| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Win 7: System wirklich sauber?Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
21.05.2014, 11:09
| #1 |
| |  Win 7: System wirklich sauber? Hallo, folgendes Problem: Mein Opa hat sich auf seinen Laptop ziemlich viel Malware und ggf. schlimmeres eingefangen. Aufgefallen war dies erst, nachdem sich eine "search-toolbar" im Firefox eingenistet hatte. Da mehrere Personen mit der Reinigung beschäftigt waren, kann ich nicht genau sagen welche Schädlinge wirklich auf dem Rechner waren, bevor ich ihn in die Hände bekommen habe. Ich habe mittels revo-uninstaller alle mir suspekte Software deinstalliert (u.a. PC-Optimizer) und anschließend mittels Anti-Malware, adwcleaner und Security Essentials alle Infektionen beseitigen lassen. Ich traue diesem Frieden aber nicht, deswegen wäre es schön, wenn noch einmal ein Experte über die Log's schauen könnte. FRST-Log: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-05-2014
Ran by User (administrator) on USER-HP on 21-05-2014 10:52:30
Running from E:\
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe
(Atheros) C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe
() C:\ProgramData\DatacardService\HWDeviceService64.exe
() C:\ProgramData\Mobile Broadband\OnlineUpdate\ouc.exe
(Portrait Displays, Inc.) C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Health Check\HPHC_Service.exe
(Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe
(Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Dropbox, Inc.) C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe
(CANON INC.) C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [AtherosBtStack] => C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [627360 2011-05-10] (Atheros Communications)
HKLM\...\Run: [AthBtTray] => C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe [379552 2011-05-10] (Atheros Commnucations)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1128448 2011-05-11] (IDT, Inc.)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1271072 2014-03-11] (Microsoft Corporation)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2804976 2013-10-30] (Synaptics Incorporated)
HKLM-x32\...\Run: [IJNetworkScannerSelectorEX] => C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe [452016 2011-01-15] (CANON INC.)
HKU\S-1-5-21-2446583867-3022644920-1075775823-1001\...\MountPoints2: E - E:\AutoRun.exe
HKU\S-1-5-21-2446583867-3022644920-1075775823-1001\...\MountPoints2: {30952e6a-5e05-11e1-9235-d0df9afeb206} - E:\AutoRun.exe
HKU\S-1-5-21-2446583867-3022644920-1075775823-1001\...\MountPoints2: {5049a7f4-04cc-11e2-b4c4-d0df9aff0efe} - E:\AutoRun.exe
HKU\S-1-5-21-2446583867-3022644920-1075775823-1001\...\MountPoints2: {690cff6d-4369-11e1-92e1-d0df9aff0efe} - E:\AutoRun.exe
HKU\S-1-5-21-2446583867-3022644920-1075775823-1001\...\MountPoints2: {690cff7d-4369-11e1-92e1-d0df9aff0efe} - E:\AutoRun.exe
HKU\S-1-5-21-2446583867-3022644920-1075775823-1001\...\MountPoints2: {87b23889-4fe3-11e1-a06b-d0df9afeb206} - E:\AutoRun.exe
Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} URL = hxxp://www.default-search.net/search?sid=492&aid=103&itype=n&ver=12565&tm=348&src=ds&p={searchTerms}
SearchScopes: HKLM-x32 - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} URL = hxxp://www.default-search.net/search?sid=492&aid=103&itype=n&ver=12565&tm=348&src=ds&p={searchTerms}
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {2FAF37A7-AF53-4D45-BAFE-138BB6AE74A6} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000027&src=kw&q={searchTerms}&locale=&apn_ptnrs=U3&apn_dtid=YYYYYYYYSE&apn_uid=6CEC5624-25D3-4A0E-8D13-F17582B93460&apn_sauid=66F901F8-7141-406F-9FFB-A1EE0281EE97
SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} URL = hxxp://www.default-search.net/search?sid=492&aid=103&itype=n&ver=12565&tm=348&src=ds&p={searchTerms}
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: No Name - {DBC80044-A445-435b-BC74-9C25C1C588A9} - No File
BHO-x32: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 172.16.23.1
Tcpip\..\Interfaces\{3EA6B487-3EF8-4E74-B4DA-70776ADF1378}: [NameServer]212.23.97.2 212.23.97.3
Tcpip\..\Interfaces\{47131E74-A8A8-48D6-9288-CA3F1907FF36}: [NameServer]195.67.199.18 195.67.199.19
Tcpip\..\Interfaces\{E8ED6CD7-D5B7-497A-B0BA-37BA5A818B81}: [NameServer]195.67.199.27 195.67.199.28
Tcpip\..\Interfaces\{F386DD48-D4BA-4039-B614-93D11549095B}: [NameServer]195.67.199.27 195.67.199.28
FireFox:
========
FF ProfilePath: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\pnndptg0.default
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.40.2 - C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.40.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll No File
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Adblock Plus - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\pnndptg0.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-05-19]
==================== Services (Whitelisted) =================
R2 Atheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [146592 2011-05-10] (Atheros)
R2 hpHotkeyMonitor; C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\HpHotkeyMonitor.exe [317496 2011-05-14] (Hewlett-Packard Company)
R2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [346976 2011-03-14] ()
S2 Mobile Broadband. RunOuc; C:\Program Files (x86)\Mobile Broadband\UpdateDog\ouc.exe [246112 2012-06-01] ()
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2014-03-11] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [347872 2014-03-11] (Microsoft Corporation)
S3 wifimansvc; C:\Program Files (x86)\Mobile Broadband\eap\wifimansvc.exe [598528 2012-06-01] ()
S2 Mobile Partner. RunOuc; C:\Program Files (x86)\Mobile Partner\UpdateDog\ouc.exe [X]
==================== Drivers (Whitelisted) ====================
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [268512 2014-01-25] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133928 2014-03-11] (Microsoft Corporation)
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1866080 2012-11-28] ()
R1 {0782648b-1717-4fef-ac58-8cb3ce03adb3}Gw64; C:\Windows\System32\drivers\{0782648b-1717-4fef-ac58-8cb3ce03adb3}Gw64.sys [61120 2014-04-24] (StdLib)
S3 ARCVCAM; system32\DRIVERS\ArcSoftVCapture.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-05-21 10:52 - 2014-05-21 10:52 - 00000000 ____D () C:\FRST
2014-05-21 10:45 - 2014-05-21 10:45 - 00000570 _____ () C:\windows\PFRO.log
2014-05-21 10:45 - 2014-05-21 10:45 - 00000056 _____ () C:\windows\setupact.log
2014-05-21 10:45 - 2014-05-21 10:45 - 00000000 _____ () C:\windows\setuperr.log
2014-05-21 10:44 - 2014-05-21 10:44 - 00000470 _____ () C:\windows\SysWOW64\defogger_disable.log
2014-05-21 10:44 - 2014-05-21 10:44 - 00000000 _____ () C:\Users\User\defogger_reenable
2014-05-21 10:43 - 2014-05-21 10:43 - 00050477 _____ () C:\Users\User\Downloads\Defogger.exe
2014-05-21 00:27 - 2014-01-09 04:22 - 05694464 _____ (Microsoft Corporation) C:\windows\SysWOW64\mstscax.dll
2014-05-21 00:27 - 2014-01-04 00:44 - 06574592 _____ (Microsoft Corporation) C:\windows\system32\mstscax.dll
2014-05-20 20:41 - 2014-05-20 20:43 - 00000000 ____D () C:\Users\User\AppData\Local\Xobni
2014-05-20 20:26 - 2014-05-20 20:26 - 00003148 _____ () C:\windows\System32\Tasks\SidebarExecute
2014-05-20 19:52 - 2013-10-02 04:22 - 00056832 _____ (Microsoft Corporation) C:\windows\system32\Drivers\TsUsbFlt.sys
