Starte bitte im abgesicherten Modus mit Netzwerktreibern und führt JRT da nochmal aus.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 5.5.1 (08.19.2013:1)
OS: Windows 7 Home Premium x64
Ran by *****on 21.08.2013 at  9:31:32,78
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services

Successfully stopped: [Service] backupstack 
Successfully deleted: [Service] backupstack 



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7825CFB6-490A-436B-9F26-4A7B5CFC01A9}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{7825CFB6-490A-436B-9F26-4A7B5CFC01A9}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7825CFB6-490A-436B-9F26-4A7B5CFC01A9}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7825CFB6-490A-436B-9F26-4A7B5CFC01A9}



~~~ Files



~~~ Folders



~~~ FireFox

Emptied folder: C:\Users\*****\AppData\Roaming\mozilla\firefox\profiles\af0dqc2b.default\minidumps [1 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 21.08.2013 at  9:33:53,69
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         

Frisches Log mit FRST machen bitte. Normaler Windows-Modus.

FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 21-08-2013
Ran by ***** (administrator) on 21-08-2013 09:57:29
Running from C:\Users\*****\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(HP) C:\Program Files (x86)\HP SimplePass 2012\TrueSuiteService.exe
(AMD) C:\Windows\system32\atiesrxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\STacSV64.exe
(Hewlett-Packard Company) C:\Windows\system32\Hpservice.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Validity Sensors, Inc.) C:\Windows\system32\vcsFPService.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
(Symantec Corporation) C:\Program Files (x86)\Norton AntiVirus\Engine\20.4.0.40\ccSvcHst.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Identity Safe\Engine\2013.4.0.10\ccSvcHst.exe
(Native Instruments GmbH) C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe
(PACE Anti-Piracy, Inc.) C:\Program Files (x86)\Common Files\PACE\Services\LicenseServices\LDSvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(HP) C:\Program Files (x86)\HP SimplePass 2012\TouchControl.exe
(PacketVideo) C:\Program Files (x86)\TwonkyMedia\twonkymediaserverwatchdog.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(HP) C:\Program Files (x86)\HP SimplePass 2012\BioMonitor.exe
() C:\Program Files (x86)\TwonkyMedia\TwonkyMediaServer.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Identity Safe\Engine\2013.4.0.10\ccSvcHst.exe
(Symantec Corporation) C:\Program Files (x86)\Norton AntiVirus\Engine\20.4.0.40\ccSvcHst.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Spotify Ltd) C:\Users\*****\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Microsoft Corporation) C:\Windows\System32\StikyNot.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(PacketVideo) C:\Program Files (x86)\TwonkyMedia\twonkymediaserverconfig.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
(Synaptics Incorporated) C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE
(CANON INC.) C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Desura Pty Ltd) C:\Program Files (x86)\Desura\desura.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Desura Pty Ltd) C:\Program Files (x86)\Common Files\Desura\desura_service.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(BitTorrent Inc.) C:\Users\*****\AppData\Roaming\uTorrent\uTorrent.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunes.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceHelper.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\distnoted.exe
(Last.fm) C:\Program Files (x86)\Last.fm\Last.fm Scrobbler.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(AIR Music Technology) C:\Program Files\AIR Music Technology\Ignite\Ignite.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [1128448 2011-03-11] (IDT, Inc.)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2837288 2011-10-14] (Synaptics Incorporated)
HKLM\...\Run: [IntelWireless] - C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [1933584 2011-02-04] (Intel(R) Corporation)
HKLM\...\Run: [BTMTrayAgent] - C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll [10355200 2011-01-24] (Intel Corporation)
HKCU\...\Run: [Desura] - C:\Program Files (x86)\Desura\desura.exe [2529096 2013-05-30] (Desura Pty Ltd)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [19875432 2013-06-21] (Skype Technologies S.A.)
HKCU\...\Run: [Steam] - C:\Program Files (x86)\Steam\steam.exe [1807272 2013-07-27] (Valve Corporation)
HKCU\...\Run: [Spotify Web Helper] - C:\Users\*****\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1104384 2013-07-07] (Spotify Ltd)
HKCU\...\Run: [RESTART_STICKY_NOTES] - C:\Windows\System32\StikyNot.exe [427520 2009-07-14] (Microsoft Corporation)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2011-01-13] (Intel Corporation)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-03-15] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [NUSB3MON] - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [HP Quick Launch] - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [586296 2010-11-09] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [HPOSD] - C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [318520 2011-01-27] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [IJNetworkScanUtility] - C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE [128352 2010-01-18] (CANON INC.)
