 2015-05-25 15:54 - 14021962 _____ () C:\Users\Pandur\Downloads\SARDU_2.0.6.5.zip
2015-05-25 15:54 - 2015-05-25 15:54 - 01196832 _____ () C:\Users\Pandur\Downloads\Sardu - CHIP-Installer.exe
2015-05-24 21:51 - 2015-05-24 21:55 - 674234368 _____ () C:\Users\Pandur\Downloads\bitdefender-rescue-cd.iso
2015-05-24 21:48 - 2015-05-24 21:48 - 00231544 _____ () C:\Users\Pandur\Downloads\Install_JDownloader_2_BETA.exe
2015-05-23 18:36 - 2015-05-23 18:36 - 00000080 _____ () C:\Users\Pandur\AppData\Local剜捯獫慴慇敭屳呇⁁屖湥楴汴浥湥湩潦
2015-05-22 22:27 - 2015-05-24 21:36 - 00000000 ____D () C:\EEK
2015-05-22 22:27 - 2015-05-22 22:27 - 00000743 _____ () C:\Users\Pandur\Desktop\Start Emsisoft Emergency Kit.lnk
2015-05-22 22:25 - 2015-05-22 22:25 - 01196832 _____ () C:\Users\Pandur\Downloads\Emsisoft Emergency Kit - CHIP-Installer.exe
2015-05-22 22:18 - 2015-05-22 22:18 - 00003142 _____ () C:\Windows\System32\Tasks\{5C8F0819-D8F3-47D2-8AF3-8E5BAB226457}
2015-05-22 22:15 - 2015-05-25 17:11 - 00027314 _____ () C:\Windows\PFRO.log
2015-05-21 17:26 - 2015-05-25 17:12 - 00003651 _____ () C:\Windows\setupact.log
2015-05-21 17:26 - 2015-05-21 17:26 - 00000000 _____ () C:\Windows\setuperr.log
2015-05-20 20:50 - 2015-05-20 20:50 - 00178748 _____ () C:\Users\Pandur\Downloads\cc_20150520_205004.reg
2015-05-20 19:43 - 2015-05-20 19:43 - 00000000 __SHD () C:\Users\Pandur\AppData\Local\EmieBrowserModeList
2015-05-20 19:40 - 2015-05-20 19:43 - 00000000 ____D () C:\Program Files (x86)\Opera
2015-05-20 19:40 - 2015-05-20 19:40 - 00000000 ____D () C:\Users\Pandur\AppData\Roaming\Opera Software
2015-05-20 19:40 - 2015-05-20 19:40 - 00000000 ____D () C:\Users\Pandur\AppData\Local\Opera Software
2015-05-20 19:40 - 2009-06-10 23:00 - 00000824 _____ () C:\Windows\system32\Drivers\etc\hp.bak
2015-05-18 19:57 - 2015-05-18 19:57 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-05-13 23:15 - 2015-05-01 15:17 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 23:15 - 2015-05-01 15:16 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 16:37 - 2015-05-05 03:29 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-05-13 16:37 - 2015-05-05 03:12 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-05-13 16:37 - 2015-04-27 21:28 - 05569984 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-05-13 16:37 - 2015-04-27 21:28 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-05-13 16:37 - 2015-04-27 21:28 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-05-13 16:37 - 2015-04-27 21:26 - 01728960 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 01254400 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 01162752 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00113664 _____ (Microsoft Corporation) C:\Windows\system32\sechost.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-05-13 16:37 - 2015-04-27 21:22 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\tracerpt.exe
2015-05-13 16:37 - 2015-04-27 21:22 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-05-13 16:37 - 2015-04-27 21:22 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-05-13 16:37 - 2015-04-27 21:22 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-05-13 16:37 - 2015-04-27 21:22 - 00104448 _____ (Microsoft Corporation) C:\Windows\system32\logman.exe
2015-05-13 16:37 - 2015-04-27 21:22 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\typeperf.exe
2015-05-13 16:37 - 2015-04-27 21:22 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\relog.exe
2015-05-13 16:37 - 2015-04-27 21:22 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-05-13 16:37 - 2015-04-27 21:22 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\diskperf.exe
2015-05-13 16:37 - 2015-04-27 21:21 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-05-13 16:37 - 2015-04-27 21:18 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-05-13 16:37 - 2015-04-27 21:18 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:11 - 03989440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-05-13 16:37 - 2015-04-27 21:11 - 03934144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-05-13 16:37 - 2015-04-27 21:08 - 01310744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-05-13 16:37 - 2015-04-27 21:05 - 00635392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2015-05-13 16:37 - 2015-04-27 21:05 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-05-13 16:37 - 2015-04-27 21:05 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-05-13 16:37 - 2015-04-27 21:05 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-05-13 16:37 - 2015-04-27 21:05 - 00092160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sechost.dll
2015-05-13 16:37 - 2015-04-27 21:05 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-05-13 16:37 - 2015-04-27 21:05 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-05-13 16:37 - 2015-04-27 21:05 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-05-13 16:37 - 2015-04-27 21:05 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-05-13 16:37 - 2015-04-27 21:04 - 00641536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2015-05-13 16:37 - 2015-04-27 21:04 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-05-13 16:37 - 2015-04-27 21:04 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tracerpt.exe
2015-05-13 16:37 - 2015-04-27 21:04 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\logman.exe
2015-05-13 16:37 - 2015-04-27 21:04 - 00040448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\typeperf.exe
2015-05-13 16:37 - 2015-04-27 21:04 - 00037888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\relog.exe
2015-05-13 16:37 - 2015-04-27 21:04 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-05-13 16:37 - 2015-04-27 21:04 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-05-13 16:37 - 2015-04-27 21:03 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-05-13 16:37 - 2015-04-27 21:03 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-05-13 16:37 - 2015-04-27 21:03 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-05-13 16:37 - 2015-04-27 21:03 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-05-13 16:37 - 2015-04-27 21:03 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\diskperf.exe
2015-05-13 16:37 - 2015-04-27 21:03 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-05-13 16:37 - 2015-04-27 21:01 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-05-13 16:37 - 2015-04-27 21:01 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:06 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-05-13 16:37 - 2015-04-27 19:57 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-05-13 16:37 - 2015-04-27 19:57 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-05-13 16:37 - 2015-04-27 19:55 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 19:55 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-05-13 16:37 - 2015-04-22 04:28 - 00389840 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-05-13 16:37 - 2015-04-22 03:48 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-05-13 16:37 - 2015-04-21 19:14 - 24971776 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-05-13 16:37 - 2015-04-21 19:08 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-05-13 16:37 - 2015-04-21 19:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-05-13 16:37 - 2015-04-21 18:51 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-05-13 16:37 - 2015-04-21 18:50 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-05-13 16:37 - 2015-04-21 18:50 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-05-13 16:37 - 2015-04-21 18:50 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-05-13 16:37 - 2015-04-21 18:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-05-13 16:37 - 2015-04-21 18:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-05-13 16:37 - 2015-04-21 18:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-05-13 16:37 - 2015-04-21 18:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-05-13 16:37 - 2015-04-21 18:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-05-13 16:37 - 2015-04-21 18:35 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-05-13 16:37 - 2015-04-21 18:35 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-05-13 16:37 - 2015-04-21 18:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-05-13 16:37 - 2015-04-21 18:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-05-13 16:37 - 2015-04-21 18:31 - 06025728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-05-13 16:37 - 2015-04-21 18:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-05-13 16:37 - 2015-04-21 18:25 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-05-13 16:37 - 2015-04-21 18:24 - 19691008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-05-13 16:37 - 2015-04-21 18:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-05-13 16:37 - 2015-04-21 18:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-05-13 16:37 - 2015-04-21 18:11 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-05-13 16:37 - 2015-04-21 18:11 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-05-13 16:37 - 2015-04-21 18:10 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-05-13 16:37 - 2015-04-21 18:09 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-05-13 16:37 - 2015-04-21 18:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-05-13 16:37 - 2015-04-21 18:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-05-13 16:37 - 2015-04-21 18:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-05-13 16:37 - 2015-04-21 18:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-05-13 16:37 - 2015-04-21 18:04 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-05-13 16:37 - 2015-04-21 18:03 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-05-13 16:37 - 2015-04-21 18:02 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-05-13 16:37 - 2015-04-21 18:00 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-05-13 16:37 - 2015-04-21 17:58 - 00664576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-05-13 16:37 - 2015-04-21 17:58 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-05-13 16:37 - 2015-04-21 17:57 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-05-13 16:37 - 2015-04-21 17:49 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-05-13 16:37 - 2015-04-21 17:49 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-05-13 16:37 - 2015-04-21 17:48 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-05-13 16:37 - 2015-04-21 17:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-05-13 16:37 - 2015-04-21 17:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-05-13 16:37 - 2015-04-21 17:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-05-13 16:37 - 2015-04-21 17:40 - 14401536 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-05-13 16:37 - 2015-04-21 17:39 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-05-13 16:37 - 2015-04-21 17:38 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-05-13 16:37 - 2015-04-21 17:36 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-05-13 16:37 - 2015-04-21 17:31 - 04305920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-05-13 16:37 - 2015-04-21 17:27 - 02352128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-05-13 16:37 - 2015-04-21 17:26 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-05-13 16:37 - 2015-04-21 17:25 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-05-13 16:37 - 2015-04-21 17:24 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-05-13 16:37 - 2015-04-21 17:17 - 12828672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-05-13 16:37 - 2015-04-21 17:15 - 01547264 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-05-13 16:37 - 2015-04-21 17:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-05-13 16:37 - 2015-04-21 17:02 - 01882112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-05-13 16:37 - 2015-04-21 16:58 - 01310208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-05-13 16:37 - 2015-04-21 16:56 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-05-13 16:37 - 2015-04-20 05:17 - 01647104 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-05-13 16:37 - 2015-04-20 05:17 - 01179136 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-05-13 16:37 - 2015-04-20 04:56 - 01250816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2015-05-13 16:37 - 2015-04-20 04:11 - 03204608 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-05-13 16:37 - 2015-04-18 05:10 - 00460800 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-05-13 16:37 - 2015-04-18 04:56 - 00342016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2015-05-13 16:37 - 2015-04-13 05:28 - 00328704 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2015-05-13 16:37 - 2015-04-08 05:29 - 00275456 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2015-05-13 16:37 - 2015-04-08 05:29 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll
2015-05-13 16:37 - 2015-04-08 05:14 - 00216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll
2015-05-13 16:36 - 2015-03-04 06:41 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll
2015-05-13 16:36 - 2015-03-04 06:41 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\aelupsvc.dll
2015-05-13 16:36 - 2015-03-04 06:41 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\sdbinst.exe
2015-05-13 16:36 - 2015-03-04 06:41 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\shimeng.dll
2015-05-13 16:36 - 2015-03-04 06:11 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shimeng.dll
2015-05-13 16:36 - 2015-03-04 06:10 - 00295936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apphelp.dll
2015-05-13 16:36 - 2015-03-04 06:10 - 00020992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sdbinst.exe
2015-05-13 16:36 - 2015-02-18 09:06 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe
2015-05-13 16:36 - 2015-02-18 09:04 - 00142336 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2015-05-13 16:36 - 2015-01-29 05:19 - 02543104 _____ (Microsoft Corporation) C:\Windows\system32\wpdshext.dll
2015-05-13 16:36 - 2015-01-29 05:02 - 02311168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wpdshext.dll
2015-05-08 15:10 - 2015-05-08 15:15 - 00000000 ____D () C:\Users\Pandur\Documents\Project CARS
2015-05-08 15:10 - 2015-05-08 15:10 - 00000000 ____D () C:\Users\Pandur\Documents\wmd_symbol_cache
2015-05-03 13:22 - 2015-05-03 13:24 - 00000000 ____D () C:\ProgramData\Ralink
2015-05-03 13:22 - 2012-05-10 22:01 - 01503744 _____ (The OpenSSL Project, hxxp://www.openssl.org/) C:\Windows\system32\libeay32.dll
2015-05-03 13:22 - 2012-05-10 22:01 - 00308736 _____ (The OpenSSL Project, hxxp://www.openssl.org/) C:\Windows\system32\ssleay32.dll
2015-05-03 13:21 - 2015-05-03 13:21 - 00003486 _____ () C:\Windows\system32\RaCoInst.log
2015-05-03 13:21 - 2015-05-03 13:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ralink Wireless
2015-05-03 13:20 - 2015-05-03 13:20 - 00000000 ____D () C:\Windows\system32\RaLanguages
2015-05-03 13:20 - 2015-05-03 13:20 - 00000000 ____D () C:\ProgramData\Ralink Driver
2015-05-03 13:20 - 2015-05-03 13:20 - 00000000 ____D () C:\Program Files (x86)\Ralink
2015-05-03 13:20 - 2013-09-06 20:43 - 02273072 _____ (Ralink Technology Corp.) C:\Windows\system32\Drivers\netr28ux.sys
2015-05-03 13:20 - 2013-08-27 09:18 - 00331568 _____ (Ralink Technology, Inc.) C:\Windows\system32\RaCoInstx.dll
2015-05-03 13:20 - 2013-08-27 09:18 - 00013973 _____ () C:\Windows\SysWOW64\RaCoInst.dat
2015-05-03 13:20 - 2013-08-27 09:18 - 00013973 _____ () C:\Windows\system32\RaCoInst.dat
2015-05-03 13:20 - 2013-08-23 14:10 - 00080316 _____ () C:\Windows\SysWOW64\Drivers\FW_7610.bin
2015-05-03 13:20 - 2013-08-23 14:10 - 00080316 _____ () C:\Windows\system32\Drivers\FW_7610.bin
2015-05-03 13:20 - 2013-07-03 09:59 - 00046692 _____ () C:\Windows\SysWOW64\Drivers\FW_7601.bin
2015-05-03 13:20 - 2013-07-03 09:59 - 00046692 _____ () C:\Windows\system32\Drivers\FW_7601.bin
2015-05-03 13:20 - 2013-07-03 09:59 - 00008192 _____ () C:\Windows\SysWOW64\Drivers\FW_2870.bin
2015-05-03 13:20 - 2013-07-03 09:59 - 00008192 _____ () C:\Windows\system32\Drivers\FW_2870.bin
2015-05-03 13:20 - 2013-07-03 09:59 - 00004096 _____ () C:\Windows\SysWOW64\Drivers\FW_3573.bin
2015-05-03 13:20 - 2013-07-03 09:59 - 00004096 _____ () C:\Windows\system32\Drivers\FW_3573.bin
2015-05-03 13:20 - 2012-08-01 16:46 - 01115648 _____ (Ralink Technology, Corp.) C:\Windows\SysWOW64\RAIHV.dll
2015-05-03 13:20 - 2012-08-01 16:46 - 01115648 _____ (Ralink Technology, Corp.) C:\Windows\system32\RAIHV.dll
2015-05-03 13:20 - 2012-01-10 11:39 - 00127488 _____ (Ralink Technology, Corp.) C:\Windows\SysWOW64\RAEXTUI.dll
2015-05-03 13:20 - 2012-01-10 11:39 - 00127488 _____ (Ralink Technology, Corp.) C:\Windows\system32\RAEXTUI.dll
2015-05-03 13:20 - 2011-05-04 13:57 - 02403392 _____ (Ralink Technology, Corp.) C:\Windows\system32\RaCertMgr.dll
2015-05-03 13:20 - 2011-05-04 13:56 - 01608768 _____ (Ralink Technology, Corp.) C:\Windows\SysWOW64\RaCertMgr.dll
2015-05-03 13:20 - 2010-06-29 10:35 - 00792416 _____ () C:\Windows\SysWOW64\DiagFunc.dll
2015-05-03 13:20 - 2010-06-29 10:35 - 00792416 _____ () C:\Windows\system32\DiagFunc.dll
2015-05-03 13:20 - 2010-01-27 12:47 - 00000451 _____ () C:\Windows\system32\DiagFunc.ini
2015-05-03 13:20 - 2010-01-27 11:54 - 00000451 _____ () C:\Windows\SysWOW64\DiagFunc.ini
2015-05-03 13:19 - 2015-05-03 13:19 - 38616354 _____ () C:\Users\Pandur\Downloads\RT5X7X_2870_2770_307X_2070_357X_3370_8070_MT7610_MT7610_Driver_Setup_for_Windows.zip
2015-05-03 13:19 - 2015-05-03 13:19 - 00000000 ____D () C:\Users\Pandur\AppData\Roaming\InstallShield
2015-05-03 13:10 - 2015-05-03 13:10 - 00003088 _____ () C:\Windows\System32\Tasks\{541D2B34-DC2A-4F6F-966E-92373DE66718}
2015-04-29 13:02 - 2015-05-20 19:50 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2015-04-29 13:02 - 2015-04-29 13:42 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2015-04-29 13:02 - 2015-04-29 13:02 - 00001351 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2015-04-29 13:02 - 2015-04-29 13:02 - 00001339 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2015-04-29 13:02 - 2015-04-29 13:02 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2015-04-29 13:02 - 2015-04-29 13:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2015-04-29 13:02 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2015-04-29 12:35 - 2015-04-29 12:35 - 01203488 _____ () C:\Users\Pandur\Downloads\SpyBot Search Destroy - CHIP-Installer.exe
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-05-25 19:04 - 2013-10-04 18:18 - 00000000 ____D () C:\Users\Pandur
2015-05-25 19:00 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2015-05-25 18:57 - 2013-11-17 02:38 - 00000000 ____D () C:\Users\Pandur\AppData\Roaming\BitTorrent
2015-05-25 18:55 - 2013-10-04 17:58 - 01845298 _____ () C:\Windows\WindowsUpdate.log
2015-05-25 18:52 - 2009-07-14 06:45 - 00031680 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-05-25 18:52 - 2009-07-14 06:45 - 00031680 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-05-25 18:10 - 2013-10-08 18:10 - 00000316 _____ () C:\Windows\Tasks\MT66 Software Update.job
2015-05-25 17:12 - 2013-10-08 14:39 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-05-25 17:12 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-05-25 17:10 - 2014-01-12 13:39 - 00001039 _____ () C:\Users\Pandur\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-05-25 17:10 - 2013-10-04 18:44 - 00001021 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-05-25 17:10 - 2013-10-04 18:19 - 00000997 _____ () C:\Users\Pandur\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-05-25 17:05 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system
2015-05-25 16:44 - 2013-10-04 18:44 - 00001147 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-05-25 16:17 - 2011-04-12 09:43 - 00699416 _____ () C:\Windows\system32\perfh007.dat
2015-05-25 16:17 - 2011-04-12 09:43 - 00149556 _____ () C:\Windows\system32\perfc007.dat
2015-05-25 16:17 - 2009-07-14 07:13 - 01620612 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-05-23 18:53 - 2013-10-04 19:52 - 00000000 ____D () C:\Users\Pandur\AppData\Roaming\TS3Client
2015-05-23 18:36 - 2014-01-16 20:58 - 00000000 ____D () C:\Program Files (x86)\Steam
2015-05-23 18:27 - 2014-03-03 12:10 - 00000000 ____D () C:\Users\Pandur\AppData\Local\Battle.net
2015-05-20 20:51 - 2015-04-06 23:26 - 00000000 ___SD () C:\Windows\SysWOW64\GWX
2015-05-20 20:51 - 2015-04-06 23:26 - 00000000 ___SD () C:\Windows\system32\GWX
2015-05-20 20:49 - 2013-11-22 16:25 - 00000000 ____D () C:\Users\Pandur\AppData\Roaming\Winamp
2015-05-20 20:49 - 2013-10-08 18:01 - 00000000 ____D () C:\Users\Pandur\AppData\Roaming\Media Player Classic
2015-05-20 20:48 - 2013-10-04 18:54 - 00000000 ____D () C:\Windows\Panther
2015-05-20 20:20 - 2013-10-07 19:38 - 00000000 ____D () C:\Program Files\Diablo III
2015-05-20 18:09 - 2013-10-06 11:22 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-05-19 16:13 - 2014-10-17 15:12 - 00000000 ____D () C:\Users\Pandur\AppData\Local\Adobe
2015-05-19 16:12 - 2013-10-05 22:48 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-05-19 16:12 - 2013-10-05 22:48 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-05-16 18:06 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2015-05-15 10:13 - 2014-03-11 21:34 - 00000000 ____D () C:\Program Files (x86)\Hearthstone
2015-05-15 10:07 - 2009-07-14 06:45 - 00296840 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-05-15 10:05 - 2011-04-12 09:55 - 00000000 ____D () C:\Program Files\Windows Journal
2015-05-15 10:05 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\AdvancedInstallers
2015-05-13 23:22 - 2013-10-04 21:07 - 00000000 ____D () C:\Windows\system32\MRT
2015-05-13 23:18 - 2013-10-04 21:07 - 140425016 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-05-13 16:38 - 2013-10-06 10:50 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-05-11 19:41 - 2014-03-03 12:10 - 00000000 ____D () C:\Program Files (x86)\Battle.net
2015-05-07 19:01 - 2015-01-15 12:13 - 00000000 ____D () C:\Users\Pandur\AppData\Roaming\Factorio
2015-05-07 18:19 - 2015-01-21 17:56 - 00000000 ____D () C:\Program Files\Factorio
2015-05-05 16:36 - 2013-10-04 19:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-05-05 16:35 - 2013-10-04 19:33 - 00152744 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2015-05-05 16:35 - 2013-10-04 19:33 - 00132120 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2015-05-03 13:20 - 2013-10-04 19:07 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-04-29 12:47 - 2014-09-03 19:47 - 00007605 _____ () C:\Users\Pandur\AppData\Local\Resmon.ResmonCfg
2015-04-29 10:21 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
==================== Files in the root of some directories =======
2015-05-25 17:10 - 2015-05-25 17:10 - 1471489 _____ () C:\Users\Pandur\AppData\Roaming\5.exe
2014-09-03 19:47 - 2015-04-29 12:47 - 0007605 _____ () C:\Users\Pandur\AppData\Local\Resmon.ResmonCfg
Some files in TEMP:
====================
C:\Users\Pandur\AppData\Local\Temp\avgnt.exe
C:\Users\Pandur\AppData\Local\Temp\gkey.exe
C:\Users\Pandur\AppData\Local\Temp\handle.exe
C:\Users\Pandur\AppData\Local\Temp\pkeyui.exe
C:\Users\Pandur\AppData\Local\Temp\Quarantine.exe
C:\Users\Pandur\AppData\Local\Temp\sqlite3.dll
C:\Users\Pandur\AppData\Local\Temp\Uninstall.exe
C:\Users\Pandur\AppData\Local\Temp\wabk.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-05-16 17:58
==================== End of log ============================
Code:
ATTFilter
|
|
26.05.2015, 05:54
| #2 |
| /// the machine /// TB-Ausbilder    | Firefox Startseite wird geändert und Avira Echtzeitscan findet laufend etwas hi,
__________________Addition.txt fehlt noch 
__________________ |
|
26.05.2015, 15:21
| #3 |
| | Firefox Startseite wird geändert und Avira Echtzeitscan findet laufend etwas ups. Da is sie
__________________ Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 24-05-2015 01
Ran by Pandur at 2015-05-25 19:07:17
Running from C:\Users\Pandur\Downloads
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-4083855489-4222839378-707726563-500 - Administrator - Disabled)
Gast (S-1-5-21-4083855489-4222839378-707726563-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-4083855489-4222839378-707726563-1003 - Limited - Enabled)
Pandur (S-1-5-21-4083855489-4222839378-707726563-1000 - Administrator - Enabled) => C:\Users\Pandur
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Antivirus (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Antivirus (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Absolute Uninstaller 5.3.1.20 (HKLM-x32\...\Absolute Uninstaller) (Version: 5.3.1.20 - Glarysoft Ltd)
Adobe Flash Player 11 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 11.8.800.175 - Adobe Systems Incorporated)
Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.188 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.11) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.11 - Adobe Systems Incorporated)
Age of Wonders III (HKLM-x32\...\Steam App 226840) (Version: - Triumph Studios)
AION Free-to-Play (HKLM-x32\...\{82E73E8D-E1E7-45A4-A311-6D31492AA913}_is1) (Version: - Gameforge)
Amazon.com Kindle Fire (HKLM\...\Kindle Fire Drivers) (Version: - )
Arc (HKLM-x32\...\{CED8E25B-122A-4E80-B612-7F99B93284B3}) (Version: 1.0.0.9668 - Perfect World Entertainment)
ArcheAge (HKLM-x32\...\Steam App 304030) (Version: - XLGAMES)
Arma 3 (HKLM-x32\...\Steam App 107410) (Version: - Bohemia Interactive)
ASIO4ALL (HKLM-x32\...\ASIO4ALL) (Version: 2.11 Beta2 - Michael Tippach)
ATI Catalyst Install Manager (HKLM\...\{62140B07-129A-2BD0-81D2-2A1A7408ADC8}) (Version: 3.0.762.0 - ATI Technologies, Inc.)
Avira (HKLM-x32\...\{b5675cc4-ab8b-4945-8c1d-4c5479556d6a}) (Version: 1.1.34.19732 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.34.19732 - Avira Operations GmbH & Co. KG) Hidden
Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.10.434 - Avira Operations GmbH & Co. KG)
Banished (HKLM-x32\...\Steam App 242920) (Version: - Shining Rock Software LLC)
Battle.net (HKLM-x32\...\Battle.net) (Version: - Blizzard Entertainment)
Battlefield 4™ (HKLM-x32\...\{ABADE36E-EC37-413B-8179-B432AD3FACE7}) (Version: 1.4.2.23831 - Electronic Arts)
Battlelog Web Plugins (HKLM-x32\...\Battlelog Web Plugins) (Version: 2.6.2 - EA Digital Illusions CE AB)
BitRaider Web Client (HKLM-x32\...\BitRaider Web Client) (Version: 1.1.9.9 - BitRaider, LLC)
CCleaner (HKLM\...\CCleaner) (Version: 4.06 - Piriform)
Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM-x32\...\{51C7AD07-C3F6-4635-8E8A-231306D810FE}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM-x32\...\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.)