2014-05-20 19:52 - 2013-10-02 04:11 - 00013824 _____ (Microsoft Corporation) C:\windows\system32\TsUsbRedirectionGroupPolicyControl.exe
2014-05-20 19:52 - 2013-10-02 04:08 - 00012800 _____ (Microsoft Corporation) C:\windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2014-05-20 19:52 - 2013-10-02 03:48 - 00056832 _____ (Microsoft Corporation) C:\windows\system32\MsRdpWebAccess.dll
2014-05-20 19:52 - 2013-10-02 03:48 - 00018944 _____ (Microsoft Corporation) C:\windows\system32\wksprtPS.dll
2014-05-20 19:52 - 2013-10-02 03:29 - 00062976 _____ (Microsoft Corporation) C:\windows\system32\tsgqec.dll
2014-05-20 19:52 - 2013-10-02 03:10 - 00044544 _____ (Microsoft Corporation) C:\windows\system32\TsUsbGDCoInstaller.dll
2014-05-20 19:52 - 2013-10-02 02:15 - 01057280 _____ (Microsoft Corporation) C:\windows\system32\rdvidcrl.dll
2014-05-20 19:52 - 2013-10-02 02:14 - 00050176 _____ (Microsoft Corporation) C:\windows\SysWOW64\MsRdpWebAccess.dll
2014-05-20 19:52 - 2013-10-02 02:14 - 00017920 _____ (Microsoft Corporation) C:\windows\SysWOW64\wksprtPS.dll
2014-05-20 19:52 - 2013-10-02 02:08 - 00083968 _____ (Microsoft Corporation) C:\windows\system32\TSWbPrxy.exe
2014-05-20 19:52 - 2013-10-02 02:01 - 00420864 _____ (Microsoft Corporation) C:\windows\system32\wksprt.exe
2014-05-20 19:52 - 2013-10-02 01:58 - 00053248 _____ (Microsoft Corporation) C:\windows\SysWOW64\tsgqec.dll
2014-05-20 19:52 - 2013-10-02 01:31 - 01147392 _____ (Microsoft Corporation) C:\windows\system32\mstsc.exe
2014-05-20 19:52 - 2013-10-02 01:08 - 00855552 _____ (Microsoft Corporation) C:\windows\SysWOW64\rdvidcrl.dll
2014-05-20 19:52 - 2013-10-02 00:34 - 01068544 _____ (Microsoft Corporation) C:\windows\SysWOW64\mstsc.exe
2014-05-20 19:51 - 2012-08-23 16:13 - 00243200 _____ (Microsoft Corporation) C:\windows\system32\rdpudd.dll
2014-05-20 19:51 - 2012-08-23 16:10 - 00019456 _____ (Microsoft Corporation) C:\windows\system32\Drivers\rdpvideominiport.sys
2014-05-20 19:51 - 2012-08-23 16:08 - 00030208 _____ (Microsoft Corporation) C:\windows\system32\Drivers\TsUsbGD.sys
2014-05-20 19:51 - 2012-08-23 15:24 - 00015360 _____ (Microsoft Corporation) C:\windows\system32\RdpGroupPolicyExtension.dll
2014-05-20 19:51 - 2012-08-23 13:12 - 00192000 _____ (Microsoft Corporation) C:\windows\SysWOW64\rdpendp_winip.dll
2014-05-20 19:51 - 2012-08-23 12:51 - 00228864 _____ (Microsoft Corporation) C:\windows\system32\rdpendp_winip.dll
2014-05-20 19:51 - 2012-08-23 11:51 - 03174912 _____ (Microsoft Corporation) C:\windows\system32\rdpcorets.dll
2014-05-20 19:50 - 2014-05-20 19:50 - 00000000 ____H () C:\windows\system32\Drivers\Msft_Kernel_SynTP_01011.Wdf
2014-05-20 19:47 - 2013-09-25 04:23 - 01030144 _____ (Microsoft Corporation) C:\windows\system32\TSWorkspace.dll
2014-05-20 19:47 - 2013-09-25 03:57 - 00792576 _____ (Microsoft Corporation) C:\windows\SysWOW64\TSWorkspace.dll
2014-05-20 19:47 - 2012-05-04 13:00 - 00366592 _____ (Microsoft Corporation) C:\windows\system32\qdvd.dll
2014-05-20 19:47 - 2012-05-04 11:59 - 00514560 _____ (Microsoft Corporation) C:\windows\SysWOW64\qdvd.dll
2014-05-20 19:43 - 2014-05-20 19:43 - 00000000 __SHD () C:\Users\User\AppData\Local\EmieUserList
2014-05-20 19:43 - 2014-05-20 19:43 - 00000000 __SHD () C:\Users\User\AppData\Local\EmieSiteList
2014-05-19 19:33 - 2014-05-19 19:33 - 00001169 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-05-19 19:33 - 2014-05-19 19:33 - 00001157 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-05-19 19:33 - 2014-05-19 19:33 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-05-19 19:32 - 2014-05-19 19:32 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-05-19 08:08 - 2014-05-19 08:08 - 00000000 ____D () C:\Users\User\Downloads\AdwCleaner_TSA13I851
2014-05-19 08:06 - 2014-05-19 19:33 - 00000000 ____D () C:\Users\User\AppData\Roaming\Mozilla
2014-05-18 15:08 - 2014-05-21 10:49 - 00253949 _____ () C:\windows\WindowsUpdate.log
2014-05-18 15:01 - 2014-05-18 15:01 - 00240786 _____ () C:\Users\User\Desktop\cc_20140518_150149.reg
2014-05-18 14:42 - 2014-05-18 14:42 - 00000000 ____D () C:\windows\pss
2014-05-18 14:28 - 2014-05-19 09:03 - 00119512 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-18 14:27 - 2014-05-18 15:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-05-18 14:27 - 2014-05-18 15:18 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-05-18 14:27 - 2014-05-18 14:27 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-18 14:27 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2014-05-18 14:27 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2014-05-18 14:27 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2014-05-18 01:21 - 2014-05-18 01:21 - 00000042 _____ () C:\Users\User\AppData\Roaming\WB.CFG
2014-05-17 11:19 - 2014-05-17 11:22 - 28852416 _____ (Mozilla) C:\Users\User\Downloads\Firefox Setup 29.0.1.exe
2014-05-16 09:34 - 2014-05-16 09:35 - 00000000 ____D () C:\Users\User\Documents\Bluetooth Folder
2014-05-16 01:04 - 2014-04-24 12:36 - 00061120 _____ (StdLib) C:\windows\system32\Drivers\{0782648b-1717-4fef-ac58-8cb3ce03adb3}Gw64.sys
2014-05-15 23:06 - 2014-05-15 23:06 - 00000000 ____D () C:\Users\User\AppData\Local\cache
2014-05-15 23:06 - 2014-05-15 23:06 - 00000000 ____D () C:\Users\User\.android
2014-05-15 20:05 - 2014-05-18 15:11 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-05-14 10:21 - 2014-05-06 06:40 - 23544320 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2014-05-14 10:21 - 2014-05-06 06:17 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2014-05-14 10:21 - 2014-05-06 05:25 - 17382912 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2014-05-14 10:21 - 2014-05-06 05:07 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2014-05-14 10:21 - 2014-05-06 05:00 - 00084992 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2014-05-14 10:21 - 2014-05-06 04:10 - 00069632 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2014-05-14 09:52 - 2014-05-09 08:14 - 00477184 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2014-05-14 09:52 - 2014-05-09 08:11 - 00424448 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2014-05-14 09:52 - 2014-04-12 04:22 - 00155072 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys
2014-05-14 09:52 - 2014-04-12 04:22 - 00095680 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecdd.sys
2014-05-14 09:52 - 2014-04-12 04:19 - 01460736 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll
2014-05-14 09:52 - 2014-04-12 04:19 - 00136192 _____ (Microsoft Corporation) C:\windows\system32\sspicli.dll
2014-05-14 09:52 - 2014-04-12 04:19 - 00031232 _____ (Microsoft Corporation) C:\windows\system32\lsass.exe
2014-05-14 09:52 - 2014-04-12 04:19 - 00029184 _____ (Microsoft Corporation) C:\windows\system32\sspisrv.dll
2014-05-14 09:52 - 2014-04-12 04:19 - 00028160 _____ (Microsoft Corporation) C:\windows\system32\secur32.dll
2014-05-14 09:52 - 2014-04-12 04:12 - 00022016 _____ (Microsoft Corporation) C:\windows\SysWOW64\secur32.dll
2014-05-14 09:52 - 2014-04-12 04:10 - 00096768 _____ (Microsoft Corporation) C:\windows\SysWOW64\sspicli.dll
2014-05-14 09:52 - 2014-03-25 04:43 - 14175744 _____ (Microsoft Corporation) C:\windows\system32\shell32.dll
2014-05-14 09:52 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\windows\SysWOW64\shell32.dll
