| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Windows Vista: Adware und anderes ZeugsWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
21.11.2014, 16:08
| #16 |
| /// the machine /// TB-Ausbilder    |  Windows Vista: Adware und anderes Zeugs Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter HKU\S-1-5-18\...\RunOnce: [panda2_0dn] => reg.exe delete "HKCU\Software\AppDataLow\Software\panda2_0dn" /f
HKU\S-1-5-18\...\RunOnce: [panda2_0dn_XP] => reg.exe delete "HKCU\Software\panda2_0dn" /f
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:52644;https=127.0.0.1:52644;
Task: {42634A12-FFD5-47CF-BC9A-E6D5F66A4936} - System32\Tasks\{B643054E-1D6C-49DF-85D3-286962B2F3F2} => Firefox.exe hxxp://www.skype.com/go/downloading?source=lightinstaller&ver=5.5.0.124.260&LastError=12002
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
21.11.2014, 17:08
| #17 |
 | Windows Vista: Adware und anderes ZeugsCode:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 20-11-2014
Ran by Herrin at 2014-11-21 16:54:43 Run:1
Running from C:\Users\Herrin\Desktop
Loaded Profile: Herrin (Available profiles: Herrin)
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
HKU\S-1-5-18\...\RunOnce: [panda2_0dn] => reg.exe delete "HKCU\Software\AppDataLow\Software\panda2_0dn" /f
HKU\S-1-5-18\...\RunOnce: [panda2_0dn_XP] => reg.exe delete "HKCU\Software\panda2_0dn" /f
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:52644;https=127.0.0.1:52644;
Task: {42634A12-FFD5-47CF-BC9A-E6D5F66A4936} - System32\Tasks\{B643054E-1D6C-49DF-85D3-286962B2F3F2} => Firefox.exe hxxp://www.skype.com/go/downloading?source=lightinstaller&ver=5.5.0.124.260&LastError=12002
*****************
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\RunOnce\\panda2_0dn => value deleted successfully.
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\RunOnce\\panda2_0dn_XP => value deleted successfully.
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable => value deleted successfully.
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => value deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{42634A12-FFD5-47CF-BC9A-E6D5F66A4936}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{42634A12-FFD5-47CF-BC9A-E6D5F66A4936}" => Key deleted successfully.
C:\Windows\System32\Tasks\{B643054E-1D6C-49DF-85D3-286962B2F3F2} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{B643054E-1D6C-49DF-85D3-286962B2F3F2}" => Key deleted successfully.
==== End of Fixlog ====
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 20-11-2014
Ran by Herrin (administrator) on HERRIN-PC on 21-11-2014 16:40:00
Running from C:\Users\Herrin\Desktop
Loaded Profile: Herrin (Available profiles: Herrin)
Platform: Microsoft® Windows Vista™ Ultimate Service Pack 2 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 8
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\afwServ.exe
(Yahoo! Inc.) C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Ruiware LLC) C:\Program Files\Ruiware\WinPatrol\WinPatrol.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(Microsoft Corporation) C:\Windows\SoftwareDistribution\Download\Install\mpas-d_bd_1.189.72.0.exe
(Microsoft Corporation) C:\533faa6764462e2fde2a4b2a\MpMiniSigStub.exe
(Microsoft Corporation) C:\Windows\System32\MpSigStub.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5225064 2014-11-14] (AVAST Software)
HKLM\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [41056 2013-05-08] (Adobe Systems Incorporated)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKU\S-1-5-21-2708201434-1965334668-4040377041-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation)
HKU\S-1-5-21-2708201434-1965334668-4040377041-1000\...\Run: [WMPNSCFG] => C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-19] (Microsoft Corporation)
HKU\S-1-5-21-2708201434-1965334668-4040377041-1000\...\Run: [WinPatrol] => C:\Users\Herrin\Desktop\Sicherheit\winpatrol.exe -expressboot
HKU\S-1-5-18\...\RunOnce: [panda2_0dn] => reg.exe delete "HKCU\Software\AppDataLow\Software\panda2_0dn" /f
HKU\S-1-5-18\...\RunOnce: [panda2_0dn_XP] => reg.exe delete "HKCU\Software\panda2_0dn" /f
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk
ShortcutTarget: Microsoft Office.lnk -> C:\Program Files\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software)
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:52644;https=127.0.0.1:52644;
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-2708201434-1965334668-4040377041-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-2708201434-1965334668-4040377041-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.yahoo.com/?fr=mkg029
URLSearchHook: HKLM - Default Value = {855F3B16-6D32-4fe6-8A56-BBB695989046}
URLSearchHook: HKLM - (No Name) - {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - No File
SearchScopes: HKLM -> DefaultScope {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL =
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search
SearchScopes: HKU\S-1-5-21-2708201434-1965334668-4040377041-1000 -> DefaultScope {2AEA96DD-CC4B-45F3-97D0-65FBC2888F47} URL = https://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-2708201434-1965334668-4040377041-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search
SearchScopes: HKU\S-1-5-21-2708201434-1965334668-4040377041-1000 -> {2AEA96DD-CC4B-45F3-97D0-65FBC2888F47} URL = https://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-2708201434-1965334668-4040377041-1000 -> {4F6CF4C1-C88D-44C8-97FB-821F288D0212} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=vc_trans_8140&type=foxysecurity
SearchScopes: HKU\S-1-5-21-2708201434-1965334668-4040377041-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={sear
BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Herrin\AppData\Roaming\Mozilla\Firefox\Profiles\apekw9zh.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_223.dll ()
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin: @java.com/DTPlugin -> C:\Program Files\Java\jre6\bin\npDeployJava1.dll (Sun Microsystems, Inc.)