HKLM-x32\...\Run: [] -  [x]
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-08-16] (Apple Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\TwonkyMedia Tray Control.lnk
ShortcutTarget: TwonkyMedia Tray Control.lnk -> C:\Program Files (x86)\TwonkyMedia\twonkymediaserverconfig.exe (PacketVideo)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://at.msn.com/?ocid=iehp
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: TrueSuite Website Log On - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2012\x64\IEBHO.dll (HP)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton AntiVirus\Engine\20.4.0.40\IPS\IPSBHO.DLL (Symantec Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: TrueSuite Website Log On - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2012\IEBHO.dll (HP)
BHO-x32: Norton Identity Protection - {AB4C7833-A6EC-433f-B9FE-6B14B1A2F836} - C:\Program Files (x86)\Norton Identity Safe\Engine\2013.4.0.10\coIEPlg.dll (Symantec Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM-x32 - Norton Identity Safe Toolbar - {A13C2648-91D4-4bf3-BC6D-0079707C4389} - C:\Program Files (x86)\Norton Identity Safe\Engine\2013.4.0.10\coIEPlg.dll (Symantec Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\af0dqc2b.default
FF NewTab: user_pref("browser.newtab.url", "");
FF SelectedSearchEngine: Startpage HTTPS - Deutsch
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_202.dll ()
FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\af0dqc2b.default\searchplugins\duckduckgo-1.xml
FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\af0dqc2b.default\searchplugins\duckduckgo.xml
FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\af0dqc2b.default\searchplugins\startpage-https---deutsch.xml
FF Extension: firefox - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\af0dqc2b.default\Extensions\firefox@ghostery.com.xpi
FF Extension: No Name - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\af0dqc2b.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
FF Extension: No Name - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\af0dqc2b.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM-x32\...\Firefox\Extensions: [{F04D2D30-776C-4d02-8627-8E4385ECA58D}] C:\ProgramData\Norton\{92622AAD-05E8-4459-B256-765CE1E929FB}\NST_2013.3.3.19\coFFPlgn\
FF Extension: Norton Identity Safe Toolbar - C:\ProgramData\Norton\{92622AAD-05E8-4459-B256-765CE1E929FB}\NST_2013.3.3.19\coFFPlgn\
FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_20.1.0.24\IPSFFPlgn\
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_20.1.0.24\IPSFFPlgn\

Chrome: 
=======
CHR HomePage: hxxp://www.google.com/
CHR Extension: (YouTube Options) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdokagampppgbnjfdlkfpphniapiiifn\1.8.133_0
CHR Extension: (DuckDuckGo for Chrome) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\bpphkkgodbfncbcpgopijlfakfgmclao\42.5.8_0
CHR Extension: (Website Logon) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\debkinhcgejcbfgjiaalomcmkedjmiaa\1.0_0
CHR Extension: (PanicButton) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\faminaibgiklngmfpfbhmokfmnglamcm\0.14.2.2_0
CHR Extension: (AdBlock) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.6.4_0
CHR Extension: (YouTube Options (Full Version)) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\ojmgeoecaejeajjegjmijbcifhkbmgjd\1.8.133_0
CHR HKLM-x32\...\Chrome\Extension: [ajdjdbbimplpmffaimajhilbnmciagkd] - C:\Program Files (x86)\OApps\chrome-sl.crx
CHR HKLM-x32\...\Chrome\Extension: [debkinhcgejcbfgjiaalomcmkedjmiaa] - C:\Program Files (x86)\HP SimplePass 2012\tschrome.crx
CHR HKLM-x32\...\Chrome\Extension: [nppllibpnmahfaklnpggkibhkapjkeob] - C:\Program Files (x86)\Norton Identity Safe\Engine\2013.4.0.10\Exts\Chrome.crx

==================== Services (Whitelisted) =================

R2 FPLService; C:\Program Files (x86)\HP SimplePass 2012\TrueSuiteService.exe [260424 2011-08-26] (HP)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2011-02-04] ()
R2 NAV; C:\Program Files (x86)\Norton AntiVirus\Engine\20.4.0.40\ccSvcHst.exe [144368 2013-05-21] (Symantec Corporation)
R2 NCO; C:\Program Files (x86)\Norton Identity Safe\Engine\2013.4.0.10\ccSvcHst.exe [144368 2013-05-21] (Symantec Corporation)
R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [76888 2013-07-14] ()
R2 TwonkyMedia; C:\Program Files (x86)\TwonkyMedia\twonkymediaserverwatchdog.exe [472664 2010-07-28] (PacketVideo)
S2 HP Health Check Service; "C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe" [x]
R2 PaceLicenseDServices; "C:\Program Files (x86)\Common Files\PACE\Services\LicenseServices\LDSvc.exe" -u https://activation.paceap.com/InitiateActivation [x]

==================== Drivers (Whitelisted) ====================

R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_20.1.0.24\Definitions\BASHDefs\20130715.001\BHDrvx64.sys [1393240 2013-05-31] (Symantec Corporation)
R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_20.1.0.24\Definitions\BASHDefs\20130715.001\BHDrvx64.sys [1393240 2013-05-31] (Symantec Corporation)
R1 ccSet_NAV; C:\Windows\system32\drivers\NAVx64\1404000.028\ccSetx64.sys [169048 2013-04-16] (Symantec Corporation)
R1 ccSet_NST; C:\Windows\system32\drivers\NSTx64\7DD04000.00A\ccSetx64.sys [169048 2013-04-16] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-08-20] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-08-20] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [139864 2013-08-20] (Symantec Corporation)
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_20.1.0.24\Definitions\IPSDefs\20130813.001\IDSvia64.sys [513184 2013-05-30] (Symantec Corporation)