2014-05-14 09:52 - 2014-03-04 11:47 - 05550016 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2014-05-14 09:52 - 2014-03-04 11:44 - 00728064 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll
2014-05-14 09:52 - 2014-03-04 11:44 - 00722944 _____ (Microsoft Corporation) C:\windows\system32\objsel.dll
2014-05-14 09:52 - 2014-03-04 11:44 - 00424960 _____ (Microsoft Corporation) C:\windows\system32\KernelBase.dll
2014-05-14 09:52 - 2014-03-04 11:44 - 00340992 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll
2014-05-14 09:52 - 2014-03-04 11:44 - 00314880 _____ (Microsoft Corporation) C:\windows\system32\msv1_0.dll
2014-05-14 09:52 - 2014-03-04 11:44 - 00210944 _____ (Microsoft Corporation) C:\windows\system32\wdigest.dll
2014-05-14 09:52 - 2014-03-04 11:44 - 00086528 _____ (Microsoft Corporation) C:\windows\system32\TSpkg.dll
2014-05-14 09:52 - 2014-03-04 11:44 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\wincredprovider.dll
2014-05-14 09:52 - 2014-03-04 11:43 - 00455168 _____ (Microsoft Corporation) C:\windows\system32\winlogon.exe
2014-05-14 09:52 - 2014-03-04 11:43 - 00057344 _____ (Microsoft Corporation) C:\windows\system32\cngprovider.dll
2014-05-14 09:52 - 2014-03-04 11:43 - 00056832 _____ (Microsoft Corporation) C:\windows\system32\adprovider.dll
2014-05-14 09:52 - 2014-03-04 11:43 - 00053760 _____ (Microsoft Corporation) C:\windows\system32\capiprovider.dll
2014-05-14 09:52 - 2014-03-04 11:43 - 00052736 _____ (Microsoft Corporation) C:\windows\system32\dpapiprovider.dll
2014-05-14 09:52 - 2014-03-04 11:43 - 00044544 _____ (Microsoft Corporation) C:\windows\system32\dimsroam.dll
2014-05-14 09:52 - 2014-03-04 11:43 - 00022016 _____ (Microsoft Corporation) C:\windows\system32\credssp.dll
2014-05-14 09:52 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe
2014-05-14 09:52 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe
2014-05-14 09:52 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\windows\SysWOW64\kerberos.dll
2014-05-14 09:52 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\windows\SysWOW64\objsel.dll
2014-05-14 09:52 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\windows\SysWOW64\msv1_0.dll
2014-05-14 09:52 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll
2014-05-14 09:52 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\windows\SysWOW64\wdigest.dll
2014-05-14 09:52 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\windows\SysWOW64\TSpkg.dll
2014-05-14 09:52 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\windows\SysWOW64\cngprovider.dll
2014-05-14 09:52 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\windows\SysWOW64\adprovider.dll
2014-05-14 09:52 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\windows\SysWOW64\capiprovider.dll
2014-05-14 09:52 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\windows\SysWOW64\dpapiprovider.dll
2014-05-14 09:52 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\windows\SysWOW64\dimsroam.dll
2014-05-14 09:52 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\windows\SysWOW64\wincredprovider.dll
2014-05-14 09:52 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\windows\SysWOW64\credssp.dll
2014-05-14 09:52 - 2014-03-04 11:16 - 00274944 _____ (Microsoft Corporation) C:\windows\SysWOW64\KernelBase.dll
2014-05-12 17:37 - 2014-05-12 17:37 - 00002741 _____ () C:\Users\User\Downloads\Kontroll av Biotronik ICD.eml
2014-05-06 11:38 - 2014-05-14 17:25 - 00000000 ___SD () C:\windows\system32\CompatTel
2014-05-03 20:33 - 2014-05-03 20:34 - 00000000 ____D () C:\Users\User\AppData\Roaming\DropboxMaster
2014-04-25 15:30 - 2014-04-27 21:29 - 00000000 ____D () C:\Users\User\AppData\Local\Windows Live
2014-04-25 15:29 - 2014-04-25 15:29 - 00000000 ____D () C:\Users\User\AppData\Local\{B57C9FFA-5D76-44C0-8578-45303CFD8CB6}
2014-04-22 13:09 - 2014-03-06 11:31 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2014-04-22 13:09 - 2014-03-06 10:57 - 00548352 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2014-04-22 13:09 - 2014-03-06 10:39 - 00033792 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2014-04-22 13:09 - 2014-03-06 10:32 - 00574976 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2014-04-22 13:09 - 2014-03-06 10:28 - 00752640 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2014-04-22 13:09 - 2014-03-06 10:03 - 00586240 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2014-04-22 13:09 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2014-04-22 13:09 - 2014-03-06 09:56 - 00038400 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
2014-04-22 13:09 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2014-04-22 13:08 - 2014-03-06 10:59 - 00066048 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2014-04-22 13:08 - 2014-03-06 10:57 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2014-04-22 13:08 - 2014-03-06 10:53 - 02767360 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2014-04-22 13:08 - 2014-03-06 10:40 - 00051200 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2014-04-22 13:08 - 2014-03-06 10:29 - 00139264 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2014-04-22 13:08 - 2014-03-06 10:29 - 00111616 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2014-04-22 13:08 - 2014-03-06 10:15 - 00940032 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2014-04-22 13:08 - 2014-03-06 10:11 - 05784064 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2014-04-22 13:08 - 2014-03-06 10:09 - 00453120 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2014-04-22 13:08 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2014-04-22 13:08 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll
2014-04-22 13:08 - 2014-03-06 09:48 - 00195584 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2014-04-22 13:08 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2014-04-22 13:08 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2014-04-22 13:08 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2014-04-22 13:08 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2014-04-22 13:08 - 2014-03-06 09:42 - 00296960 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2014-04-22 13:08 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe
2014-04-22 13:08 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll
2014-04-22 13:08 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2014-04-22 13:08 - 2014-03-06 09:21 - 00628736 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2014-04-22 13:08 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-04-22 13:08 - 2014-03-06 09:11 - 02043904 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2014-04-22 13:08 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2014-04-22 13:08 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2014-04-22 13:08 - 2014-03-06 08:53 - 13551104 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2014-04-22 13:08 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2014-04-22 13:08 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2014-04-22 13:08 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2014-04-22 13:08 - 2014-03-06 08:22 - 02260480 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2014-04-22 13:08 - 2014-03-06 07:58 - 01400832 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2014-04-22 13:08 - 2014-03-06 07:50 - 00846336 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2014-04-22 13:08 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