FF Plugin: @java.com/JavaPlugin -> C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: Adblock Plus - C:\Users\Herrin\AppData\Roaming\Mozilla\Firefox\Profiles\apekw9zh.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-11-19]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-12-29]
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-11-14]
FF Extension: No Name - wrc@avast.com [Not Found]
Chrome:
=======
CHR HomePage: Default -> https://www.google.de/
CHR Profile: C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-11-14]
CHR Extension: (Google Docs) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-11-14]
CHR Extension: (Google Drive) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-11-14]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-11-14]
CHR Extension: (WOT) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bhmmomiinigofkjcapegjjndpbikblnp [2014-11-17]
CHR Extension: (YouTube) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-11-14]
CHR Extension: (Google Search) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-11-14]
CHR Extension: (Google Sheets) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-11-14]
CHR Extension: (Avira Browser Safety) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2014-11-14]
CHR Extension: (AdBlock) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-11-15]
CHR Extension: (Avast Online Security) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-11-14]
CHR Extension: (Google Wallet) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-11-14]
CHR Extension: (NotScripts) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\odjhifogjcknibkahlpidmdajjpkkcfn [2014-11-17]
CHR Extension: (Gmail) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-11-14]
CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-11-14]
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-11-14] (AVAST Software)
R2 avast! Firewall; C:\Program Files\AVAST Software\Avast\afwServ.exe [104416 2014-11-14] (AVAST Software)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [24184 2014-11-14] ()
R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [26136 2014-11-14] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [70384 2014-11-14] (AVAST Software)
R0 aswNdis; C:\Windows\System32\DRIVERS\aswNdis.sys [12112 2014-11-14] (ALWIL Software)
R0 aswNdis2; C:\Windows\system32\Drivers\aswNdis2.sys [253640 2014-11-14] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr.sys [55240 2014-11-14] (AVAST Software)
R0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [49944 2014-11-14] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [787800 2014-11-14] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [422760 2014-11-14] (AVAST Software)
R1 aswTdi; C:\Windows\system32\drivers\aswTdi.sys [57928 2014-11-14] (AVAST Software)
R0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [206248 2014-11-14] ()
S3 PROCEXP113; C:\Windows\system32\Drivers\PROCEXP113.SYS [12568 2014-11-13] (Sysinternals - www.sysinternals.com) [File not signed]
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-11-21 16:40 - 2014-11-21 16:44 - 00014247 _____ () C:\Users\Herrin\Desktop\FRST.txt
2014-11-21 16:36 - 2014-11-21 16:37 - 01108992 _____ (Farbar) C:\Users\Herrin\Desktop\FRST.exe
2014-11-21 16:32 - 2014-11-21 16:32 - 00000550 _____ () C:\Users\Herrin\Desktop\Fixlist.txt
2014-11-21 00:55 - 2014-11-21 00:55 - 00000000 ____D () C:\Users\Herrin\AppData\Local\webkit
2014-11-20 15:38 - 2014-11-20 15:38 - 00000000 ____D () C:\Program Files\VS Revo Group
2014-11-20 15:27 - 2014-11-20 15:27 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware
2014-11-20 15:19 - 2014-11-20 15:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinPatrol
2014-11-20 15:19 - 2014-11-20 15:19 - 00000000 ____D () C:\ProgramData\InstallMate
2014-11-20 15:19 - 2014-11-20 15:19 - 00000000 ____D () C:\Program Files\Ruiware
2014-11-20 03:03 - 2014-10-24 02:03 - 00499200 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-11-19 17:15 - 2014-11-19 17:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpywareBlaster
2014-11-19 17:15 - 2014-11-19 17:15 - 00000000 ____D () C:\ProgramData\Licenses
2014-11-19 17:01 - 2014-11-19 17:01 - 00000000 ____D () C:\Users\Herrin\AppData\Roaming\WinPatrol
2014-11-19 16:13 - 2014-11-21 16:41 - 00000000 ____D () C:\FRST
2014-11-18 23:02 - 2014-11-21 01:40 - 00000000 ____D () C:\Users\Herrin\.gimp-2.8
2014-11-18 23:01 - 2014-11-18 23:02 - 00000834 _____ () C:\Users\Herrin\Desktop\Gimp 2.8.lnk
2014-11-18 22:49 - 2014-11-18 22:49 - 00000842 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GIMP 2.lnk
2014-11-18 22:38 - 2014-11-18 22:47 - 00000000 ____D () C:\Program Files\GIMP 2
2014-11-18 17:51 - 2014-11-11 20:04 - 00979456 _____ () C:\Users\Herrin\Documents\~WRL2275.tmp
2014-11-18 15:16 - 2014-11-18 15:16 - 00001662 _____ () C:\Users\Public\Desktop\Defraggler.lnk
2014-11-18 15:12 - 2014-11-18 15:17 - 00000000 ____D () C:\Program Files\Defraggler
2014-11-17 19:32 - 2014-11-18 13:44 - 00000000 ____D () C:\ProgramData\DataCardService
2014-11-17 19:32 - 2014-11-17 19:33 - 00000000 ____D () C:\ProgramData\Mobile Partner
2014-11-17 15:51 - 2014-11-17 15:53 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Mozilla
2014-11-17 15:51 - 2014-11-17 15:51 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Mozilla
2014-11-17 15:49 - 2014-11-17 19:36 - 00002418 _____ () C:\Windows\setupact.log
2014-11-17 15:49 - 2014-11-17 15:49 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\AVAST Software
2014-11-17 15:49 - 2014-11-17 15:49 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Adobe
2014-11-17 15:49 - 2014-11-17 15:49 - 00000000 _____ () C:\Windows\setuperr.log
2014-11-17 15:48 - 2014-11-17 15:48 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Google
2014-11-17 15:46 - 2014-11-18 13:44 - 00000000 ____D () C:\Users\Administrator
2014-11-17 00:56 - 2014-11-17 01:04 - 00000000 ____D () C:\AdwCleaner
2014-11-17 00:42 - 2014-11-17 00:42 - 00000000 ____D () C:\Users\Herrin\AppData\Local\Secunia PSI
2014-11-17 00:32 - 2014-11-20 15:36 - 00000000 ____D () C:\ProgramData\TEMP
2014-11-17 00:32 - 2014-11-18 13:03 - 00000000 ____D () C:\Program Files\SpywareBlaster
2014-11-16 23:17 - 2014-11-16 23:35 - 00000972 _____ () C:\DelFix.txt
2014-11-16 22:44 - 2014-11-16 22:44 - 00144480 _____ () C:\Windows\Minidump\Mini111614-01.dmp
2014-11-16 22:43 - 2014-11-16 22:43 - 198988063 _____ () C:\Windows\MEMORY.DMP
2014-11-16 21:34 - 2014-11-21 15:39 - 00003138 _____ () C:\Windows\PFRO.log