Cities in Motion 2 (HKLM-x32\...\Steam App 225420) (Version: - Colossal Order Ltd.)
Cities XL 2012 (HKLM-x32\...\Cities XL 2012) (Version: 1.0.0 - Focus Home Interactive)
Cities: Skylines (HKLM-x32\...\Steam App 255710) (Version: - Colossal Order Ltd.)
CPUID CPU-Z 1.66.1 (HKLM\...\CPUID CPU-Z_is1) (Version: - )
Craft The World (HKLM-x32\...\Steam App 248390) (Version: - Dekovir Entertainment)
Crusader Kings II (HKLM-x32\...\Steam App 203770) (Version: - Paradox Development Studio)
DayZ (HKLM-x32\...\Steam App 221100) (Version: - Bohemia Interactive)
Dead Space (HKLM-x32\...\{025A585C-0C66-413D-80D2-4C05CB699771}) (Version: 1.0.0.222 - Electronic Arts)
DiRT 3 (HKLM-x32\...\Steam App 44320) (Version: - Codemasters Racing Studio)
Don't Starve (HKLM-x32\...\Steam App 219740) (Version: - Klei Entertainment)
Don't Starve Together Beta (HKLM-x32\...\Steam App 322330) (Version: - Klei Entertainment)
Dragon Age™: Inquisition (HKLM-x32\...\{DC4C36DC-4E5B-4262-B0C7-157DF534B969}) (Version: 1.0.0.5 - Electronic Arts)
Emu64 V4.30 (HKLM-x32\...\{FB1EBA58-4829-4AE5-A9C8-7170E7BA7005}) (Version: 4.3.0003 - ALFSOFT)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version: - )
Europa Universalis IV (HKLM-x32\...\Steam App 236850) (Version: - Paradox Development Studio)
EVEREST Home Edition v2.20 (HKLM-x32\...\EVEREST Home Edition_is1) (Version: 2.20 - Lavalys Inc)
Factorio version 0.10.12 (HKLM\...\Factorio_is1) (Version: - )
Fallout: New Vegas (HKLM-x32\...\Steam App 22380) (Version: - Obsidian Entertainment)
FL Studio 11 (HKLM-x32\...\FL Studio 11) (Version: - Image-Line)
FlowStone FL 3.0 (HKLM-x32\...\FlowStone) (Version: - )
FUSSBALL MANAGER 12 (HKLM-x32\...\FUSSBALL MANAGER 12) (Version: 1.0.0.3 - Electronic Arts)
Game Dev Tycoon (HKLM-x32\...\Steam App 239820) (Version: - Greenheart Games)
Gameforge Live 1.9.0 "Legend" (HKLM-x32\...\{9C98989A-3A15-42DA-A3B9-D20331437D67}}_is1) (Version: 1.9.0 - Gameforge)
GPU Boost Driver (HKLM-x32\...\{B8887E02-C910-4498-A7C0-186ABFDCD110}) (Version: 1.01.15 - ASUS)
Grand Theft Auto V (HKLM-x32\...\Steam App 271590) (Version: - Rockstar North)
Hearthstone (HKLM-x32\...\Hearthstone) (Version: - Blizzard Entertainment)
Heroes of the Storm (HKLM-x32\...\Heroes of the Storm) (Version: - Blizzard Entertainment)
How to Survive (HKLM-x32\...\Steam App 250400) (Version: - )
IL Shared Libraries (HKLM-x32\...\IL Shared Libraries) (Version: - Image-Line)
Java 8 Update 45 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418045F0}) (Version: 8.0.450 - Oracle Corporation)
Kerbal Space Program (HKLM-x32\...\Steam App 220200) (Version: - Squad)
K-Lite Codec Pack 10.0.5 Full (HKLM-x32\...\KLiteCodecPack_is1) (Version: 10.0.5 - )
Landmark (HKLM-x32\...\Steam App 297810) (Version: - Sony Online Entertainment)
Landmark Beta (HKU\S-1-5-21-4083855489-4222839378-707726563-1000\...\SOE-Landmark Beta) (Version: - Sony Online Entertainment)
Magicka (HKLM-x32\...\Steam App 42910) (Version: - Arrowhead Game Studios)
Malwarebytes Anti-Malware Version 2.1.6.1022 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)
Max Payne 3 (HKLM-x32\...\Steam App 204100) (Version: - Rockstar Studios)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{42AA4CA8-DCD8-4308-BCAB-0B6D75856A9D}) (Version: 3.5.95.0 - Microsoft Corporation)
Microsoft Games for Windows Marketplace (HKLM-x32\...\{67F42018-F647-4D3C-BE62-F8CB4FE2FCD5}) (Version: 3.5.67.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft XNA Framework Redistributable 3.1 (HKLM-x32\...\{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}) (Version: 3.1.10527.0 - Microsoft Corporation)
Minecraft (HKLM-x32\...\{1C16BCA3-EBC1-49F6-8623-8FBFB9CCC872}) (Version: 1.0.3.0 - Mojang)
Mount & Blade: Warband (HKLM-x32\...\Steam App 48700) (Version: - TaleWorlds Entertainment)
Mozilla Firefox 38.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 38.0.1 (x86 de)) (Version: 38.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSI Afterburner 2.3.0 (HKLM-x32\...\Afterburner) (Version: 2.3.0 - MSI Co., LTD)
MT66 Software Update (HKLM-x32\...\{F2E4F3A5-A8F0-46F4-8E91-E8C1DE1FCFE5}_is1) (Version: - )
MyFreeCodec (HKU\S-1-5-21-4083855489-4222839378-707726563-1000\...\MyFreeCodec) (Version: - )
NEC Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{D7BF9739-8A68-4335-BBEE-37752AD9E86B}) (Version: 1.0.19.0 - NEC Electronics Corporation)
NEC Electronics USB 3.0 Host Controller Driver (x32 Version: 1.0.19.0 - NEC Electronics Corporation) Hidden
NVIDIA 3D Vision Controller-Treiber 337.88 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 337.88 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 347.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 347.52 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.0.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.0.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 347.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 347.52 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.33.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.33.0 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)
OpenAL (HKLM-x32\...\OpenAL) (Version: - )
OpenOffice 4.1.1 (HKLM-x32\...\{ACD0FFF9-6B35-43C1-82DB-9FF6990E8602}) (Version: 4.11.9775 - Apache Software Foundation)
OpenTTD 1.2.1 (HKLM-x32\...\OpenTTD) (Version: 1.2.1 - OpenTTD)
Origin (HKLM-x32\...\Origin) (Version: 9.2.1.4399 - Electronic Arts, Inc.)
Patrician IV: Rise of a Dynasty (HKLM-x32\...\Steam App 57730) (Version: - Gaming Minds Studios)
Patrician IV: Steam Special Edition (HKLM-x32\...\Steam App 57620) (Version: - Gaming Minds Studios)
Pillars of Eternity (HKLM-x32\...\Steam App 291650) (Version: - Obsidian Entertainment)
Planet Explorers (HKLM-x32\...\Steam App 237870) (Version: - Pathea Games)
Port Royale 3 (HKLM-x32\...\Steam App 205610) (Version: - Gaming Minds)
Prison Architect (HKLM-x32\...\Steam App 233450) (Version: - Introversion Software)
Ralink RT2870 Wireless LAN Card (HKLM-x32\...\{28DA7D8B-F9A4-4F18-8AA0-551B1E084D0D}) (Version: 1.5.31.0 - Ralink)
Rapture3D 2.4.8 Game (HKLM-x32\...\{D2FCA41E-AC01-4DCD-B3A7-DC9E32363065}}_is1) (Version: - Blue Ripple Sound)
Realtek Ethernet Controller Driver For Windows 7 (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.17.304.2010 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6873 - Realtek Semiconductor Corp.)
REALTEK Wireless LAN Driver and Utility (HKLM-x32\...\{9C049499-055C-4a0c-A916-1D8CA1FF45EB}) (Version: 1.00.0187 - REALTEK Semiconductor Corp.)
Rockstar Games Social Club (HKLM-x32\...\Rockstar Games Social Club) (Version: 1.1.5.8 - Rockstar Games)
RollerCoaster Tycoon 3 (HKLM-x32\...\{907B4640-266B-4A21-92FB-CD1A86CD0F63}) (Version: 1.00.000 - )
Saints Row IV (HKLM-x32\...\Steam App 206420) (Version: - Deep Silver Volition)
Samsung Kies3 (HKLM-x32\...\InstallShield_{88547073-C566-4895-9005-EBE98EA3F7C7}) (Version: 3.2.14024.11 - Samsung Electronics Co., Ltd.)
Samsung Kies3 (x32 Version: 3.2.14024.11 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.33.0 - SAMSUNG Electronics Co., Ltd.)
Shadowrun Returns (HKLM-x32\...\Steam App 234650) (Version: - Harebrained Schemes)
SHIELD Streaming (Version: 2.1.108 - NVIDIA Corporation) Hidden
Shift 2 Unleashed (HKLM-x32\...\Steam App 47920) (Version: - Slightly Mad Studios)
SimCity 2000 Special Edition (HKLM-x32\...\{59D2C751-F7BE-4E9F-9C8C-1F16013802C7}) (Version: 2.0.0.1 - Electronic Arts)
Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
Starbound (HKLM-x32\...\Steam App 211820) (Version: - )
StarCraft II (HKLM-x32\...\StarCraft II) (Version: - Blizzard Entertainment)
State of Decay (HKLM-x32\...\Steam App 241540) (Version: - Undead Labs)
Steam (HKLM-x32\...\Steam) (Version: - Valve Corporation)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.15 - TeamSpeak Systems GmbH)
The Elder Scrolls V: Skyrim (HKLM-x32\...\Steam App 72850) (Version: - Bethesda Game Studios)
Titanfall™ (HKLM-x32\...\{347EE0C3-0690-48F6-A231-53853C2A80D6}) (Version: 1.0.8.10 - Electronic Arts)
Train Fever (HKLM-x32\...\Steam App 304730) (Version: - Urban Games)
Tropico 5 (HKLM-x32\...\Steam App 245620) (Version: - Haemimont Games)
Tunngle (HKLM-x32\...\Tunngle_is1) (Version: 5.2 - Tunngle.net GmbH)
Visual Studio C++ 10.0 Runtime (HKLM-x32\...\{4412F224-3849-4461-A3E9-DEEF8D252790}) (Version: 10.0.0 - TomTom International B.V.)
Winamp (HKLM-x32\...\Winamp) (Version: 5.66 - Nullsoft, Inc)
WinCDEmu (HKLM-x32\...\WinCDEmu) (Version: 3.6 - Bazis)
Windows Live ID Sign-in Assistant (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation)
Windows-Treiberpaket - Amazon.com (WinUSB) KindleFireUsbDeviceClass (08/20/2012 1.0.0000.00000) (HKLM\...\289137531F7C014BF296EFFBFC7E3748A293FEE9) (Version: 08/20/2012 1.0.0000.00000 - Amazon.com)
XMedia Recode Version 3.1.7.3 (HKLM-x32\...\{DDA3C325-47B2-4730-9672-BF3771C08799}_is1) (Version: 3.1.7.3 - XMedia Recode)
Xvid 1.1.3 final uninstall (HKLM-x32\...\Xvid_is1) (Version: 1.1 - Xvid team (Koepi))
Zak McKracken - Between Time and Space (HKLM-x32\...\Zak McKracken - Between Time and Space) (Version: - )
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== Restore Points =========================
==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {11746373-6E09-460F-A639-BF67FF5DD805} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe [2014-06-24] (Safer-Networking Ltd.)
Task: {18C73D89-1A45-4A72-97B7-85ECF9C2E4FF} - System32\Tasks\MT66 Software Update => C:\Program Files (x86)\Common Files\MT66 Software Update\UpdateClient.exe [2009-11-18] (MedienTeam66)
Task: {1CC390C6-5E19-402D-8707-23B27E2CC4BB} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-05-07] (Microsoft Corporation)
Task: {1F56B889-41E3-42FC-B331-919CFB1D1E94} - System32\Tasks\{5C8F0819-D8F3-47D2-8AF3-8E5BAB226457} => pcalua.exe -a C:\Users\Pandur\AppData\Roaming\oursurfing\UninstallManager.exe -c -ptid=cmi
Task: {2E608CF4-C3CC-4F52-AC1A-81C7A429B823} - System32\Tasks\{541D2B34-DC2A-4F6F-966E-92373DE66718} => pcalua.exe -a E:\Drivers\Windows\Setup.exe -d E:\Drivers\Windows
Task: {458BBD9B-8FA4-40A2-A2A5-0EE29602CF17} - System32\Tasks\ASUS\Gpu Boost Driver => C:\Program Files\ASUS\GPU Boost Driver\GpuBoostServer.exe [2010-03-27] (
ASUSTeK Computer Inc.)
Task: {4F392ADE-6908-4058-8240-0177A87C590B} - System32\Tasks\{2510C488-E874-49EE-B4A1-99464475629E} => pcalua.exe -a "C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\Uninstall.exe"
Task: {5B2A0B5E-CEEC-4B93-9599-93669C8152B5} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe [2014-06-27] (Safer-Networking Ltd.)
Task: {5E7AFD11-BFD4-4AE2-9EF5-BB80688FD3D9} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {655A0992-158F-4190-A4A0-3E03F7249BF4} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe [2014-06-24] (Safer-Networking Ltd.)
Task: {A07A6BE9-2535-4FEF-A93D-992CF78A3EF7} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-05-07] (Microsoft Corporation)
Task: {BD6E3643-D991-49DB-90BF-A525D81E58EE} - System32\Tasks\{10221A91-C42E-41F8-986E-1065A5198CC1} => Firefox.exe hxxp://ui.skype.com/ui/0/5.1.0.104.259/de/abandoninstall?source=lightinstaller&page=tsProblems&LastError=12007&installinfo=google-toolbar:notoffered;ienotdefaultbrowser2,google-chrome:offered-installed;madedefault
Task: {BFB860A9-B4A0-434E-B61A-1423FF113C05} - \ProPCCleaner_Popup No Task File <==== ATTENTION
Task: {DFA4137B-63E0-46C4-ABC4-738EDA7888A8} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-09-19] (Piriform Ltd)
Task: {F42E9670-7A9D-479A-9301-431F1A57D428} - \ProPCCleaner_Start No Task File <==== ATTENTION
Task: {FDEC95FA-DB2F-4D72-9FBD-8F7FF3BB0FA1} - System32\Tasks\{156FC590-52B7-40AF-8E2A-CA22B46F6EC4} => pcalua.exe -a C:\Users\Pandur\Downloads\SID_Player_Winamp_Plugin_HardSID_4U.exe -d C:\Users\Pandur\Downloads
Task: C:\Windows\Tasks\MT66 Software Update.job => C:\Program Files (x86)\Common Files\MT66 Software Update\UpdateClient.exe
==================== Loaded Modules (Whitelisted) ==============
2015-05-25 17:20 - 2014-06-26 07:44 - 00358144 _____ () C:\Program Files (x86)\ESET\ESET Online Scanner\OnlineCmdLineScanner.exe
2013-10-08 14:38 - 2015-02-05 21:07 - 00117576 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2015-04-29 13:02 - 2014-05-13 12:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2015-04-29 13:02 - 2014-05-13 12:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2015-04-29 13:02 - 2014-05-13 12:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2015-04-29 13:02 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2015-04-29 13:02 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2015-05-19 16:12 - 2015-05-19 16:12 - 16867504 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_188.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
==================== Safe Mode (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CleanHlp => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CleanHlp.sys => ""="Driver"
==================== EXE Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
IE trusted site: HKU\S-1-5-21-4083855489-4222839378-707726563-1000\...\clonewarsadventures.com -> clonewarsadventures.com
IE trusted site: HKU\S-1-5-21-4083855489-4222839378-707726563-1000\...\freerealms.com -> freerealms.com
IE trusted site: HKU\S-1-5-21-4083855489-4222839378-707726563-1000\...\soe.com -> soe.com
IE trusted site: HKU\S-1-5-21-4083855489-4222839378-707726563-1000\...\sony.com -> sony.com
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-4083855489-4222839378-707726563-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Pandur\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.192.1
==================== MSCONFIG/TASK MANAGER Error getting ==
(Currently there is no automatic fix for this section.)
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [{DFB3D525-9DFC-4BF7-A3E9-C2DF95723C4C}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
FirewallRules: [{491C9830-DF63-40C1-A5D5-CE42D6AEB844}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
FirewallRules: [{DAD116B1-B1D6-4380-80FE-60837F9C4F52}] => (Allow) C:\Program Files (x86)\REALTEK\11n USB Wireless LAN Utility\RtWLan.exe
FirewallRules: [{88962255-E486-4555-BD15-59D18581BF2B}] => (Allow) C:\Program Files (x86)\REALTEK\11n USB Wireless LAN Utility\RtWLan.exe
FirewallRules: [{8FDB8629-887E-468B-BF93-C61AE0D24885}] => (Allow) LPort=1542
FirewallRules: [{63A201F0-02B6-48C1-9130-B1920654ADFB}] => (Allow) LPort=1542
FirewallRules: [{EB23FCCF-C895-4E8F-90D2-C9D13F765F75}] => (Allow) LPort=53
FirewallRules: [{F7F6CA91-5BE1-4300-80C3-D41F08C08F7A}] => (Allow) LPort=67
FirewallRules: [{095CA025-8482-4C1D-AF3A-16F5DBC95051}] => (Allow) LPort=68
FirewallRules: [{765B0F06-8CEF-4916-B68E-2B3C13EB1164}] => (Allow) LPort=53
FirewallRules: [{5FA40A9F-9349-4E05-AFA3-E0388481C913}] => (Allow) LPort=53
FirewallRules: [{E2E12A96-B2E3-4FF6-A886-68210DF8B173}] => (Allow) C:\Program Files (x86)\REALTEK\11n USB Wireless LAN Utility\Rtldhcp.exe
FirewallRules: [{41C2C60F-3FB5-480F-81B4-13939FA3246B}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [TCP Query User{1183935E-ACAD-4799-933D-941CCE749EA9}C:\program files\diablo iii\diablo iii.exe] => (Block) C:\program files\diablo iii\diablo iii.exe
FirewallRules: [UDP Query User{D4330311-AA17-47C5-B89E-C985F1DC32EF}C:\program files\diablo iii\diablo iii.exe] => (Block) C:\program files\diablo iii\diablo iii.exe
FirewallRules: [{B45B3090-93AC-49BE-A0F0-F0CEA51E7350}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{85F6A769-4A54-4A38-AADD-D8FBF98460F2}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{06246537-75AB-425B-8C63-74851CEACC4B}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{2B27A1EF-86FF-4471-8D37-AC12D5C550EC}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{8345C310-EFDA-4D3F-877F-3B3D189AD2E0}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{4074B2EF-EC17-4018-92B9-D5C1338D4E23}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{6FA6324A-DCEC-40E9-9169-405AD0D6D737}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{21AF1A1D-114A-404E-B35A-2324936436F8}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{88983BEB-4065-4936-8416-B60C6D5D3ED6}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{F4B142BC-02B4-430D-ABEA-BD2E59E0CF43}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{536A8077-BD07-4E0E-938E-86A9BA5AF8BA}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{DA095244-A544-4412-AADF-B7B9752CC77D}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{8D6BF635-AB91-49BF-B9DA-EBD934F434D9}] => (Allow) D:\Program Files (x86)\Winamp\winamp.exe
FirewallRules: [{FF2F5D19-15A2-4D19-A855-B03C2C08796D}] => (Allow) D:\Program Files (x86)\Winamp\winamp.exe
FirewallRules: [{20D0AF36-B09A-4286-A528-AE4DA19C6A9A}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{047D67E3-04D4-47E8-9BF3-D4926E7E0A9F}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{FAC05E27-33C0-445B-9C6B-5960C13EA5EC}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{A3B28EFE-D760-4E35-AA6C-F890A8D7F706}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{1FE7D0CC-2913-43F4-BF71-FB4295AC2FC3}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{F8A85B1F-7716-4BDA-8A0D-80D1FD9B7C6E}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{803C1A34-F86A-4DCD-A66F-227E17EACB84}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{689CDFCE-0DF9-4C12-8DE3-46C643B34072}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{DA65771C-B8E2-4C85-9044-AE2790BB6CBC}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{2B161DC3-4254-4AF3-8ECB-3AEC611B449A}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{EC27B628-62AE-48B1-8B90-C999413EDFE8}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{9AD9CED9-04B5-4500-85EC-A60059491DF8}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{4480FE59-3149-447D-AB71-3D6D2DB0CD3B}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{7BDC2CC9-EC50-4B69-804F-033B20ED2388}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{D2AE1F30-08B4-4BAC-8CB4-BFF9251A6B0F}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Game Dev Tycoon\GameDevTycoon.exe
FirewallRules: [{13A99301-E9CC-4F92-9922-2B80FC008144}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Game Dev Tycoon\GameDevTycoon.exe
FirewallRules: [{498E65D8-41AB-42DB-8A3B-2509222D96A8}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\DayZ\DayZ.exe
FirewallRules: [{82949E9C-F865-408A-9D05-24533DDF4774}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\DayZ\DayZ.exe
FirewallRules: [{54914415-08B5-419D-8AE4-991973BF3438}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Prison Architect\Prison Architect.exe
FirewallRules: [{CB32AABD-E083-448C-A4AC-9AA1E19EFE39}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Prison Architect\Prison Architect.exe
FirewallRules: [{E3021E62-CB9B-4753-8CDB-FE3BEED886EC}] => (Allow) D:\SteamLibrary\SteamApps\common\Skyrim\SkyrimLauncher.exe
FirewallRules: [{14428B33-EA1B-43EC-A493-F4AB5CB416A9}] => (Allow) D:\SteamLibrary\SteamApps\common\Skyrim\SkyrimLauncher.exe
FirewallRules: [{2920120A-CAA5-4BAC-8229-BE3B0195FA27}] => (Allow) C:\Windows\SysWOW64\muzapp.exe
FirewallRules: [{8E1AB508-D20D-4FAC-914E-B052319579C6}] => (Allow) C:\Windows\SysWOW64\muzapp.exe
FirewallRules: [{4B2545B2-C4CE-49F8-8CF7-99971FB0B73B}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{92972706-7CE3-4DFC-AF3D-F3DD31817B77}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{B262CFBC-2BBD-4608-B931-C4BF129CBD79}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{4A7AC3A4-D559-41AF-9F06-5770DB003BDD}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{2D681457-C839-4E34-813A-169D65594DBC}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{0692D8A3-05AC-457D-93B3-58CFA2BF7C53}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{DEA166FA-10A5-4C35-992B-9E0A43AE4156}] => (Allow) D:\SteamLibrary\SteamApps\common\Arma 3\arma3.exe