2014-04-22 13:08 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2014-04-22 13:08 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
==================== One Month Modified Files and Folders =======
2014-05-21 10:52 - 2014-05-21 10:52 - 00000000 ____D () C:\FRST
2014-05-21 10:52 - 2009-07-14 06:45 - 00028576 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-21 10:52 - 2009-07-14 06:45 - 00028576 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-21 10:50 - 2012-08-24 14:29 - 00000000 ____D () C:\Users\User\AppData\Roaming\Dropbox
2014-05-21 10:49 - 2014-05-18 15:08 - 00253949 _____ () C:\windows\WindowsUpdate.log
2014-05-21 10:48 - 2012-08-24 14:36 - 00000000 ___RD () C:\Users\User\Dropbox
2014-05-21 10:45 - 2014-05-21 10:45 - 00000570 _____ () C:\windows\PFRO.log
2014-05-21 10:45 - 2014-05-21 10:45 - 00000056 _____ () C:\windows\setupact.log
2014-05-21 10:45 - 2014-05-21 10:45 - 00000000 _____ () C:\windows\setuperr.log
2014-05-21 10:45 - 2012-02-23 10:57 - 00065536 _____ () C:\windows\system32\Ikeext.etl
2014-05-21 10:45 - 2009-07-14 07:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-05-21 10:44 - 2014-05-21 10:44 - 00000470 _____ () C:\windows\SysWOW64\defogger_disable.log
2014-05-21 10:44 - 2014-05-21 10:44 - 00000000 _____ () C:\Users\User\defogger_reenable
2014-05-21 10:43 - 2014-05-21 10:43 - 00050477 _____ () C:\Users\User\Downloads\Defogger.exe
2014-05-21 10:30 - 2012-07-20 14:14 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2014-05-21 10:30 - 2009-07-14 05:20 - 00000000 ____D () C:\windows\tracing
2014-05-20 23:24 - 2009-07-14 05:20 - 00000000 ____D () C:\windows\rescache
2014-05-20 20:43 - 2014-05-20 20:41 - 00000000 ____D () C:\Users\User\AppData\Local\Xobni
2014-05-20 20:43 - 2011-06-14 22:25 - 00699666 _____ () C:\windows\system32\perfh007.dat
2014-05-20 20:43 - 2011-06-14 22:25 - 00149774 _____ () C:\windows\system32\perfc007.dat
2014-05-20 20:43 - 2009-07-14 07:13 - 01620612 _____ () C:\windows\system32\PerfStringBackup.INI
2014-05-20 20:38 - 2011-06-14 23:48 - 00000000 ____D () C:\Program Files\Hewlett-Packard
2014-05-20 20:38 - 2011-06-14 23:02 - 00000000 ____D () C:\ProgramData\Hewlett-Packard
2014-05-20 20:26 - 2014-05-20 20:26 - 00003148 _____ () C:\windows\System32\Tasks\SidebarExecute
2014-05-20 20:26 - 2011-12-23 14:03 - 00000000 ___RD () C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-20 20:26 - 2011-12-23 14:03 - 00000000 ___RD () C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-20 20:26 - 2011-06-14 23:03 - 00000000 ____D () C:\Program Files (x86)\Hewlett-Packard
2014-05-20 20:26 - 2011-06-14 22:32 - 00000000 ____D () C:\windows\SysWOW64\it
2014-05-20 20:26 - 2011-06-14 22:32 - 00000000 ____D () C:\windows\system32\it
2014-05-20 20:26 - 2011-06-14 22:25 - 00000000 ____D () C:\windows\SysWOW64\de
2014-05-20 20:26 - 2011-06-14 22:25 - 00000000 ____D () C:\windows\system32\de
2014-05-20 20:26 - 2011-06-14 22:17 - 00000000 ____D () C:\windows\SysWOW64\fr
2014-05-20 20:26 - 2011-06-14 22:17 - 00000000 ____D () C:\windows\system32\fr
2014-05-20 20:15 - 2011-12-23 14:03 - 00003922 _____ () C:\windows\System32\Tasks\User_Feed_Synchronization-{ED26CBF3-07CD-4A64-B44F-4B3D6F9DF22E}
2014-05-20 19:59 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2014-05-20 19:56 - 2012-08-25 11:26 - 00000000 ____D () C:\Program Files\Google
2014-05-20 19:56 - 2012-08-25 11:25 - 00000000 ____D () C:\Program Files (x86)\Google
2014-05-20 19:56 - 2009-07-14 06:45 - 00342240 _____ () C:\windows\system32\FNTCACHE.DAT
2014-05-20 19:54 - 2009-07-14 05:20 - 00000000 ____D () C:\windows\PolicyDefinitions
2014-05-20 19:51 - 2011-06-14 23:11 - 01594892 _____ () C:\windows\SysWOW64\PerfStringBackup.INI
2014-05-20 19:50 - 2014-05-20 19:50 - 00000000 ____H () C:\windows\system32\Drivers\Msft_Kernel_SynTP_01011.Wdf
2014-05-20 19:46 - 2011-12-23 14:01 - 00086160 _____ () C:\Users\User\AppData\Local\GDIPFONTCACHEV1.DAT
2014-05-20 19:43 - 2014-05-20 19:43 - 00000000 __SHD () C:\Users\User\AppData\Local\EmieUserList
2014-05-20 19:43 - 2014-05-20 19:43 - 00000000 __SHD () C:\Users\User\AppData\Local\EmieSiteList
2014-05-20 19:43 - 2012-06-01 21:07 - 00101049 _____ () C:\rajesh.txt
2014-05-20 19:42 - 2012-08-25 11:25 - 00000000 ____D () C:\ProgramData\Google
2014-05-20 19:33 - 2011-06-14 23:42 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-05-20 19:26 - 2011-04-15 02:35 - 00000000 ____D () C:\swsetup
2014-05-20 19:25 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-05-20 19:24 - 2011-06-15 00:16 - 00000000 ____D () C:\ProgramData\WildTangent
2014-05-20 18:30 - 2011-12-23 13:29 - 00000000 ____D () C:\Users\User\AppData\Roaming\hpqLog
2014-05-19 23:38 - 2011-06-14 23:54 - 00000000 ____D () C:\ProgramData\PDFC
2014-05-19 19:47 - 2011-12-23 14:03 - 00000999 _____ () C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-05-19 19:33 - 2014-05-19 19:33 - 00001169 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-05-19 19:33 - 2014-05-19 19:33 - 00001157 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-05-19 19:33 - 2014-05-19 19:33 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-05-19 19:33 - 2014-05-19 08:06 - 00000000 ____D () C:\Users\User\AppData\Roaming\Mozilla
2014-05-19 19:32 - 2014-05-19 19:32 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-05-19 19:28 - 2011-09-11 18:48 - 00000000 ____D () C:\windows\Options
2014-05-19 09:03 - 2014-05-18 14:28 - 00119512 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-19 08:17 - 2012-01-20 20:46 - 00000000 ____D () C:\ProgramData\Mobile Partner
2014-05-19 08:08 - 2014-05-19 08:08 - 00000000 ____D () C:\Users\User\Downloads\AdwCleaner_TSA13I851
2014-05-18 15:47 - 2011-09-11 19:00 - 00000000 ____D () C:\windows\Hewlett-Packard
2014-05-18 15:18 - 2014-05-18 14:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-05-18 15:18 - 2014-05-18 14:27 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-05-18 15:11 - 2014-05-15 20:05 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-05-18 15:01 - 2014-05-18 15:01 - 00240786 _____ () C:\Users\User\Desktop\cc_20140518_150149.reg
2014-05-18 15:01 - 2012-01-20 11:37 - 00000000 ____D () C:\Users\User\AppData\Local\CrashDumps
2014-05-18 15:01 - 2012-01-19 18:31 - 00000000 ____D () C:\Users\User\AppData\Roaming\Skype
2014-05-18 15:01 - 2011-02-11 07:14 - 00000000 ____D () C:\windows\Panther
2014-05-18 14:42 - 2014-05-18 14:42 - 00000000 ____D () C:\windows\pss
2014-05-18 14:42 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-18 14:27 - 2014-05-18 14:27 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-18 13:37 - 2009-07-14 04:34 - 00000505 _____ () C:\windows\win.ini
2014-05-18 13:35 - 2009-07-14 07:08 - 00032640 _____ () C:\windows\Tasks\SCHEDLGU.TXT
2014-05-18 01:21 - 2014-05-18 01:21 - 00000042 _____ () C:\Users\User\AppData\Roaming\WB.CFG
2014-05-17 11:22 - 2014-05-17 11:19 - 28852416 _____ (Mozilla) C:\Users\User\Downloads\Firefox Setup 29.0.1.exe
2014-05-16 09:35 - 2014-05-16 09:34 - 00000000 ____D () C:\Users\User\Documents\Bluetooth Folder
2014-05-15 23:45 - 2012-08-24 14:36 - 00000982 _____ () C:\Users\User\Desktop\Dropbox.lnk
2014-05-15 23:45 - 2012-08-24 14:29 - 00000000 ____D () C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-05-15 23:06 - 2014-05-15 23:06 - 00000000 ____D () C:\Users\User\AppData\Local\cache