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_20.1.0.24\Definitions\IPSDefs\20130813.001\IDSvia64.sys [513184 2013-05-30] (Symantec Corporation)
S3 iLokDrvr; C:\Windows\System32\DRIVERS\iLokDrvr.sys [25808 2013-04-11] ()
R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_20.1.0.24\Definitions\VirusDefs\20130820.002\ENG64.SYS [126040 2013-08-05] (Symantec Corporation)
R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_20.1.0.24\Definitions\VirusDefs\20130820.002\ENG64.SYS [126040 2013-08-05] (Symantec Corporation)
R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_20.1.0.24\Definitions\VirusDefs\20130820.002\EX64.SYS [2098776 2013-08-05] (Symantec Corporation)
R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_20.1.0.24\Definitions\VirusDefs\20130820.002\EX64.SYS [2098776 2013-08-05] (Symantec Corporation)
R3 NIWinCDEmu; C:\Windows\System32\DRIVERS\NIWinCDEmu.sys [111696 2013-05-31] ()
R3 SRTSP; C:\Windows\System32\Drivers\NAVx64\1404000.028\SRTSP64.SYS [796760 2013-05-16] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NAVx64\1404000.028\SRTSPX64.SYS [36952 2013-03-05] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\NAVx64\1404000.028\SYMDS64.SYS [493656 2013-05-21] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NAVx64\1404000.028\SYMEFA64.SYS [1139800 2013-05-23] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177312 2013-06-19] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NAVx64\1404000.028\Ironx64.SYS [224416 2013-03-05] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\NAVx64\1404000.028\SYMNETS.SYS [433752 2013-04-25] (Symantec Corporation)
S3 YMIDUSBW; C:\Windows\System32\drivers\ymidusbx64.sys [51016 2011-11-01] (Yamaha Corporation)
S3 clwvd; system32\DRIVERS\clwvd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-08-21 09:55 - 2013-08-21 09:55 - 00000000 ____D C:\Users\*****\AppData\Local\AIR Music Technology
2013-08-21 09:33 - 2013-08-21 09:33 - 00001443 _____ C:\Users\*****\Desktop\JRT.txt
2013-08-21 09:18 - 2013-08-21 09:18 - 00001809 _____ C:\Users\Public\Desktop\Ignite.lnk
2013-08-21 09:18 - 2013-08-21 09:18 - 00000000 ____D C:\ProgramData\AIR Music Technology
2013-08-21 09:18 - 2013-08-21 09:18 - 00000000 ____D C:\Program Files\AIR Music Technology
2013-08-20 23:00 - 2013-08-20 23:18 - 83081127 _____ C:\Users\*****\Downloads\Basement Drums.zip
2013-08-20 22:46 - 2013-08-21 09:45 - 00000000 ____D C:\Users\*****\Downloads\Total Harmonic Distortion
2013-08-20 22:12 - 2013-08-20 22:12 - 00001011 _____ C:\Users\*****\Desktop\RealBand.lnk
2013-08-20 22:12 - 2013-08-20 22:12 - 00000932 _____ C:\Users\*****\Desktop\Band-in-a-Box.lnk
2013-08-20 22:12 - 2013-08-20 22:12 - 00000000 ____D C:\Users\*****\Documents\IK Multimedia
2013-08-20 22:12 - 2013-08-20 22:12 - 00000000 ____D C:\Program Files (x86)\PowerTracks DirectX Plugins
2013-08-20 22:12 - 2013-08-20 22:12 - 00000000 ____D C:\Program Files (x86)\Coyote
2013-08-20 22:12 - 2003-10-16 14:21 - 00059004 _____ C:\Windows\SysWOW64\Pgtextj_.ttf
2013-08-20 22:12 - 2003-09-27 00:11 - 00153064 _____ C:\Windows\SysWOW64\Pgchords.ttf
2013-08-20 22:12 - 2003-09-27 00:09 - 00051864 _____ C:\Windows\SysWOW64\Pgtextje.ttf
2013-08-20 22:12 - 2003-09-24 23:30 - 00048072 _____ C:\Windows\SysWOW64\Pgjazz__.ttf
2013-08-20 22:12 - 1996-07-30 10:12 - 00047252 _____ C:\Windows\SysWOW64\pgmus.ttf
2013-08-20 22:12 - 1996-07-01 07:00 - 00049896 _____ C:\Windows\SysWOW64\Pgtext.ttf
2013-08-20 22:11 - 2013-08-20 22:12 - 00000000 ____D C:\Program Files (x86)\RealBand
2013-08-20 22:10 - 2013-08-20 22:12 - 00000000 ____D C:\Program Files (x86)\bb
2013-08-20 22:10 - 2013-08-20 22:12 - 00000000 ____D C:\bb
2013-08-20 21:08 - 2013-08-21 09:44 - 00000000 ____D C:\Users\*****\Downloads\PC
2013-08-20 19:56 - 2013-08-20 19:56 - 01018949 _____ (Thisisu) C:\Users\*****\Downloads\JRT.exe
2013-08-20 16:52 - 2013-08-20 16:52 - 00000000 ____D C:\Users\*****\Documents\Psicraft
2013-08-20 16:52 - 2013-08-20 16:52 - 00000000 ____D C:\ProgramData\Psicraft
2013-08-20 16:52 - 2013-08-20 16:52 - 00000000 ____D C:\Program Files (x86)\Psicraft
2013-08-20 15:45 - 2013-08-20 15:51 - 136417802 _____ C:\Users\*****\Downloads\enrmp281_amitron_7_-_try_for_next_stage_free.zip
2013-08-20 15:39 - 2013-08-20 15:39 - 00000000 ____D C:\Program Files\Recuva
2013-08-20 14:02 - 2013-08-20 14:38 - 896216436 _____ C:\Users\*****\Downloads\Ignite_1.2.1_Win.zip
2013-08-20 13:25 - 2013-08-20 13:25 - 00000000 ____D C:\FRST
2013-08-19 20:47 - 2013-08-19 20:47 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_iLokDrvr_01007.Wdf
2013-08-19 20:41 - 2013-08-19 20:41 - 00000000 ____D C:\Users\*****\AppData\Roaming\Avid
2013-08-19 19:24 - 2013-08-19 19:50 - 00000000 ____D C:\Users\*****\AppData\Roaming\Ableton
2013-08-19 19:22 - 2013-08-19 19:56 - 00000000 ____D C:\ProgramData\Ableton
2013-08-19 19:04 - 2013-08-19 19:05 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-19 18:00 - 2013-08-19 18:01 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-08-19 18:00 - 2013-08-19 18:01 - 00000000 ____D C:\Program Files\iTunes
2013-08-19 18:00 - 2013-08-19 18:00 - 00000000 ____D C:\Program Files\iPod
2013-08-16 10:54 - 2013-08-16 11:02 - 109543206 _____ C:\Users\*****\Downloads\enrmp167_un_-_the_secret_rift.zip
2013-08-16 10:53 - 2013-08-16 11:01 - 110608368 _____ C:\Users\*****\Downloads\enrmp168_un_-_hol.zip
2013-08-16 10:52 - 2013-08-16 10:53 - 26665445 _____ C:\Users\*****\Downloads\enrmp194_bashed_nursling_-_eating_thorax.zip
2013-08-16 08:36 - 2013-08-16 08:42 - 81475627 _____ C:\Users\*****\Downloads\enrmp238_bashed_nursling_-_every_sunday_morning_kills_us.zip
2013-08-16 08:34 - 2013-08-16 08:42 - 126372901 _____ C:\Users\*****\Downloads\enrmp259_bashed_nursling_-_palace_of_toxicology.zip