FirewallRules: [{08EF84BC-814A-488A-91AC-63C7B1A4446D}] => (Allow) D:\SteamLibrary\SteamApps\common\Arma 3\arma3.exe
FirewallRules: [{9B969130-0102-4B09-B23B-55331DA114CE}] => (Allow) D:\SteamLibrary\SteamApps\common\Banished\Application-steam-x64.exe
FirewallRules: [{A61B72A3-B41A-4CC8-8765-A2823D20697B}] => (Allow) D:\SteamLibrary\SteamApps\common\Banished\Application-steam-x64.exe
FirewallRules: [{E651D13E-AF8E-49D7-9287-F580E0599EE2}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\State of Decay\StateOfDecay.exe
FirewallRules: [{04DF19A1-9772-4914-AB22-986857337904}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\State of Decay\StateOfDecay.exe
FirewallRules: [{A9E15E74-DE9F-4081-B2D8-497BC0280793}] => (Allow) D:\SteamLibrary\SteamApps\common\Shadowrun Returns\Shadowrun.exe
FirewallRules: [{DA2D535F-1A0F-4BF3-A885-D5E5981D61AE}] => (Allow) D:\SteamLibrary\SteamApps\common\Shadowrun Returns\Shadowrun.exe
FirewallRules: [{5C5168B0-0239-45E1-A29A-980ECA105891}] => (Allow) C:\Program Files (x86)\Battle.net\Battle.net.exe
FirewallRules: [{67A0CF14-FDBB-491B-9710-724FE37AAFFA}] => (Allow) C:\Program Files (x86)\Battle.net\Battle.net.exe
FirewallRules: [{BB7F594C-48B9-42AA-9D14-BDA2EF112B3E}] => (Allow) C:\Program Files (x86)\StarCraft II\StarCraft II.exe
FirewallRules: [{DBEF6131-5E07-4701-B11B-A842814CC5FC}] => (Allow) C:\Program Files (x86)\StarCraft II\StarCraft II.exe
FirewallRules: [{13B12879-ACE7-46A2-AC00-CBB445EE5016}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.beta.2737\Agent.exe
FirewallRules: [{4A956ADC-A72D-4038-AB58-329BA77B39E7}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.beta.2737\Agent.exe
FirewallRules: [{12C3736E-29D1-48EF-B5DF-6E916BA1CE37}] => (Allow) C:\Program Files (x86)\Hearthstone\Hearthstone.exe
FirewallRules: [{7EFDA36A-C045-4B06-917F-309039124799}] => (Allow) C:\Program Files (x86)\Hearthstone\Hearthstone.exe
FirewallRules: [{709DADAE-35BF-40EA-9913-7C6FF5B9264A}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.beta.2753\Agent.exe
FirewallRules: [{8B0E0434-3D25-465A-9BD2-B220682654DF}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.beta.2753\Agent.exe
FirewallRules: [TCP Query User{38C21479-C717-4002-84B4-3737B3D6A2CB}C:\program files (x86)\starcraft ii\versions\base28667\sc2.exe] => (Allow) C:\program files (x86)\starcraft ii\versions\base28667\sc2.exe
FirewallRules: [UDP Query User{689A4593-E282-475B-8150-463CE1F16132}C:\program files (x86)\starcraft ii\versions\base28667\sc2.exe] => (Allow) C:\program files (x86)\starcraft ii\versions\base28667\sc2.exe
FirewallRules: [{2F4E8F1A-880A-4D03-AD06-27CCF223B239}] => (Allow) D:\SteamLibrary\SteamApps\common\Tropico 5\Tropico5Steam.exe
FirewallRules: [{29FC6536-98C2-4ECC-AB11-65152679EEC4}] => (Allow) D:\SteamLibrary\SteamApps\common\Tropico 5\Tropico5Steam.exe
FirewallRules: [{6A64A07B-CD56-4899-A592-BAADB9D05A22}] => (Allow) D:\SteamLibrary\SteamApps\common\AoW3\AoW3.exe
FirewallRules: [{777E3219-3926-4C40-BC78-DAAF15501435}] => (Allow) D:\SteamLibrary\SteamApps\common\AoW3\AoW3.exe
FirewallRules: [{B40CE88A-6F5B-4EDE-A3DF-3BE6A651FEE3}] => (Allow) D:\SteamLibrary\SteamApps\common\AoW3\AoW3_Debug.exe
FirewallRules: [{E7B0B94C-C38B-4003-AFDA-5401E58F6708}] => (Allow) D:\SteamLibrary\SteamApps\common\AoW3\AoW3_Debug.exe
FirewallRules: [{4FF1BECF-8653-45A9-852F-DE7660350F17}] => (Allow) D:\SteamLibrary\SteamApps\common\Fallout New Vegas\FalloutNVLauncher.exe
FirewallRules: [{BBC98AC4-B5A0-4F21-B522-32ADF24CFB68}] => (Allow) D:\SteamLibrary\SteamApps\common\Fallout New Vegas\FalloutNVLauncher.exe
FirewallRules: [{7A84B3D0-FA76-4062-A903-76894019663F}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\DiRT 3\dirt3.exe
FirewallRules: [{9D14F59C-BA50-443C-BF48-0C3D03C0A6AF}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\DiRT 3\dirt3.exe
FirewallRules: [TCP Query User{2775970E-BDF1-4134-9C60-DCCEF8753537}C:\program files (x86)\steam\steamapps\common\dirt 3\dirt3_game.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\dirt 3\dirt3_game.exe
FirewallRules: [UDP Query User{5FFD2D48-CB76-4982-973B-97BFC6B0986F}C:\program files (x86)\steam\steamapps\common\dirt 3\dirt3_game.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\dirt 3\dirt3_game.exe
FirewallRules: [{D2A68FAE-1E5E-4894-BE13-75C4ED043B23}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Saints Row IV\SaintsRowIV.exe
FirewallRules: [{7676EECB-5E6D-45D0-8D09-15EDF40852B0}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Saints Row IV\SaintsRowIV.exe
FirewallRules: [{9AFC2267-5FF2-4BA6-82C7-2329A86B5D31}] => (Allow) D:\SteamLibrary\SteamApps\common\Europa Universalis IV\eu4.exe
FirewallRules: [{34823720-47D3-461D-85C8-C0CF6A734DE4}] => (Allow) D:\SteamLibrary\SteamApps\common\Europa Universalis IV\eu4.exe
FirewallRules: [TCP Query User{7AA8C7A7-5C13-4BAD-A852-6E80AB234A67}D:\program files (x86)\star trek online\star trek online_de\star trek online\live\gameclient.exe] => (Allow) D:\program files (x86)\star trek online\star trek online_de\star trek online\live\gameclient.exe
FirewallRules: [UDP Query User{4064D91A-BB8C-42C8-A3B5-B5FA6BA7A1E5}D:\program files (x86)\star trek online\star trek online_de\star trek online\live\gameclient.exe] => (Allow) D:\program files (x86)\star trek online\star trek online_de\star trek online\live\gameclient.exe
FirewallRules: [{B4ADBB15-1472-41A6-9DFC-BFC26A3DEA10}] => (Allow) C:\Program Files (x86)\Origin Games\Dead Space\Dead Space.exe
FirewallRules: [{2FF26EC1-49E7-4949-87F1-CD882CBBBD9C}] => (Allow) C:\Program Files (x86)\Origin Games\Dead Space\Dead Space.exe
FirewallRules: [{96F45B1B-5111-46E7-A0A1-DE7D7F793B1B}] => (Allow) D:\SteamLibrary\SteamApps\common\Arma 3\arma3launcher.exe
FirewallRules: [{54FEE5B4-DA6D-4604-8D74-618E8639303A}] => (Allow) D:\SteamLibrary\SteamApps\common\Arma 3\arma3launcher.exe
FirewallRules: [{D13A0D9B-BB1D-43EB-801F-EDF2F753A5BF}] => (Allow) D:\SteamLibrary\SteamApps\common\How to Survive\HowToSurvive.exe
FirewallRules: [{3192F47A-1A7A-451D-B93D-F200706FC40C}] => (Allow) D:\SteamLibrary\SteamApps\common\How to Survive\HowToSurvive.exe
FirewallRules: [{2EC990B5-0010-4A38-A7C8-7553219C3D67}] => (Allow) D:\SteamLibrary\SteamApps\common\How to Survive\Detect.exe
FirewallRules: [{DA40E810-982E-4684-A0F1-C45FF9F82117}] => (Allow) D:\SteamLibrary\SteamApps\common\How to Survive\Detect.exe
FirewallRules: [{B3D3AF2D-C666-499F-9DC5-AEE3CDD1FCD8}] => (Allow) D:\SteamLibrary\SteamApps\common\Kerbal Space Program\KSP.exe
FirewallRules: [{DA73CA4F-75BB-4452-8790-16DEC723DC68}] => (Allow) D:\SteamLibrary\SteamApps\common\Kerbal Space Program\KSP.exe
FirewallRules: [{B1B748B1-C611-43EB-9DB8-7AC52AAC7B51}] => (Allow) D:\SteamLibrary\SteamApps\common\Planet Explorers\PE_Launcher.exe
FirewallRules: [{1D2852BA-30B8-4CA4-A014-0B5FCD8AC2CD}] => (Allow) D:\SteamLibrary\SteamApps\common\Planet Explorers\PE_Launcher.exe
FirewallRules: [TCP Query User{F8EC8723-D513-464A-B75E-834F950D4431}D:\steamlibrary\steamapps\common\planet explorers\pe_client.exe] => (Allow) D:\steamlibrary\steamapps\common\planet explorers\pe_client.exe
FirewallRules: [UDP Query User{333DFE24-C3A5-4CB9-B0BD-1A7884A22566}D:\steamlibrary\steamapps\common\planet explorers\pe_client.exe] => (Allow) D:\steamlibrary\steamapps\common\planet explorers\pe_client.exe
FirewallRules: [{F4D5491F-7833-461C-A13D-88064F1171B3}] => (Allow) D:\SteamLibrary\SteamApps\common\Need For Speed Shift 2\SHIFT2U.exe
FirewallRules: [{DDBC55A1-793F-4D24-8195-064B928C084B}] => (Allow) D:\SteamLibrary\SteamApps\common\Need For Speed Shift 2\SHIFT2U.exe
FirewallRules: [{EF529000-95D7-443D-B2AD-84E2522844D7}] => (Allow) D:\SteamLibrary\SteamApps\common\Landmark\LaunchPad.exe
FirewallRules: [{3C831F34-8ED6-454A-A99D-0273754FE9D2}] => (Allow) D:\SteamLibrary\SteamApps\common\Landmark\LaunchPad.exe
FirewallRules: [TCP Query User{832F8D4B-F9C0-4B07-BC9A-268A29A5C322}D:\steamlibrary\steamapps\common\landmark\landmark64.exe] => (Allow) D:\steamlibrary\steamapps\common\landmark\landmark64.exe
FirewallRules: [UDP Query User{DAA4ADF2-BCA3-4B5E-BC06-02F38649724A}D:\steamlibrary\steamapps\common\landmark\landmark64.exe] => (Allow) D:\steamlibrary\steamapps\common\landmark\landmark64.exe
FirewallRules: [{5B87972B-D417-445B-B43F-0FDCA30A696C}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{1166D7A4-F3DA-41AB-922E-129873063148}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{E2DDDAB8-3A89-435D-A41E-AA7781CEE921}] => (Allow) D:\SteamLibrary\SteamApps\common\Max Payne 3\Max Payne 3\MaxPayne3.exe
FirewallRules: [{14CBAEC3-8FE2-435F-9FCA-A22072FB37A1}] => (Allow) D:\SteamLibrary\SteamApps\common\Max Payne 3\Max Payne 3\MaxPayne3.exe
FirewallRules: [{B724211D-2F5B-4180-8A3B-B7A5D5124678}] => (Allow) D:\SteamLibrary\SteamApps\common\Port Royale 3\PortRoyale3.exe
FirewallRules: [{91D260BB-196F-4E1E-8AFF-61B4D45B4B89}] => (Allow) D:\SteamLibrary\SteamApps\common\Port Royale 3\PortRoyale3.exe
FirewallRules: [{32AB1A1B-5D9C-45E7-9F03-201FCC4237D6}] => (Allow) D:\SteamLibrary\SteamApps\common\Patrician IV\Patrician4.exe
FirewallRules: [{C97D9D97-E18B-40F1-BEF9-BBF17F258B6D}] => (Allow) D:\SteamLibrary\SteamApps\common\Patrician IV\Patrician4.exe
FirewallRules: [{B192C77B-80D9-4937-9EBE-CBC8915125C6}] => (Allow) D:\SteamLibrary\SteamApps\common\Patrician IV\Patrician4_addon.exe
FirewallRules: [{BDF01795-34BF-437E-B19A-93F0B09AF2EA}] => (Allow) D:\SteamLibrary\SteamApps\common\Patrician IV\Patrician4_addon.exe
FirewallRules: [{30DB2244-8846-4E13-B54D-BA4D20B1248B}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Game Dev Tycoon\nw.exe
FirewallRules: [{81F6BBEE-FB14-4126-BB9F-95B60CC08020}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Game Dev Tycoon\nw.exe
FirewallRules: [{BCF18F60-D272-4025-BC3B-6C84E5233A6F}] => (Allow) D:\SteamLibrary\SteamApps\common\MountBlade Warband\mb_warband.exe
FirewallRules: [{0F398E41-6111-434E-B90E-AFDEFEF45BE0}] => (Allow) D:\SteamLibrary\SteamApps\common\MountBlade Warband\mb_warband.exe
FirewallRules: [{519B3D2F-B86E-4060-A7EA-F93FFD32A9D6}] => (Allow) D:\SteamLibrary\SteamApps\common\Cities in Motion 2\CIM2.exe
FirewallRules: [{73A4B9E3-0D42-48E4-B47A-2BE2C1741792}] => (Allow) D:\SteamLibrary\SteamApps\common\Cities in Motion 2\CIM2.exe
FirewallRules: [{C2653BD7-C4C2-48FB-9DD6-0A43FA831EE2}] => (Allow) D:\SteamLibrary\SteamApps\common\Crusader Kings II\CK2game.exe
FirewallRules: [{18E2375A-6E0A-4E25-A3E7-2D379853B034}] => (Allow) D:\SteamLibrary\SteamApps\common\Crusader Kings II\CK2game.exe
FirewallRules: [TCP Query User{110A3BE7-DE53-4AE9-AAEF-36BE15E1D131}D:\far cry 4\bin\farcry4.exe] => (Block) D:\far cry 4\bin\farcry4.exe
FirewallRules: [UDP Query User{8B83DD51-7EC8-40C4-8898-E0B6DF09F3FB}D:\far cry 4\bin\farcry4.exe] => (Block) D:\far cry 4\bin\farcry4.exe
FirewallRules: [TCP Query User{8DA3B258-30EB-4B5E-B6F0-FD3262294D8D}D:\stronghold crusader 2\bin\win32_release\crusader2.exe] => (Block) D:\stronghold crusader 2\bin\win32_release\crusader2.exe
FirewallRules: [UDP Query User{FF88E611-7637-434B-9893-BBFC701B0393}D:\stronghold crusader 2\bin\win32_release\crusader2.exe] => (Block) D:\stronghold crusader 2\bin\win32_release\crusader2.exe
FirewallRules: [{A35DE9D8-1EF4-432E-960F-5081D544F7F8}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\DayZ\DayZ_BE.exe
FirewallRules: [{0F0A021E-BFB6-4225-81E6-953EC7696E43}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\DayZ\DayZ_BE.exe
FirewallRules: [{027E3658-7427-4065-836C-DFADDC3CE1E2}] => (Allow) C:\Program Files (x86)\Origin Games\Battlefield 4\bf4_x86.exe
FirewallRules: [{1BD71287-A1AF-4967-86CF-13E3318114A9}] => (Allow) C:\Program Files (x86)\Origin Games\Battlefield 4\bf4_x86.exe
FirewallRules: [{8F0DDAE4-E9FB-4A4E-91CF-28F327FDCE23}] => (Allow) C:\Program Files (x86)\Origin Games\Battlefield 4\bf4.exe
FirewallRules: [{D258CCFD-95BA-421E-AD3B-C65D1D6107A1}] => (Allow) C:\Program Files (x86)\Origin Games\Battlefield 4\bf4.exe
FirewallRules: [{FFD37600-3D62-464E-9F5F-265B40034640}] => (Allow) C:\Program Files (x86)\Origin Games\SimCity 2000 SE\Game\Game\DOSBox\DOSBox.exe
FirewallRules: [{C4A8F763-3041-4341-9C2D-BE2FAD8AF093}] => (Allow) C:\Program Files (x86)\Origin Games\SimCity 2000 SE\Game\Game\DOSBox\DOSBox.exe
FirewallRules: [{16338C9C-A702-427B-A0DF-FF55FDC77B32}] => (Allow) D:\SteamLibrary\SteamApps\common\CraftTheWorld\CraftWorld.exe
FirewallRules: [{AA096874-C96F-462E-A7CC-2DD25E1557C9}] => (Allow) D:\SteamLibrary\SteamApps\common\CraftTheWorld\CraftWorld.exe
FirewallRules: [{0180BA8B-7722-4542-B3EA-6B06C91F049D}] => (Allow) C:\Program Files (x86)\Origin Games\Titanfall\Titanfall.exe
FirewallRules: [{B2966D1C-1758-4CD0-949E-498320598C0F}] => (Allow) C:\Program Files (x86)\Origin Games\Titanfall\Titanfall.exe
FirewallRules: [{6C6E69FC-2F6B-42E1-B0EE-3B81CB004C73}] => (Allow) D:\SteamLibrary\SteamApps\common\Train Fever\TrainFever.exe
FirewallRules: [{84AEA127-B045-4D93-9C43-0A9CFEDAAC07}] => (Allow) D:\SteamLibrary\SteamApps\common\Train Fever\TrainFever.exe
FirewallRules: [{5FF2D9B1-B8DA-4A59-A859-447F2E4E599A}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{8C7A2B5F-B484-4F04-A657-122B59411FA0}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{C9F1BC45-06DA-4A4F-BD12-8DA01FC0A37F}] => (Allow) C:\Program Files (x86)\Origin Games\Dragon Age Inquisition\DragonAgeInquisition.exe
FirewallRules: [{528D040A-3B1B-484D-B5A7-279D54311206}] => (Allow) C:\Program Files (x86)\Origin Games\Dragon Age Inquisition\DragonAgeInquisition.exe
FirewallRules: [{AF240058-0210-4732-9292-FB64170E18A1}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{7128378F-2952-449D-A948-AB1B7F6018D4}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{592CDCDB-03A4-4475-90CB-970F5FB3E7B0}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [{BFD5CC4D-10B8-4F33-BD3D-1CDFAC046A2D}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [TCP Query User{5A37AAA1-7C16-4A5A-9FB5-066A9DC06806}D:\program files (x86)\dying light\dyinglightgame.exe] => (Block) D:\program files (x86)\dying light\dyinglightgame.exe
FirewallRules: [UDP Query User{CE01A5B6-0B5C-4BD9-99AD-73D6D6AF7207}D:\program files (x86)\dying light\dyinglightgame.exe] => (Block) D:\program files (x86)\dying light\dyinglightgame.exe
FirewallRules: [{3135C5EB-67F8-4E83-AFAC-BDA57A53F477}] => (Allow) D:\SteamLibrary\SteamApps\common\Don't Starve Together Beta\bin\dontstarve_steam.exe
FirewallRules: [{7BAA5846-7013-452B-9C7F-AD53E012A5EC}] => (Allow) D:\SteamLibrary\SteamApps\common\Don't Starve Together Beta\bin\dontstarve_steam.exe
FirewallRules: [{85C40FEB-14D7-4AA9-B133-AC6E5EC0CB55}] => (Allow) D:\SteamLibrary\SteamApps\common\Magicka\Magicka.exe
FirewallRules: [{E72C938F-26AC-4B2B-A681-B04B94983E99}] => (Allow) D:\SteamLibrary\SteamApps\common\Magicka\Magicka.exe
FirewallRules: [{0589F302-F2E4-4DFD-9E2A-AA1F66E76395}] => (Allow) D:\Program Files (x86)\Tunngle\TnglCtrl.exe
FirewallRules: [{CC4CBE70-B12F-4B70-BC69-63EDCB853390}] => (Allow) D:\Program Files (x86)\Tunngle\TnglCtrl.exe
FirewallRules: [{071AFD11-CD72-4BEB-81E0-A9B726C1AC77}] => (Allow) D:\Program Files (x86)\Tunngle\TnglCtrl.exe
FirewallRules: [{87376B0A-98D1-4838-BE4A-A5317C586F6D}] => (Allow) D:\Program Files (x86)\Tunngle\TnglCtrl.exe
FirewallRules: [{743E3B20-B580-48CF-970C-070EA9273C3D}] => (Allow) D:\Program Files (x86)\Tunngle\Tunngle.exe
FirewallRules: [{835088B1-D84D-4C48-BC2C-FA4EED292072}] => (Allow) D:\Program Files (x86)\Tunngle\Tunngle.exe
FirewallRules: [{1E52984A-CF58-4B52-91B8-BB288DDED812}] => (Allow) D:\Program Files (x86)\Tunngle\Tunngle.exe
FirewallRules: [{07B17308-FEF7-4E19-B4EF-2CB08F440A6B}] => (Allow) D:\Program Files (x86)\Tunngle\Tunngle.exe
FirewallRules: [TCP Query User{766784CE-7189-4FE3-BA5B-64126DB64EBE}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{55F14565-96A0-4B35-9E76-4B672F7ED116}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [{B7822945-DFEC-4932-9D78-C967F7C2AC15}] => (Allow) D:\SteamLibrary\SteamApps\common\Cities_Skylines\Cities.exe
FirewallRules: [{3A4F79A8-7E4F-4D94-B134-66FFF9271B4D}] => (Allow) D:\SteamLibrary\SteamApps\common\Cities_Skylines\Cities.exe
FirewallRules: [TCP Query User{FC4FCEF5-F186-44D8-9DC9-1ADA7CE5BDC8}C:\users\pandur\appdata\local\id software\quakelive\quakelive.exe] => (Allow) C:\users\pandur\appdata\local\id software\quakelive\quakelive.exe
FirewallRules: [UDP Query User{400E393B-E388-445C-9507-8053970C4281}C:\users\pandur\appdata\local\id software\quakelive\quakelive.exe] => (Allow) C:\users\pandur\appdata\local\id software\quakelive\quakelive.exe
FirewallRules: [{1F4FB634-F678-4AEA-B79A-A2D3B11E4D1A}] => (Block) C:\users\pandur\appdata\local\id software\quakelive\quakelive.exe
FirewallRules: [{3AE6E682-F84F-45C5-B04D-4538C83C0AD2}] => (Block) C:\users\pandur\appdata\local\id software\quakelive\quakelive.exe
FirewallRules: [{B8BED4CA-8055-403C-A40D-7DD325ED516B}] => (Allow) D:\SteamLibrary\SteamApps\common\ArcheAge\GlyphClient.exe
FirewallRules: [{B3CDE362-3929-4EFC-AD41-AB49DB1F9554}] => (Allow) D:\SteamLibrary\SteamApps\common\ArcheAge\GlyphClient.exe
FirewallRules: [{39C6023A-A68B-4EE8-BF56-ED360A6AF200}] => (Allow) D:\SteamLibrary\SteamApps\common\Pillars of Eternity\PillarsOfEternity.exe
FirewallRules: [{7A7ABAEF-4358-4F67-BEE6-FA45FB41DE77}] => (Allow) D:\SteamLibrary\SteamApps\common\Pillars of Eternity\PillarsOfEternity.exe
FirewallRules: [{DB86C7CB-4708-4EC4-ADEF-A2EED3210560}] => (Allow) D:\SteamLibrary\SteamApps\common\AoW3\AoW3Launcher.exe
FirewallRules: [{405FC4C7-2821-4C59-93F0-10BD5854C574}] => (Allow) D:\SteamLibrary\SteamApps\common\AoW3\AoW3Launcher.exe
FirewallRules: [{2C3DAC8A-0BFF-421D-9E5C-2DA0F0D0F471}] => (Allow) D:\SteamLibrary\SteamApps\common\Grand Theft Auto V\GTAVLauncher.exe
FirewallRules: [{DF1B696A-228D-4ECD-AA4B-E67B8FDE7041}] => (Allow) D:\SteamLibrary\SteamApps\common\Grand Theft Auto V\GTAVLauncher.exe
FirewallRules: [TCP Query User{1A2FBA2C-64E1-496C-865A-57F7B10CDF05}D:\steamlibrary\steamapps\common\grand theft auto v\gta5.exe] => (Allow) D:\steamlibrary\steamapps\common\grand theft auto v\gta5.exe
FirewallRules: [UDP Query User{BDB191F8-5C1D-4B13-B91E-EC84CEC46954}D:\steamlibrary\steamapps\common\grand theft auto v\gta5.exe] => (Allow) D:\steamlibrary\steamapps\common\grand theft auto v\gta5.exe
FirewallRules: [{CC49BDFB-4F37-412A-8350-C83526D3D6AE}] => (Allow) D:\SteamLibrary\SteamApps\common\dont_starve\bin\dontstarve_steam.exe
FirewallRules: [{6535520C-9BC5-4E4D-BDA0-0AA780EA1643}] => (Allow) D:\SteamLibrary\SteamApps\common\dont_starve\bin\dontstarve_steam.exe
FirewallRules: [{A11886C6-675A-4B8D-B45F-9E47F4B6FFB2}] => (Allow) C:\Program Files (x86)\Ralink\Common\RaMediaServer.exe
FirewallRules: [{26B922A7-8BEC-4B54-B652-C8610FC8625E}] => (Allow) C:\Program Files (x86)\Ralink\Common\RaMediaServer.exe
FirewallRules: [{F2369B41-3A5B-41EB-9EB8-C643CC83B0ED}] => (Allow) C:\Program Files (x86)\Ralink\Common\RaUI.exe
FirewallRules: [{0DE89B1A-0D8A-4966-B175-89FFB5AB9E26}] => (Allow) C:\Program Files (x86)\Ralink\Common\RaUI.exe
FirewallRules: [{057FD4DA-E887-4FED-8D75-CC8EAE217A5F}] => (Allow) D:\SteamLibrary\SteamApps\common\Don't Starve Together Beta\bin\dontstarve_steam.exe
FirewallRules: [{42E46DAA-FD34-48FB-AB97-361C8B46B3BA}] => (Allow) D:\SteamLibrary\SteamApps\common\Don't Starve Together Beta\bin\dontstarve_steam.exe
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray access
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D 2 Scanner Service
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D 2 Updater
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D 2 Background update service
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (05/25/2015 06:46:43 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest.
Error: (05/25/2015 05:20:07 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest.
Error: (05/25/2015 05:20:05 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest.