2014-05-15 23:06 - 2014-05-15 23:06 - 00000000 ____D () C:\Users\User\.android
2014-05-15 22:27 - 2012-08-23 23:04 - 00000000 ____D () C:\Users\User\AppData\Local\Thunderbird
2014-05-15 22:27 - 2012-01-19 16:47 - 00002112 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Thunderbird.lnk
2014-05-15 22:27 - 2012-01-19 16:47 - 00002100 _____ () C:\Users\Public\Desktop\Mozilla Thunderbird.lnk
2014-05-15 22:27 - 2012-01-19 16:47 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-05-15 20:05 - 2009-07-14 05:20 - 00000000 ___HD () C:\windows\system32\GroupPolicy
2014-05-15 20:05 - 2009-07-14 05:20 - 00000000 ____D () C:\windows\SysWOW64\GroupPolicy
2014-05-14 21:12 - 2012-01-19 16:49 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2014-05-14 21:11 - 2012-07-20 14:14 - 00003822 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater
2014-05-14 21:10 - 2012-07-20 14:14 - 00692400 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2014-05-14 21:10 - 2011-06-14 23:55 - 00070832 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-05-14 17:25 - 2014-05-06 11:38 - 00000000 ___SD () C:\windows\system32\CompatTel
2014-05-14 10:23 - 2012-01-19 16:55 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-05-14 10:19 - 2013-08-14 23:19 - 00000000 ____D () C:\windows\system32\MRT
2014-05-14 10:17 - 2012-01-19 17:43 - 93223848 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2014-05-13 10:00 - 2014-01-06 10:24 - 00000000 ____D () C:\Users\User\Documents\2014
2014-05-12 17:37 - 2014-05-12 17:37 - 00002741 _____ () C:\Users\User\Downloads\Kontroll av Biotronik ICD.eml
2014-05-09 08:14 - 2014-05-14 09:52 - 00477184 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2014-05-09 08:11 - 2014-05-14 09:52 - 00424448 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2014-05-08 18:37 - 2013-04-13 16:43 - 00000000 ____D () C:\Users\User\Documents\2013
2014-05-07 09:15 - 2011-12-23 14:03 - 00000000 ____D () C:\Users\User\AppData\Local\PDFC
2014-05-06 06:40 - 2014-05-14 10:21 - 23544320 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2014-05-06 06:17 - 2014-05-14 10:21 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2014-05-06 05:25 - 2014-05-14 10:21 - 17382912 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2014-05-06 05:07 - 2014-05-14 10:21 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2014-05-06 05:00 - 2014-05-14 10:21 - 00084992 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2014-05-06 04:10 - 2014-05-14 10:21 - 00069632 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2014-05-03 20:34 - 2014-05-03 20:33 - 00000000 ____D () C:\Users\User\AppData\Roaming\DropboxMaster
2014-04-27 21:29 - 2014-04-25 15:30 - 00000000 ____D () C:\Users\User\AppData\Local\Windows Live
2014-04-25 23:42 - 2014-04-11 16:04 - 00000000 ____D () C:\Users\User\Documents\Anita
2014-04-25 15:29 - 2014-04-25 15:29 - 00000000 ____D () C:\Users\User\AppData\Local\{B57C9FFA-5D76-44C0-8578-45303CFD8CB6}
2014-04-24 12:36 - 2014-05-16 01:04 - 00061120 _____ (StdLib) C:\windows\system32\Drivers\{0782648b-1717-4fef-ac58-8cb3ce03adb3}Gw64.sys
Some content of TEMP:
====================
C:\Users\User\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp1tsa2q.dll
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe
[2014-05-14 09:52] - [2014-03-04 11:43] - 0455168 ____A (Microsoft Corporation) 88AB9B72B4BF3963A0DE0820B4B0B06C
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-05-19 00:22
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 17-05-2014
Ran by User at 2014-05-21 10:53:39
Running from E:\
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Microsoft Security Essentials (Enabled - Up to date) {641105E6-77ED-3F35-A304-765193BCB75F}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Microsoft Security Essentials (Enabled - Up to date) {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
==================== Installed Programs ======================
ActiveCheck component for HP Active Support Library (x32 Version: 3.0.0.3 - Hewlett-Packard) Hidden
Adobe Flash Player 13 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Photoshop 6.0 (HKLM-x32\...\Adobe Photoshop 6.0) (Version: 6.0 - Adobe Systems, Inc.)
Adobe Reader X (10.1.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.10 - Adobe Systems Incorporated)
Adobe SVG Viewer (HKLM-x32\...\Adobe SVG Viewer) (Version: 1.0 - Adobe Systems, Inc.)
AMD APP SDK Runtime (Version: 2.4.595.9 - Advanced Micro Devices Inc.) Hidden
AMD VISION Engine Control Center (x32 Version: 2011.0526.27.42091 - ATI) Hidden
Atheros Driver Installation Program (HKLM-x32\...\{C3A32068-8AB1-4327-BB16-BED9C6219DC7}) (Version: 9.2 - Atheros)
ATI Catalyst Install Manager (HKLM\...\{A55EC1B4-A03B-18FB-F03B-54E0C007EB06}) (Version: 3.0.820.0 - ATI Technologies, Inc.)
Bluetooth Win7 Suite (64) (HKLM\...\{230D1595-57DA-4933-8C4E-375797EBB7E1}) (Version: 7.2.0.80 - Atheros Communications)
Canon IJ Network Scanner Selector EX (HKLM-x32\...\Canon_IJ_Network_Scanner_Selector_EX) (Version: - )
Canon IJ Network Tool (HKLM-x32\...\Canon_IJ_Network_UTILITY) (Version: 3.1.1 - Canon Inc.)
Canon MG6200 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG6200_series) (Version: - Canon Inc.)
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - ATI) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2011.0526.27.42091 - ATI) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2011.0526.27.42091 - ATI Technologies, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2011.0526.27.42091 - ATI) Hidden
CCC Help Chinese Standard (x32 Version: 2011.0526.0026.42091 - ATI) Hidden
CCC Help Chinese Traditional (x32 Version: 2011.0526.0026.42091 - ATI) Hidden
CCC Help Czech (x32 Version: 2011.0526.0026.42091 - ATI) Hidden
CCC Help Danish (x32 Version: 2011.0526.0026.42091 - ATI) Hidden
CCC Help Dutch (x32 Version: 2011.0526.0026.42091 - ATI) Hidden
CCC Help English (x32 Version: 2011.0526.0026.42091 - ATI) Hidden
CCC Help Finnish (x32 Version: 2011.0526.0026.42091 - ATI) Hidden
CCC Help French (x32 Version: 2011.0526.0026.42091 - ATI) Hidden
CCC Help German (x32 Version: 2011.0526.0026.42091 - ATI) Hidden
CCC Help Greek (x32 Version: 2011.0526.0026.42091 - ATI) Hidden
CCC Help Hungarian (x32 Version: 2011.0526.0026.42091 - ATI) Hidden
CCC Help Italian (x32 Version: 2011.0526.0026.42091 - ATI) Hidden
CCC Help Japanese (x32 Version: 2011.0526.0026.42091 - ATI) Hidden
CCC Help Korean (x32 Version: 2011.0526.0026.42091 - ATI) Hidden
CCC Help Norwegian (x32 Version: 2011.0526.0026.42091 - ATI) Hidden
CCC Help Polish (x32 Version: 2011.0526.0026.42091 - ATI) Hidden
CCC Help Portuguese (x32 Version: 2011.0526.0026.42091 - ATI) Hidden
CCC Help Russian (x32 Version: 2011.0526.0026.42091 - ATI) Hidden
CCC Help Spanish (x32 Version: 2011.0526.0026.42091 - ATI) Hidden
CCC Help Swedish (x32 Version: 2011.0526.0026.42091 - ATI) Hidden
CCC Help Thai (x32 Version: 2011.0526.0026.42091 - ATI) Hidden
CCC Help Turkish (x32 Version: 2011.0526.0026.42091 - ATI) Hidden
ccc-utility64 (Version: 2011.0526.27.42091 - ATI) Hidden
Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM-x32\...\{51C7AD07-C3F6-4635-8E8A-231306D810FE}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM-x32\...\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{349F73CA-653A-43A6-AE77-970B07D6EDA0}) (Version: - Microsoft)
Dropbox (HKCU\...\Dropbox) (Version: 2.6.33 - Dropbox, Inc.)