2014-11-16 21:34 - 2014-11-16 21:34 - 00250352 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-11-16 20:52 - 2014-11-16 20:52 - 00000000 ____D () C:\Program Files\Common Files\Java
2014-11-16 20:48 - 2014-11-16 20:48 - 00000000 ____D () C:\ProgramData\Oracle
2014-11-16 20:21 - 2014-11-16 20:22 - 00638888 _____ (Oracle Corporation) C:\Users\Herrin\Desktop\chromeinstall-8u25.exe
2014-11-16 19:35 - 2014-11-16 19:39 - 00002425 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader 9.lnk
2014-11-16 19:25 - 2014-11-21 16:03 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-11-16 19:24 - 2014-11-16 19:27 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-11-16 14:17 - 2014-11-16 14:17 - 00055088 _____ () C:\Users\Herrin\AppData\Local\GDIPFONTCACHEV1.DAT
2014-11-16 01:42 - 2014-11-16 01:42 - 00000000 ____D () C:\Users\Herrin\AppData\Local\fontconfig
2014-11-16 01:41 - 2014-11-16 01:41 - 00000000 ____D () C:\Users\Herrin\AppData\Local\gegl-0.2
2014-11-15 17:33 - 2014-11-15 17:33 - 00000806 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-11-15 17:32 - 2014-11-15 17:33 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-11-15 17:32 - 2014-11-15 17:32 - 00000000 ____D () C:\ProgramData\Mozilla
2014-11-15 17:32 - 2014-11-15 17:32 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-11-14 22:23 - 2007-06-26 15:57 - 00192512 _____ (Intel Corporation) C:\Windows\system32\igfxres.dll
2014-11-14 22:05 - 2014-11-16 23:17 - 00000000 ____D () C:\Windows\ERUNT
2014-11-14 20:44 - 2014-11-20 15:29 - 00114904 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-11-14 20:42 - 2014-11-20 15:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-11-14 20:41 - 2014-11-14 20:41 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-11-14 20:41 - 2014-10-01 11:11 - 00075480 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-11-14 20:41 - 2014-10-01 11:11 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-11-14 20:41 - 2014-10-01 11:11 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-11-14 19:18 - 2014-11-14 19:18 - 00001837 _____ () C:\Users\Public\Desktop\Avast Internet Security.lnk
2014-11-14 19:13 - 2014-11-14 19:12 - 00026136 _____ (AVAST Software) C:\Windows\system32\Drivers\aswKbd.sys
2014-11-14 19:13 - 2014-11-14 19:11 - 00253640 _____ (AVAST Software) C:\Windows\system32\Drivers\aswNdis2.sys
2014-11-14 19:13 - 2014-11-14 18:35 - 00291352 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-11-14 19:11 - 2014-11-14 19:11 - 00012112 _____ (ALWIL Software) C:\Windows\system32\Drivers\aswNdis.sys
2014-11-14 19:07 - 2014-11-14 19:07 - 00000000 ____D () C:\Program Files\Dropbox
2014-11-14 19:05 - 2014-11-14 19:05 - 00000000 ____D () C:\Users\Herrin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-11-14 18:54 - 2014-11-14 19:08 - 00000000 ____D () C:\Users\Herrin\AppData\Roaming\Dropbox
2014-11-14 18:40 - 2014-11-14 18:40 - 00000000 ____D () C:\Users\Herrin\AppData\Roaming\AVAST Software
2014-11-14 18:39 - 2014-11-14 19:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2014-11-14 18:36 - 2014-11-14 18:36 - 00422760 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2014-11-14 18:36 - 2014-11-14 18:36 - 00206248 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-11-14 18:36 - 2014-11-14 18:36 - 00070384 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-11-14 18:36 - 2014-11-14 18:36 - 00057928 _____ (AVAST Software) C:\Windows\system32\Drivers\aswTdi.sys
2014-11-14 18:36 - 2014-11-14 18:36 - 00055240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr.sys
2014-11-14 18:36 - 2014-11-14 18:36 - 00049944 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-11-14 18:36 - 2014-11-14 18:36 - 00024184 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2014-11-14 18:36 - 2014-11-14 18:34 - 00787800 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2014-11-14 18:35 - 2014-11-14 18:35 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-11-14 18:31 - 2014-11-14 18:31 - 00000000 ____D () C:\Program Files\AVAST Software
2014-11-14 18:20 - 2014-11-14 18:31 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-11-14 16:52 - 2014-11-14 16:52 - 00039402 _____ () C:\Users\Herrin\Documents\Ereignisse.txt
2014-11-14 14:37 - 2014-11-21 02:04 - 00001923 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-11-14 14:37 - 2014-11-14 14:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-11-13 20:10 - 2014-11-20 15:48 - 00000000 ____D () C:\Users\Herrin\Desktop\Sicherheit
2014-11-13 19:33 - 2014-11-13 19:33 - 00012568 _____ (Sysinternals - www.sysinternals.com) C:\Windows\system32\Drivers\PROCEXP113.SYS
2014-11-13 18:01 - 2014-11-13 19:22 - 00000000 ____D () C:\Windows\erdnt
2014-11-13 03:32 - 2014-10-10 02:01 - 00449536 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2014-11-13 03:32 - 2014-10-10 02:00 - 01259008 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-11-13 03:32 - 2014-10-10 02:00 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2014-11-13 03:32 - 2014-10-10 00:22 - 00619520 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2014-11-13 03:31 - 2014-08-27 01:55 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-11-13 03:31 - 2014-08-27 01:55 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-11-13 03:29 - 2014-10-24 02:04 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-11-13 03:29 - 2014-09-19 01:50 - 00278528 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-11-13 03:28 - 2014-08-12 03:25 - 00729600 _____ (Microsoft Corporation) C:\Windows\system32\IMJP10K.DLL
2014-11-13 03:23 - 2014-10-18 02:08 - 00564224 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2014-11-13 03:23 - 2014-10-03 02:18 - 00274432 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2014-11-13 03:23 - 2014-10-03 02:17 - 00396800 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2014-11-13 03:23 - 2014-10-03 02:17 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2014-11-13 03:23 - 2014-10-03 02:17 - 00170496 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2014-11-13 03:04 - 2014-10-13 00:34 - 02054656 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-11-12 18:40 - 2014-11-12 18:40 - 00000000 ____D () C:\Users\Herrin\AppData\Roaming\AdvancedSystemProtector
2014-11-12 18:27 - 2014-11-12 18:27 - 00000000 ____D () C:\Users\Herrin\AppData\Roaming\dlg