Error: (05/25/2015 05:13:37 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/25/2015 05:06:18 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/25/2015 04:54:47 PM) (Source: MsiInstaller) (EventID: 11723) (User: Baby)
Description: Product: Pro PC Cleaner -- Error 1723. There is a problem with this Windows Installer package. A DLL required for this install to complete could not be run. Contact your support personnel or package vendor. Action Uninst000.CA.dll_fix100, entry: CustomActionFix100, library: C:\Program Files (x86)\Pro PC Cleaner\Uninst000.CA.dll
Error: (05/25/2015 04:52:39 PM) (Source: MsiInstaller) (EventID: 11723) (User: Baby)
Description: Product: Pro PC Cleaner -- Error 1723. There is a problem with this Windows Installer package. A DLL required for this install to complete could not be run. Contact your support personnel or package vendor. Action Uninst000.CA.dll_fix100, entry: CustomActionFix100, library: C:\Program Files (x86)\Pro PC Cleaner\Uninst000.CA.dll
Error: (05/25/2015 04:50:42 PM) (Source: MsiInstaller) (EventID: 11723) (User: Baby)
Description: Product: Pro PC Cleaner -- Error 1723. There is a problem with this Windows Installer package. A DLL required for this install to complete could not be run. Contact your support personnel or package vendor. Action Uninst000.CA.dll_fix100, entry: CustomActionFix100, library: C:\Program Files (x86)\Pro PC Cleaner\Uninst000.CA.dll
Error: (05/25/2015 04:50:09 PM) (Source: MsiInstaller) (EventID: 11723) (User: Baby)
Description: Product: Pro PC Cleaner -- Error 1723. There is a problem with this Windows Installer package. A DLL required for this install to complete could not be run. Contact your support personnel or package vendor. Action Uninst000.CA.dll_fix100, entry: CustomActionFix100, library: C:\Program Files (x86)\Pro PC Cleaner\Uninst000.CA.dll
Error: (05/25/2015 04:40:18 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
System errors:
=============
Error: (05/25/2015 05:18:24 PM) (Source: Service Control Manager) (EventID: 7032) (User: )
Description: Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden des Dienstes "Software Protection" Korrekturmaßnahmen (Neustart des Diensts) durchzuführen, ist fehlgeschlagen. Fehler:
%%1056
Error: (05/25/2015 05:16:24 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Software Protection" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (05/25/2015 05:16:24 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Media Player-Netzwerkfreigabedienst" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (05/25/2015 05:16:23 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Spybot-S&D 2 Security Center Service" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (05/25/2015 05:16:23 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Spybot-S&D 2 Updating Service" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (05/25/2015 05:16:23 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Realtek11nSU" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (05/25/2015 05:16:23 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "RalinkRegistryWriter64" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (05/25/2015 05:16:23 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "RalinkRegistryWriter" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (05/25/2015 05:16:23 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "PnkBstrA" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (05/25/2015 05:16:23 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "NVIDIA Streamer Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Microsoft Office:
=========================
Error: (05/25/2015 06:46:43 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifestC:\Users\Pandur\Downloads\esetsmartinstaller_deu.exe
Error: (05/25/2015 05:20:07 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifestC:\Users\Pandur\Downloads\esetsmartinstaller_deu.exe
Error: (05/25/2015 05:20:05 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifestC:\Users\Pandur\Downloads\esetsmartinstaller_deu.exe
Error: (05/25/2015 05:13:37 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/25/2015 05:06:18 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/25/2015 04:54:47 PM) (Source: MsiInstaller) (EventID: 11723) (User: Baby)
Description: Product: Pro PC Cleaner -- Error 1723. There is a problem with this Windows Installer package. A DLL required for this install to complete could not be run. Contact your support personnel or package vendor. Action Uninst000.CA.dll_fix100, entry: CustomActionFix100, library: C:\Program Files (x86)\Pro PC Cleaner\Uninst000.CA.dll (NULL)(NULL)(NULL)(NULL)(NULL)
Error: (05/25/2015 04:52:39 PM) (Source: MsiInstaller) (EventID: 11723) (User: Baby)
Description: Product: Pro PC Cleaner -- Error 1723. There is a problem with this Windows Installer package. A DLL required for this install to complete could not be run. Contact your support personnel or package vendor. Action Uninst000.CA.dll_fix100, entry: CustomActionFix100, library: C:\Program Files (x86)\Pro PC Cleaner\Uninst000.CA.dll (NULL)(NULL)(NULL)(NULL)(NULL)
Error: (05/25/2015 04:50:42 PM) (Source: MsiInstaller) (EventID: 11723) (User: Baby)
Description: Product: Pro PC Cleaner -- Error 1723. There is a problem with this Windows Installer package. A DLL required for this install to complete could not be run. Contact your support personnel or package vendor. Action Uninst000.CA.dll_fix100, entry: CustomActionFix100, library: C:\Program Files (x86)\Pro PC Cleaner\Uninst000.CA.dll (NULL)(NULL)(NULL)(NULL)(NULL)
Error: (05/25/2015 04:50:09 PM) (Source: MsiInstaller) (EventID: 11723) (User: Baby)
Description: Product: Pro PC Cleaner -- Error 1723. There is a problem with this Windows Installer package. A DLL required for this install to complete could not be run. Contact your support personnel or package vendor. Action Uninst000.CA.dll_fix100, entry: CustomActionFix100, library: C:\Program Files (x86)\Pro PC Cleaner\Uninst000.CA.dll (NULL)(NULL)(NULL)(NULL)(NULL)
Error: (05/25/2015 04:40:18 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
CodeIntegrity Errors:
===================================
Date: 2013-10-07 15:27:20.348
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Users\Pandur\AppData\Local\Temp\EverestDriver.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-10-07 15:27:20.318
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Users\Pandur\AppData\Local\Temp\EverestDriver.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-10-07 15:27:19.958
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Lavalys\EVEREST Home Edition\kerneld.amd64" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-10-07 15:27:19.928
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Lavalys\EVEREST Home Edition\kerneld.amd64" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
==================== Memory info ===========================
Processor: AMD Phenom(tm) II X4 955 Processor
Percentage of memory in use: 20%
Total physical RAM: 12287.18 MB
Available physical RAM: 9823.68 MB
Total Pagefile: 24572.56 MB
Available Pagefile: 21834.37 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:931.41 GB) (Free:316.84 GB) NTFS
Drive d: (Volume) (Fixed) (Total:931.51 GB) (Free:639.32 GB) NTFS
Drive k: (BIG ONE) (Fixed) (Total:1397.26 GB) (Free:688.29 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: E680E680)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=931.4 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: D2C69E5F)
Partition 1: (Not Active) - (Size=931.5 GB) - (Type=07 NTFS)
========================================================
Disk: 6 (Size: 1397.3 GB) (Disk ID: 554E975A)
Partition 1: (Not Active) - (Size=1397.3 GB) - (Type=07 NTFS)
==================== End of log ============================
|
|
27.05.2015, 06:56
| #4 |
| /// the machine /// TB-Ausbilder | Firefox Startseite wird geändert und Avira Echtzeitscan findet laufend etwas hi, Scan mit Combofix
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
27.05.2015, 19:05
| #5 |
| | Firefox Startseite wird geändert und Avira Echtzeitscan findet laufend etwas Hallo Schrauber Hier der Log: Code:
ATTFilter ComboFix 15-05-25.01 - Pandur 27.05.2015 19:50:36.1.4 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1252.49.1031.18.12287.8876 [GMT 2:00]
ausgeführt von:: c:\users\Pandur\Desktop\ComboFix.exe
AV: Avira Antivirus *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
SP: Avira Antivirus *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\Install.exe
c:\users\Pandur\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
c:\users\Pandur\AppData\Roaming\5.exe
c:\windows\SysWow64\drivers\hwinterface.sys
c:\windows\wininit.ini
.
.
((((((((((((((((((((((( Dateien erstellt von 2015-04-27 bis 2015-05-27 ))))))))))))))))))))))))))))))
.
.
2015-05-27 17:56 . 2015-05-27 17:56 -------- d-----w- c:\users\Default\AppData\Local\temp
2015-05-26 17:29 . 2015-05-26 17:29 -------- d-----w- c:\program files (x86)\Microsoft ASP.NET
2015-05-25 18:58 . 2015-05-12 02:34 571024 ----a-w- c:\windows\SysWow64\nvStreaming.exe
2015-05-25 18:55 . 2015-05-08 00:35 1316184 ----a-w- c:\windows\SysWow64\nvspbridge.dll
2015-05-25 18:55 . 2015-05-08 00:34 1756424 ----a-w- c:\windows\system32\nvspbridge64.dll
2015-05-25 18:55 . 2014-11-22 10:46 38032 ----a-w- c:\windows\system32\drivers\nvvad64v.sys
2015-05-25 18:55 . 2014-11-22 10:46 32400 ----a-w- c:\windows\SysWow64\nvaudcap32v.dll
2015-05-25 17:06 . 2015-05-25 17:07 -------- d-----w- C:\FRST
2015-05-25 15:20 . 2015-05-25 15:20 -------- d-----w- c:\program files (x86)\ESET
2015-05-25 15:16 . 2015-05-25 15:16 -------- d-----w- C:\RegBackup
2015-05-25 15:08 . 2015-05-25 15:10 -------- d-----w- C:\AdwCleaner
2015-05-25 14:49 . 2015-05-25 14:49 -------- d-----w- c:\program files (x86)\Glarysoft
2015-05-25 14:46 . 2015-05-25 15:26 136408 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2015-05-25 14:46 . 2015-05-25 14:46 -------- d-----w- c:\program files (x86)\ Malwarebytes Anti-Malware
2015-05-25 14:46 . 2015-05-25 14:46 -------- d-----w- c:\programdata\Malwarebytes
2015-05-25 14:46 . 2015-04-14 07:37 63704 ----a-w- c:\windows\system32\drivers\mwac.sys
2015-05-25 14:46 . 2015-04-14 07:37 107736 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2015-05-25 14:46 . 2015-04-14 07:37 25816 ----a-w- c:\windows\system32\drivers\mbam.sys
2015-05-22 20:27 . 2015-05-24 19:36 -------- d-----w- C:\EEK
2015-05-20 17:43 . 2015-05-20 17:43 -------- d-sh--w- c:\users\Pandur\AppData\Local\EmieBrowserModeList
2015-05-20 17:40 . 2015-05-20 17:40 -------- d-----w- c:\users\Pandur\AppData\Roaming\Opera Software
2015-05-20 17:40 . 2015-05-20 17:40 -------- d-----w- c:\users\Pandur\AppData\Local\Opera Software
2015-05-20 17:40 . 2015-05-20 17:43 -------- d-----w- c:\program files (x86)\Opera
2015-05-13 21:15 . 2015-05-01 13:17 124112 ----a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 21:15 . 2015-05-01 13:16 102608 ----a-w- c:\windows\SysWow64\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 14:36 . 2015-01-29 03:19 2543104 ----a-w- c:\windows\system32\wpdshext.dll
2015-05-13 14:36 . 2015-01-29 03:19 1195008 ----a-w- c:\windows\system32\drivers\UMDF\WpdMtpDr.dll
2015-05-13 14:36 . 2015-01-29 03:02 2311168 ----a-w- c:\windows\SysWow64\wpdshext.dll
2015-05-13 14:36 . 2015-02-18 07:06 123904 ----a-w- c:\windows\SysWow64\poqexec.exe
2015-05-13 14:36 . 2015-02-18 07:04 142336 ----a-w- c:\windows\system32\poqexec.exe
2015-05-13 14:36 . 2015-03-04 04:41 6656 ----a-w- c:\windows\system32\shimeng.dll
2015-05-13 14:36 . 2015-03-04 04:41 72192 ----a-w- c:\windows\system32\aelupsvc.dll
2015-05-13 14:36 . 2015-03-04 04:41 342016 ----a-w- c:\windows\system32\apphelp.dll
2015-05-13 14:36 . 2015-03-04 04:41 23552 ----a-w- c:\windows\system32\sdbinst.exe
2015-05-13 14:36 . 2015-03-04 04:11 5120 ----a-w- c:\windows\SysWow64\shimeng.dll
2015-05-13 14:36 . 2015-03-04 04:10 295936 ----a-w- c:\windows\SysWow64\apphelp.dll
2015-05-13 14:36 . 2015-03-04 04:10 20992 ----a-w- c:\windows\SysWow64\sdbinst.exe
2015-05-03 11:22 . 2015-05-03 11:24 -------- d-----w- c:\programdata\Ralink
2015-05-03 11:22 . 2012-05-10 20:01 308736 ----a-w- c:\windows\system32\ssleay32.dll
2015-05-03 11:22 . 2012-05-10 20:01 1503744 ----a-w- c:\windows\system32\libeay32.dll
2015-05-03 11:19 . 2015-05-03 11:19 -------- d-----w- c:\users\Pandur\AppData\Roaming\InstallShield
2015-04-29 11:02 . 2015-05-25 17:12 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2015-04-29 11:02 . 2015-05-25 18:25 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy 2
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-05-19 14:12 . 2013-10-05 20:48 778416 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2015-05-19 14:12 . 2013-10-05 20:48 142512 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2015-05-13 21:18 . 2013-10-04 19:07 140425016 ----a-w- c:\windows\system32\MRT.exe
2015-05-13 06:52 . 2015-02-19 23:18 1558848 ----a-w- c:\windows\system32\nvhdagenco6420103.dll
2015-05-12 06:27 . 2015-02-19 23:18 15048816 ----a-w- c:\windows\SysWow64\nvwgf2um.dll
2015-05-12 06:27 . 2013-10-08 12:32 3363224 ----a-w- c:\windows\system32\nvapi64.dll
2015-05-12 06:27 . 2013-10-04 16:30 112784 ----a-w- c:\windows\system32\OpenCL.dll
2015-05-12 06:27 . 2013-10-04 16:30 105288 ----a-w- c:\windows\SysWow64\OpenCL.dll
2015-05-12 06:27 . 2013-09-17 20:22 17540416 ----a-w- c:\windows\system32\nvwgf2umx.dll
2015-05-12 06:27 . 2013-09-17 20:22 12849056 ----a-w- c:\windows\SysWow64\nvd3dum.dll
2015-05-12 06:27 . 2013-09-17 20:22 2971776 ----a-w- c:\windows\SysWow64\nvapi.dll
2015-05-12 03:30 . 2013-10-08 12:38 937288 ----a-w- c:\windows\system32\nvvsvc.exe
2015-05-12 03:30 . 2013-10-08 12:38 62608 ----a-w- c:\windows\system32\nvshext.dll
2015-05-12 03:30 . 2013-10-08 12:38 385352 ----a-w- c:\windows\system32\nvmctray.dll
2015-05-12 03:30 . 2013-10-08 12:38 2558608 ----a-w- c:\windows\system32\nvsvcr.dll
2015-05-12 03:30 . 2013-10-08 12:38 6872392 ----a-w- c:\windows\system32\nvcpl.dll
2015-05-12 03:30 . 2013-10-08 12:38 3490448 ----a-w- c:\windows\system32\nvsvc64.dll
2015-05-11 17:01 . 2013-10-08 12:38 4391871 ----a-w- c:\windows\system32\nvcoproc.bin
2015-05-08 00:35 . 2013-10-29 15:33 1316000 ----a-w- c:\windows\SysWow64\nvspcap.dll
2015-05-08 00:34 . 2013-10-29 15:33 1570672 ----a-w- c:\windows\system32\nvspcap64.dll
2015-05-05 14:35 . 2013-10-04 17:33 152744 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2015-05-05 14:35 . 2013-10-04 17:33 132120 ----a-w- c:\windows\system32\drivers\avipbb.sys
2015-04-27 19:04 . 2015-05-13 14:37 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2015-04-14 20:36 . 2015-03-06 18:58 111016 ----a-w- c:\windows\system32\WindowsAccessBridge-64.dll
2015-03-25 03:24 . 2015-04-15 14:24 98304 ----a-w- c:\windows\system32\wudriver.dll
2015-03-25 03:24 . 2015-04-15 14:24 37376 ----a-w- c:\windows\system32\wups2.dll
2015-03-25 03:24 . 2015-04-15 14:24 35328 ----a-w- c:\windows\system32\wups.dll
2015-03-25 03:24 . 2015-04-15 14:24 3298816 ----a-w- c:\windows\system32\wucltux.dll
2015-03-25 03:24 . 2015-04-15 14:24 2553856 ----a-w- c:\windows\system32\wuaueng.dll
2015-03-25 03:24 . 2015-04-15 14:24 191488 ----a-w- c:\windows\system32\wuwebv.dll
2015-03-25 03:24 . 2015-04-15 14:24 696320 ----a-w- c:\windows\system32\wuapi.dll
2015-03-25 03:24 . 2015-04-15 14:24 60416 ----a-w- c:\windows\system32\WinSetupUI.dll
2015-03-25 03:23 . 2015-04-15 14:24 12288 ----a-w- c:\windows\system32\wu.upgrade.ps.dll
2015-03-25 03:23 . 2015-04-15 14:24 36864 ----a-w- c:\windows\system32\wuapp.exe
2015-03-25 03:23 . 2015-04-15 14:24 135168 ----a-w- c:\windows\system32\wuauclt.exe
2015-03-25 03:00 . 2015-04-15 14:24 92672 ----a-w- c:\windows\SysWow64\wudriver.dll
2015-03-25 03:00 . 2015-04-15 14:24 566784 ----a-w- c:\windows\SysWow64\wuapi.dll
2015-03-25 03:00 . 2015-04-15 14:24 29696 ----a-w- c:\windows\SysWow64\wups.dll
2015-03-25 03:00 . 2015-04-15 14:24 173056 ----a-w- c:\windows\SysWow64\wuwebv.dll
2015-03-25 03:00 . 2015-04-15 14:24 33792 ----a-w- c:\windows\SysWow64\wuapp.exe
2015-03-23 03:25 . 2015-04-15 14:24 726528 ----a-w- c:\windows\system32\generaltel.dll
2015-03-23 03:25 . 2015-04-15 14:24 769536 ----a-w- c:\windows\system32\invagent.dll
2015-03-23 03:24 . 2015-04-15 14:24 419840 ----a-w- c:\windows\system32\devinv.dll
2015-03-23 03:24 . 2015-04-15 14:24 957952 ----a-w- c:\windows\system32\appraiser.dll
2015-03-23 03:24 . 2015-04-15 14:24 30720 ----a-w- c:\windows\system32\acmigration.dll
2015-03-23 03:24 . 2015-04-15 14:24 227328 ----a-w- c:\windows\system32\aepdu.dll
2015-03-23 03:24 . 2015-04-15 14:24 192000 ----a-w- c:\windows\system32\aepic.dll
2015-03-23 03:17 . 2015-04-15 14:24 1111552 ----a-w- c:\windows\system32\aeinv.dll
2015-03-10 16:45 . 2013-10-04 17:33 44088 ----a-w- c:\windows\system32\drivers\avnetflt.sys
2015-03-10 03:25 . 2015-04-15 14:24 1882624 ----a-w- c:\windows\system32\msxml3.dll
2015-03-10 03:21 . 2015-04-15 14:24 2048 ----a-w- c:\windows\system32\msxml3r.dll
2015-03-10 03:08 . 2015-04-15 14:24 1237504 ----a-w- c:\windows\SysWow64\msxml3.dll
2015-03-10 03:05 . 2015-04-15 14:24 2048 ----a-w- c:\windows\SysWow64\msxml3r.dll
2015-03-05 05:12 . 2015-04-15 14:24 404480 ----a-w- c:\windows\system32\gdi32.dll
2015-03-05 04:05 . 2015-04-15 14:24 311808 ----a-w- c:\windows\SysWow64\gdi32.dll
2015-03-04 04:55 . 2015-04-15 14:23 367552 ----a-w- c:\windows\system32\clfs.sys
2015-03-04 04:41 . 2015-04-15 14:23 79360 ----a-w- c:\windows\system32\clfsw32.dll
2015-03-04 04:41 . 2015-05-13 14:36 309248 ----a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll
2015-03-04 04:41 . 2015-05-13 14:36 103424 ----a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll
2015-03-04 04:10 . 2015-04-15 14:23 58880 ----a-w- c:\windows\SysWow64\clfsw32.dll
2015-03-04 04:10 . 2015-05-13 14:36 470528 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2015-03-04 04:10 . 2015-05-13 14:36 2178560 ----a-w- c:\windows\apppatch\AcGenral.dll
2015-03-04 04:06 . 2015-05-13 14:36 2560 ----a-w- c:\windows\apppatch\AcRes.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2015-05-05 728312]
"NUSB3MON"="c:\program files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-01-22 106496]
"Avira Systray"="c:\program files (x86)\Avira\My Avira\Avira.OE.Systray.exe" [2015-03-16 129272]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2014-12-19 1022152]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Ralink Wireless Utility.lnk - c:\program files (x86)\Ralink\Common\RaUI.exe -s [2015-5-3 15661872]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean64.exe
.
R2 AntiVirMailService;Avira Email-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\avmailc7.exe;c:\program files (x86)\Avira\AntiVir Desktop\avmailc7.exe [x]
R2 AntiVirWebService;Avira Browser-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\avwebg7.exe;c:\program files (x86)\Avira\AntiVir Desktop\avwebg7.exe [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 MBAMService;MBAMService;c:\program files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe;c:\program files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 ArcService;Arc Service;c:\program files (x86)\Perfect World Entertainment\Arc\ArcService.exe;c:\program files (x86)\Perfect World Entertainment\Arc\ArcService.exe [x]
R3 BEService;BattlEye Service;c:\program files (x86)\Common Files\BattlEye\BEService.exe;c:\program files (x86)\Common Files\BattlEye\BEService.exe [x]
R3 BRDriver64;BRDriver64;c:\programdata\BitRaider\BRDriver64.sys;c:\programdata\BitRaider\BRDriver64.sys [x]
R3 BRSptSvc;BitRaider Mini-Support Service;c:\programdata\BitRaider\BRSptSvc.exe;c:\programdata\BitRaider\BRSptSvc.exe [x]
R3 cleanhlp;cleanhlp;c:\eek\bin\cleanhlp64.sys;c:\eek\bin\cleanhlp64.sys [x]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys;c:\windows\SYSNATIVE\drivers\EagleX64.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys;c:\windows\SYSNATIVE\drivers\mwac.sys [x]
R3 MSICDSetup;MSICDSetup;e:\cdriver64.sys;e:\CDriver64.sys [x]
R3 Origin Client Service;Origin Client Service;c:\program files (x86)\Origin\OriginClientService.exe;c:\program files (x86)\Origin\OriginClientService.exe [x]
R3 RaMediaServer;Ralink UPnP Media Server;c:\program files (x86)\Ralink\Common\RaMediaServer.exe;c:\program files (x86)\Ralink\Common\RaMediaServer.exe [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 RTL8192su;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8192su.sys;c:\windows\SYSNATIVE\DRIVERS\RTL8192su.sys [x]
R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 TunngleService;TunngleService;d:\program files (x86)\Tunngle\TnglCtrl.exe;d:\program files (x86)\Tunngle\TnglCtrl.exe [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 Avira.OE.ServiceHost;Avira Service Host;c:\program files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe;c:\program files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [x]
S2 avnetflt;avnetflt;c:\windows\system32\DRIVERS\avnetflt.sys;c:\windows\SYSNATIVE\DRIVERS\avnetflt.sys [x]
S2 DiagTrack;Diagnostics Tracking Service;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
S2 GfExperienceService;NVIDIA GeForce Experience Service;c:\program files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe;c:\program files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [x]
S2 NvNetworkService;NVIDIA Network Service;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [x]
S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [x]
S2 RalinkRegistryWriter64;RalinkRegistryWriter64;c:\program files (x86)\Ralink\Common\RaRegistry64.exe;c:\program files (x86)\Ralink\Common\RaRegistry64.exe [x]
S2 Realtek11nSU;Realtek11nSU;c:\program files (x86)\REALTEK\11n USB Wireless LAN Utility\RtlService.exe;c:\program files (x86)\REALTEK\11n USB Wireless LAN Utility\RtlService.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S3 BazisVirtualCDBus;WinCDEmu Virtual Bus Driver;c:\windows\system32\DRIVERS\BazisVirtualCDBus.sys;c:\windows\SYSNATIVE\DRIVERS\BazisVirtualCDBus.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
S3 nusb3hub;NEC Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3hub.sys [x]
S3 nusb3xhc;NEC Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3xhc.sys [x]
S3 NvStreamKms;NvStreamKms;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [x]
S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad64v.sys;c:\windows\SYSNATIVE\drivers\nvvad64v.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 tap0901t;TAP-Win32 Adapter V9 (Tunngle);c:\windows\system32\DRIVERS\tap0901t.sys;c:\windows\SYSNATIVE\DRIVERS\tap0901t.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
Inhalt des "geplante Tasks" Ordners
.
2015-05-26 c:\windows\Tasks\MT66 Software Update.job
- c:\program files (x86)\Common Files\MT66 Software Update\UpdateClient.exe [2013-10-08 16:44]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2013-03-29 7174728]
"ShadowPlay"="c:\windows\system32\nvspcap64.dll" [2015-05-08 1570672]
"NvBackend"="c:\program files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe" [2015-05-08 2685072]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = www.google.com
mDefault_Search_URL = www.google.com
mDefault_Page_URL = www.google.com
mStart Page = www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
mSearch Page = www.google.com
uSearchAssistant = www.google.com
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
TCP: DhcpNameServer = 192.168.192.1
FF - ProfilePath - c:\users\Pandur\AppData\Roaming\Mozilla\Firefox\Profiles\1olm1qcv.default-1432326152348\
FF - prefs.js: browser.startup.homepage - hxxps://www.google.de/
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
SafeBoot-CleanHlp
SafeBoot-CleanHlp.sys
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
AddRemove-MyFreeCodec - c:\program files (x86)\MyFree Codec\1.0b beta\uninstall.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_175_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_175_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_175_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_175_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_175.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_175.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_175.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_175.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files\ASUS\GPU Boost Driver\GpuBoostServer.exe
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\windows\SysWOW64\PnkBstrA.exe
c:\program files (x86)\Ralink\Common\RaRegistry.exe
c:\program files (x86)\REALTEK\11n USB Wireless LAN Utility\RtWlan.exe
c:\users\Pandur\AppData\Local\NVIDIA\NvBackend\ApplicationOntology\NvOAWrapperCache.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2015-05-27 20:02:42 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2015-05-27 18:02
.
Vor Suchlauf: 15 Verzeichnis(se), 338.111.811.584 Bytes frei
Nach Suchlauf: 20 Verzeichnis(se), 338.066.313.216 Bytes frei
.