2013-08-16 08:31 - 2013-08-16 08:33 - 30072191 _____ C:\Users\*****\Downloads\enrmp288_edgeist_-_landscapes.zip
2013-08-14 21:49 - 2013-08-14 23:48 - 228607849 _____ C:\Users\*****\Downloads\AGML_1_1_0_Installer.rar
2013-08-14 21:46 - 2013-08-15 01:37 - 212007729 _____ (Univers Sons                                                ) C:\Users\*****\Downloads\uviworkstation-x64-2-1-5.exe
2013-08-14 20:32 - 2013-07-25 05:54 - 17830400 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-14 20:32 - 2013-07-25 05:37 - 02312704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-14 20:32 - 2013-07-25 05:35 - 10926080 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-14 20:32 - 2013-07-25 05:31 - 01346560 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-14 20:32 - 2013-07-25 05:30 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-14 20:32 - 2013-07-25 05:29 - 01494528 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-08-14 20:32 - 2013-07-25 05:29 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-08-14 20:32 - 2013-07-25 05:29 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-14 20:32 - 2013-07-25 05:28 - 02147840 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-14 20:32 - 2013-07-25 05:28 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-14 20:32 - 2013-07-25 05:28 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-14 20:32 - 2013-07-25 05:28 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-08-14 20:32 - 2013-07-25 05:28 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-08-14 20:32 - 2013-07-25 05:27 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-14 20:32 - 2013-07-25 05:27 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-08-14 20:32 - 2013-07-25 05:26 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-14 20:32 - 2013-07-25 04:40 - 12334080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-14 20:32 - 2013-07-25 04:32 - 01800704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-14 20:32 - 2013-07-25 04:30 - 09738752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-14 20:32 - 2013-07-25 04:26 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-14 20:32 - 2013-07-25 04:26 - 01104384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-14 20:32 - 2013-07-25 04:25 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-08-14 20:32 - 2013-07-25 04:24 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-08-14 20:32 - 2013-07-25 04:24 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-14 20:32 - 2013-07-25 04:23 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-14 20:32 - 2013-07-25 04:23 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-14 20:32 - 2013-07-25 04:23 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-14 20:32 - 2013-07-25 04:23 - 00420864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-08-14 20:32 - 2013-07-25 04:23 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-08-14 20:32 - 2013-07-25 04:22 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-14 20:32 - 2013-07-25 04:22 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-14 20:32 - 2013-07-25 04:22 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-08-14 20:21 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-14 20:21 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-08-14 19:59 - 2013-07-09 08:03 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-08-14 19:59 - 2013-07-09 07:54 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-08-14 19:59 - 2013-07-09 07:53 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-08-14 19:59 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-08-14 19:59 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-08-14 19:59 - 2013-07-09 06:53 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-08-14 19:59 - 2013-07-09 06:52 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-08-14 19:59 - 2013-07-09 04:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-08-14 19:59 - 2013-07-09 04:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-08-14 19:59 - 2013-07-09 04:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-08-14 19:59 - 2013-07-09 04:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-08-14 19:43 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-14 19:43 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-14 19:36 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-14 19:23 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-14 19:23 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-14 19:23 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-14 19:23 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-14 19:23 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-14 19:23 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-14 19:23 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-14 19:23 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-14 19:13 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-14 19:13 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-14 19:07 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-08-14 17:57 - 2013-08-14 17:57 - 00000000 ____D C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\JXPlugins
2013-08-14 17:57 - 2013-08-14 17:57 - 00000000 ____D C:\Program Files (x86)\JXPlugins
2013-08-14 14:28 - 2013-08-14 14:28 - 00000000 ____D C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Radio VSTI FREE
2013-08-14 14:27 - 2013-08-14 14:27 - 00000000 ____D C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Om VSTI FREE
2013-08-14 14:26 - 2013-08-14 14:26 - 00000000 ____D C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mushroombpm VSTI FREE