2014-11-12 11:16 - 2014-10-31 08:17 - 06004736 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 11082752 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 02006016 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 01469440 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-11-12 11:15 - 2014-10-31 08:17 - 01214976 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 00916992 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 00630784 _____ (Microsoft Corporation) C:\Windows\system32\mstime.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 00630272 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 00387584 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 00164352 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-11-12 11:15 - 2014-10-31 08:16 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\corpol.dll
2014-11-12 11:15 - 2014-10-31 03:37 - 00385024 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2014-11-12 11:15 - 2014-10-31 03:30 - 00174080 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-11-12 11:15 - 2014-10-31 03:30 - 00133632 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-11-12 11:15 - 2014-10-31 03:29 - 01638912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-11-12 11:15 - 2014-10-31 03:29 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-11-10 12:08 - 2014-11-10 12:08 - 00000000 ____D () C:\Users\Herrin\AppData\Roaming\Daichi
2014-11-10 10:28 - 2014-11-18 13:42 - 00000000 ____D () C:\Users\Herrin\Desktop\Sounds
2014-11-09 21:38 - 2014-11-09 21:38 - 00000000 ____D () C:\Program Files\Common Files\Avid
2014-11-09 21:28 - 2014-11-09 22:01 - 00000000 ____D () C:\Program Files\Common Files\VST3
2014-11-07 20:49 - 2014-11-07 20:49 - 00000000 ____D () C:\Users\Herrin\Documents\CabraProjects
2014-11-07 20:48 - 2014-11-07 20:49 - 00678093 _____ () C:\Users\Herrin\Desktop\Cabra_0.7.0.jar
2014-11-06 18:04 - 2014-11-06 18:04 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
2014-11-06 14:41 - 2012-11-22 04:54 - 00353280 _____ (Microsoft Corporation) C:\Windows\system32\shlwapi.dll
2014-11-06 14:35 - 2014-11-06 14:35 - 00000000 ____D () C:\Users\Herrin\AppData\Local\AviraSpeedup
2014-11-06 13:20 - 2014-06-26 23:17 - 00619664 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2014-11-06 13:20 - 2014-06-26 23:17 - 00099480 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2014-11-06 13:20 - 2014-06-26 23:17 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2014-11-06 13:19 - 2014-06-06 05:28 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-11-06 13:16 - 2014-06-15 23:18 - 01131664 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll
2014-11-06 13:16 - 2014-06-13 19:22 - 00156824 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll
2014-11-06 13:16 - 2014-06-13 19:22 - 00081560 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll
2014-11-06 13:11 - 2014-11-06 13:11 - 00000000 ___RD () C:\Program Files\Skype
2014-11-06 13:11 - 2014-11-06 13:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-11-06 13:11 - 2014-11-06 13:11 - 00000000 ____D () C:\Program Files\Common Files\Skype
2014-11-06 12:52 - 2014-09-09 07:24 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-11-06 12:22 - 2014-08-23 02:03 - 00297984 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-11-06 11:44 - 2012-11-08 04:48 - 01314816 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
2014-11-06 11:10 - 2014-11-13 03:23 - 00000000 ____D () C:\Windows\system32\MRT
2014-11-05 21:45 - 2014-11-05 21:45 - 00000000 ____D () C:\e1bf55fb68ca2ff1452d
2014-11-05 21:44 - 2014-09-05 00:27 - 00143360 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fastfat.sys
2014-11-05 21:41 - 2012-07-26 03:46 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\Wdfres.dll
2014-11-05 21:41 - 2012-06-02 15:57 - 00000003 _____ () C:\Windows\system32\Drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf
2014-11-05 21:40 - 2012-07-26 04:39 - 00047720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdfLdr.sys
2014-11-05 21:40 - 2012-07-26 04:21 - 00196608 _____ (Microsoft Corporation) C:\Windows\system32\WUDFHost.exe
2014-11-05 21:40 - 2012-07-26 04:20 - 00613888 _____ (Microsoft Corporation) C:\Windows\system32\WUDFx.dll
2014-11-05 21:40 - 2012-07-26 04:20 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\WUDFPlatform.dll
2014-11-05 21:40 - 2012-07-26 04:20 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\WUDFSvc.dll
2014-11-05 21:40 - 2012-07-26 04:20 - 00038912 _____ (Microsoft Corporation) C:\Windows\system32\WUDFCoinstaller.dll
2014-11-05 21:40 - 2012-07-26 03:33 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WUDFPf.sys
2014-11-05 21:40 - 2012-07-26 03:32 - 00155136 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WUDFRd.sys
2014-11-05 21:40 - 2009-07-14 13:12 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\winusb.dll
2014-11-05 16:58 - 2014-06-02 11:31 - 02263552 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-11-05 16:58 - 2014-06-02 11:31 - 00332800 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-11-05 16:58 - 2014-06-02 11:30 - 01993728 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-11-05 16:58 - 2014-06-02 11:30 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2014-11-05 16:58 - 2014-06-02 09:56 - 00082432 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2014-11-05 16:58 - 2014-04-26 17:01 - 00502784 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2014-11-05 16:58 - 2014-03-25 14:26 - 11587584 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-11-05 16:58 - 2013-08-27 03:47 - 01029120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll
2014-11-05 16:58 - 2013-08-27 03:47 - 00219648 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll
2014-11-05 16:58 - 2013-08-27 03:47 - 00189952 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll
2014-11-05 16:58 - 2013-08-27 03:47 - 00160768 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll
2014-11-05 16:58 - 2013-08-27 02:52 - 01172480 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-11-05 16:58 - 2013-08-27 02:50 - 00486400 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2014-11-05 16:58 - 2013-08-27 02:32 - 00683008 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2014-11-05 16:58 - 2013-08-27 02:28 - 01069056 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2014-11-05 16:58 - 2013-08-27 02:28 - 00798208 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2014-11-05 16:58 - 2013-06-15 14:22 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\icaapi.dll