- - End Of File - - CD584713682198F0CB5B41E23024A1C9
A36C5E4F47E84449FF07ED3517B43A31
|
|
28.05.2015, 12:23
| #6 |
| /// the machine /// TB-Ausbilder | Firefox Startseite wird geändert und Avira Echtzeitscan findet laufend etwas Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ --> Firefox Startseite wird geändert und Avira Echtzeitscan findet laufend etwas |
|
28.05.2015, 13:00
| #7 |
| | Firefox Startseite wird geändert und Avira Echtzeitscan findet laufend etwasCode:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 28.05.2015 Suchlauf-Zeit: 13:33:17 Logdatei: mbam.txt Administrator: Ja Version: 2.01.6.1022 Malware Datenbank: v2015.05.28.03 Rootkit Datenbank: v2015.05.24.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: Pandur Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 362883 Verstrichene Zeit: 15 Min, 48 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (Keine schädliche Elemente gefunden) Module: 0 (Keine schädliche Elemente gefunden) Registrierungsschlüssel: 0 (Keine schädliche Elemente gefunden) Registrierungswerte: 0 (Keine schädliche Elemente gefunden) Registrierungsdaten: 0 (Keine schädliche Elemente gefunden) Ordner: 0 (Keine schädliche Elemente gefunden) Dateien: 0 (Keine schädliche Elemente gefunden) Physische Sektoren: 0 (Keine schädliche Elemente gefunden) (end) Code:
ATTFilter # AdwCleaner v4.205 - Bericht erstellt 28/05/2015 um 13:52:00
# Aktualisiert 21/05/2015 von Xplode
# Datenbank : 2015-05-25.3 [Server]
# Betriebssystem : Windows 7 Professional Service Pack 1 (x64)
# Benutzername : Pandur - BABY
# Gestarted von : C:\Users\Pandur\Downloads\AdwCleaner_4.205.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
***** [ Geplante Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
***** [ Internetbrowser ] *****
-\\ Internet Explorer v11.0.9600.17801
-\\ Mozilla Firefox v38.0.1 (x86 de)
-\\ Google Chrome v
-\\ Chromium v
-\\ Opera v0.0.0.0
*************************
AdwCleaner[R0].txt - [5675 Bytes] - [25/05/2015 17:08:51]
AdwCleaner[R1].txt - [979 Bytes] - [28/05/2015 13:50:31]
AdwCleaner[S0].txt - [5517 Bytes] - [25/05/2015 17:10:51]
AdwCleaner[S1].txt - [900 Bytes] - [28/05/2015 13:52:00]
########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [958 Bytes] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.8.1 (05.27.2015:1)
OS: Windows 7 Professional x64
Ran by Pandur on 28.05.2015 at 13:56:50,86
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Tasks
~~~ Registry Values
~~~ Registry Keys
~~~ Files
~~~ Folders
~~~ FireFox
Emptied folder: C:\Users\Pandur\AppData\Roaming\mozilla\firefox\profiles\1olm1qcv.default-1432326152348\minidumps [1 files]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 28.05.2015 at 13:58:52,02
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 27-05-2015 01
Ran by Pandur (administrator) on BABY on 28-05-2015 13:29:29
Running from C:\Users\Pandur\Downloads
Loaded Profiles: Pandur (Available Profiles: Pandur)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(
ASUSTeK Computer Inc.) C:\Program Files\ASUS\GPU Boost Driver\GpuBoostServer.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Ralink Technology, Corp.) C:\Program Files (x86)\Ralink\Common\RaRegistry.exe
(Ralink Technology, Corp.) C:\Program Files (x86)\Ralink\Common\RaRegistry64.exe
(Realtek) C:\Program Files (x86)\REALTEK\11n USB Wireless LAN Utility\RtlService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Realtek Semiconductor Corp.) C:\Program Files (x86)\REALTEK\11n USB Wireless LAN Utility\RtWLan.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Ralink Technology, Corp.) C:\Program Files (x86)\Ralink\Common\RaUI.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(NEC Electronics Corporation) C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7174728 2013-03-29] (Realtek Semiconductor)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2685072 2015-05-08] (NVIDIA Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [728312 2015-05-05] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [106496 2010-01-22] (NEC Electronics Corporation)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [129272 2015-03-16] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Ralink Wireless Utility.lnk [2015-05-03]
ShortcutTarget: Ralink Wireless Utility.lnk -> C:\Program Files (x86)\Ralink\Common\RaUI.exe (Ralink Technology, Corp.)
BootExecute: autocheck autochk * sdnclean64.exe
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-4083855489-4222839378-707726563-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-4083855489-4222839378-707726563-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_45\bin\ssv.dll [2015-04-14] (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-04-14] (Oracle Corporation)
BHO-x32: No Name -> {120A8821-2BEE-4C29-BCDA-62C577781992} -> No File
BHO-x32: ArcPluginIEBHO Class -> {84BFE29A-8139-402a-B2A4-C23AE9E1A75F} -> C:\Program Files (x86)\Perfect World Entertainment\Arc\Plugins\ArcPluginIE.dll [2014-07-02] (Perfect World Entertainment Inc)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.192.1
FireFox:
========
FF ProfilePath: C:\Users\Pandur\AppData\Roaming\Mozilla\Firefox\Profiles\1olm1qcv.default-1432326152348
FF Homepage: https://www.google.de/
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_188.dll [2015-05-19] ()
FF Plugin: @esn/npbattlelog,version=2.6.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.6.2\npbattlelogx64.dll [2015-01-13] (EA Digital Illusions CE AB)
FF Plugin: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-04-14] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-04-14] (Oracle Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_188.dll [2015-05-19] ()
FF Plugin-x32: @esn/npbattlelog,version=2.4.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.4.0\npbattlelog.dll No File
FF Plugin-x32: @esn/npbattlelog,version=2.6.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.6.2\npbattlelog.dll [2015-01-13] (EA Digital Illusions CE AB)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2015-05-12] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2015-05-12] (NVIDIA Corporation)
FF Plugin-x32: @perfectworld.com/npArcPlayNowPlugin -> C:\Program Files (x86)\Perfect World Entertainment\Arc\Plugins\npArcPluginFF.dll [2014-07-02] (Perfect World Entertainment Inc)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)
FF Extension: Recorder Toolbar - C:\Program Files (x86)\Mozilla Firefox\extensions\{10743931-94DF-476f-A987-4391233C17A2} [2015-05-18]
StartMenuInternet: FIREFOX.EXE - firefox.exe
Chrome:
=======
CHR Profile: C:\Users\Pandur\AppData\Local\Google\Chrome\User Data\Default
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [827640 2015-05-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [434424 2015-05-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [434424 2015-05-05] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1185584 2015-05-05] (Avira Operations GmbH & Co. KG)
S3 ArcService; C:\Program Files (x86)\Perfect World Entertainment\Arc\ArcService.exe [88400 2014-07-02] (Perfect World Entertainment Inc)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [201008 2015-03-16] (Avira Operations GmbH & Co. KG)
S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [448384 2014-12-06] ()
S3 BRSptSvc; C:\ProgramData\BitRaider\BRSptSvc.exe [477960 2014-07-08] (BitRaider, LLC)
R2 DiagTrack; C:\Windows\system32\diagtrack.dll [1254400 2015-04-27] (Microsoft Corporation)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1152656 2015-05-08] (NVIDIA Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1884304 2015-05-08] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [22997648 2015-05-08] (NVIDIA Corporation)
S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [1910128 2015-01-27] (Electronic Arts)
R2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [76152 2014-07-10] ()
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76152 2015-02-03] ()
S3 RaMediaServer; C:\Program Files (x86)\Ralink\Common\RaMediaServer.exe [1863680 2012-07-06] (Ralink) [File not signed]
R2 Realtek11nSU; C:\Program Files (x86)\REALTEK\11n USB Wireless LAN Utility\RtlService.exe [36864 2010-04-16] (Realtek) [File not signed]
S3 TunngleService; D:\Program Files (x86)\Tunngle\TnglCtrl.exe [792016 2015-02-09] (Tunngle.net GmbH)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2009-08-04] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [152744 2015-05-05] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132120 2015-05-05] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [44088 2015-03-10] (Avira Operations GmbH & Co. KG)
S3 BRDriver64; C:\ProgramData\BitRaider\BRDriver64.sys [75048 2014-07-08] (BitRaider)
S3 cleanhlp; C:\EEK\bin\cleanhlp64.sys [57024 2015-02-09] (Emsisoft GmbH)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-04-14] (Malwarebytes Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-16] ()
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2015-05-08] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38032 2014-11-22] (NVIDIA Corporation)
R3 tap0901t; C:\Windows\System32\DRIVERS\tap0901t.sys [31232 2009-09-16] (Tunngle.net)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
S3 MSICDSetup; \??\E:\CDriver64.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-05-28 13:29 - 2015-05-28 13:29 - 00000000 ____D () C:\Users\Pandur\Downloads\FRST-OlderVersion
2015-05-27 20:02 - 2015-05-27 20:02 - 00026501 _____ () C:\ComboFix.txt
2015-05-27 19:48 - 2015-05-27 20:02 - 00000000 ____D () C:\Qoobox
2015-05-27 19:48 - 2015-05-27 20:01 - 00000000 ____D () C:\Windows\erdnt
2015-05-27 19:48 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-05-27 19:48 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-05-27 19:48 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-05-27 19:48 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-05-27 19:48 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-05-27 19:48 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2015-05-27 19:48 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2015-05-27 19:48 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2015-05-27 19:47 - 2015-05-27 19:47 - 05628291 ____R (Swearware) C:\Users\Pandur\Desktop\ComboFix.exe
2015-05-26 19:29 - 2015-05-26 19:29 - 00000000 ____D () C:\Program Files (x86)\Microsoft ASP.NET
2015-05-25 20:58 - 2015-05-12 04:34 - 00571024 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2015-05-25 20:56 - 2015-05-13 08:52 - 00195912 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys
2015-05-25 20:56 - 2015-05-13 08:52 - 00031552 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll
2015-05-25 20:56 - 2015-05-12 08:27 - 42718864 _____ () C:\Windows\system32\nvcompiler.dll
2015-05-25 20:56 - 2015-05-12 08:27 - 37741712 _____ () C:\Windows\SysWOW64\nvcompiler.dll
2015-05-25 20:56 - 2015-05-12 08:27 - 30478992 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2015-05-25 20:56 - 2015-05-12 08:27 - 22945424 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2015-05-25 20:56 - 2015-05-12 08:27 - 16145176 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2015-05-25 20:56 - 2015-05-12 08:27 - 15858728 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2015-05-25 20:56 - 2015-05-12 08:27 - 14455296 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2015-05-25 20:56 - 2015-05-12 08:27 - 13263568 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2015-05-25 20:56 - 2015-05-12 08:27 - 11790144 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2015-05-25 20:56 - 2015-05-12 08:27 - 10972304 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2015-05-25 20:56 - 2015-05-12 08:27 - 02932368 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2015-05-25 20:56 - 2015-05-12 08:27 - 02599056 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2015-05-25 20:56 - 2015-05-12 08:27 - 01898312 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6435286.dll
2015-05-25 20:56 - 2015-05-12 08:27 - 01557648 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6435286.dll
2015-05-25 20:56 - 2015-05-12 08:27 - 01099808 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll
2015-05-25 20:56 - 2015-05-12 08:27 - 01059984 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2015-05-25 20:56 - 2015-05-12 08:27 - 01050256 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2015-05-25 20:56 - 2015-05-12 08:27 - 00982672 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2015-05-25 20:56 - 2015-05-12 08:27 - 00974480 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2015-05-25 20:56 - 2015-05-12 08:27 - 00939080 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll
2015-05-25 20:56 - 2015-05-12 08:27 - 00502896 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncodeAPI64.dll
2015-05-25 20:56 - 2015-05-12 08:27 - 00408208 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFROpenGL.dll
2015-05-25 20:56 - 2015-05-12 08:27 - 00407296 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncodeAPI.dll
2015-05-25 20:56 - 2015-05-12 08:27 - 00364176 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFROpenGL.dll
2015-05-25 20:56 - 2015-05-12 08:27 - 00176064 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll
2015-05-25 20:56 - 2015-05-12 08:27 - 00154256 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll
2015-05-25 20:56 - 2015-05-12 08:27 - 00150832 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
2015-05-25 20:56 - 2015-05-12 08:27 - 00128512 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
2015-05-25 20:55 - 2015-05-08 02:35 - 01316184 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll
2015-05-25 20:55 - 2015-05-08 02:34 - 01756424 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll
2015-05-25 20:55 - 2014-11-22 12:46 - 00038032 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2015-05-25 20:55 - 2014-11-22 12:46 - 00032400 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2015-05-25 20:21 - 2015-05-25 20:21 - 00004153 _____ () C:\Users\Pandur\Desktop\GMER.log
2015-05-25 20:06 - 2015-05-25 20:06 - 00380416 _____ () C:\Users\Pandur\Downloads\Gmer-19357.exe
2015-05-25 19:11 - 2015-05-25 19:11 - 00067003 _____ () C:\Users\Pandur\Desktop\Addition.txt
2015-05-25 19:08 - 2015-05-25 19:08 - 00056770 _____ () C:\Users\Pandur\Desktop\FRST.txt
2015-05-25 19:07 - 2015-05-25 19:07 - 00067003 _____ () C:\Users\Pandur\Downloads\Addition.txt
2015-05-25 19:06 - 2015-05-28 13:29 - 00013854 _____ () C:\Users\Pandur\Downloads\FRST.txt
2015-05-25 19:06 - 2015-05-28 13:29 - 00000000 ____D () C:\FRST
2015-05-25 19:05 - 2015-05-28 13:29 - 02108928 _____ (Farbar) C:\Users\Pandur\Downloads\FRST64.exe
2015-05-25 19:04 - 2015-05-25 19:05 - 00000474 _____ () C:\Users\Pandur\Downloads\defogger_disable.log
2015-05-25 19:04 - 2015-05-25 19:04 - 00050477 _____ () C:\Users\Pandur\Downloads\Defogger.exe
2015-05-25 19:04 - 2015-05-25 19:04 - 00000000 _____ () C:\Users\Pandur\defogger_reenable
2015-05-25 17:27 - 2015-05-25 17:10 - 00005517 _____ () C:\Users\Pandur\Desktop\AdwCleaner[S0].txt
2015-05-25 17:26 - 2015-05-25 17:26 - 00030841 _____ () C:\Users\Pandur\Desktop\mbam.txt
2015-05-25 17:20 - 2015-05-25 17:20 - 00000000 ____D () C:\Program Files (x86)\ESET
2015-05-25 17:19 - 2015-05-25 17:20 - 02347384 _____ (ESET) C:\Users\Pandur\Downloads\esetsmartinstaller_deu.exe
2015-05-25 17:19 - 2015-05-25 17:19 - 00001880 _____ () C:\Users\Pandur\Desktop\sc-cleaner.txt
2015-05-25 17:18 - 2015-05-25 17:19 - 00463688 _____ (Bleeping Computer, LLC) C:\Users\Pandur\Downloads\sc-cleaner.exe
2015-05-25 17:18 - 2015-05-25 17:18 - 00001190 _____ () C:\Users\Pandur\Desktop\JRT.txt
2015-05-25 17:16 - 2015-05-25 17:16 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-BABY-Windows-7-Professional-(64-bit).dat
2015-05-25 17:16 - 2015-05-25 17:16 - 00000000 ____D () C:\RegBackup
2015-05-25 17:15 - 2015-05-25 17:15 - 02945770 _____ (Thisisu) C:\Users\Pandur\Downloads\JRT.exe
2015-05-25 17:08 - 2015-05-25 17:10 - 00000000 ____D () C:\AdwCleaner
2015-05-25 17:08 - 2015-05-25 17:08 - 02222592 _____ () C:\Users\Pandur\Downloads\AdwCleaner_4.205.exe
2015-05-25 16:49 - 2015-05-25 16:49 - 04737952 _____ () C:\Users\Pandur\Downloads\ausetup5.3.1.20.exe
2015-05-25 16:49 - 2015-05-25 16:49 - 00001230 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Absolute Uninstaller.lnk
2015-05-25 16:49 - 2015-05-25 16:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glarysoft
2015-05-25 16:49 - 2015-05-25 16:49 - 00000000 ____D () C:\Program Files (x86)\Glarysoft
2015-05-25 16:46 - 2015-05-25 17:26 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-05-25 16:46 - 2015-05-25 16:46 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\Pandur\Downloads\mbam-setup-2.1.6.1022.exe
2015-05-25 16:46 - 2015-05-25 16:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-05-25 16:46 - 2015-05-25 16:46 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-05-25 16:46 - 2015-05-25 16:46 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2015-05-25 16:46 - 2015-04-14 09:37 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-05-25 16:46 - 2015-04-14 09:37 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-05-25 16:46 - 2015-04-14 09:37 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-05-25 16:23 - 2015-05-25 16:23 - 00060965 _____ () C:\Users\Pandur\Downloads\pkeyuibx_v1.5.0.zip
2015-05-25 16:23 - 2015-05-25 16:23 - 00000000 ____D () C:\Users\Pandur\Downloads\pkeyuibx_v1.5.0
2015-05-25 16:22 - 2015-05-25 16:22 - 01196832 _____ () C:\Users\Pandur\Downloads\Windows Product Key Viewer - CHIP-Installer.exe
2015-05-25 16:06 - 2015-05-25 16:06 - 01196832 _____ () C:\Users\Pandur\Downloads\UNetbootin - CHIP-Installer.exe
2015-05-25 15:56 - 2015-05-25 18:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SARDU
2015-05-25 15:55 - 2015-05-25 16:12 - 00000000 ____D () C:\Users\Pandur\Downloads\SARDU_2.0.6.5
2015-05-25 15:54 - 2015-05-25 15:54 - 14021962 _____ () C:\Users\Pandur\Downloads\SARDU_2.0.6.5.zip
2015-05-25 15:54 - 2015-05-25 15:54 - 01196832 _____ () C:\Users\Pandur\Downloads\Sardu - CHIP-Installer.exe
2015-05-24 21:51 - 2015-05-24 21:55 - 674234368 _____ () C:\Users\Pandur\Downloads\bitdefender-rescue-cd.iso
2015-05-24 21:48 - 2015-05-24 21:48 - 00231544 _____ () C:\Users\Pandur\Downloads\Install_JDownloader_2_BETA.exe
2015-05-23 18:36 - 2015-05-27 22:16 - 00000080 _____ () C:\Users\Pandur\AppData\Local剜捯獫慴慇敭屳呇⁁屖湥楴汴浥湥湩潦
2015-05-22 22:27 - 2015-05-24 21:36 - 00000000 ____D () C:\EEK
2015-05-22 22:27 - 2015-05-22 22:27 - 00000743 _____ () C:\Users\Pandur\Desktop\Start Emsisoft Emergency Kit.lnk
2015-05-22 22:25 - 2015-05-22 22:25 - 01196832 _____ () C:\Users\Pandur\Downloads\Emsisoft Emergency Kit - CHIP-Installer.exe
2015-05-22 22:18 - 2015-05-22 22:18 - 00003142 _____ () C:\Windows\System32\Tasks\{5C8F0819-D8F3-47D2-8AF3-8E5BAB226457}
2015-05-22 22:15 - 2015-05-27 19:57 - 00030962 _____ () C:\Windows\PFRO.log
2015-05-21 17:26 - 2015-05-28 12:09 - 00005201 _____ () C:\Windows\setupact.log
2015-05-21 17:26 - 2015-05-21 17:26 - 00000000 _____ () C:\Windows\setuperr.log
2015-05-20 20:50 - 2015-05-20 20:50 - 00178748 _____ () C:\Users\Pandur\Downloads\cc_20150520_205004.reg
2015-05-20 19:43 - 2015-05-20 19:43 - 00000000 __SHD () C:\Users\Pandur\AppData\Local\EmieBrowserModeList
2015-05-20 19:40 - 2015-05-20 19:43 - 00000000 ____D () C:\Program Files (x86)\Opera
2015-05-20 19:40 - 2015-05-20 19:40 - 00000000 ____D () C:\Users\Pandur\AppData\Roaming\Opera Software
2015-05-20 19:40 - 2015-05-20 19:40 - 00000000 ____D () C:\Users\Pandur\AppData\Local\Opera Software
2015-05-20 19:40 - 2009-06-10 23:00 - 00000824 _____ () C:\Windows\system32\Drivers\etc\hp.bak
2015-05-18 19:57 - 2015-05-18 19:57 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-05-13 23:15 - 2015-05-01 15:17 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 23:15 - 2015-05-01 15:16 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 16:37 - 2015-05-05 03:29 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-05-13 16:37 - 2015-05-05 03:12 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-05-13 16:37 - 2015-04-27 21:28 - 05569984 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-05-13 16:37 - 2015-04-27 21:28 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-05-13 16:37 - 2015-04-27 21:28 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-05-13 16:37 - 2015-04-27 21:26 - 01728960 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 01254400 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 01162752 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00113664 _____ (Microsoft Corporation) C:\Windows\system32\sechost.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-05-13 16:37 - 2015-04-27 21:22 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\tracerpt.exe
2015-05-13 16:37 - 2015-04-27 21:22 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-05-13 16:37 - 2015-04-27 21:22 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-05-13 16:37 - 2015-04-27 21:22 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-05-13 16:37 - 2015-04-27 21:22 - 00104448 _____ (Microsoft Corporation) C:\Windows\system32\logman.exe
2015-05-13 16:37 - 2015-04-27 21:22 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\typeperf.exe
2015-05-13 16:37 - 2015-04-27 21:22 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\relog.exe
2015-05-13 16:37 - 2015-04-27 21:22 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-05-13 16:37 - 2015-04-27 21:22 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\diskperf.exe
2015-05-13 16:37 - 2015-04-27 21:21 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-05-13 16:37 - 2015-04-27 21:18 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-05-13 16:37 - 2015-04-27 21:18 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:11 - 03989440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-05-13 16:37 - 2015-04-27 21:11 - 03934144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-05-13 16:37 - 2015-04-27 21:08 - 01310744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-05-13 16:37 - 2015-04-27 21:05 - 00635392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2015-05-13 16:37 - 2015-04-27 21:05 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-05-13 16:37 - 2015-04-27 21:05 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-05-13 16:37 - 2015-04-27 21:05 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-05-13 16:37 - 2015-04-27 21:05 - 00092160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sechost.dll
2015-05-13 16:37 - 2015-04-27 21:05 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-05-13 16:37 - 2015-04-27 21:05 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-05-13 16:37 - 2015-04-27 21:05 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-05-13 16:37 - 2015-04-27 21:05 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-05-13 16:37 - 2015-04-27 21:04 - 00641536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2015-05-13 16:37 - 2015-04-27 21:04 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-05-13 16:37 - 2015-04-27 21:04 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tracerpt.exe
2015-05-13 16:37 - 2015-04-27 21:04 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\logman.exe
2015-05-13 16:37 - 2015-04-27 21:04 - 00040448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\typeperf.exe
2015-05-13 16:37 - 2015-04-27 21:04 - 00037888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\relog.exe
2015-05-13 16:37 - 2015-04-27 21:04 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-05-13 16:37 - 2015-04-27 21:04 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-05-13 16:37 - 2015-04-27 21:03 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-05-13 16:37 - 2015-04-27 21:03 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-05-13 16:37 - 2015-04-27 21:03 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-05-13 16:37 - 2015-04-27 21:03 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-05-13 16:37 - 2015-04-27 21:03 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\diskperf.exe