2013-08-14 14:25 - 2013-08-14 14:25 - 00000000 ____D C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Marijuana VSTI FREE
2013-08-11 21:02 - 2013-08-11 21:02 - 00001007 _____ C:\Users\*****\Desktop\Free Alarm Clock.lnk
2013-08-11 21:02 - 2013-08-11 21:02 - 00000000 ____D C:\Program Files (x86)\FreeAlarmClock
2013-08-09 10:50 - 2013-08-09 10:50 - 00000000 ____D C:\ProgramData\Caphyon
2013-08-07 23:46 - 2013-08-07 23:48 - 00000000 ____D C:\ProgramData\WindSolutions
2013-08-07 23:46 - 2013-08-07 23:46 - 00000000 ____D C:\Users\*****\AppData\Roaming\WindSolutions
2013-08-04 18:15 - 2013-08-04 18:15 - 00001014 _____ C:\Users\Public\Desktop\Kontakt 5.lnk
2013-08-04 18:15 - 2013-08-04 18:15 - 00000000 __HDC C:\ProgramData\{ACEB5C90-39F7-4044-91EF-FBD59A59D240}
2013-08-04 13:23 - 2013-08-04 13:23 - 00000000 ____D C:\Program Files (x86)\Xylgo
2013-07-30 12:21 - 2013-07-30 12:21 - 00000000 __HDC C:\ProgramData\{B459B207-EA55-45E4-939F-D5DBD19BA3B1}
2013-07-30 12:21 - 2013-07-30 12:21 - 00000000 __HDC C:\ProgramData\{00E0164B-B182-4800-96DA-F8D39B3A7189}
2013-07-30 11:53 - 2013-07-30 11:53 - 00000000 __HDC C:\ProgramData\{3B9A3AE3-5BE1-4645-A31C-753724255564}
2013-07-30 11:53 - 2013-07-30 11:53 - 00000000 __HDC C:\ProgramData\{3A633AE9-5307-4E4D-ACED-C8739F84CB10}
2013-07-28 23:03 - 2013-07-30 13:39 - 00000000 ____D C:\Program Files (x86)\DVDVideoSoft
2013-07-28 23:03 - 2013-07-28 23:03 - 00001306 _____ C:\Users\Public\Desktop\Free YouTube Download.lnk
2013-07-27 20:51 - 2013-07-27 20:51 - 00001675 _____ C:\Users\*****\Desktop\Massive.lnk
2013-07-27 20:48 - 2013-07-27 20:48 - 00000000 ____D C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Native Instruments Massive
2013-07-27 20:47 - 2003-07-06 08:10 - 00017408 ____N C:\Windows\SysWOW64\minimp3.exe
2013-07-26 13:40 - 2013-07-26 13:39 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-07-26 13:40 - 2013-07-26 13:39 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-07-26 13:39 - 2013-07-26 13:39 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-07-26 13:39 - 2013-07-26 13:39 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-07-26 13:39 - 2013-07-26 13:39 - 00000000 ____D C:\Program Files (x86)\Java
2013-07-26 13:38 - 2013-07-26 13:38 - 00312232 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-07-26 13:38 - 2013-07-26 13:38 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-07-26 13:38 - 2013-07-26 13:38 - 00188840 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-07-26 13:38 - 2013-07-26 13:38 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2013-07-26 13:27 - 2013-07-26 13:28 - 01378902 _____ C:\Users\*****\Downloads\ME3_CinemaMod_v05.zip
2013-07-23 11:32 - 2013-07-23 11:32 - 00001947 _____ C:\Users\Public\Desktop\Medias in res! CD-ROM.lnk
2013-07-23 11:32 - 2013-07-23 11:32 - 00000000 ____D C:\Program Files (x86)\Veritas
2013-07-23 11:29 - 2013-07-23 11:29 - 00000000 __SHD C:\Users\*****\AppData\Roaming\.#

==================== One Month Modified Files and Folders =======

2013-08-21 09:57 - 2013-06-29 17:05 - 00000000 ____D C:\ProgramData\twonkymedia
2013-08-21 09:56 - 2013-05-30 15:20 - 00000000 ____D C:\Users\*****\AppData\Roaming\uTorrent
2013-08-21 09:55 - 2013-08-21 09:55 - 00000000 ____D C:\Users\*****\AppData\Local\AIR Music Technology
2013-08-21 09:55 - 2009-07-14 06:51 - 00052503 _____ C:\Windows\setupact.log
2013-08-21 09:46 - 2009-07-14 06:45 - 00032064 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-21 09:46 - 2009-07-14 06:45 - 00032064 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-21 09:45 - 2013-08-20 22:46 - 00000000 ____D C:\Users\*****\Downloads\Total Harmonic Distortion
2013-08-21 09:44 - 2013-08-20 21:08 - 00000000 ____D C:\Users\*****\Downloads\PC
2013-08-21 09:41 - 2011-06-21 21:41 - 00696870 _____ C:\Windows\system32\perfh007.dat
2013-08-21 09:41 - 2011-06-21 21:41 - 00148134 _____ C:\Windows\system32\perfc007.dat
2013-08-21 09:41 - 2009-07-14 07:13 - 01612484 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-21 09:38 - 2013-05-31 11:57 - 00000000 ____D C:\Program Files (x86)\Steam
2013-08-21 09:38 - 2013-05-30 12:24 - 00073560 _____ C:\Users\*****\AppData\Local\GDIPFONTCACHEV1.DAT
2013-08-21 09:37 - 2013-06-29 17:05 - 00000000 ____D C:\Program Files (x86)\TwonkyMedia
2013-08-21 09:37 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-21 09:34 - 2013-05-30 16:14 - 00033792 ___SH C:\Users\*****\Thumbs.db
2013-08-21 09:33 - 2013-08-21 09:33 - 00001443 _____ C:\Users\*****\Desktop\JRT.txt
2013-08-21 09:29 - 2009-07-14 06:45 - 00320952 _____ C:\Windows\system32\FNTCACHE.DAT
2013-08-21 09:25 - 2013-05-30 11:46 - 01384518 _____ C:\Windows\WindowsUpdate.log
2013-08-21 09:18 - 2013-08-21 09:18 - 00001809 _____ C:\Users\Public\Desktop\Ignite.lnk
2013-08-21 09:18 - 2013-08-21 09:18 - 00000000 ____D C:\ProgramData\AIR Music Technology
2013-08-21 09:18 - 2013-08-21 09:18 - 00000000 ____D C:\Program Files\AIR Music Technology
2013-08-21 09:18 - 2013-05-30 11:54 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-08-21 09:05 - 2013-05-30 15:59 - 00000000 ____D C:\Users\*****\AppData\Roaming\Skype
2013-08-20 23:18 - 2013-08-20 23:00 - 83081127 _____ C:\Users\*****\Downloads\Basement Drums.zip
2013-08-20 22:48 - 2013-05-30 15:16 - 00000000 ____D C:\Users\*****\AppData\Local\Last.fm
2013-08-20 22:12 - 2013-08-20 22:12 - 00001011 _____ C:\Users\*****\Desktop\RealBand.lnk
2013-08-20 22:12 - 2013-08-20 22:12 - 00000932 _____ C:\Users\*****\Desktop\Band-in-a-Box.lnk
2013-08-20 22:12 - 2013-08-20 22:12 - 00000000 ____D C:\Users\*****\Documents\IK Multimedia
2013-08-20 22:12 - 2013-08-20 22:12 - 00000000 ____D C:\Program Files (x86)\PowerTracks DirectX Plugins