2014-11-05 16:58 - 2013-06-15 12:23 - 00024064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2014-11-05 16:57 - 2014-04-05 03:42 - 00905664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-11-05 16:57 - 2013-12-22 16:42 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-11-05 16:57 - 2013-10-30 03:12 - 00335360 _____ (Microsoft Corporation) C:\Windows\system32\SysFxUI.dll
2014-11-05 16:57 - 2013-10-30 02:43 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmk.sys
2014-11-05 16:57 - 2013-10-30 01:43 - 00167936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys
2014-11-05 16:57 - 2013-07-20 11:44 - 00102608 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2014-11-05 16:57 - 2013-07-10 10:47 - 00783360 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2014-11-05 16:57 - 2012-11-02 11:18 - 00376320 _____ (Microsoft Corporation) C:\Windows\system32\dpnet.dll
2014-11-05 16:57 - 2012-11-02 09:26 - 00023040 _____ (Microsoft Corporation) C:\Windows\system32\dpnsvr.exe
2014-11-05 16:55 - 2014-06-14 01:44 - 00638400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-11-05 16:55 - 2014-06-14 01:33 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2014-11-05 16:55 - 2014-06-06 09:59 - 00506880 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-11-05 16:55 - 2012-08-21 12:47 - 00224640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\volsnap.sys
2014-11-05 16:53 - 2012-11-20 05:22 - 00204288 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2014-11-05 16:52 - 2013-10-11 03:08 - 00444928 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2014-11-05 16:52 - 2013-10-11 03:07 - 00596480 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2014-11-05 16:52 - 2013-10-11 01:39 - 00218228 _____ () C:\Windows\system32\WFP.TMF
2014-11-05 16:20 - 2014-05-30 07:53 - 00273408 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-11-05 16:20 - 2013-06-29 03:07 - 00226304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-11-05 16:20 - 2013-06-29 03:07 - 00197632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-11-05 16:20 - 2013-06-29 03:06 - 00006016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-11-05 16:20 - 2013-03-03 20:07 - 01082232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-11-05 16:20 - 2011-05-05 14:54 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-11-05 16:20 - 2011-05-05 14:54 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-11-05 16:19 - 2014-03-10 02:22 - 01401344 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2014-11-05 16:18 - 2014-11-19 21:19 - 00000000 ____D () C:\Users\Herrin\Desktop\Webdesign
2014-11-05 16:16 - 2014-11-05 16:16 - 00001596 _____ () C:\Users\Herrin\Desktop\Webocton - Scriptly.lnk
2014-11-05 16:16 - 2014-11-05 16:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Webocton - Scriptly
2014-11-05 16:15 - 2014-11-05 16:16 - 00000000 ____D () C:\Users\Herrin\Webocton - Scriptly
2014-11-05 16:15 - 2014-11-05 16:16 - 00000000 ____D () C:\Users\Herrin\AppData\Roaming\Webocton - Scriptly
2014-11-05 16:14 - 2013-05-02 05:04 - 00443904 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2014-11-05 16:14 - 2013-05-02 05:03 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\printcom.dll
2014-11-05 16:13 - 2013-07-09 13:10 - 01205168 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2014-11-05 16:13 - 2013-07-08 05:55 - 03603904 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2014-11-05 16:13 - 2013-07-08 05:55 - 03551680 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-11-05 16:13 - 2013-03-09 04:45 - 00049152 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2014-11-05 16:13 - 2013-03-09 02:28 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2014-11-05 16:13 - 2013-03-08 04:53 - 00376320 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2014-11-05 16:09 - 2014-11-17 22:33 - 00001010 _____ () C:\Users\Herrin\.lmmsrc.xml
2014-11-05 16:09 - 2014-11-05 16:09 - 00000726 _____ () C:\Users\Herrin\Desktop\LMMS.lnk
2014-11-05 16:08 - 2014-11-05 16:08 - 00000000 ____D () C:\Users\Herrin\lmms
2014-11-05 16:07 - 2013-10-11 03:08 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2014-11-05 16:07 - 2013-10-11 03:08 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx
2014-11-05 16:07 - 2013-10-11 03:08 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wshcon.dll
2014-11-05 16:07 - 2013-10-11 01:35 - 00155648 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe
2014-11-05 16:07 - 2013-10-11 01:35 - 00135168 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe
2014-11-05 16:07 - 2013-10-03 13:45 - 00993792 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2014-11-05 16:06 - 2014-11-05 16:07 - 00000000 ____D () C:\Program Files\LMMS
2014-11-05 16:06 - 2013-08-02 05:09 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2014-11-05 16:06 - 2013-04-24 05:00 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\certenc.dll
2014-11-05 16:06 - 2013-04-24 02:46 - 00812544 _____ (Microsoft Corporation) C:\Windows\system32\certutil.exe
2014-11-05 16:02 - 2014-11-05 16:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LMMS 1.0.3
2014-11-05 15:38 - 2014-02-06 02:56 - 00894464 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-11-05 15:38 - 2013-06-27 00:01 - 00527064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2014-11-05 15:37 - 2013-10-22 08:19 - 00158208 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2014-11-05 14:59 - 2013-07-16 05:35 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\themeui.dll
2014-11-05 14:58 - 2013-06-04 05:16 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2014-11-05 14:58 - 2013-06-04 02:49 - 00293376 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2014-11-05 14:57 - 2013-03-08 04:52 - 02067968 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-11-05 14:56 - 2013-07-04 05:21 - 00532480 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2014-11-05 14:07 - 2014-01-30 08:46 - 00876032 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
2014-11-05 13:17 - 2013-04-17 13:30 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\cryptdlg.dll
2014-11-05 13:16 - 2013-07-03 03:33 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbscan.sys
2014-11-05 13:16 - 2013-07-03 03:10 - 00025472 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2014-11-05 13:15 - 2013-02-12 02:57 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usb8023.sys