2015-05-13 16:37 - 2015-04-27 21:03 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-05-13 16:37 - 2015-04-27 21:01 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-05-13 16:37 - 2015-04-27 21:01 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:06 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-05-13 16:37 - 2015-04-27 19:57 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-05-13 16:37 - 2015-04-27 19:57 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-05-13 16:37 - 2015-04-27 19:55 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 19:55 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-05-13 16:37 - 2015-04-22 04:28 - 00389840 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-05-13 16:37 - 2015-04-22 03:48 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-05-13 16:37 - 2015-04-21 19:14 - 24971776 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-05-13 16:37 - 2015-04-21 19:08 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-05-13 16:37 - 2015-04-21 19:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-05-13 16:37 - 2015-04-21 18:51 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-05-13 16:37 - 2015-04-21 18:50 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-05-13 16:37 - 2015-04-21 18:50 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-05-13 16:37 - 2015-04-21 18:50 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-05-13 16:37 - 2015-04-21 18:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-05-13 16:37 - 2015-04-21 18:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-05-13 16:37 - 2015-04-21 18:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-05-13 16:37 - 2015-04-21 18:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-05-13 16:37 - 2015-04-21 18:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-05-13 16:37 - 2015-04-21 18:35 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-05-13 16:37 - 2015-04-21 18:35 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-05-13 16:37 - 2015-04-21 18:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-05-13 16:37 - 2015-04-21 18:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-05-13 16:37 - 2015-04-21 18:31 - 06025728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-05-13 16:37 - 2015-04-21 18:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-05-13 16:37 - 2015-04-21 18:25 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-05-13 16:37 - 2015-04-21 18:24 - 19691008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-05-13 16:37 - 2015-04-21 18:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-05-13 16:37 - 2015-04-21 18:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-05-13 16:37 - 2015-04-21 18:11 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-05-13 16:37 - 2015-04-21 18:11 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-05-13 16:37 - 2015-04-21 18:10 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-05-13 16:37 - 2015-04-21 18:09 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-05-13 16:37 - 2015-04-21 18:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-05-13 16:37 - 2015-04-21 18:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-05-13 16:37 - 2015-04-21 18:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-05-13 16:37 - 2015-04-21 18:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-05-13 16:37 - 2015-04-21 18:04 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-05-13 16:37 - 2015-04-21 18:03 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-05-13 16:37 - 2015-04-21 18:02 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-05-13 16:37 - 2015-04-21 18:00 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-05-13 16:37 - 2015-04-21 17:58 - 00664576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-05-13 16:37 - 2015-04-21 17:58 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-05-13 16:37 - 2015-04-21 17:57 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-05-13 16:37 - 2015-04-21 17:49 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-05-13 16:37 - 2015-04-21 17:49 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-05-13 16:37 - 2015-04-21 17:48 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-05-13 16:37 - 2015-04-21 17:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-05-13 16:37 - 2015-04-21 17:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-05-13 16:37 - 2015-04-21 17:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-05-13 16:37 - 2015-04-21 17:40 - 14401536 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-05-13 16:37 - 2015-04-21 17:39 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-05-13 16:37 - 2015-04-21 17:38 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-05-13 16:37 - 2015-04-21 17:36 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-05-13 16:37 - 2015-04-21 17:31 - 04305920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-05-13 16:37 - 2015-04-21 17:27 - 02352128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-05-13 16:37 - 2015-04-21 17:26 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-05-13 16:37 - 2015-04-21 17:25 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-05-13 16:37 - 2015-04-21 17:24 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-05-13 16:37 - 2015-04-21 17:17 - 12828672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-05-13 16:37 - 2015-04-21 17:15 - 01547264 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-05-13 16:37 - 2015-04-21 17:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-05-13 16:37 - 2015-04-21 17:02 - 01882112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-05-13 16:37 - 2015-04-21 16:58 - 01310208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-05-13 16:37 - 2015-04-21 16:56 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-05-13 16:37 - 2015-04-20 05:17 - 01647104 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-05-13 16:37 - 2015-04-20 05:17 - 01179136 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-05-13 16:37 - 2015-04-20 04:56 - 01250816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2015-05-13 16:37 - 2015-04-20 04:11 - 03204608 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-05-13 16:37 - 2015-04-18 05:10 - 00460800 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-05-13 16:37 - 2015-04-18 04:56 - 00342016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2015-05-13 16:37 - 2015-04-13 05:28 - 00328704 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2015-05-13 16:37 - 2015-04-08 05:29 - 00275456 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2015-05-13 16:37 - 2015-04-08 05:29 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll
2015-05-13 16:37 - 2015-04-08 05:14 - 00216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll
2015-05-13 16:36 - 2015-03-04 06:41 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll
2015-05-13 16:36 - 2015-03-04 06:41 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\aelupsvc.dll
2015-05-13 16:36 - 2015-03-04 06:41 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\sdbinst.exe
2015-05-13 16:36 - 2015-03-04 06:41 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\shimeng.dll
2015-05-13 16:36 - 2015-03-04 06:11 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shimeng.dll
2015-05-13 16:36 - 2015-03-04 06:10 - 00295936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apphelp.dll
2015-05-13 16:36 - 2015-03-04 06:10 - 00020992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sdbinst.exe
2015-05-13 16:36 - 2015-02-18 09:06 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe
2015-05-13 16:36 - 2015-02-18 09:04 - 00142336 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2015-05-13 16:36 - 2015-01-29 05:19 - 02543104 _____ (Microsoft Corporation) C:\Windows\system32\wpdshext.dll
2015-05-13 16:36 - 2015-01-29 05:02 - 02311168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wpdshext.dll
2015-05-08 15:10 - 2015-05-08 15:15 - 00000000 ____D () C:\Users\Pandur\Documents\Project CARS
2015-05-08 15:10 - 2015-05-08 15:10 - 00000000 ____D () C:\Users\Pandur\Documents\wmd_symbol_cache
2015-05-03 13:22 - 2015-05-03 13:24 - 00000000 ____D () C:\ProgramData\Ralink
2015-05-03 13:22 - 2012-05-10 22:01 - 01503744 _____ (The OpenSSL Project, hxxp://www.openssl.org/) C:\Windows\system32\libeay32.dll
2015-05-03 13:22 - 2012-05-10 22:01 - 00308736 _____ (The OpenSSL Project, hxxp://www.openssl.org/) C:\Windows\system32\ssleay32.dll
2015-05-03 13:21 - 2015-05-03 13:21 - 00003486 _____ () C:\Windows\system32\RaCoInst.log
2015-05-03 13:21 - 2015-05-03 13:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ralink Wireless
2015-05-03 13:20 - 2015-05-03 13:20 - 00000000 ____D () C:\Windows\system32\RaLanguages
2015-05-03 13:20 - 2015-05-03 13:20 - 00000000 ____D () C:\ProgramData\Ralink Driver
2015-05-03 13:20 - 2015-05-03 13:20 - 00000000 ____D () C:\Program Files (x86)\Ralink
2015-05-03 13:20 - 2013-09-06 20:43 - 02273072 _____ (Ralink Technology Corp.) C:\Windows\system32\Drivers\netr28ux.sys
2015-05-03 13:20 - 2013-08-27 09:18 - 00331568 _____ (Ralink Technology, Inc.) C:\Windows\system32\RaCoInstx.dll
2015-05-03 13:20 - 2013-08-27 09:18 - 00013973 _____ () C:\Windows\SysWOW64\RaCoInst.dat
2015-05-03 13:20 - 2013-08-27 09:18 - 00013973 _____ () C:\Windows\system32\RaCoInst.dat
2015-05-03 13:20 - 2013-08-23 14:10 - 00080316 _____ () C:\Windows\SysWOW64\Drivers\FW_7610.bin
2015-05-03 13:20 - 2013-08-23 14:10 - 00080316 _____ () C:\Windows\system32\Drivers\FW_7610.bin
2015-05-03 13:20 - 2013-07-03 09:59 - 00046692 _____ () C:\Windows\SysWOW64\Drivers\FW_7601.bin
2015-05-03 13:20 - 2013-07-03 09:59 - 00046692 _____ () C:\Windows\system32\Drivers\FW_7601.bin
2015-05-03 13:20 - 2013-07-03 09:59 - 00008192 _____ () C:\Windows\SysWOW64\Drivers\FW_2870.bin
2015-05-03 13:20 - 2013-07-03 09:59 - 00008192 _____ () C:\Windows\system32\Drivers\FW_2870.bin
2015-05-03 13:20 - 2013-07-03 09:59 - 00004096 _____ () C:\Windows\SysWOW64\Drivers\FW_3573.bin
2015-05-03 13:20 - 2013-07-03 09:59 - 00004096 _____ () C:\Windows\system32\Drivers\FW_3573.bin
2015-05-03 13:20 - 2012-08-01 16:46 - 01115648 _____ (Ralink Technology, Corp.) C:\Windows\SysWOW64\RAIHV.dll
2015-05-03 13:20 - 2012-08-01 16:46 - 01115648 _____ (Ralink Technology, Corp.) C:\Windows\system32\RAIHV.dll
2015-05-03 13:20 - 2012-01-10 11:39 - 00127488 _____ (Ralink Technology, Corp.) C:\Windows\SysWOW64\RAEXTUI.dll
2015-05-03 13:20 - 2012-01-10 11:39 - 00127488 _____ (Ralink Technology, Corp.) C:\Windows\system32\RAEXTUI.dll
2015-05-03 13:20 - 2011-05-04 13:57 - 02403392 _____ (Ralink Technology, Corp.) C:\Windows\system32\RaCertMgr.dll
2015-05-03 13:20 - 2011-05-04 13:56 - 01608768 _____ (Ralink Technology, Corp.) C:\Windows\SysWOW64\RaCertMgr.dll
2015-05-03 13:20 - 2010-06-29 10:35 - 00792416 _____ () C:\Windows\SysWOW64\DiagFunc.dll
2015-05-03 13:20 - 2010-06-29 10:35 - 00792416 _____ () C:\Windows\system32\DiagFunc.dll
2015-05-03 13:20 - 2010-01-27 12:47 - 00000451 _____ () C:\Windows\system32\DiagFunc.ini
2015-05-03 13:20 - 2010-01-27 11:54 - 00000451 _____ () C:\Windows\SysWOW64\DiagFunc.ini
2015-05-03 13:19 - 2015-05-03 13:19 - 38616354 _____ () C:\Users\Pandur\Downloads\RT5X7X_2870_2770_307X_2070_357X_3370_8070_MT7610_MT7610_Driver_Setup_for_Windows.zip
2015-05-03 13:19 - 2015-05-03 13:19 - 00000000 ____D () C:\Users\Pandur\AppData\Roaming\InstallShield
2015-05-03 13:10 - 2015-05-03 13:10 - 00003088 _____ () C:\Windows\System32\Tasks\{541D2B34-DC2A-4F6F-966E-92373DE66718}
2015-04-29 13:02 - 2015-05-25 20:25 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2015-04-29 13:02 - 2015-05-25 19:12 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2015-04-29 13:02 - 2015-04-29 13:02 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2015-04-29 12:35 - 2015-04-29 12:35 - 01203488 _____ () C:\Users\Pandur\Downloads\SpyBot Search Destroy - CHIP-Installer.exe
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-05-28 13:21 - 2014-03-03 12:10 - 00000000 ____D () C:\Users\Pandur\AppData\Local\Battle.net
2015-05-28 12:17 - 2009-07-14 06:45 - 00031680 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-05-28 12:17 - 2009-07-14 06:45 - 00031680 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-05-28 12:09 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-05-28 12:08 - 2013-10-08 14:39 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-05-27 23:23 - 2013-10-04 17:58 - 01973917 _____ () C:\Windows\WindowsUpdate.log
2015-05-27 22:39 - 2013-10-04 19:52 - 00000000 ____D () C:\Users\Pandur\AppData\Roaming\TS3Client
2015-05-27 22:16 - 2014-01-16 20:58 - 00000000 ____D () C:\Program Files (x86)\Steam
2015-05-27 20:02 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default
2015-05-27 19:58 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2015-05-26 18:10 - 2013-10-08 18:10 - 00000316 _____ () C:\Windows\Tasks\MT66 Software Update.job
2015-05-25 20:58 - 2013-10-08 14:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2015-05-25 20:57 - 2013-10-04 18:30 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
2015-05-25 20:55 - 2013-10-29 17:33 - 00000000 ____D () C:\Users\Pandur\AppData\Local\NVIDIA Corporation
2015-05-25 20:55 - 2013-10-08 14:40 - 00001337 _____ () C:\Users\Public\Desktop\GeForce Experience.lnk
2015-05-25 19:04 - 2013-10-04 18:18 - 00000000 ____D () C:\Users\Pandur
2015-05-25 19:00 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2015-05-25 18:57 - 2013-11-17 02:38 - 00000000 ____D () C:\Users\Pandur\AppData\Roaming\BitTorrent
2015-05-25 17:10 - 2014-01-12 13:39 - 00001039 _____ () C:\Users\Pandur\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-05-25 17:10 - 2013-10-04 18:44 - 00001021 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-05-25 17:10 - 2013-10-04 18:19 - 00000997 _____ () C:\Users\Pandur\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-05-25 17:05 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system
2015-05-25 16:44 - 2013-10-04 18:44 - 00001147 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-05-25 16:17 - 2011-04-12 09:43 - 00699416 _____ () C:\Windows\system32\perfh007.dat
2015-05-25 16:17 - 2011-04-12 09:43 - 00149556 _____ () C:\Windows\system32\perfc007.dat
2015-05-25 16:17 - 2009-07-14 07:13 - 01620612 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-05-20 20:51 - 2015-04-06 23:26 - 00000000 ___SD () C:\Windows\SysWOW64\GWX
2015-05-20 20:51 - 2015-04-06 23:26 - 00000000 ___SD () C:\Windows\system32\GWX
2015-05-20 20:49 - 2013-11-22 16:25 - 00000000 ____D () C:\Users\Pandur\AppData\Roaming\Winamp
2015-05-20 20:49 - 2013-10-08 18:01 - 00000000 ____D () C:\Users\Pandur\AppData\Roaming\Media Player Classic
2015-05-20 20:48 - 2013-10-04 18:54 - 00000000 ____D () C:\Windows\Panther
2015-05-20 20:20 - 2013-10-07 19:38 - 00000000 ____D () C:\Program Files\Diablo III
2015-05-20 18:09 - 2013-10-06 11:22 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-05-19 16:13 - 2014-10-17 15:12 - 00000000 ____D () C:\Users\Pandur\AppData\Local\Adobe
2015-05-19 16:12 - 2013-10-05 22:48 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-05-19 16:12 - 2013-10-05 22:48 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-05-16 18:06 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2015-05-15 10:13 - 2014-03-11 21:34 - 00000000 ____D () C:\Program Files (x86)\Hearthstone
2015-05-15 10:07 - 2009-07-14 06:45 - 00296840 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-05-15 10:05 - 2011-04-12 09:55 - 00000000 ____D () C:\Program Files\Windows Journal
2015-05-15 10:05 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\AdvancedInstallers
2015-05-13 23:22 - 2013-10-04 21:07 - 00000000 ____D () C:\Windows\system32\MRT
2015-05-13 23:18 - 2013-10-04 21:07 - 140425016 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-05-13 16:38 - 2013-10-06 10:50 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-05-13 08:52 - 2015-02-20 01:18 - 01558848 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdagenco6420103.dll
2015-05-12 08:27 - 2015-02-20 01:18 - 15048816 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2015-05-12 08:27 - 2013-10-08 14:32 - 03363224 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll
2015-05-12 08:27 - 2013-10-04 18:30 - 00112784 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll
2015-05-12 08:27 - 2013-10-04 18:30 - 00105288 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll
2015-05-12 08:27 - 2013-10-04 18:30 - 00031710 _____ () C:\Windows\system32\nvinfo.pb
2015-05-12 08:27 - 2013-09-17 22:22 - 17540416 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2015-05-12 08:27 - 2013-09-17 22:22 - 12849056 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll
2015-05-12 08:27 - 2013-09-17 22:22 - 02971776 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll
2015-05-12 05:30 - 2013-10-08 14:38 - 06872392 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll
2015-05-12 05:30 - 2013-10-08 14:38 - 03490448 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll
2015-05-12 05:30 - 2013-10-08 14:38 - 02558608 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll
2015-05-12 05:30 - 2013-10-08 14:38 - 00937288 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
2015-05-12 05:30 - 2013-10-08 14:38 - 00385352 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll
2015-05-12 05:30 - 2013-10-08 14:38 - 00062608 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll
2015-05-11 19:41 - 2014-03-03 12:10 - 00000000 ____D () C:\Program Files (x86)\Battle.net
2015-05-11 19:01 - 2013-10-08 14:38 - 04391871 _____ () C:\Windows\system32\nvcoproc.bin
2015-05-08 02:35 - 2013-10-29 17:33 - 01316000 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll
2015-05-08 02:34 - 2013-10-29 17:33 - 01570672 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll
2015-05-07 19:01 - 2015-01-15 12:13 - 00000000 ____D () C:\Users\Pandur\AppData\Roaming\Factorio
2015-05-07 18:19 - 2015-01-21 17:56 - 00000000 ____D () C:\Program Files\Factorio
2015-05-05 16:36 - 2013-10-04 19:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-05-05 16:35 - 2013-10-04 19:33 - 00152744 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2015-05-05 16:35 - 2013-10-04 19:33 - 00132120 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2015-05-03 13:20 - 2013-10-04 19:07 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-04-29 12:47 - 2014-09-03 19:47 - 00007605 _____ () C:\Users\Pandur\AppData\Local\Resmon.ResmonCfg
2015-04-29 10:21 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
==================== Files in the root of some directories =======
2014-09-03 19:47 - 2015-04-29 12:47 - 0007605 _____ () C:\Users\Pandur\AppData\Local\Resmon.ResmonCfg
Some files in TEMP:
====================
C:\Users\Pandur\AppData\Local\Temp\avgnt.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-05-16 17:58
==================== End of log ============================
|
|
29.05.2015, 06:36
| #8 |
| /// the machine /// TB-Ausbilder | Firefox Startseite wird geändert und Avira Echtzeitscan findet laufend etwasESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
29.05.2015, 13:41
| #9 |
| | Firefox Startseite wird geändert und Avira Echtzeitscan findet laufend etwas Hallo Schrauber Avira hat nichtmehr gemeckert und auch meine Startseite ist immer brav goggle geblieben. ESET hat ein paar Sachen gefunden. Hier die Logs: Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=ebded8588c0f824fb64b050ba2456784
# engine=24014
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-05-25 06:05:39
# local_time=2015-05-25 08:05:39 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 51662348 184206989 0 0
# scanned=354981
# found=45
# cleaned=0
# scan_time=9831
sh=09E369F9EA069BC141F0D34DC18AEC3ABBA77F6B ft=1 fh=241f3ea108f7cde2 vn="Variante von Win32/Adware.Vonteera.L Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Convertor\Convertor.exe.vir"
sh=09E369F9EA069BC141F0D34DC18AEC3ABBA77F6B ft=1 fh=241f3ea108f7cde2 vn="Variante von Win32/Adware.Vonteera.L Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Winsta\bin\Winsta.exe.vir"
sh=2F1D201B1AE254E9C5A8008228911823BA8F5A35 ft=1 fh=e22ad69a47e5f92a vn="Variante von Win32/Adware.ConvertAd.QI Anwendung" ac=I fn="C:\Users\Pandur\AppData\Local\Temp\nsb2B2F.tmp"
sh=2F1D201B1AE254E9C5A8008228911823BA8F5A35 ft=1 fh=e22ad69a47e5f92a vn="Variante von Win32/Adware.ConvertAd.QI Anwendung" ac=I fn="C:\Users\Pandur\AppData\Local\Temp\nsb3859.tmp"
sh=64600DD370DB8E151A487B50B3F4AC6E4A4319F7 ft=1 fh=50c54760ce628d40 vn="Variante von Win32/Adware.ConvertAd.QI Anwendung" ac=I fn="C:\Users\Pandur\AppData\Local\Temp\nsb3991.tmp"
sh=C8C3D14A2E1701FBA1268C2B9BA4754C5903BF39 ft=1 fh=ef3040c92b9d5aae vn="Variante von Win32/Adware.ConvertAd.QI Anwendung" ac=I fn="C:\Users\Pandur\AppData\Local\Temp\nsbFB0B.tmp"
sh=07A23891C20535E49703F06E2E1D7C78B8102039 ft=1 fh=750d883b87a4dcb3 vn="Variante von Win32/InstallCore.PK evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Pandur\AppData\Local\Temp\nsfE192.tmp"
sh=173F7B91CE2E27A1C01626B18A533B9EBC99AFDF ft=1 fh=0a4c3cdac29dc205 vn="Variante von Win32/Adware.ConvertAd.QI Anwendung" ac=I fn="C:\Users\Pandur\AppData\Local\Temp\nsl2FC1.tmp"
sh=0E6BC7492C7618DED426D2D979A60AD91115C319 ft=1 fh=f1c93bbab6fe6be4 vn="Variante von Win32/Adware.ConvertAd.QI Anwendung" ac=I fn="C:\Users\Pandur\AppData\Local\Temp\nsl74D4.tmp"
sh=5603CC94D22611AC97AD915B57CA0EDEC3BB917C ft=1 fh=920cfbc0536e6647 vn="Variante von Win32/Adware.ConvertAd.QI Anwendung" ac=I fn="C:\Users\Pandur\AppData\Local\Temp\nsl7DAA.tmp"
sh=541EBB34382A78BEBE5705AD0355D792D338DE28 ft=1 fh=168e2cbc55e8efc2 vn="Variante von Win32/Adware.ConvertAd.QI Anwendung" ac=I fn="C:\Users\Pandur\AppData\Local\Temp\nsl7EE2.tmp"
sh=2433F428259B109284F2A157BA30E88D0728832A ft=1 fh=e8baf7c339271f71 vn="Variante von Win32/Adware.ConvertAd.QI Anwendung" ac=I fn="C:\Users\Pandur\AppData\Local\Temp\nsm40AB.tmp"
sh=5603CC94D22611AC97AD915B57CA0EDEC3BB917C ft=1 fh=920cfbc0536e6647 vn="Variante von Win32/Adware.ConvertAd.QI Anwendung" ac=I fn="C:\Users\Pandur\AppData\Local\Temp\nsmA373.tmp"
sh=D18F9E7D9803A80245486854E34EA091AE4FCA7D ft=1 fh=737ed0f21edb91f2 vn="Variante von Win32/Adware.ConvertAd.QI Anwendung" ac=I fn="C:\Users\Pandur\AppData\Local\Temp\nsmC62F.tmp"
sh=C25EBB1A61910D7B854D0E32AF6B0389A66F42B6 ft=1 fh=50d5ccf16ea44ba7 vn="Variante von Win32/Adware.ConvertAd.QI Anwendung" ac=I fn="C:\Users\Pandur\AppData\Local\Temp\nsr3953.tmp"
sh=2F1D201B1AE254E9C5A8008228911823BA8F5A35 ft=1 fh=e22ad69a47e5f92a vn="Variante von Win32/Adware.ConvertAd.QI Anwendung" ac=I fn="C:\Users\Pandur\AppData\Local\Temp\nsr5DE3.tmp"
sh=5603CC94D22611AC97AD915B57CA0EDEC3BB917C ft=1 fh=920cfbc0536e6647 vn="Variante von Win32/Adware.ConvertAd.QI Anwendung" ac=I fn="C:\Users\Pandur\AppData\Local\Temp\nsr70EE.tmp"
sh=62EA52C46CA2AEF055B149971199B16DD0624969 ft=1 fh=a523c22b957cc041 vn="Variante von Win32/Adware.ConvertAd.QI Anwendung" ac=I fn="C:\Users\Pandur\AppData\Local\Temp\nsr8051.tmp"
sh=9B59B7663D07B9998293C1AD90C521E97CF43137 ft=1 fh=4131e2a6381b9543 vn="Variante von Win32/Adware.ConvertAd.QI Anwendung" ac=I fn="C:\Users\Pandur\AppData\Local\Temp\nsw58BD.tmp"
sh=1F93F5FE420B28E0C9E9161E81DDEB4F9C9DE449 ft=1 fh=c138ae358509f971 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Pandur\AppData\Local\Temp\DMR\dmr_72.exe"
sh=5D01C8785EBEEE4CBEECCA5CA54E9A6AA16EF5D4 ft=1 fh=d622c00b87743adf vn="Variante von Win32/OptimizerPro.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Pandur\AppData\Local\Temp\is-LVU35.tmp\OptProHelper.dll"
sh=B1C5433FBB7375369084BC81132C503485C39711 ft=1 fh=558932ea8c8e5c09 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Pandur\Downloads\Emsisoft Emergency Kit - CHIP-Installer.exe"
sh=A3619CE1B68F7C606731E55E6A02A29D1DDFEFD4 ft=1 fh=0ef0ffecc2a65d37 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Pandur\Downloads\Firefox - CHIP-Installer.exe"
sh=FC3A673534D256FA77902C55AE0B188093E61754 ft=1 fh=521c4069fd6d90db vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Pandur\Downloads\LogMeIn Hamachi - CHIP-Installer.exe"
sh=8C472E025FFCF1BB483128470A33F98D2973503D ft=1 fh=bbff638460d5409b vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Pandur\Downloads\Sardu - CHIP-Installer.exe"
sh=7274708FBEC3E739945B7B6910F7512E7FA00770 ft=0 fh=0000000000000000 vn="Win32/InstallMonetizer.AN evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Pandur\Downloads\SARDU_2.0.6.5.zip"
sh=BF85D998DFD305B846F31D17B580168E8059521A ft=1 fh=5ea020e1d927144d vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Pandur\Downloads\SpyBot Search Destroy - CHIP-Installer.exe"
sh=A50D2ECE721AA1B30DA43E0BE0B73739C0BFDBB7 ft=1 fh=3d79f618121ae56a vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Pandur\Downloads\UNetbootin - CHIP-Installer.exe"
sh=CD9E7D454A0437E624DEE48A81779DA24E7357A2 ft=1 fh=b71f45b90f5672ad vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Pandur\Downloads\Windows Media Connect - CHIP-Installer.exe"
sh=A36E32D9830A525388ABA394C77850899B365AEA ft=1 fh=14ef98700fbb5c7e vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Pandur\Downloads\Windows Product Key Viewer - CHIP-Installer.exe"
sh=DFC39FEA2EF68963B067C0C4683B0A3DD6DA5D52 ft=1 fh=b65b4cdf183724ad vn="Win32/InstallMonetizer.AN evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Pandur\Downloads\SARDU_2.0.6.5\Setup.exe"
sh=EF241D41A13604CC7EFC0FE8457BC40E7FF84023 ft=1 fh=86d9559890abdcc3 vn="Variante von Win32/Adware.ConvertAd.QJ Anwendung" ac=I fn="C:\Windows\Temp\D49D.tmp.exe"
sh=E644D342C9AE32996A24D078BE0CFC82DF9CBE4A ft=1 fh=29cc8bf88f33257f vn="Variante von Win32/Adware.ConvertAd.QJ Anwendung" ac=I fn="C:\Windows\Temp\DC79.tmp.exe"
sh=D21E4C58D8A35C98CD3018FAA4D1DCFBB3CEAAB5 ft=1 fh=c93870853e49291f vn="Variante von Win32/Adware.ConvertAd.QJ Anwendung" ac=I fn="C:\Windows\Temp\DDB1.tmp.exe"
sh=E1B4F67A7B18D98C085E574465024CA89792E09F ft=1 fh=8958f12660588bb7 vn="Variante von Win32/Adware.ConvertAd.QC Anwendung" ac=I fn="C:\Windows\Temp\E189.tmp.exe"
sh=3505E9973CCB325FC419762D49963AE1CF008882 ft=1 fh=c17fc999a14beb3c vn="Variante von Win32/Adware.ConvertAd.QC Anwendung" ac=I fn="C:\Windows\Temp\E31F.tmp.exe"
sh=6169A3F8172B13B41A1071E93841215FCA9D3309 ft=1 fh=246a928187420c73 vn="Variante von Win32/Adware.ConvertAd.QJ Anwendung" ac=I fn="C:\Windows\Temp\F5C3.tmp.exe"
sh=574C5A535E43B29E0B783F7D3D3B3F04201B9D76 ft=1 fh=9ca4eef9d4eb4ff9 vn="Win32/Adware.ConvertAd.QA Anwendung" ac=I fn="C:\Windows\Temp\FA27.tmp.exe"
sh=7F552444330C8E914323B1677B93FA81CC396189 ft=1 fh=cbbdea82cd6f41d4 vn="Win32/TopMedia.B evtl. unerwünschte Anwendung" ac=I fn="C:\Windows.old\Documents and Settings\Pandur\AppData\Local\Anwendungsdaten\Temp\pACcgUgI.exe.part"
sh=7F552444330C8E914323B1677B93FA81CC396189 ft=1 fh=cbbdea82cd6f41d4 vn="Win32/TopMedia.B evtl. unerwünschte Anwendung" ac=I fn="C:\Windows.old\Documents and Settings\Pandur\AppData\Local\Temp\pACcgUgI.exe.part"
sh=60E1F2FEC9A31C5E93BB28434067A55EB79C945B ft=1 fh=ccc1781669c3d753 vn="Win32/SoftonicDownloader.A evtl. unerwünschte Anwendung" ac=I fn="C:\Windows.old\Documents and Settings\Pandur\Downloads\SoftonicDownloader29371.exe"