Galerie de photos Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
HP 3D DriveGuard (HKLM\...\{D3419F92-0DC8-437E-A3F1-9DA358DF8503}) (Version: 4.1.8.1 - Hewlett-Packard Company)
HP Auto (Version: 1.0.12935.3667 - Hewlett-Packard Company) Hidden
HP Customer Experience Enhancements (x32 Version: 6.0.1.7 - Hewlett-Packard) Hidden
HP HotKey Support (HKLM\...\{06160949-DACD-4F5D-99A1-B7676CE5C83B}) (Version: 4.0.18.1 - Hewlett-Packard Company)
HP Webcam Driver (HKLM-x32\...\{399C37FB-08AF-493B-BFED-20FBD85EDF7F}) (Version: 5.8.50060.0 - Sonix)
HPAsset component for HP Active Support Library (x32 Version: 3.0.0.3 - Hewlett-Packard) Hidden
IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6336.0 - IDT)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
JMicron Flash Media Controller Driver (HKLM-x32\...\{26604C7E-A313-4D12-867F-7C6E7820BE4C}) (Version: 1.0.58.0 - JMicron Technology Corp.)
K-Lite Codec Pack 5.5.0 (64-bit) (HKLM\...\KLiteCodecPack64_is1) (Version: 5.5.0 - )
Malwarebytes Anti-Malware Version 2.0.1.1004 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.1.1004 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Home and Student 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Single Image 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Security Client (Version: 4.5.0216.0 - Microsoft Corporation) Hidden
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.5.216.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft_VC90_CRT_x86 (HKLM-x32\...\{DF2035BE-5820-4965-BD97-7FAF8D4A7879}) (Version: 1.0.0 - Microsoft Corporation)
Mobile Broadband (HKLM-x32\...\Mobile Broadband) (Version: 22.001.18.02.07 - Huawei Technologies Co.,Ltd)
Mozilla Firefox 29.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 29.0.1 (x86 de)) (Version: 29.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
Mozilla Thunderbird 9.0.1 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 9.0.1 (x86 de)) (Version: 9.0.1 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Realtek Ethernet Controller All-In-One Windows Driver (HKLM-x32\...\{F7E7F0CB-AA41-4D5A-B6F2-8E6738EB063F}) (Version: 1.12.0016 - Realtek)
SDK (x32 Version: 2.26.012 - Portrait Displays, Inc.) Hidden
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32 Version: - Microsoft) Hidden
Skype Click to Call (HKLM-x32\...\{B6CF2967-C81E-40C0-9815-C05774FEF120}) (Version: 5.6.8442 - Skype Technologies S.A.)
Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 17.0.18.8 - Synaptics Incorporated)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{B4A38370-2ADB-46B0-A1B0-0C4A2F7DCA31}) (Version: - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2878281) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{302A8FE3-EBF5-486C-A431-16A1CD914443}) (Version: - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2878281) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{302A8FE3-EBF5-486C-A431-16A1CD914443}) (Version: - Microsoft)
Update for Microsoft InfoPath 2010 (KB2817369) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{4EEA3D3E-989C-4DF4-AB0A-3042C0C12AA3}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2494150) (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{3FCFD88F-4D13-4F38-8625-ABABEA7F61EA}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DADF7E25-FFA4-4D02-BE84-1DAE62C18516}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{287A1E92-9E41-4BC1-8920-B3D0E9220800}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{9D69691D-823D-4C3E-9B12-563A3F520366}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{35698CB7-AAA2-4577-B505-DBFF504AEF23}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{5AA578BB-759C-40FD-9661-A737C0884541}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2825635) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{F1A20C69-9FE5-40FD-9CD5-84EABC2EF64A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0407-0000-0000000FF1CE}_Office14.SingleImage_{C70D2038-A2C4-4A99-87DE-5272BB44F0CE}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM-x32\...\{90140000-001F-040C-0000-0000000FF1CE}_Office14.SingleImage_{82F87E28-B18E-46D6-A399-E2F19CF5949B}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2878225) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{EFF5EBA3-40AD-4859-85E7-3C1CF4F297EB}) (Version: - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version: - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version: - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-001A-0407-0000-0000000FF1CE}_Office14.SingleImage_{A0657506-69DC-44AE-8DC1-58E7C6F5B1C9}) (Version: - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{2AB483F1-C86E-427A-83B4-23889B03512D}) (Version: - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM-x32\...\{90140000-0018-0407-0000-0000000FF1CE}_Office14.SingleImage_{40EC8FB1-5202-469D-9232-C28FB1C6FC64}) (Version: - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{2BA40F82-F3A4-441C-BF1A-ED4C42FF4872}) (Version: - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version: - Microsoft)
Update for Microsoft Visio 2010 (KB2880526) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{7B29D8B8-6A87-496C-A65E-B935E740448A}) (Version: - Microsoft)
Update for Microsoft Visio Viewer 2010 (KB2837587) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{38CF30E4-3348-4BD1-A859-B630C355A56F}) (Version: - Microsoft)
Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
WMV9/VC-1 Video Playback (Version: 1.00.0000 - ATI Technologies Inc.) Hidden
Xobni Core (x32 Version: 1.0.0 - Xobni, Inc.) Hidden
==================== Restore Points =========================
20-05-2014 17:32:57 Removed HP Setup
20-05-2014 17:35:01 Revo Uninstaller's restore point - HP Software Framework
20-05-2014 17:35:19 Removed HP Software Framework
20-05-2014 17:36:39 Revo Uninstaller's restore point - PDF Complete Special Edition
20-05-2014 17:38:18 Revo Uninstaller's restore point - HP ESU for Microsoft Windows 7
20-05-2014 17:38:31 Removed HP ESU for Microsoft Windows 7
20-05-2014 17:39:42 Revo Uninstaller's restore point - Energy Star Digital Logo
20-05-2014 17:40:15 Removed Energy Star Digital Logo
20-05-2014 17:40:56 Revo Uninstaller's restore point - Evernote v. 4.2.3
20-05-2014 17:41:13 Removed Evernote v. 4.2.3
20-05-2014 17:42:27 Revo Uninstaller's restore point - Google Toolbar for Internet Explorer
20-05-2014 17:48:12 Windows Update
20-05-2014 18:04:50 Removed Drive Encryption For HP ProtectTools
20-05-2014 18:07:16 Removed HP ProtectTools Security Manager.
20-05-2014 18:08:15 Removed Face Recognition for HP ProtectTools.
20-05-2014 18:13:13 Removed Device Access Manager for HP ProtectTools.
20-05-2014 18:14:36 Removed Drive Encryption For HP ProtectTools
20-05-2014 18:16:15 Removed HP ProtectTools Security Manager.
20-05-2014 18:17:12 Removed Validity Fingerprint Sensor Driver
20-05-2014 18:17:58 Removed Privacy Manager for HP ProtectTools.
20-05-2014 18:23:46 Removed HP ProtectTools Security Manager.