2014-11-05 13:14 - 2013-07-08 05:20 - 00172544 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2014-11-05 13:14 - 2013-07-08 05:16 - 00133120 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2014-11-05 13:14 - 2013-07-08 05:16 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2014-11-05 11:10 - 2012-09-25 17:19 - 00075776 _____ (Microsoft Corporation) C:\Windows\system32\synceng.dll
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-11-21 16:43 - 2006-11-02 13:51 - 01249850 _____ () C:\Windows\WindowsUpdate.log
2014-11-21 16:32 - 2010-07-09 14:57 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-11-21 15:41 - 2010-07-09 14:57 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-11-21 15:41 - 2006-11-02 14:00 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-11-21 15:41 - 2006-11-02 13:46 - 00003664 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-11-21 15:41 - 2006-11-02 13:46 - 00003664 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-11-21 05:11 - 2006-11-02 14:00 - 00032534 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-11-18 23:02 - 2008-12-24 09:42 - 00000000 ____D () C:\Users\Herrin
2014-11-18 13:44 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\system32\Msdtc
2014-11-18 13:43 - 2006-11-02 11:22 - 50331648 _____ () C:\Windows\system32\config\components_previous
2014-11-18 13:43 - 2006-11-02 11:22 - 39583744 _____ () C:\Windows\system32\config\software_previous
2014-11-18 13:43 - 2006-11-02 11:22 - 17825792 _____ () C:\Windows\system32\config\system_previous
2014-11-18 13:43 - 2006-11-02 11:22 - 00262144 _____ () C:\Windows\system32\config\security_previous
2014-11-18 13:43 - 2006-11-02 11:22 - 00262144 _____ () C:\Windows\system32\config\default_previous
2014-11-18 13:43 - 2006-11-02 11:22 - 00061440 _____ () C:\Windows\system32\config\sam_previous
2014-11-18 13:42 - 2008-12-25 09:38 - 00000000 ____D () C:\Users\Herrin\AppData\Roaming\vlc
2014-11-18 13:42 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\system32\spool
2014-11-18 13:42 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\registration
2014-11-17 22:09 - 2008-12-24 23:16 - 00000000 ____D () C:\Users\Herrin\AppData\Roaming\Mozilla
2014-11-17 19:33 - 2009-08-22 21:27 - 00000000 ____D () C:\Program Files\Mobile Partner
2014-11-16 22:44 - 2009-03-29 11:59 - 00000000 ____D () C:\Windows\Minidump
2014-11-16 20:45 - 2010-08-02 14:21 - 00000000 ____D () C:\Program Files\Java
2014-11-16 20:29 - 2008-12-25 09:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2014-11-16 20:19 - 2008-12-24 11:39 - 00000000 ____D () C:\Users\Herrin\AppData\Local\Adobe
2014-11-16 19:35 - 2011-03-13 20:56 - 00000000 ____D () C:\Program Files\Common Files\Adobe
2014-11-16 19:35 - 2008-12-24 11:38 - 00000000 ____D () C:\ProgramData\Adobe
2014-11-16 19:27 - 2011-05-13 05:53 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-11-16 19:15 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\system32\LogFiles
2014-11-16 15:13 - 2006-11-02 11:33 - 01566310 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-11-16 12:30 - 2008-12-25 09:41 - 00000000 ____D () C:\Users\Herrin\Desktop\Büro
2014-11-14 21:52 - 2012-02-16 20:28 - 00000000 ____D () C:\temp
2014-11-14 18:34 - 2006-11-02 13:35 - 00000000 ____D () C:\Program Files\Windows Sidebar
2014-11-14 14:38 - 2009-05-17 00:15 - 00000000 ____D () C:\Users\Herrin\AppData\Local\Google
2014-11-14 14:37 - 2009-05-17 00:14 - 00000000 ____D () C:\Program Files\Google
2014-11-14 14:03 - 2011-12-15 23:36 - 00000000 ____D () C:\Users\Herrin\AppData\Roaming\Skype
2014-11-13 19:33 - 2006-11-02 12:18 - 00000000 __RHD () C:\Users\Default
2014-11-13 19:33 - 2006-11-02 12:18 - 00000000 ___RD () C:\Users\Public
2014-11-13 19:17 - 2006-11-02 11:23 - 00000215 _____ () C:\Windows\system.ini
2014-11-13 09:49 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\rescache
2014-11-13 09:01 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-11-13 08:44 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\system32\de-DE
2014-11-13 03:08 - 2006-11-02 11:24 - 100445232 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-11-12 22:25 - 2010-07-03 07:33 - 00000000 ____D () C:\ProgramData\ICQ
2014-11-12 19:44 - 2008-12-24 09:42 - 00001356 _____ () C:\Users\Herrin\AppData\Local\d3d9caps.dat
2014-11-07 09:42 - 2012-02-20 18:54 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-11-06 23:25 - 2012-02-20 18:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-11-06 13:37 - 2006-11-02 13:35 - 00000000 ____D () C:\Program Files\Windows Journal
2014-11-06 13:36 - 2006-11-02 13:35 - 00000000 ____D () C:\Windows\system32\XPSViewer
2014-11-06 13:11 - 2011-12-15 23:34 - 00001880 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-11-06 13:11 - 2009-05-17 08:11 - 00000000 ____D () C:\ProgramData\Skype
2014-11-06 09:03 - 2006-11-02 16:46 - 00000000 ____D () C:\Windows\system32\Drivers\de-DE
2014-11-05 13:07 - 2009-11-11 20:02 - 00000000 ____D () C:\Program Files\Yahoo!
2014-11-05 12:55 - 2012-02-19 18:42 - 00000000 ____D () C:\ProgramData\Yahoo!
2014-11-04 14:30 - 2009-11-17 20:16 - 00229000 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
Some content of TEMP:
====================
C:\Users\Herrin\AppData\Local\temp\ERUNT.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-11-21 16:35
==================== End Of Log ============================
--- --- --- |
|
22.11.2014, 13:39
| #18 |
| /// the machine /// TB-Ausbilder | Windows Vista: Adware und anderes Zeugs Öffne bitte FRST, setz nen Haken bei Addition und scanne, poste bitte nur die Addition.txt.
__________________
__________________ |
|
22.11.2014, 16:49
| #19 |
| | Windows Vista: Adware und anderes ZeugsCode:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 22-11-2014
Ran by Herrin at 2014-11-22 16:40:46
Running from C:\Users\Herrin\Desktop\Sicherheit
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
FW: avast! Antivirus (Enabled) {2F96FC65-F07D-9D1E-5A6E-3DA5C487EAF0}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Flash Player 15 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 15.0.0.223 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 15.0.0.223 - Adobe Systems Incorporated)
Adobe Reader 9.5.5 - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-A95000000001}) (Version: 9.5.5 - Adobe Systems Incorporated)
Avast Internet Security (HKLM\...\Avast) (Version: 10.0.2208 - AVAST Software)
CCleaner (HKLM\...\CCleaner) (Version: 3.11 - Piriform)
Defraggler (HKLM\...\Defraggler) (Version: 2.18 - Piriform)
Dropbox (HKU\S-1-5-21-2708201434-1965334668-4040377041-1000\...\Dropbox) (Version: 2.10.52 - Dropbox, Inc.)