2013-08-20 22:12 - 2013-08-20 22:12 - 00000000 ____D C:\Program Files (x86)\Coyote
2013-08-20 22:12 - 2013-08-20 22:11 - 00000000 ____D C:\Program Files (x86)\RealBand
2013-08-20 22:12 - 2013-08-20 22:10 - 00000000 ____D C:\Program Files (x86)\bb
2013-08-20 22:12 - 2013-08-20 22:10 - 00000000 ____D C:\bb
2013-08-20 22:12 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system
2013-08-20 22:02 - 2013-05-30 17:55 - 00000000 ____D C:\Users\*****\AppData\Roaming\vlc
2013-08-20 21:06 - 2013-06-21 15:11 - 00000000 ____D C:\Users\*****\shared
2013-08-20 20:59 - 2013-05-30 13:41 - 00000000 ____D C:\Users\*****\.VirtualBox
2013-08-20 19:56 - 2013-08-20 19:56 - 01018949 _____ (Thisisu) C:\Users\*****\Downloads\JRT.exe
2013-08-20 19:17 - 2013-06-24 19:20 - 00000000 ____D C:\Users\*****\Documents\Cubase Projects
2013-08-20 18:56 - 2013-07-18 12:12 - 00000000 ____D C:\Users\*****\AppData\Local\dxhr
2013-08-20 16:52 - 2013-08-20 16:52 - 00000000 ____D C:\Users\*****\Documents\Psicraft
2013-08-20 16:52 - 2013-08-20 16:52 - 00000000 ____D C:\ProgramData\Psicraft
2013-08-20 16:52 - 2013-08-20 16:52 - 00000000 ____D C:\Program Files (x86)\Psicraft
2013-08-20 15:51 - 2013-08-20 15:45 - 136417802 _____ C:\Users\*****\Downloads\enrmp281_amitron_7_-_try_for_next_stage_free.zip
2013-08-20 15:39 - 2013-08-20 15:39 - 00000000 ____D C:\Program Files\Recuva
2013-08-20 14:38 - 2013-08-20 14:02 - 896216436 _____ C:\Users\*****\Downloads\Ignite_1.2.1_Win.zip
2013-08-20 13:25 - 2013-08-20 13:25 - 00000000 ____D C:\FRST
2013-08-20 13:10 - 2013-05-30 12:22 - 00000000 ____D C:\Users\*****
2013-08-20 09:27 - 2013-05-30 13:33 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-20 08:40 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\NDF
2013-08-19 20:47 - 2013-08-19 20:47 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_iLokDrvr_01007.Wdf
2013-08-19 20:41 - 2013-08-19 20:41 - 00000000 ____D C:\Users\*****\AppData\Roaming\Avid
2013-08-19 19:56 - 2013-08-19 19:22 - 00000000 ____D C:\ProgramData\Ableton
2013-08-19 19:50 - 2013-08-19 19:24 - 00000000 ____D C:\Users\*****\AppData\Roaming\Ableton
2013-08-19 19:34 - 2013-07-12 10:11 - 01249792 _____ (hxxp://www.ruby-lang.org/) C:\Users\*****\AppData\Roaming\msvcr90-ruby191.dll
2013-08-19 19:05 - 2013-08-19 19:04 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-19 18:01 - 2013-08-19 18:00 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-08-19 18:01 - 2013-08-19 18:00 - 00000000 ____D C:\Program Files\iTunes
2013-08-19 18:01 - 2013-05-30 15:40 - 00000000 ____D C:\Program Files (x86)\iTunes
2013-08-19 18:00 - 2013-08-19 18:00 - 00000000 ____D C:\Program Files\iPod
2013-08-17 17:33 - 2013-05-30 15:51 - 00000000 ____D C:\Users\*****\AppData\Local\CrashDumps
2013-08-16 11:02 - 2013-08-16 10:54 - 109543206 _____ C:\Users\*****\Downloads\enrmp167_un_-_the_secret_rift.zip
2013-08-16 11:01 - 2013-08-16 10:53 - 110608368 _____ C:\Users\*****\Downloads\enrmp168_un_-_hol.zip
2013-08-16 10:53 - 2013-08-16 10:52 - 26665445 _____ C:\Users\*****\Downloads\enrmp194_bashed_nursling_-_eating_thorax.zip
2013-08-16 08:42 - 2013-08-16 08:36 - 81475627 _____ C:\Users\*****\Downloads\enrmp238_bashed_nursling_-_every_sunday_morning_kills_us.zip
2013-08-16 08:42 - 2013-08-16 08:34 - 126372901 _____ C:\Users\*****\Downloads\enrmp259_bashed_nursling_-_palace_of_toxicology.zip
2013-08-16 08:33 - 2013-08-16 08:31 - 30072191 _____ C:\Users\*****\Downloads\enrmp288_edgeist_-_landscapes.zip
2013-08-15 19:54 - 2013-06-02 13:28 - 00000000 ____D C:\Users\*****\AppData\Roaming\Audacity
2013-08-15 18:24 - 2013-05-30 20:30 - 00000000 ____D C:\Users\*****\AppData\Roaming\Mp3tag
2013-08-15 03:55 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-08-15 03:17 - 2010-11-21 05:47 - 00057252 _____ C:\Windows\PFRO.log
2013-08-15 01:37 - 2013-08-14 21:46 - 212007729 _____ (Univers Sons                                                ) C:\Users\*****\Downloads\uviworkstation-x64-2-1-5.exe
2013-08-14 23:48 - 2013-08-14 21:49 - 228607849 _____ C:\Users\*****\Downloads\AGML_1_1_0_Installer.rar
2013-08-14 20:35 - 2013-07-12 18:31 - 00000000 ____D C:\Windows\system32\MRT
2013-08-14 20:33 - 2013-05-30 12:53 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-08-14 17:57 - 2013-08-14 17:57 - 00000000 ____D C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\JXPlugins
2013-08-14 17:57 - 2013-08-14 17:57 - 00000000 ____D C:\Program Files (x86)\JXPlugins
2013-08-14 17:45 - 2013-07-20 11:53 - 00000000 ____D C:\Users\*****\AppData\Local\The Witcher
2013-08-14 14:28 - 2013-08-14 14:28 - 00000000 ____D C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Radio VSTI FREE
2013-08-14 14:27 - 2013-08-14 14:27 - 00000000 ____D C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Om VSTI FREE
2013-08-14 14:26 - 2013-08-14 14:26 - 00000000 ____D C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mushroombpm VSTI FREE
2013-08-14 14:25 - 2013-08-14 14:25 - 00000000 ____D C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Marijuana VSTI FREE
2013-08-11 21:02 - 2013-08-11 21:02 - 00001007 _____ C:\Users\*****\Desktop\Free Alarm Clock.lnk
2013-08-11 21:02 - 2013-08-11 21:02 - 00000000 ____D C:\Program Files (x86)\FreeAlarmClock
2013-08-11 07:50 - 2013-05-30 14:46 - 00000000 ____D C:\Users\*****\Documents\Calibre Library
2013-08-10 11:00 - 2013-05-30 16:32 - 00000000 ____D C:\Games
2013-08-09 21:20 - 2013-05-30 15:53 - 00000000 ____D C:\Users\*****\AppData\Local\Paint.NET
2013-08-09 11:12 - 2013-06-24 19:18 - 00000000 ____D C:\Program Files (x86)\Steinberg
2013-08-09 10:50 - 2013-08-09 10:50 - 00000000 ____D C:\ProgramData\Caphyon
2013-08-09 10:49 - 2013-06-21 16:11 - 00000000 ____D C:\Users\*****\AppData\Roaming\Flux