20-05-2014 18:31:39 Removed HP Power Assistant
20-05-2014 18:37:06 Removed HP DayStarter
20-05-2014 18:41:02 Revo Uninstaller's restore point - Xobni
21-05-2014 01:00:12 Windows Update
==================== Hosts content: ==========================
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {09803341-FEA0-4399-B5E0-C3F1F770AFAF} - \FoxTab No Task File <==== ATTENTION
Task: {0AFE2BA9-8F50-4F38-AFC3-D4F038B3287E} - \RegClean Pro_DEFAULT No Task File <==== ATTENTION
Task: {1F58C33E-574A-42E2-AFB6-22AFF7AD3300} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-14] (Adobe Systems Incorporated)
Task: {485BB8D5-7187-4174-AD6A-93A98210BC35} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe
Task: {56567E1F-2A13-4545-B1B1-6516DA7D748C} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Tuneup => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe
Task: {6093A5A9-517A-48D7-8218-1BB994427081} - System32\Tasks\{C7906577-A0F6-4D6C-A07A-1E7009EE83F2} => Firefox.exe
Task: {70B18DF0-9B8A-49FA-8D3A-F2E5A21060A5} - \Advanced System Protector_startup No Task File <==== ATTENTION
Task: {8457EE7C-F9A9-436B-80EE-EEAD9FD493C7} - \Scheduled Update for Ask Toolbar No Task File <==== ATTENTION
Task: {877CB761-920F-47B6-AC87-C3FAA4DC6D80} - \RegClean Pro No Task File <==== ATTENTION
Task: {8BB09F40-BE7D-41FC-B498-BFBE0B5CE81F} - \Re-markit Update No Task File <==== ATTENTION
Task: {93EA567D-89E3-4DD7-8572-5510ED9E0679} - System32\Tasks\{A3B245B3-F1A1-4C38-9B34-DCE6EF2BCDF2} => Firefox.exe
Task: {A53377DE-1B54-4648-BD5D-D0C1978D6A3B} - \Re-markit_wd No Task File <==== ATTENTION
Task: {B089C58A-219A-494C-A664-5C041EE9C515} - System32\Tasks\{7CA8D22E-7EC3-481F-81D8-9A2E83429DF9} => Firefox.exe hxxp://ui.skype.com/ui/0/5.9.0.115.259/de/abandoninstall?source=lightinstaller&page=tsInstall
Task: {CBF2CF65-8D5D-4E84-9675-94F5F9528E78} - \RegClean Pro_UPDATES No Task File <==== ATTENTION
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Loaded Modules (whitelisted) =============
2011-03-14 17:27 - 2011-03-14 17:27 - 00346976 _____ () C:\ProgramData\DatacardService\HWDeviceService64.exe
2012-06-01 21:07 - 2012-06-01 21:07 - 00246112 _____ () C:\ProgramData\Mobile Broadband\OnlineUpdate\ouc.exe
2012-06-01 21:07 - 2012-06-01 21:07 - 00011362 _____ () C:\ProgramData\Mobile Broadband\OnlineUpdate\mingwm10.dll
2012-06-01 21:07 - 2012-06-01 21:07 - 00043008 _____ () C:\ProgramData\Mobile Broadband\OnlineUpdate\libgcc_s_dw2-1.dll
2012-06-01 21:07 - 2012-06-01 21:07 - 02415104 _____ () C:\ProgramData\Mobile Broadband\OnlineUpdate\QtCore4.dll
2012-06-01 21:07 - 2012-06-01 21:07 - 01148416 _____ () C:\ProgramData\Mobile Broadband\OnlineUpdate\QtNetwork4.dll
2012-06-01 21:07 - 2012-06-01 21:07 - 00384512 _____ () C:\ProgramData\Mobile Broadband\OnlineUpdate\QueryStrategy.dll
2012-06-01 21:07 - 2012-06-01 21:07 - 00398336 _____ () C:\ProgramData\Mobile Broadband\OnlineUpdate\QtXml4.dll
2014-05-21 10:48 - 2014-05-21 10:48 - 00041984 _____ () c:\users\user\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp1tsa2q.dll
2013-10-19 01:55 - 2013-10-19 01:55 - 25100288 _____ () C:\Users\User\AppData\Roaming\Dropbox\bin\libcef.dll
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\Users\User\Downloads\Kontroll av Biotronik ICD.eml:OECustomProperty
==================== Safe Mode (whitelisted) ===================
==================== EXE Association (whitelisted) =============
==================== Disabled items from MSCONFIG ==============
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: File Sanitizer => C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\CoreShredder.exe
MSCONFIG\startupreg: HPConnectionManager => c:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe
MSCONFIG\startupreg: HPPowerAssistant => C:\Program Files\Hewlett-Packard\HP Power Assistant\DelayedAppStarter.exe 120 C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe /hidden
MSCONFIG\startupreg: HPQuickWebProxy => "c:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe"
MSCONFIG\startupreg: MfeEpePcMonitor => "C:\Program Files\Hewlett-Packard\Drive Encryption\EpePcMonitor.exe"
MSCONFIG\startupreg: PDF Complete => C:\Program Files (x86)\PDF Complete\pdfsty.exe
MSCONFIG\startupreg: QLBController => C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\QLBController.exe /start
MSCONFIG\startupreg: StartCCC => "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
==================== Faulty Device Manager Devices =============
Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
==================== Event log errors: =========================
Application errors:
==================
Error: (05/21/2014 10:45:46 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/21/2014 01:24:34 AM) (Source: SideBySide) (EventID: 75) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Mehrere requestedPrivileges-Elemente sind nicht im Manifest zulässig.
System errors:
=============
Error: (05/21/2014 10:45:44 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Mobile Partner. OUC" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (05/21/2014 10:45:44 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Mobile Broadband. OUC" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (05/21/2014 10:45:44 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Mobile Broadband. OUC erreicht.
Microsoft Office Sessions:
=========================
Error: (05/21/2014 10:45:46 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/21/2014 01:24:34 AM) (Source: SideBySide) (EventID: 75) (User: )
Description: C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exeC:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exe2
==================== Memory info ===========================
Percentage of memory in use: 46%
Total physical RAM: 3552.17 MB
Available physical RAM: 1901.53 MB
Total Pagefile: 7102.52 MB
Available Pagefile: 5407.62 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB
==================== Drives ================================
Drive c: (System) (Fixed) (Total:574.38 GB) (Free:513.56 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (USB-Speicher) (Removable) (Total:29.3 GB) (Free:8.16 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 596 GB) (Disk ID: B24213B6)
Partition 1: (Active) - (Size=300 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=574 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=16 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=5 GB) - (Type=0C)
========================================================
Disk: 1 (Size: 29 GB) (Disk ID: CBA58025)
Partition 1: (Not Active) - (Size=29 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-05-21 11:15:27
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\00000068 TOSHIBA_ rev.GS00 596,17GB
Running: Gmer-19357.exe; Driver: C:\Users\User\AppData\Local\Temp\kftdapob.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528 fffff80002fad000 45 bytes [00, 00, 15, 02, 46, 69, 6C, ...]
INITKDBG C:\windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 575 fffff80002fad02f 18 bytes [00, 00, 00, 00, 00, 00, 00, ...]