sh=27E2BC49EC7018C8F91660DD145E181638C41F4B ft=1 fh=1654f2b05b9444d7 vn="Win32/SoftonicDownloader.D evtl. unerwünschte Anwendung" ac=I fn="C:\Windows.old\Documents and Settings\Pandur\Downloads\SoftonicDownloader_fuer_burnaware-free.exe"
sh=02FFD21A2425BF42FEF241ABB1E39781385F5434 ft=1 fh=2b3bafae1d510bb8 vn="Win32/SoftonicDownloader.A evtl. unerwünschte Anwendung" ac=I fn="C:\Windows.old\Documents and Settings\Pandur\Downloads\SoftonicDownloader_fuer_germanix-transcoder.exe"
sh=450B0AD6627A2921A1B5A284329A6F7CCB3AF73A ft=1 fh=580fb0254474db9d vn="Win32/SoftonicDownloader.A evtl. unerwünschte Anwendung" ac=I fn="C:\Windows.old\Documents and Settings\Pandur\Downloads\SoftonicDownloader_fuer_k-lite-codec-pack.exe"
sh=0258FFF1313E8F393A9FDBA8D75F28E9F9873A12 ft=1 fh=4cb56bd07d5b55d2 vn="Win32/SoftonicDownloader.A evtl. unerwünschte Anwendung" ac=I fn="C:\Windows.old\Documents and Settings\Pandur\Downloads\SoftonicDownloader_fuer_teamspeak.exe"
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=ebded8588c0f824fb64b050ba2456784
# engine=24080
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-05-29 12:15:13
# local_time=2015-05-29 02:15:13 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 51986922 184531563 0 0
# scanned=862493
# found=26
# cleaned=17
# scan_time=11234
sh=7F552444330C8E914323B1677B93FA81CC396189 ft=1 fh=cbbdea82cd6f41d4 vn="Win32/TopMedia.B evtl. unerwünschte Anwendung" ac=I fn="C:\Windows.old\Documents and Settings\Pandur\AppData\Local\Temp\pACcgUgI.exe.part"
sh=7F552444330C8E914323B1677B93FA81CC396189 ft=1 fh=cbbdea82cd6f41d4 vn="Win32/TopMedia.B evtl. unerwünschte Anwendung" ac=I fn="C:\Windows.old\Documents and Settings\Pandur\Lokale Einstellungen\Temp\pACcgUgI.exe.part"
sh=7F552444330C8E914323B1677B93FA81CC396189 ft=1 fh=cbbdea82cd6f41d4 vn="Win32/TopMedia.B evtl. unerwünschte Anwendung" ac=I fn="C:\Windows.old\Users\Pandur\AppData\Local\Temp\pACcgUgI.exe.part"
sh=60E1F2FEC9A31C5E93BB28434067A55EB79C945B ft=1 fh=ccc1781669c3d753 vn="Win32/SoftonicDownloader.A evtl. unerwünschte Anwendung" ac=I fn="C:\Windows.old\Users\Pandur\Downloads\SoftonicDownloader29371.exe"
sh=27E2BC49EC7018C8F91660DD145E181638C41F4B ft=1 fh=1654f2b05b9444d7 vn="Win32/SoftonicDownloader.D evtl. unerwünschte Anwendung" ac=I fn="C:\Windows.old\Users\Pandur\Downloads\SoftonicDownloader_fuer_burnaware-free.exe"
sh=02FFD21A2425BF42FEF241ABB1E39781385F5434 ft=1 fh=2b3bafae1d510bb8 vn="Win32/SoftonicDownloader.A evtl. unerwünschte Anwendung" ac=I fn="C:\Windows.old\Users\Pandur\Downloads\SoftonicDownloader_fuer_germanix-transcoder.exe"
sh=450B0AD6627A2921A1B5A284329A6F7CCB3AF73A ft=1 fh=580fb0254474db9d vn="Win32/SoftonicDownloader.A evtl. unerwünschte Anwendung" ac=I fn="C:\Windows.old\Users\Pandur\Downloads\SoftonicDownloader_fuer_k-lite-codec-pack.exe"
sh=0258FFF1313E8F393A9FDBA8D75F28E9F9873A12 ft=1 fh=4cb56bd07d5b55d2 vn="Win32/SoftonicDownloader.A evtl. unerwünschte Anwendung" ac=I fn="C:\Windows.old\Users\Pandur\Downloads\SoftonicDownloader_fuer_teamspeak.exe"
sh=7F552444330C8E914323B1677B93FA81CC396189 ft=1 fh=cbbdea82cd6f41d4 vn="Win32/TopMedia.B evtl. unerwünschte Anwendung" ac=I fn="C:\Windows.old\Users\Pandur\Lokale Einstellungen\Temp\pACcgUgI.exe.part"
sh=09E369F9EA069BC141F0D34DC18AEC3ABBA77F6B ft=1 fh=241f3ea108f7cde2 vn="Variante von Win32/Adware.Vonteera.L Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Convertor\Convertor.exe.vir"
sh=09E369F9EA069BC141F0D34DC18AEC3ABBA77F6B ft=1 fh=241f3ea108f7cde2 vn="Variante von Win32/Adware.Vonteera.L Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Winsta\bin\Winsta.exe.vir"
sh=B1C5433FBB7375369084BC81132C503485C39711 ft=1 fh=558932ea8c8e5c09 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Pandur\Downloads\Emsisoft Emergency Kit - CHIP-Installer.exe"
sh=A3619CE1B68F7C606731E55E6A02A29D1DDFEFD4 ft=1 fh=0ef0ffecc2a65d37 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Pandur\Downloads\Firefox - CHIP-Installer.exe"
sh=FC3A673534D256FA77902C55AE0B188093E61754 ft=1 fh=521c4069fd6d90db vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Pandur\Downloads\LogMeIn Hamachi - CHIP-Installer.exe"
sh=8C472E025FFCF1BB483128470A33F98D2973503D ft=1 fh=bbff638460d5409b vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Pandur\Downloads\Sardu - CHIP-Installer.exe"
sh=BF85D998DFD305B846F31D17B580168E8059521A ft=1 fh=5ea020e1d927144d vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Pandur\Downloads\SpyBot Search Destroy - CHIP-Installer.exe"
sh=A50D2ECE721AA1B30DA43E0BE0B73739C0BFDBB7 ft=1 fh=3d79f618121ae56a vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Pandur\Downloads\UNetbootin - CHIP-Installer.exe"
sh=CD9E7D454A0437E624DEE48A81779DA24E7357A2 ft=1 fh=b71f45b90f5672ad vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Pandur\Downloads\Windows Media Connect - CHIP-Installer.exe"
sh=A36E32D9830A525388ABA394C77850899B365AEA ft=1 fh=14ef98700fbb5c7e vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Pandur\Downloads\Windows Product Key Viewer - CHIP-Installer.exe"
sh=DFC39FEA2EF68963B067C0C4683B0A3DD6DA5D52 ft=1 fh=b65b4cdf183724ad vn="Win32/InstallMonetizer.AN evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Pandur\Downloads\SARDU_2.0.6.5\Setup.exe"
sh=7F552444330C8E914323B1677B93FA81CC396189 ft=1 fh=cbbdea82cd6f41d4 vn="Win32/TopMedia.B evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Windows.old\Documents and Settings\Pandur\AppData\Local\Anwendungsdaten\Temp\pACcgUgI.exe.part"
sh=60E1F2FEC9A31C5E93BB28434067A55EB79C945B ft=1 fh=ccc1781669c3d753 vn="Win32/SoftonicDownloader.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Windows.old\Documents and Settings\Pandur\Downloads\SoftonicDownloader29371.exe"
sh=27E2BC49EC7018C8F91660DD145E181638C41F4B ft=1 fh=1654f2b05b9444d7 vn="Win32/SoftonicDownloader.D evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Windows.old\Documents and Settings\Pandur\Downloads\SoftonicDownloader_fuer_burnaware-free.exe"
sh=02FFD21A2425BF42FEF241ABB1E39781385F5434 ft=1 fh=2b3bafae1d510bb8 vn="Win32/SoftonicDownloader.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Windows.old\Documents and Settings\Pandur\Downloads\SoftonicDownloader_fuer_germanix-transcoder.exe"
sh=450B0AD6627A2921A1B5A284329A6F7CCB3AF73A ft=1 fh=580fb0254474db9d vn="Win32/SoftonicDownloader.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Windows.old\Documents and Settings\Pandur\Downloads\SoftonicDownloader_fuer_k-lite-codec-pack.exe"
sh=0258FFF1313E8F393A9FDBA8D75F28E9F9873A12 ft=1 fh=4cb56bd07d5b55d2 vn="Win32/SoftonicDownloader.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Windows.old\Documents and Settings\Pandur\Downloads\SoftonicDownloader_fuer_teamspeak.exe"
Code:
ATTFilter Results of screen317's Security Check version 1.002
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Avira Antivirus
Antivirus up to date! (On Access scanning disabled!)
`````````Anti-malware/Other Utilities Check:`````````
Java version 32-bit out of Date!
Adobe Flash Player 17.0.0.188
Adobe Reader XI
Mozilla Firefox (38.0.1)
````````Process Check: objlist.exe by Laurent````````
Avira Antivir avgnt.exe
Avira Antivir avguard.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 27-05-2015 01
Ran by Pandur (administrator) on BABY on 29-05-2015 14:37:32
Running from C:\Users\Pandur\Downloads
Loaded Profiles: Pandur (Available Profiles: Pandur)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(
ASUSTeK Computer Inc.) C:\Program Files\ASUS\GPU Boost Driver\GpuBoostServer.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Ralink Technology, Corp.) C:\Program Files (x86)\Ralink\Common\RaRegistry.exe
(Ralink Technology, Corp.) C:\Program Files (x86)\Ralink\Common\RaRegistry64.exe
(Realtek) C:\Program Files (x86)\REALTEK\11n USB Wireless LAN Utility\RtlService.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Ralink Technology, Corp.) C:\Program Files (x86)\Ralink\Common\RaUI.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(NEC Electronics Corporation) C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Realtek Semiconductor Corp.) C:\Program Files (x86)\REALTEK\11n USB Wireless LAN Utility\RtWLan.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_188.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_188.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7174728 2013-03-29] (Realtek Semiconductor)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2685072 2015-05-08] (NVIDIA Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [728312 2015-05-05] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [106496 2010-01-22] (NEC Electronics Corporation)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [129272 2015-03-16] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Ralink Wireless Utility.lnk [2015-05-03]
ShortcutTarget: Ralink Wireless Utility.lnk -> C:\Program Files (x86)\Ralink\Common\RaUI.exe (Ralink Technology, Corp.)
BootExecute: autocheck autochk * sdnclean64.exe
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-4083855489-4222839378-707726563-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-4083855489-4222839378-707726563-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_45\bin\ssv.dll [2015-04-14] (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-04-14] (Oracle Corporation)
BHO-x32: No Name -> {120A8821-2BEE-4C29-BCDA-62C577781992} -> No File
BHO-x32: ArcPluginIEBHO Class -> {84BFE29A-8139-402a-B2A4-C23AE9E1A75F} -> C:\Program Files (x86)\Perfect World Entertainment\Arc\Plugins\ArcPluginIE.dll [2014-07-02] (Perfect World Entertainment Inc)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.192.1
FireFox:
========
FF ProfilePath: C:\Users\Pandur\AppData\Roaming\Mozilla\Firefox\Profiles\1olm1qcv.default-1432326152348
FF Homepage: https://www.google.de/
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_188.dll [2015-05-19] ()
FF Plugin: @esn/npbattlelog,version=2.6.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.6.2\npbattlelogx64.dll [2015-01-13] (EA Digital Illusions CE AB)
FF Plugin: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-04-14] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-04-14] (Oracle Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_188.dll [2015-05-19] ()
FF Plugin-x32: @esn/npbattlelog,version=2.4.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.4.0\npbattlelog.dll No File
FF Plugin-x32: @esn/npbattlelog,version=2.6.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.6.2\npbattlelog.dll [2015-01-13] (EA Digital Illusions CE AB)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2015-05-12] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2015-05-12] (NVIDIA Corporation)
FF Plugin-x32: @perfectworld.com/npArcPlayNowPlugin -> C:\Program Files (x86)\Perfect World Entertainment\Arc\Plugins\npArcPluginFF.dll [2014-07-02] (Perfect World Entertainment Inc)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)
FF Extension: Recorder Toolbar - C:\Program Files (x86)\Mozilla Firefox\extensions\{10743931-94DF-476f-A987-4391233C17A2} [2015-05-18]
StartMenuInternet: FIREFOX.EXE - firefox.exe
Chrome:
=======
CHR Profile: C:\Users\Pandur\AppData\Local\Google\Chrome\User Data\Default
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [827640 2015-05-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [434424 2015-05-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [434424 2015-05-05] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1185584 2015-05-05] (Avira Operations GmbH & Co. KG)
S3 ArcService; C:\Program Files (x86)\Perfect World Entertainment\Arc\ArcService.exe [88400 2014-07-02] (Perfect World Entertainment Inc)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [201008 2015-03-16] (Avira Operations GmbH & Co. KG)
S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [448384 2014-12-06] ()
S3 BRSptSvc; C:\ProgramData\BitRaider\BRSptSvc.exe [477960 2014-07-08] (BitRaider, LLC)
R2 DiagTrack; C:\Windows\system32\diagtrack.dll [1254400 2015-04-27] (Microsoft Corporation)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1152656 2015-05-08] (NVIDIA Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1884304 2015-05-08] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [22997648 2015-05-08] (NVIDIA Corporation)
S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [1910128 2015-01-27] (Electronic Arts)
R2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [76152 2014-07-10] ()
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76152 2015-02-03] ()
S3 RaMediaServer; C:\Program Files (x86)\Ralink\Common\RaMediaServer.exe [1863680 2012-07-06] (Ralink) [File not signed]
R2 Realtek11nSU; C:\Program Files (x86)\REALTEK\11n USB Wireless LAN Utility\RtlService.exe [36864 2010-04-16] (Realtek) [File not signed]
S3 TunngleService; D:\Program Files (x86)\Tunngle\TnglCtrl.exe [792016 2015-02-09] (Tunngle.net GmbH)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2009-08-04] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [152744 2015-05-05] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132120 2015-05-05] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [44088 2015-03-10] (Avira Operations GmbH & Co. KG)
S3 BRDriver64; C:\ProgramData\BitRaider\BRDriver64.sys [75048 2014-07-08] (BitRaider)
S3 cleanhlp; C:\EEK\bin\cleanhlp64.sys [57024 2015-02-09] (Emsisoft GmbH)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-04-14] (Malwarebytes Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-16] ()
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2015-05-08] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38032 2014-11-22] (NVIDIA Corporation)
R3 tap0901t; C:\Windows\System32\DRIVERS\tap0901t.sys [31232 2009-09-16] (Tunngle.net)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
S3 MSICDSetup; \??\E:\CDriver64.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-05-29 14:36 - 2015-05-29 14:36 - 00000801 _____ () C:\Users\Pandur\Desktop\checkup.txt
2015-05-29 14:33 - 2015-05-29 14:33 - 00852639 _____ () C:\Users\Pandur\Downloads\SecurityCheck.exe
2015-05-29 11:06 - 2015-05-29 11:06 - 02347384 _____ (ESET) C:\Users\Pandur\Downloads\esetsmartinstaller_deu(1).exe
2015-05-28 13:58 - 2015-05-28 13:59 - 00000747 _____ () C:\Users\Pandur\Desktop\JRT.txt
2015-05-28 13:56 - 2015-05-27 12:41 - 02946603 _____ (Thisisu) C:\Users\Pandur\Desktop\JRT_NEW.exe
2015-05-28 13:53 - 2015-05-28 13:53 - 00001037 _____ () C:\Users\Pandur\Desktop\AdwCleaner[S1].txt
2015-05-28 13:50 - 2015-05-28 13:50 - 00001212 _____ () C:\Users\Pandur\Desktop\mbam.txt
2015-05-28 13:29 - 2015-05-28 13:29 - 00000000 ____D () C:\Users\Pandur\Downloads\FRST-OlderVersion
2015-05-27 20:02 - 2015-05-27 20:02 - 00026501 _____ () C:\ComboFix.txt
2015-05-27 19:48 - 2015-05-27 20:02 - 00000000 ____D () C:\Qoobox
2015-05-27 19:48 - 2015-05-27 20:01 - 00000000 ____D () C:\Windows\erdnt
2015-05-27 19:48 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-05-27 19:48 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-05-27 19:48 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-05-27 19:48 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-05-27 19:48 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-05-27 19:48 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2015-05-27 19:48 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2015-05-27 19:48 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2015-05-27 19:47 - 2015-05-27 19:47 - 05628291 ____R (Swearware) C:\Users\Pandur\Desktop\ComboFix.exe
2015-05-26 19:29 - 2015-05-26 19:29 - 00000000 ____D () C:\Program Files (x86)\Microsoft ASP.NET
2015-05-25 20:58 - 2015-05-12 04:34 - 00571024 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2015-05-25 20:56 - 2015-05-13 08:52 - 00195912 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys
2015-05-25 20:56 - 2015-05-13 08:52 - 00031552 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll
2015-05-25 20:56 - 2015-05-12 08:27 - 42718864 _____ () C:\Windows\system32\nvcompiler.dll
2015-05-25 20:56 - 2015-05-12 08:27 - 37741712 _____ () C:\Windows\SysWOW64\nvcompiler.dll
2015-05-25 20:56 - 2015-05-12 08:27 - 30478992 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2015-05-25 20:56 - 2015-05-12 08:27 - 22945424 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2015-05-25 20:56 - 2015-05-12 08:27 - 16145176 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2015-05-25 20:56 - 2015-05-12 08:27 - 15858728 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2015-05-25 20:56 - 2015-05-12 08:27 - 14455296 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2015-05-25 20:56 - 2015-05-12 08:27 - 13263568 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2015-05-25 20:56 - 2015-05-12 08:27 - 11790144 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2015-05-25 20:56 - 2015-05-12 08:27 - 10972304 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2015-05-25 20:56 - 2015-05-12 08:27 - 02932368 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2015-05-25 20:56 - 2015-05-12 08:27 - 02599056 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2015-05-25 20:56 - 2015-05-12 08:27 - 01898312 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6435286.dll
2015-05-25 20:56 - 2015-05-12 08:27 - 01557648 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6435286.dll
2015-05-25 20:56 - 2015-05-12 08:27 - 01099808 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll
2015-05-25 20:56 - 2015-05-12 08:27 - 01059984 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2015-05-25 20:56 - 2015-05-12 08:27 - 01050256 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2015-05-25 20:56 - 2015-05-12 08:27 - 00982672 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2015-05-25 20:56 - 2015-05-12 08:27 - 00974480 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2015-05-25 20:56 - 2015-05-12 08:27 - 00939080 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll
2015-05-25 20:56 - 2015-05-12 08:27 - 00502896 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncodeAPI64.dll
2015-05-25 20:56 - 2015-05-12 08:27 - 00408208 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFROpenGL.dll
2015-05-25 20:56 - 2015-05-12 08:27 - 00407296 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncodeAPI.dll
2015-05-25 20:56 - 2015-05-12 08:27 - 00364176 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFROpenGL.dll
2015-05-25 20:56 - 2015-05-12 08:27 - 00176064 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll
2015-05-25 20:56 - 2015-05-12 08:27 - 00154256 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll
2015-05-25 20:56 - 2015-05-12 08:27 - 00150832 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
2015-05-25 20:56 - 2015-05-12 08:27 - 00128512 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
2015-05-25 20:55 - 2015-05-08 02:35 - 01316184 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll
2015-05-25 20:55 - 2015-05-08 02:34 - 01756424 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll
2015-05-25 20:55 - 2014-11-22 12:46 - 00038032 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2015-05-25 20:55 - 2014-11-22 12:46 - 00032400 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2015-05-25 20:06 - 2015-05-25 20:06 - 00380416 _____ () C:\Users\Pandur\Downloads\Gmer-19357.exe
2015-05-25 19:08 - 2015-05-28 13:31 - 00063293 _____ () C:\Users\Pandur\Desktop\FRST.txt
2015-05-25 19:07 - 2015-05-25 19:07 - 00067003 _____ () C:\Users\Pandur\Downloads\Addition.txt
2015-05-25 19:06 - 2015-05-29 14:37 - 00014052 _____ () C:\Users\Pandur\Downloads\FRST.txt
2015-05-25 19:06 - 2015-05-29 14:37 - 00000000 ____D () C:\FRST
2015-05-25 19:05 - 2015-05-28 13:29 - 02108928 _____ (Farbar) C:\Users\Pandur\Downloads\FRST64.exe
2015-05-25 19:04 - 2015-05-25 19:05 - 00000474 _____ () C:\Users\Pandur\Downloads\defogger_disable.log
2015-05-25 19:04 - 2015-05-25 19:04 - 00050477 _____ () C:\Users\Pandur\Downloads\Defogger.exe
2015-05-25 19:04 - 2015-05-25 19:04 - 00000000 _____ () C:\Users\Pandur\defogger_reenable
2015-05-25 17:19 - 2015-05-25 17:20 - 02347384 _____ (ESET) C:\Users\Pandur\Downloads\esetsmartinstaller_deu.exe
2015-05-25 17:18 - 2015-05-25 17:19 - 00463688 _____ (Bleeping Computer, LLC) C:\Users\Pandur\Downloads\sc-cleaner.exe
2015-05-25 17:16 - 2015-05-25 17:16 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-BABY-Windows-7-Professional-(64-bit).dat
2015-05-25 17:16 - 2015-05-25 17:16 - 00000000 ____D () C:\RegBackup
2015-05-25 17:15 - 2015-05-25 17:15 - 02945770 _____ (Thisisu) C:\Users\Pandur\Downloads\JRT.exe
2015-05-25 17:08 - 2015-05-28 13:52 - 00000000 ____D () C:\AdwCleaner
2015-05-25 17:08 - 2015-05-25 17:08 - 02222592 _____ () C:\Users\Pandur\Downloads\AdwCleaner_4.205.exe
2015-05-25 16:49 - 2015-05-25 16:49 - 04737952 _____ () C:\Users\Pandur\Downloads\ausetup5.3.1.20.exe
2015-05-25 16:49 - 2015-05-25 16:49 - 00001230 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Absolute Uninstaller.lnk
2015-05-25 16:49 - 2015-05-25 16:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glarysoft
2015-05-25 16:49 - 2015-05-25 16:49 - 00000000 ____D () C:\Program Files (x86)\Glarysoft
2015-05-25 16:46 - 2015-05-28 13:32 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-05-25 16:46 - 2015-05-28 13:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-05-25 16:46 - 2015-05-28 13:32 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2015-05-25 16:46 - 2015-05-25 16:46 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\Pandur\Downloads\mbam-setup-2.1.6.1022.exe
2015-05-25 16:46 - 2015-05-25 16:46 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-05-25 16:46 - 2015-04-14 09:37 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-05-25 16:46 - 2015-04-14 09:37 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-05-25 16:46 - 2015-04-14 09:37 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-05-25 16:23 - 2015-05-25 16:23 - 00060965 _____ () C:\Users\Pandur\Downloads\pkeyuibx_v1.5.0.zip
2015-05-25 16:23 - 2015-05-25 16:23 - 00000000 ____D () C:\Users\Pandur\Downloads\pkeyuibx_v1.5.0
2015-05-25 15:56 - 2015-05-25 18:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SARDU
2015-05-25 15:55 - 2015-05-29 14:14 - 00000000 ____D () C:\Users\Pandur\Downloads\SARDU_2.0.6.5
2015-05-25 15:54 - 2015-05-25 15:54 - 14021962 _____ () C:\Users\Pandur\Downloads\SARDU_2.0.6.5.zip
2015-05-24 21:51 - 2015-05-24 21:55 - 674234368 _____ () C:\Users\Pandur\Downloads\bitdefender-rescue-cd.iso
2015-05-24 21:48 - 2015-05-24 21:48 - 00231544 _____ () C:\Users\Pandur\Downloads\Install_JDownloader_2_BETA.exe
2015-05-23 18:36 - 2015-05-28 21:06 - 00000080 _____ () C:\Users\Pandur\AppData\Local剜捯獫慴慇敭屳呇⁁屖湥楴汴浥湥湩潦
2015-05-22 22:27 - 2015-05-24 21:36 - 00000000 ____D () C:\EEK
2015-05-22 22:27 - 2015-05-22 22:27 - 00000743 _____ () C:\Users\Pandur\Desktop\Start Emsisoft Emergency Kit.lnk
2015-05-22 22:18 - 2015-05-22 22:18 - 00003142 _____ () C:\Windows\System32\Tasks\{5C8F0819-D8F3-47D2-8AF3-8E5BAB226457}
2015-05-22 22:15 - 2015-05-27 19:57 - 00030962 _____ () C:\Windows\PFRO.log
2015-05-21 17:26 - 2015-05-29 10:53 - 00005705 _____ () C:\Windows\setupact.log
2015-05-21 17:26 - 2015-05-21 17:26 - 00000000 _____ () C:\Windows\setuperr.log
2015-05-20 20:50 - 2015-05-20 20:50 - 00178748 _____ () C:\Users\Pandur\Downloads\cc_20150520_205004.reg
2015-05-20 19:43 - 2015-05-20 19:43 - 00000000 __SHD () C:\Users\Pandur\AppData\Local\EmieBrowserModeList
2015-05-20 19:40 - 2015-05-20 19:43 - 00000000 ____D () C:\Program Files (x86)\Opera
2015-05-20 19:40 - 2015-05-20 19:40 - 00000000 ____D () C:\Users\Pandur\AppData\Roaming\Opera Software
2015-05-20 19:40 - 2015-05-20 19:40 - 00000000 ____D () C:\Users\Pandur\AppData\Local\Opera Software
2015-05-20 19:40 - 2009-06-10 23:00 - 00000824 _____ () C:\Windows\system32\Drivers\etc\hp.bak
2015-05-18 19:57 - 2015-05-18 19:57 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-05-13 23:15 - 2015-05-01 15:17 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 23:15 - 2015-05-01 15:16 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 16:37 - 2015-05-05 03:29 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-05-13 16:37 - 2015-05-05 03:12 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-05-13 16:37 - 2015-04-27 21:28 - 05569984 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-05-13 16:37 - 2015-04-27 21:28 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-05-13 16:37 - 2015-04-27 21:28 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-05-13 16:37 - 2015-04-27 21:26 - 01728960 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 01254400 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 01162752 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00113664 _____ (Microsoft Corporation) C:\Windows\system32\sechost.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-05-13 16:37 - 2015-04-27 21:23 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-05-13 16:37 - 2015-04-27 21:22 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\tracerpt.exe
2015-05-13 16:37 - 2015-04-27 21:22 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-05-13 16:37 - 2015-04-27 21:22 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-05-13 16:37 - 2015-04-27 21:22 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-05-13 16:37 - 2015-04-27 21:22 - 00104448 _____ (Microsoft Corporation) C:\Windows\system32\logman.exe
2015-05-13 16:37 - 2015-04-27 21:22 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\typeperf.exe
2015-05-13 16:37 - 2015-04-27 21:22 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\relog.exe
2015-05-13 16:37 - 2015-04-27 21:22 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-05-13 16:37 - 2015-04-27 21:22 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\diskperf.exe