DVD Shrink 3.1.4 (HKLM\...\DVD Shrink_is1) (Version: - DVD Shrink)
GIMP 2.8.14 (HKLM\...\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team)
Google Chrome (HKLM\...\Google Chrome) (Version: 39.0.2171.65 - Google Inc.)
Google Earth (HKLM\...\{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}) (Version: 6.1.0.5001 - Google)
Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden
Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: - )
Java(TM) 6 Update 20 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83216020FF}) (Version: 6.0.200 - Sun Microsystems, Inc.)
LMMS 1.0.3 (HKLM\...\LMMS) (Version: 1.0.3 - LMMS Developers)
Malwarebytes Anti-Malware Version 2.0.3.1025 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.3.1025 - Malwarebytes Corporation)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version: - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office XP Professional mit FrontPage (HKLM\...\{90280407-6000-11D3-8CFE-0050048383C9}) (Version: 10.0.2701.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 33.1 (x86 de) (HKLM\...\Mozilla Firefox 33.1 (x86 de)) (Version: 33.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 33.1 - Mozilla)
Picasa 3 (HKLM\...\Picasa 3) (Version: 3.8 - Google, Inc.)
QuickTime (HKLM\...\QuickTime) (Version: - )
Revo Uninstaller 1.95 (HKLM\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Skype™ 6.11 (HKLM\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
Spelling Dictionaries Support For Adobe Reader 9 (HKLM\...\{AC76BA86-7AD7-5464-3428-900000000004}) (Version: 9.0.0 - Adobe Systems Incorporated)
SpywareBlaster 5.0 (HKLM\...\SpywareBlaster_is1) (Version: 5.0.0 - BrightFort LLC)
VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)
Webocton - Scriptly 0.8.95.6 (HKLM\...\Webocton - Scriptly_is1) (Version: 0.8.95.6 - Webocton)
WinPatrol (HKLM\...\{6A206A04-6BC1-411B-AA04-4E52EDEEADF2}) (Version: 32.0.2014.5 - Ruiware)
Yahoo! Software Update (HKLM\...\Yahoo! Software Update) (Version: - )
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-2708201434-1965334668-4040377041-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Herrin\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2708201434-1965334668-4040377041-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Herrin\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2708201434-1965334668-4040377041-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Herrin\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2708201434-1965334668-4040377041-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Herrin\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2708201434-1965334668-4040377041-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Herrin\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2708201434-1965334668-4040377041-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Herrin\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2708201434-1965334668-4040377041-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Herrin\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2708201434-1965334668-4040377041-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Herrin\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
==================== Restore Points =========================
18-11-2014 21:25:18 Revo Uninstaller's restore point - GIMP 2.8.14
18-11-2014 21:31:04 Revo Uninstaller's restore point - GIMP 2.8.14
19-11-2014 18:32:13 Geplanter Prüfpunkt
20-11-2014 02:00:23 Windows Update
20-11-2014 14:12:47 Revo Uninstaller's restore point - WinPatrol
21-11-2014 22:01:05 Geplanter Prüfpunkt
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2006-11-02 11:23 - 2014-11-13 19:11 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {22D776E8-92AC-41F3-865C-0661FA2EFFDD} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-11-14] (AVAST Software)
Task: {75194B80-6BF9-4D8F-B1E6-15F8DDD6DD3A} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-11-05] (Google Inc.)
Task: {87BE7DD4-F78D-4FE1-8589-5591305A7A9F} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-11-16] (Adobe Systems Incorporated)
Task: {CE973C16-5E83-49E7-A9A8-C1E7F965B1D9} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-11-05] (Google Inc.)
Task: {F5CC19B5-4CE1-45AB-AFBA-C39033771C4C} - System32\Tasks\{D998DDF7-BDDF-4B9B-BB67-F7F3D6D35605} => C:\Program Files\Skype\Phone\Skype.exe [2013-11-14] (Skype Technologies S.A.)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2014-11-22 16:16 - 2014-11-22 16:16 - 02903552 _____ () C:\Program Files\AVAST Software\Avast\defs\14112200\algo.dll
2008-12-24 11:09 - 2007-06-26 15:55 - 00249856 _____ () C:\Windows\system32\igfxTMM.dll
2014-11-14 18:35 - 2014-11-14 18:35 - 38562088 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2014-11-21 02:03 - 2014-11-14 22:15 - 09009480 _____ () C:\Program Files\Google\Chrome\Application\39.0.2171.65\pdf.dll
2014-11-21 02:02 - 2014-11-14 22:15 - 01677128 _____ () C:\Program Files\Google\Chrome\Application\39.0.2171.65\ffmpegsumo.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\ProgramData\TEMP:5C321E34
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
========================= Accounts: ==========================
Administrator (S-1-5-21-2708201434-1965334668-4040377041-500 - Administrator - Disabled)
Gast (S-1-5-21-2708201434-1965334668-4040377041-501 - Limited - Disabled)
Herrin (S-1-5-21-2708201434-1965334668-4040377041-1000 - Administrator - Enabled) => C:\Users\Herrin
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (11/22/2014 05:12:23 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\HERRIN\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\P3IKZU2D\ZZZZZZZZZZZ.ZZZ> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (11/22/2014 05:12:23 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\HERRIN\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\8WAE1SP4\ZZZZZZZZZZZZZZZZZ.ZZZ> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (11/22/2014 05:12:23 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\HERRIN\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\8WAE1SP4\ZZZZZZZZZZZZ.ZZZ> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (11/22/2014 05:12:22 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\HERRIN\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\N0CFJ5ZN\ZZZZZZZZZZZZ.ZZZ> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (11/22/2014 05:12:22 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\HERRIN\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\8WAE1SP4\ZZZZZZZZZZ.ZZZ> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (11/22/2014 05:12:22 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\HERRIN\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\8WAE1SP4\ZZZZZZZZ.ZZZ> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (11/22/2014 05:12:22 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\HERRIN\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\N0CFJ5ZN\ZZZZ.ZZZ> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (11/22/2014 05:12:22 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\HERRIN\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\8WAE1SP4\ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ.ZZZ> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (11/22/2014 05:12:21 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\HERRIN\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\8WAE1SP4\ZZZZZZZZZZ.ZZZ> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (11/22/2014 05:12:21 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\HERRIN\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\8WAE1SP4\ZZZZZZZZZZZZZZ.ZZZ> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