2013-08-09 10:26 - 2013-07-10 12:00 - 00000000 ____D C:\Users\*****\AppData\Roaming\PluginUpdate
2013-08-08 12:12 - 2013-05-30 16:01 - 00000000 ____D C:\Users\*****\AppData\Local\Spotify
2013-08-08 12:12 - 2013-05-30 16:00 - 00000000 ____D C:\Users\*****\AppData\Roaming\Spotify
2013-08-07 23:48 - 2013-08-07 23:46 - 00000000 ____D C:\ProgramData\WindSolutions
2013-08-07 23:46 - 2013-08-07 23:46 - 00000000 ____D C:\Users\*****\AppData\Roaming\WindSolutions
2013-08-07 13:09 - 2013-05-30 15:05 - 00000000 ____D C:\Users\*****\Documents\BioWare
2013-08-07 11:49 - 2013-05-30 15:59 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-08-07 11:49 - 2013-05-30 15:59 - 00000000 ____D C:\ProgramData\Skype
2013-08-06 13:22 - 2013-07-14 15:12 - 00282472 _____ C:\Windows\SysWOW64\PnkBstrB.xtr
2013-08-06 13:22 - 2013-07-14 15:09 - 00282472 _____ C:\Windows\SysWOW64\PnkBstrB.exe
2013-08-04 19:18 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\LiveKernelReports
2013-08-04 18:15 - 2013-08-04 18:15 - 00001014 _____ C:\Users\Public\Desktop\Kontakt 5.lnk
2013-08-04 18:15 - 2013-08-04 18:15 - 00000000 __HDC C:\ProgramData\{ACEB5C90-39F7-4044-91EF-FBD59A59D240}
2013-08-04 18:13 - 2013-05-31 16:07 - 00000000 ____D C:\Program Files\Native Instruments
2013-08-04 13:23 - 2013-08-04 13:23 - 00000000 ____D C:\Program Files (x86)\Xylgo
2013-08-04 12:47 - 2013-05-30 13:50 - 00000000 ____D C:\Users\*****\Statistics
2013-08-03 14:40 - 2013-05-30 15:06 - 00000000 ____D C:\Users\*****\Documents\My Games
2013-08-03 10:12 - 2013-05-30 21:41 - 00000000 ___RD C:\Users\Public\Recorded TV
2013-08-03 10:12 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2013-07-31 18:31 - 2013-05-30 13:41 - 00000000 ____D C:\Users\*****\.freemind
2013-07-30 13:39 - 2013-07-28 23:03 - 00000000 ____D C:\Program Files (x86)\DVDVideoSoft
2013-07-30 13:38 - 2013-05-30 14:39 - 00000000 ____D C:\Users\*****\AppData\Roaming\DVDVideoSoft
2013-07-30 12:21 - 2013-07-30 12:21 - 00000000 __HDC C:\ProgramData\{B459B207-EA55-45E4-939F-D5DBD19BA3B1}
2013-07-30 12:21 - 2013-07-30 12:21 - 00000000 __HDC C:\ProgramData\{00E0164B-B182-4800-96DA-F8D39B3A7189}
2013-07-30 12:18 - 2013-05-31 16:07 - 00000000 ____D C:\Program Files\Common Files\Native Instruments
2013-07-30 11:53 - 2013-07-30 11:53 - 00000000 __HDC C:\ProgramData\{3B9A3AE3-5BE1-4645-A31C-753724255564}
2013-07-30 11:53 - 2013-07-30 11:53 - 00000000 __HDC C:\ProgramData\{3A633AE9-5307-4E4D-ACED-C8739F84CB10}
2013-07-30 11:53 - 2013-07-02 23:06 - 00001094 _____ C:\Users\Public\Desktop\Controller Editor.lnk
2013-07-30 11:52 - 2013-05-31 16:13 - 00000000 ____D C:\Users\Public\Documents\Guitar Rig 5 Player MFXP
2013-07-28 23:03 - 2013-07-28 23:03 - 00001306 _____ C:\Users\Public\Desktop\Free YouTube Download.lnk
2013-07-27 20:51 - 2013-07-27 20:51 - 00001675 _____ C:\Users\*****\Desktop\Massive.lnk
2013-07-27 20:49 - 2013-06-01 16:25 - 00000000 ____D C:\Users\*****\AppData\Local\Native Instruments
2013-07-27 20:49 - 2013-05-31 16:14 - 00000000 ____D C:\Users\*****\Documents\Native Instruments
2013-07-27 20:48 - 2013-07-27 20:48 - 00000000 ____D C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Native Instruments Massive
2013-07-27 20:48 - 2013-05-31 16:01 - 00000000 ____D C:\Program Files (x86)\Native Instruments
2013-07-27 18:48 - 2013-07-05 10:06 - 00000000 ____D C:\Program Files (x86)\MW3CU
2013-07-26 13:46 - 2013-05-30 14:57 - 00001114 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-26 13:46 - 2013-05-30 14:57 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-26 13:39 - 2013-07-26 13:40 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-07-26 13:39 - 2013-07-26 13:40 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-07-26 13:39 - 2013-07-26 13:39 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-07-26 13:39 - 2013-07-26 13:39 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-07-26 13:39 - 2013-07-26 13:39 - 00000000 ____D C:\Program Files (x86)\Java
2013-07-26 13:39 - 2013-05-31 20:29 - 00867240 _____ (Oracle Corporation) C:\Windows\SysWOW64\npDeployJava1.dll
2013-07-26 13:39 - 2013-05-31 20:29 - 00789416 _____ (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
2013-07-26 13:38 - 2013-07-26 13:38 - 00312232 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-07-26 13:38 - 2013-07-26 13:38 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-07-26 13:38 - 2013-07-26 13:38 - 00188840 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-07-26 13:38 - 2013-07-26 13:38 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2013-07-26 13:38 - 2013-05-30 13:40 - 01093032 _____ (Oracle Corporation) C:\Windows\system32\npDeployJava1.dll
2013-07-26 13:38 - 2013-05-30 13:40 - 00972712 _____ (Oracle Corporation) C:\Windows\system32\deployJava1.dll
2013-07-26 13:28 - 2013-07-26 13:27 - 01378902 _____ C:\Users\*****\Downloads\ME3_CinemaMod_v05.zip