2015-05-13 16:37 - 2015-04-27 21:21 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-05-13 16:37 - 2015-04-27 21:18 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-05-13 16:37 - 2015-04-27 21:18 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 21:11 - 03989440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-05-13 16:37 - 2015-04-27 21:11 - 03934144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-05-13 16:37 - 2015-04-27 21:08 - 01310744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-05-13 16:37 - 2015-04-27 21:05 - 00635392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2015-05-13 16:37 - 2015-04-27 21:05 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-05-13 16:37 - 2015-04-27 21:05 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-05-13 16:37 - 2015-04-27 21:05 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-05-13 16:37 - 2015-04-27 21:05 - 00092160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sechost.dll
2015-05-13 16:37 - 2015-04-27 21:05 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-05-13 16:37 - 2015-04-27 21:05 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-05-13 16:37 - 2015-04-27 21:05 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-05-13 16:37 - 2015-04-27 21:05 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-05-13 16:37 - 2015-04-27 21:04 - 00641536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2015-05-13 16:37 - 2015-04-27 21:04 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-05-13 16:37 - 2015-04-27 21:04 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tracerpt.exe
2015-05-13 16:37 - 2015-04-27 21:04 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\logman.exe
2015-05-13 16:37 - 2015-04-27 21:04 - 00040448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\typeperf.exe
2015-05-13 16:37 - 2015-04-27 21:04 - 00037888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\relog.exe
2015-05-13 16:37 - 2015-04-27 21:04 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-05-13 16:37 - 2015-04-27 21:04 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-05-13 16:37 - 2015-04-27 21:03 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-05-13 16:37 - 2015-04-27 21:03 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-05-13 16:37 - 2015-04-27 21:03 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-05-13 16:37 - 2015-04-27 21:03 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-05-13 16:37 - 2015-04-27 21:03 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\diskperf.exe
2015-05-13 16:37 - 2015-04-27 21:03 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-05-13 16:37 - 2015-04-27 21:01 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-05-13 16:37 - 2015-04-27 21:01 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 20:06 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-05-13 16:37 - 2015-04-27 19:57 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-05-13 16:37 - 2015-04-27 19:57 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-05-13 16:37 - 2015-04-27 19:55 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 19:55 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-05-13 16:37 - 2015-04-27 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-05-13 16:37 - 2015-04-22 04:28 - 00389840 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-05-13 16:37 - 2015-04-22 03:48 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-05-13 16:37 - 2015-04-21 19:14 - 24971776 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-05-13 16:37 - 2015-04-21 19:08 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-05-13 16:37 - 2015-04-21 19:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-05-13 16:37 - 2015-04-21 18:51 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-05-13 16:37 - 2015-04-21 18:50 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-05-13 16:37 - 2015-04-21 18:50 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-05-13 16:37 - 2015-04-21 18:50 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-05-13 16:37 - 2015-04-21 18:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-05-13 16:37 - 2015-04-21 18:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-05-13 16:37 - 2015-04-21 18:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-05-13 16:37 - 2015-04-21 18:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-05-13 16:37 - 2015-04-21 18:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-05-13 16:37 - 2015-04-21 18:35 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-05-13 16:37 - 2015-04-21 18:35 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-05-13 16:37 - 2015-04-21 18:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-05-13 16:37 - 2015-04-21 18:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-05-13 16:37 - 2015-04-21 18:31 - 06025728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-05-13 16:37 - 2015-04-21 18:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-05-13 16:37 - 2015-04-21 18:25 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-05-13 16:37 - 2015-04-21 18:24 - 19691008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-05-13 16:37 - 2015-04-21 18:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-05-13 16:37 - 2015-04-21 18:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-05-13 16:37 - 2015-04-21 18:11 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-05-13 16:37 - 2015-04-21 18:11 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-05-13 16:37 - 2015-04-21 18:10 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-05-13 16:37 - 2015-04-21 18:09 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-05-13 16:37 - 2015-04-21 18:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-05-13 16:37 - 2015-04-21 18:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-05-13 16:37 - 2015-04-21 18:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-05-13 16:37 - 2015-04-21 18:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-05-13 16:37 - 2015-04-21 18:04 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-05-13 16:37 - 2015-04-21 18:03 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-05-13 16:37 - 2015-04-21 18:02 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-05-13 16:37 - 2015-04-21 18:00 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-05-13 16:37 - 2015-04-21 17:58 - 00664576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-05-13 16:37 - 2015-04-21 17:58 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-05-13 16:37 - 2015-04-21 17:57 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-05-13 16:37 - 2015-04-21 17:49 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-05-13 16:37 - 2015-04-21 17:49 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-05-13 16:37 - 2015-04-21 17:48 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-05-13 16:37 - 2015-04-21 17:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-05-13 16:37 - 2015-04-21 17:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-05-13 16:37 - 2015-04-21 17:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-05-13 16:37 - 2015-04-21 17:40 - 14401536 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-05-13 16:37 - 2015-04-21 17:39 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-05-13 16:37 - 2015-04-21 17:38 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-05-13 16:37 - 2015-04-21 17:36 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-05-13 16:37 - 2015-04-21 17:31 - 04305920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-05-13 16:37 - 2015-04-21 17:27 - 02352128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-05-13 16:37 - 2015-04-21 17:26 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-05-13 16:37 - 2015-04-21 17:25 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-05-13 16:37 - 2015-04-21 17:24 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-05-13 16:37 - 2015-04-21 17:17 - 12828672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-05-13 16:37 - 2015-04-21 17:15 - 01547264 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-05-13 16:37 - 2015-04-21 17:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-05-13 16:37 - 2015-04-21 17:02 - 01882112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-05-13 16:37 - 2015-04-21 16:58 - 01310208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-05-13 16:37 - 2015-04-21 16:56 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-05-13 16:37 - 2015-04-20 05:17 - 01647104 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-05-13 16:37 - 2015-04-20 05:17 - 01179136 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-05-13 16:37 - 2015-04-20 04:56 - 01250816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2015-05-13 16:37 - 2015-04-20 04:11 - 03204608 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-05-13 16:37 - 2015-04-18 05:10 - 00460800 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-05-13 16:37 - 2015-04-18 04:56 - 00342016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2015-05-13 16:37 - 2015-04-13 05:28 - 00328704 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2015-05-13 16:37 - 2015-04-08 05:29 - 00275456 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2015-05-13 16:37 - 2015-04-08 05:29 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll
2015-05-13 16:37 - 2015-04-08 05:14 - 00216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll
2015-05-13 16:36 - 2015-03-04 06:41 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll
2015-05-13 16:36 - 2015-03-04 06:41 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\aelupsvc.dll
2015-05-13 16:36 - 2015-03-04 06:41 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\sdbinst.exe
2015-05-13 16:36 - 2015-03-04 06:41 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\shimeng.dll
2015-05-13 16:36 - 2015-03-04 06:11 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shimeng.dll
2015-05-13 16:36 - 2015-03-04 06:10 - 00295936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apphelp.dll
2015-05-13 16:36 - 2015-03-04 06:10 - 00020992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sdbinst.exe
2015-05-13 16:36 - 2015-02-18 09:06 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe
2015-05-13 16:36 - 2015-02-18 09:04 - 00142336 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2015-05-13 16:36 - 2015-01-29 05:19 - 02543104 _____ (Microsoft Corporation) C:\Windows\system32\wpdshext.dll
2015-05-13 16:36 - 2015-01-29 05:02 - 02311168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wpdshext.dll
2015-05-08 15:10 - 2015-05-08 15:15 - 00000000 ____D () C:\Users\Pandur\Documents\Project CARS
2015-05-08 15:10 - 2015-05-08 15:10 - 00000000 ____D () C:\Users\Pandur\Documents\wmd_symbol_cache
2015-05-03 13:22 - 2015-05-03 13:24 - 00000000 ____D () C:\ProgramData\Ralink
2015-05-03 13:22 - 2012-05-10 22:01 - 01503744 _____ (The OpenSSL Project, hxxp://www.openssl.org/) C:\Windows\system32\libeay32.dll
2015-05-03 13:22 - 2012-05-10 22:01 - 00308736 _____ (The OpenSSL Project, hxxp://www.openssl.org/) C:\Windows\system32\ssleay32.dll
2015-05-03 13:21 - 2015-05-03 13:21 - 00003486 _____ () C:\Windows\system32\RaCoInst.log
2015-05-03 13:21 - 2015-05-03 13:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ralink Wireless
2015-05-03 13:20 - 2015-05-03 13:20 - 00000000 ____D () C:\Windows\system32\RaLanguages
2015-05-03 13:20 - 2015-05-03 13:20 - 00000000 ____D () C:\ProgramData\Ralink Driver
2015-05-03 13:20 - 2015-05-03 13:20 - 00000000 ____D () C:\Program Files (x86)\Ralink
2015-05-03 13:20 - 2013-09-06 20:43 - 02273072 _____ (Ralink Technology Corp.) C:\Windows\system32\Drivers\netr28ux.sys
2015-05-03 13:20 - 2013-08-27 09:18 - 00331568 _____ (Ralink Technology, Inc.) C:\Windows\system32\RaCoInstx.dll
2015-05-03 13:20 - 2013-08-27 09:18 - 00013973 _____ () C:\Windows\SysWOW64\RaCoInst.dat
2015-05-03 13:20 - 2013-08-27 09:18 - 00013973 _____ () C:\Windows\system32\RaCoInst.dat
2015-05-03 13:20 - 2013-08-23 14:10 - 00080316 _____ () C:\Windows\SysWOW64\Drivers\FW_7610.bin
2015-05-03 13:20 - 2013-08-23 14:10 - 00080316 _____ () C:\Windows\system32\Drivers\FW_7610.bin
2015-05-03 13:20 - 2013-07-03 09:59 - 00046692 _____ () C:\Windows\SysWOW64\Drivers\FW_7601.bin
2015-05-03 13:20 - 2013-07-03 09:59 - 00046692 _____ () C:\Windows\system32\Drivers\FW_7601.bin
2015-05-03 13:20 - 2013-07-03 09:59 - 00008192 _____ () C:\Windows\SysWOW64\Drivers\FW_2870.bin
2015-05-03 13:20 - 2013-07-03 09:59 - 00008192 _____ () C:\Windows\system32\Drivers\FW_2870.bin
2015-05-03 13:20 - 2013-07-03 09:59 - 00004096 _____ () C:\Windows\SysWOW64\Drivers\FW_3573.bin
2015-05-03 13:20 - 2013-07-03 09:59 - 00004096 _____ () C:\Windows\system32\Drivers\FW_3573.bin
2015-05-03 13:20 - 2012-08-01 16:46 - 01115648 _____ (Ralink Technology, Corp.) C:\Windows\SysWOW64\RAIHV.dll
2015-05-03 13:20 - 2012-08-01 16:46 - 01115648 _____ (Ralink Technology, Corp.) C:\Windows\system32\RAIHV.dll
2015-05-03 13:20 - 2012-01-10 11:39 - 00127488 _____ (Ralink Technology, Corp.) C:\Windows\SysWOW64\RAEXTUI.dll
2015-05-03 13:20 - 2012-01-10 11:39 - 00127488 _____ (Ralink Technology, Corp.) C:\Windows\system32\RAEXTUI.dll
2015-05-03 13:20 - 2011-05-04 13:57 - 02403392 _____ (Ralink Technology, Corp.) C:\Windows\system32\RaCertMgr.dll
2015-05-03 13:20 - 2011-05-04 13:56 - 01608768 _____ (Ralink Technology, Corp.) C:\Windows\SysWOW64\RaCertMgr.dll
2015-05-03 13:20 - 2010-06-29 10:35 - 00792416 _____ () C:\Windows\SysWOW64\DiagFunc.dll
2015-05-03 13:20 - 2010-06-29 10:35 - 00792416 _____ () C:\Windows\system32\DiagFunc.dll
2015-05-03 13:20 - 2010-01-27 12:47 - 00000451 _____ () C:\Windows\system32\DiagFunc.ini
2015-05-03 13:20 - 2010-01-27 11:54 - 00000451 _____ () C:\Windows\SysWOW64\DiagFunc.ini
2015-05-03 13:19 - 2015-05-03 13:19 - 38616354 _____ () C:\Users\Pandur\Downloads\RT5X7X_2870_2770_307X_2070_357X_3370_8070_MT7610_MT7610_Driver_Setup_for_Windows.zip
2015-05-03 13:19 - 2015-05-03 13:19 - 00000000 ____D () C:\Users\Pandur\AppData\Roaming\InstallShield
2015-05-03 13:10 - 2015-05-03 13:10 - 00003088 _____ () C:\Windows\System32\Tasks\{541D2B34-DC2A-4F6F-966E-92373DE66718}
2015-04-29 13:02 - 2015-05-25 20:25 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2015-04-29 13:02 - 2015-05-25 19:12 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2015-04-29 13:02 - 2015-04-29 13:02 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-05-29 14:30 - 2013-10-04 17:58 - 02050406 _____ () C:\Windows\WindowsUpdate.log
2015-05-29 11:01 - 2009-07-14 06:45 - 00031680 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-05-29 11:01 - 2009-07-14 06:45 - 00031680 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-05-29 10:53 - 2013-10-08 14:39 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-05-29 10:53 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-05-28 22:58 - 2014-01-16 20:58 - 00000000 ____D () C:\Program Files (x86)\Steam
2015-05-28 22:48 - 2014-03-03 12:10 - 00000000 ____D () C:\Users\Pandur\AppData\Local\Battle.net
2015-05-28 22:28 - 2013-10-04 19:52 - 00000000 ____D () C:\Users\Pandur\AppData\Roaming\TS3Client
2015-05-28 18:10 - 2013-10-08 18:10 - 00000316 _____ () C:\Windows\Tasks\MT66 Software Update.job
2015-05-27 20:02 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default
2015-05-27 19:58 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2015-05-25 20:58 - 2013-10-08 14:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2015-05-25 20:57 - 2013-10-04 18:30 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
2015-05-25 20:55 - 2013-10-29 17:33 - 00000000 ____D () C:\Users\Pandur\AppData\Local\NVIDIA Corporation
2015-05-25 20:55 - 2013-10-08 14:40 - 00001337 _____ () C:\Users\Public\Desktop\GeForce Experience.lnk
2015-05-25 19:04 - 2013-10-04 18:18 - 00000000 ____D () C:\Users\Pandur
2015-05-25 19:00 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2015-05-25 18:57 - 2013-11-17 02:38 - 00000000 ____D () C:\Users\Pandur\AppData\Roaming\BitTorrent
2015-05-25 17:10 - 2014-01-12 13:39 - 00001039 _____ () C:\Users\Pandur\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-05-25 17:10 - 2013-10-04 18:44 - 00001021 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-05-25 17:10 - 2013-10-04 18:19 - 00000997 _____ () C:\Users\Pandur\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-05-25 17:05 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system
2015-05-25 16:44 - 2013-10-04 18:44 - 00001147 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-05-25 16:17 - 2011-04-12 09:43 - 00699416 _____ () C:\Windows\system32\perfh007.dat
2015-05-25 16:17 - 2011-04-12 09:43 - 00149556 _____ () C:\Windows\system32\perfc007.dat
2015-05-25 16:17 - 2009-07-14 07:13 - 01620612 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-05-20 20:51 - 2015-04-06 23:26 - 00000000 ___SD () C:\Windows\SysWOW64\GWX
2015-05-20 20:51 - 2015-04-06 23:26 - 00000000 ___SD () C:\Windows\system32\GWX
2015-05-20 20:49 - 2013-11-22 16:25 - 00000000 ____D () C:\Users\Pandur\AppData\Roaming\Winamp
2015-05-20 20:49 - 2013-10-08 18:01 - 00000000 ____D () C:\Users\Pandur\AppData\Roaming\Media Player Classic
2015-05-20 20:48 - 2013-10-04 18:54 - 00000000 ____D () C:\Windows\Panther
2015-05-20 20:20 - 2013-10-07 19:38 - 00000000 ____D () C:\Program Files\Diablo III
2015-05-20 18:09 - 2013-10-06 11:22 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-05-19 16:13 - 2014-10-17 15:12 - 00000000 ____D () C:\Users\Pandur\AppData\Local\Adobe
2015-05-19 16:12 - 2013-10-05 22:48 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-05-19 16:12 - 2013-10-05 22:48 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-05-16 18:06 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2015-05-15 10:13 - 2014-03-11 21:34 - 00000000 ____D () C:\Program Files (x86)\Hearthstone
2015-05-15 10:07 - 2009-07-14 06:45 - 00296840 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-05-15 10:05 - 2011-04-12 09:55 - 00000000 ____D () C:\Program Files\Windows Journal
2015-05-15 10:05 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\AdvancedInstallers
2015-05-13 23:22 - 2013-10-04 21:07 - 00000000 ____D () C:\Windows\system32\MRT
2015-05-13 23:18 - 2013-10-04 21:07 - 140425016 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-05-13 16:38 - 2013-10-06 10:50 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-05-13 08:52 - 2015-02-20 01:18 - 01558848 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdagenco6420103.dll
2015-05-12 08:27 - 2015-02-20 01:18 - 15048816 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2015-05-12 08:27 - 2013-10-08 14:32 - 03363224 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll
2015-05-12 08:27 - 2013-10-04 18:30 - 00112784 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll
2015-05-12 08:27 - 2013-10-04 18:30 - 00105288 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll
2015-05-12 08:27 - 2013-10-04 18:30 - 00031710 _____ () C:\Windows\system32\nvinfo.pb
2015-05-12 08:27 - 2013-09-17 22:22 - 17540416 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2015-05-12 08:27 - 2013-09-17 22:22 - 12849056 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll
2015-05-12 08:27 - 2013-09-17 22:22 - 02971776 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll
2015-05-12 05:30 - 2013-10-08 14:38 - 06872392 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll
2015-05-12 05:30 - 2013-10-08 14:38 - 03490448 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll
2015-05-12 05:30 - 2013-10-08 14:38 - 02558608 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll
2015-05-12 05:30 - 2013-10-08 14:38 - 00937288 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
2015-05-12 05:30 - 2013-10-08 14:38 - 00385352 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll
2015-05-12 05:30 - 2013-10-08 14:38 - 00062608 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll
2015-05-11 19:41 - 2014-03-03 12:10 - 00000000 ____D () C:\Program Files (x86)\Battle.net
2015-05-11 19:01 - 2013-10-08 14:38 - 04391871 _____ () C:\Windows\system32\nvcoproc.bin
2015-05-08 02:35 - 2013-10-29 17:33 - 01316000 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll
2015-05-08 02:34 - 2013-10-29 17:33 - 01570672 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll
2015-05-07 19:01 - 2015-01-15 12:13 - 00000000 ____D () C:\Users\Pandur\AppData\Roaming\Factorio
2015-05-07 18:19 - 2015-01-21 17:56 - 00000000 ____D () C:\Program Files\Factorio
2015-05-05 16:36 - 2013-10-04 19:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-05-05 16:35 - 2013-10-04 19:33 - 00152744 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2015-05-05 16:35 - 2013-10-04 19:33 - 00132120 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2015-05-03 13:20 - 2013-10-04 19:07 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-04-29 12:47 - 2014-09-03 19:47 - 00007605 _____ () C:\Users\Pandur\AppData\Local\Resmon.ResmonCfg
2015-04-29 10:21 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
==================== Files in the root of some directories =======
2014-09-03 19:47 - 2015-04-29 12:47 - 0007605 _____ () C:\Users\Pandur\AppData\Local\Resmon.ResmonCfg
Some files in TEMP:
====================
C:\Users\Pandur\AppData\Local\Temp\avgnt.exe
C:\Users\Pandur\AppData\Local\Temp\Quarantine.exe
C:\Users\Pandur\AppData\Local\Temp\sqlite3.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-05-28 18:47
==================== End of log ============================
|
|
30.05.2015, 09:01
| #10 |
| /// the machine /// TB-Ausbilder | Firefox Startseite wird geändert und Avira Echtzeitscan findet laufend etwas Download Ordner leeren, WIndows.old Ordner leeren. Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter Emptytemp:
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
 Cleanup: (Die Reihenfolge ist hier entscheidend) Falls Defogger verwendet wurde: Erneut starten und auf Re-enable klicken. Falls Combofix verwendet wurde:  Combofix deinstallieren
Alle Logs gepostet? Dann lade Dir bitte  DelFix herunter.
Hinweis: DelFix entfernt u.a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst. Starte Deinen Rechner abschließend neu. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein, kannst Du diese bedenkenlos löschen. Wenn Du möchtest, kannst Du hier sagen, ob Du mit mir und meiner Hilfe zufrieden warst...  und/oder das Forum mit einer kleinen Spende  unterstützen.   Absicherung: Beim Betriebsystem Windows die automatischen Updates aktivieren. Auch die sicherheitsrelevante Software sollte immer nur in der aktuellsten Version vorliegen: Browser Java Flash-Player PDF-Reader Sicherheitslücken in deren alten Versionen werden dazu ausgenutzt, um beim einfachen Besuch einer manipulierten Website per "Drive-by" Malware zu installieren. Ich empfehle z.B. die Verwendung von Mozilla Firefox statt des Internet Explorers. Zudem lassen sich mit dem Firefox auch PDF-Dokumente öffnen. Aktiviere eine Firewall. Die in Windows integrierte genügt im Normalfall völlig. Verwende ein Antivirusprogramm mit Echtzeitscanner und stets aktueller Signaturendatenbank. Meine Empfehlung:  Emsisoft Zusätzlich kannst Du Deinen PC regelmäßig mit Malwarebytes Anti-Malware und ESET scannen. Optional:  NoScript verhindert das Ausführen von aktiven Inhalten (Java, JavaScript, Flash,...) für sämtliche Websites. Man kann aber nach dem Prinzip einer Whitelist festlegen, auf welchen Seiten Scripts erlaubt werden sollen. Malwarebytes Anti Exploit: Schützt die Anwendungen des Computers vor der Ausnutzung bekannter Schwachstellen.Lade Software von einem sauberen Portal wie  .Wähle beim Installieren von Software immer die benutzerdefinierte Option und entferne den Haken bei allen optional angebotenen Toolbars oder sonstigen, fürs Programm, irrelevanten Ergänzungen. Um Adware wieder los zu werden, empfiehlt sich zunächst die Deinstallation sowie die anschließende Resteentfernung mit Adwcleaner . Abschließend noch ein paar grundsätzliche Bemerkungen: Ändere regelmäßig Deine wichtigen Online-Passwörter und erstelle regelmäßig Backups Deiner wichtigen Dateien oder des Systems. Der Nutzen von Registry-Cleanern, Optimizern usw. zur Performancesteigerung ist umstritten. Ich empfehle deshalb, die Finger von der Registry zu lassen und lieber die windowseigene Datenträgerbereinigung zu verwenden.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
30.05.2015, 18:36
| #11 |
| | Firefox Startseite wird geändert und Avira Echtzeitscan findet laufend etwasCode:
ATTFilter Fix result of Farbar Recovery Scan Tool (x64) Version: 27-05-2015 01
Ran by Pandur at 2015-05-30 10:37:23 Run:1
Running from C:\Users\Pandur\Desktop
Loaded Profiles: Pandur (Available Profiles: Pandur)
Boot Mode: Normal
==============================================
fixlist content:
*****************
Emptytemp:
*****************
EmptyTemp: => Removed 9.8 GB temporary data.
The system needed a reboot.
==== End of Fixlog 10:37:38 ====
Ich bin ab Sonntag eine Woche im Urlaub für alles |
|
31.05.2015, 13:46
| #12 |
| /// the machine /// TB-Ausbilder | Firefox Startseite wird geändert und Avira Echtzeitscan findet laufend etwas ja, fertig
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Firefox Startseite wird geändert und Avira Echtzeitscan findet laufend etwas |
| adobe, antivir, avira, browser, chromium, computer, defender, desktop, explorer, firefox, helper, homepage, iexplore.exe, installation, launch, mozilla, realtek, registry, rundll, safer networking, scan, secur, software, svchost.exe, system, temp, usb, windows |
WARNUNG an die MITLESER: 
+ R Taste und schreibe Combofix /Uninstall in das 
Linear-Darstellung