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[2180] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000774f1465 2 bytes [4F, 77]
.text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[2180] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000774f14bb 2 bytes [4F, 77]
.text ... * 2
.text C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[980] C:\windows\syswow64\Psapi.dll!GetModuleInformation + 69 00000000774f1465 2 bytes [4F, 77]
.text C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[980] C:\windows\syswow64\Psapi.dll!GetModuleInformation + 155 00000000774f14bb 2 bytes [4F, 77]
.text ... * 2
---- Processes - GMER 2.1 ----
Library C:\ProgramData\Mobile Broadband\OnlineUpdate\mingwm10.dll (*** suspicious ***) @ C:\ProgramData\Mobile Broadband\OnlineUpdate\ouc.exe [2240](2012-06-01 19:07:30) 000000006fbc0000
Library C:\ProgramData\Mobile Broadband\OnlineUpdate\libgcc_s_dw2-1.dll (*** suspicious ***) @ C:\ProgramData\Mobile Broadband\OnlineUpdate\ouc.exe [2240](2012-06-01 19:07:30) 000000006e940000
Library C:\ProgramData\Mobile Broadband\OnlineUpdate\QtCore4.dll (*** suspicious ***) @ C:\ProgramData\Mobile Broadband\OnlineUpdate\ouc.exe [2240](2012-06-01 19:07:30) 000000006a1c0000
Library C:\ProgramData\Mobile Broadband\OnlineUpdate\QtNetwork4.dll (*** suspicious ***) @ C:\ProgramData\Mobile Broadband\OnlineUpdate\ouc.exe [2240](2012-06-01 19:07:31) 000000006ff00000
Library C:\ProgramData\Mobile Broadband\OnlineUpdate\QueryStrategy.dll (*** suspicious ***) @ C:\ProgramData\Mobile Broadband\OnlineUpdate\ouc.exe [2240](2012-06-01 19:07:31) 000000006efc0000
Library C:\ProgramData\Mobile Broadband\OnlineUpdate\QtXml4.dll (*** suspicious ***) @ C:\ProgramData\Mobile Broadband\OnlineUpdate\ouc.exe [2240](2012-06-01 19:07:31) 000000006ed40000
Library C:\Users\User\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll (*** suspicious ***) @ C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe [980](2014-01-03 03:42:50) 00000000038f0000
Library c:\users\user\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpfc6q1z.dll (*** suspicious ***) @ C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe [980](2014-05-21 09:07:10) 0000000003ec0000
Library C:\Users\User\AppData\Roaming\Dropbox\bin\libcef.dll (*** suspicious ***) @ C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe [980](2013-10-18 23:55:02) 000000006fbe0000
Library C:\Users\User\AppData\Roaming\Dropbox\bin\icudt.dll (*** suspicious ***) @ C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe [980] (ICU Data DLL/The ICU Project)(2013-10-18 23:55:00) 0000000071eb0000
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\d0df9aff0efe
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\d0df9aff0efe (not active ControlSet)
---- EOF - GMER 2.1 ----
Code:
ATTFilter # AdwCleaner v3.210 - Bericht erstellt am 21/05/2014 um 11:46:19
# Aktualisiert 19/05/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : User - USER-HP
# Gestartet von : C:\Users\User\Downloads\adwcleaner_3.210.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.17041
-\\ Mozilla Firefox v29.0.1 (de)
[ Datei : C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\pnndptg0.default\prefs.js ]
*************************
AdwCleaner[R0].txt - [809 octets] - [21/05/2014 11:45:16]
AdwCleaner[S0].txt - [731 octets] - [21/05/2014 11:46:19]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [790 octets] ##########
Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Scan Date: 21.05.2014 Scan Time: 11:42:13 Logfile: mbam.txt Administrator: Yes Version: 2.00.1.1004 Malware Database: v2014.05.21.03 Rootkit Database: v2014.03.27.01 License: Free Malware Protection: Disabled Malicious Website Protection: Disabled Chameleon: Disabled OS: Windows 7 Service Pack 1 CPU: x64 File System: NTFS User: User Scan Type: Threat Scan Result: Completed Objects Scanned: 291360 Time Elapsed: 25 min, 56 sec Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Enabled Shuriken: Enabled PUP: Enabled PUM: Enabled Processes: 0 (No malicious items detected) Modules: 0 (No malicious items detected) Registry Keys: 0 (No malicious items detected) Registry Values: 0 (No malicious items detected) Registry Data: 0 (No malicious items detected) Folders: 0 (No malicious items detected) Files: 0 (No malicious items detected) Physical Sectors: 0 (No malicious items detected) (end) Eine zusätzliche Bitte wären Tipps, wie ich diesen Rechner halbwegs sicher bekomme. Wichtig ist dabei, dass diese Absicherung möglichst einfach und ohne viel Nachfrage geschieht. Mein Opa ist nun schon etwas älter - mit den entsprechenden Eigenheiten. Und schon einmal vorab vielen Dank für eure Hilfe. mit freundlichen Grüßen Gegenschreiber |
|
21.05.2014, 15:10
| #2 |
| /// the machine /// TB-Ausbilder    | Win 7: System wirklich sauber? hi,
__________________Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
S2 Mobile Partner. RunOuc; C:\Program Files (x86)\Mobile Partner\UpdateDog\ouc.exe [X]
SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} URL = hxxp://www.default-search.net/search?sid=492&aid=103&itype=n&ver=12565&tm=348&src=ds&p={searchTerms}
SearchScopes: HKLM-x32 - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} URL = hxxp://www.default-search.net/search?sid=492&aid=103&itype=n&ver=12565&tm=348&src=ds&p={searchTerms}
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {2FAF37A7-AF53-4D45-BAFE-138BB6AE74A6} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000027&src=kw&q={searchTerms}&locale=&apn_ptnrs=U3&apn_dtid=YYYYYYYYSE&apn_uid=6CEC5624-25D3-4A0E-8D13-F17582B93460&apn_sauid=66F901F8-7141-406F-9FFB-A1EE0281EE97
SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} URL = hxxp://www.default-search.net/search?sid=492&aid=103&itype=n&ver=12565&tm=348&src=ds&p={searchTerms}
C:\Program Files (x86)\Mobile Partner
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
__________________ |
|
21.05.2014, 15:22
| #3 |
| | Win 7: System wirklich sauber? Danke! Folgend die gewünschte Log.
__________________Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 17-05-2014
Ran by User at 2014-05-21 16:16:59 Run:1
Running from E:\
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
S2 Mobile Partner. RunOuc; C:\Program Files (x86)\Mobile Partner\UpdateDog\ouc.exe [X]
SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} URL = hxxp://www.default-search.net/search?sid=492&aid=103&itype=n&ver=12565&tm=348&src=ds&p={searchTerms}
SearchScopes: HKLM-x32 - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} URL = hxxp://www.default-search.net/search?sid=492&aid=103&itype=n&ver=12565&tm=348&src=ds&p={searchTerms}
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {2FAF37A7-AF53-4D45-BAFE-138BB6AE74A6} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000027&src=kw&q={searchTerms}&locale=&apn_ptnrs=U3&apn_dtid=YYYYYYYYSE&apn_uid=6CEC5624-25D3-4A0E-8D13-F17582B93460&apn_sauid=66F901F8-7141-406F-9FFB-A1EE0281EE97
SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} URL = hxxp://www.default-search.net/search?sid=492&aid=103&itype=n&ver=12565&tm=348&src=ds&p={searchTerms}
C:\Program Files (x86)\Mobile Partner
*****************
"C:\windows\system32\GroupPolicy\Machine" directory move:
Could not move "C:\windows\system32\GroupPolicy\Machine\Registry.pol" => Scheduled to move on reboot.
Could not move "C:\windows\system32\GroupPolicy\Machine" directory. => Scheduled to move on reboot.
Could not move "C:\windows\system32\GroupPolicy\GPT.ini" => Scheduled to move on reboot.
Mobile Partner. RunOuc => Error deleting Service
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} => Error deleting key
HKCR\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} => Key not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} => Unable to delete key
HKCR\Wow6432Node\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} => Key not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2FAF37A7-AF53-4D45-BAFE-138BB6AE74A6} => Key not found.
HKCR\CLSID\{2FAF37A7-AF53-4D45-BAFE-138BB6AE74A6} => Key not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} => Key not found.
HKCR\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} => Key not found.
"C:\Program Files (x86)\Mobile Partner" => File/Directory not found.
Gegenschreiber |
|
22.05.2014, 12:17
| #4 |
| /// the machine /// TB-Ausbilder | Win 7: System wirklich sauber? Noch probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
22.05.2014, 12:23
| #5 |
| | Win 7: System wirklich sauber? Hallo, nein, aus meiner Sicht bestehen keine Probleme mehr. Vielen Dank für die Einschätzung und Hilfe. Gruß, Gegenschreiber |
|
23.05.2014, 10:58
| #6 |
| /// the machine /// TB-Ausbilder | Win 7: System wirklich sauber? Fertig  Die Reihenfolge ist hier entscheidend.
Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ --> Win 7: System wirklich sauber? |
|
| Themen zu Win 7: System wirklich sauber? |
| 4d36e972-e325-11ce-bfc1-08002be10318, association, branding, browser, canon, defender, desktop, device driver, error, excel, failed, fehler, firefox, flash player, home, iexplore.exe, installation, log's, log-datei, malware, mozilla, photoshop, problem, registrierungsdatenbank, registry, revo uninstaller, revo-uninstaller, scan, security, services.exe, software, svchost.exe, system, teredo, windows, wlan |
Linear-Darstellung