2013-07-25 11:25 - 2013-08-14 19:43 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-07-25 10:57 - 2013-08-14 19:43 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-25 05:54 - 2013-08-14 20:32 - 17830400 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-25 05:37 - 2013-08-14 20:32 - 02312704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-25 05:35 - 2013-08-14 20:32 - 10926080 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-25 05:31 - 2013-08-14 20:32 - 01346560 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-25 05:30 - 2013-08-14 20:32 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-25 05:29 - 2013-08-14 20:32 - 01494528 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-07-25 05:29 - 2013-08-14 20:32 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-07-25 05:29 - 2013-08-14 20:32 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-25 05:28 - 2013-08-14 20:32 - 02147840 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-25 05:28 - 2013-08-14 20:32 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-25 05:28 - 2013-08-14 20:32 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-25 05:28 - 2013-08-14 20:32 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-07-25 05:28 - 2013-08-14 20:32 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-07-25 05:27 - 2013-08-14 20:32 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-25 05:27 - 2013-08-14 20:32 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-07-25 05:26 - 2013-08-14 20:32 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-25 04:40 - 2013-08-14 20:32 - 12334080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-25 04:32 - 2013-08-14 20:32 - 01800704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-25 04:30 - 2013-08-14 20:32 - 09738752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-25 04:26 - 2013-08-14 20:32 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-25 04:26 - 2013-08-14 20:32 - 01104384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-25 04:25 - 2013-08-14 20:32 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-07-25 04:24 - 2013-08-14 20:32 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-07-25 04:24 - 2013-08-14 20:32 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-25 04:23 - 2013-08-14 20:32 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-25 04:23 - 2013-08-14 20:32 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-25 04:23 - 2013-08-14 20:32 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-25 04:23 - 2013-08-14 20:32 - 00420864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-07-25 04:23 - 2013-08-14 20:32 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-07-25 04:22 - 2013-08-14 20:32 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-25 04:22 - 2013-08-14 20:32 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-07-25 04:22 - 2013-08-14 20:32 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-07-23 11:32 - 2013-07-23 11:32 - 00001947 _____ C:\Users\Public\Desktop\Medias in res! CD-ROM.lnk
2013-07-23 11:32 - 2013-07-23 11:32 - 00000000 ____D C:\Program Files (x86)\Veritas
2013-07-23 11:29 - 2013-07-23 11:29 - 00000000 __SHD C:\Users\*****\AppData\Roaming\.#
2013-07-23 09:54 - 2013-07-16 20:38 - 00000000 ____D C:\Users\Public\Documents\The Witcher

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-08-13 13:15

==================== End Of Log ============================
         

--- --- ---

--- --- ---

Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle einen Quickscan mit Malwarebytes Anti-Malware (MBAM)

Hinweis: Denk bitte vorher daran, Malwarebytes Anti-Malware über den Updatebutton zu aktualisieren!

Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:


ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.08.21.01

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
*****:: *****-HP [Administrator]

21.08.2013 10:40:37
MBAM-log-2013-08-21 (10-47-00).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 244127
Laufzeit: 4 Minute(n), 10 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 1
C:\Users\*****\AppData\Local\Temp\DarkWave-Studio-Setup.exe (PUP.Optional.OpenCandy) -> Keine Aktion durchgeführt.

(Ende)
         

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=9270e5c4eb0db145923828eb1313b017
# engine=14848
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-08-21 01:55:45
# local_time=2013-08-21 03:55:45 (+0100, Mitteleuropäische Sommerzeit)
# country="Austria"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=3590 16777213 100 87 3447247 196111531 0 0
# compatibility_mode=5893 16776574 100 94 3447394 128723195 0 0
# scanned=605190
# found=0
# cleaned=0
# scan_time=16496
         

TFC - Temp File Cleaner

Lade dir TFC (TempFileCleaner von Oldtimer) herunter und speichere es auf den Desktop.

• Öffne die TFC.exe.
  Vista und Win 7 User mit Rechtsklick "als Administrator starten".
• Schließe alle anderen Programme.
• Drücke auf den Button Start.
• Falls du zu einem Neustart aufgefordert wirst, bestätige diesen.

Gut, habe ich gemacht.

Sieht soweit ok aus

Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat.

Info: Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

Nein, gibt keine Probleme mehr.

Dann wären wir durch!


Falls du noch Lob oder Kritik loswerden möchtest => Lob, Kritik und Wünsche - Trojaner-Board

Die Programme, die hier zum Einsatz kamen, können alle deinstalliert werden. (Tools wie zB FRST einfach per Rechtsklick vom Desktop löschen)

Combofix entfernen (nur relevant wenn es hier benutzt wurde!) : Start/Ausführen (Tastenkombination WIN+R), dort den Befehl combofix /uninstall eintippen und ausführen


Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.


Microsoftupdate
Windows XP:Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.
Windows Vista/7: Start, Systemsteuerung, Windows-Update


PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:
Prüfen => Adobe - Flash Player
Downloadlinks findest du hier => Browsers and Plugins - FilePony.de

Alle Plugins im Firefox-Browser kannst du auch ganz einfach hier auf Aktualität prüfen => https://www.mozilla.org/de/plugincheck

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.


Java-Update
Veraltete Java-Installationen sind ein großes Sicherheitsrisiko, daher solltest Du die alten Versionen deinstallieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software (bzw. Programme und Funktionen) und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.