System errors:
=============
Error: (11/22/2014 07:19:58 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {C2BFE331-6739-4270-86C9-493D9A04CD38}
Error: (11/21/2014 04:54:49 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
Error: (11/21/2014 04:52:06 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: 0x80070643Definition Update for Windows Defender - KB915597 (Definition 1.189.400.0){F12EA978-53CA-4097-8C10-0F88C6BA17CE}200
Error: (11/21/2014 03:49:35 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: Windows Update
Error: (11/21/2014 05:10:55 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {C2BFE331-6739-4270-86C9-493D9A04CD38}
Error: (11/20/2014 03:59:42 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {752073A1-23F2-4396-85F0-8FDB879ED0ED}
Error: (11/20/2014 05:09:14 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {C2BFE331-6739-4270-86C9-493D9A04CD38}
Error: (11/19/2014 04:02:17 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: Windows Update
Error: (11/19/2014 03:43:52 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {C2BFE331-6739-4270-86C9-493D9A04CD38}
Error: (11/18/2014 01:52:22 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: Windows Update
Microsoft Office Sessions:
=========================
Error: (11/22/2014 05:12:23 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
C:\USERS\HERRIN\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\P3IKZU2D\ZZZZZZZZZZZ.ZZZ
Error: (11/22/2014 05:12:23 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
C:\USERS\HERRIN\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\8WAE1SP4\ZZZZZZZZZZZZZZZZZ.ZZZ
Error: (11/22/2014 05:12:23 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
C:\USERS\HERRIN\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\8WAE1SP4\ZZZZZZZZZZZZ.ZZZ
Error: (11/22/2014 05:12:22 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
C:\USERS\HERRIN\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\N0CFJ5ZN\ZZZZZZZZZZZZ.ZZZ
Error: (11/22/2014 05:12:22 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
C:\USERS\HERRIN\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\8WAE1SP4\ZZZZZZZZZZ.ZZZ
Error: (11/22/2014 05:12:22 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
C:\USERS\HERRIN\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\8WAE1SP4\ZZZZZZZZ.ZZZ
Error: (11/22/2014 05:12:22 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
C:\USERS\HERRIN\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\N0CFJ5ZN\ZZZZ.ZZZ
Error: (11/22/2014 05:12:22 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
C:\USERS\HERRIN\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\8WAE1SP4\ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ.ZZZ
Error: (11/22/2014 05:12:21 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
C:\USERS\HERRIN\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\8WAE1SP4\ZZZZZZZZZZ.ZZZ
Error: (11/22/2014 05:12:21 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
C:\USERS\HERRIN\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\8WAE1SP4\ZZZZZZZZZZZZZZ.ZZZ
CodeIntegrity Errors:
===================================
Date: 2014-11-22 16:39:32.615
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-11-22 16:39:31.538
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-11-22 16:39:30.478
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-11-22 16:39:29.354
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-11-22 16:39:26.531
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-11-22 16:39:25.423
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-11-22 16:39:24.267
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-11-22 16:39:22.582
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-11-21 16:48:26.335
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-11-21 16:48:25.118
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Processor: Intel(R) Core(TM)2 Duo CPU T7500 @ 2.20GHz
Percentage of memory in use: 73%
Total physical RAM: 1013.63 MB
Available physical RAM: 270.09 MB
Total Pagefile: 2490.95 MB
Available Pagefile: 1096.75 MB
Total Virtual: 2047.88 MB
Available Virtual: 1908.13 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:74.53 GB) (Free:35.36 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 74.5 GB) (Disk ID: 23F12D67)
Partition 1: (Active) - (Size=74.5 GB) - (Type=07 NTFS)
==================== End Of Log ============================
|
|
23.11.2014, 14:42
| #20 |
| /// the machine /// TB-Ausbilder | Windows Vista: Adware und anderes Zeugs Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter HKU\S-1-5-18\...\RunOnce: [panda2_0dn] => reg.exe delete "HKCU\Software\AppDataLow\Software\panda2_0dn" /f
HKU\S-1-5-18\...\RunOnce: [panda2_0dn_XP] => reg.exe delete "HKCU\Software\panda2_0dn" /f
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:52644;https=127.0.0.1:52644;
Emptytemp:
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
24.11.2014, 07:37
| #21 |
| | Windows Vista: Adware und anderes Zeugs Laptop ist nach dem Scan von selber neu gestartet, weiß nicht ob das normal ist. Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 23-11-2014
Ran by Herrin at 2014-11-24 07:13:12 Run:2
Running from C:\Users\Herrin\Desktop\Sicherheit
Loaded Profile: Herrin (Available profiles: Herrin)
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
HKU\S-1-5-18\...\RunOnce: [panda2_0dn] => reg.exe delete "HKCU\Software\AppDataLow\Software\panda2_0dn" /f
HKU\S-1-5-18\...\RunOnce: [panda2_0dn_XP] => reg.exe delete "HKCU\Software\panda2_0dn" /f
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:52644;https=127.0.0.1:52644;
Emptytemp:
*****************
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\RunOnce\\panda2_0dn => Value not found.
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\RunOnce\\panda2_0dn_XP => Value not found.
"HKLM\SOFTWARE\Policies\Google" => Key deleted successfully.
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable => value deleted successfully.
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => value deleted successfully.
EmptyTemp: => Removed 420.9 MB temporary data.
The system needed a reboot.
==== End of Fixlog ====
|
|
24.11.2014, 20:24
| #22 |
| /// the machine /// TB-Ausbilder | Windows Vista: Adware und anderes Zeugs Ja das war FRST. Bitte nochmal frisches FRST und Addition log. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
25.11.2014, 20:25
| #23 |
| | Windows Vista: Adware und anderes Zeugs Nein, keine Probleme mehr. FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 23-11-2014
Ran by Herrin (administrator) on HERRIN-PC on 25-11-2014 20:14:33
Running from C:\Users\Herrin\Desktop\Sicherheit
Loaded Profile: Herrin (Available profiles: Herrin)
Platform: Microsoft® Windows Vista™ Ultimate Service Pack 2 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 8
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\afwServ.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Yahoo! Inc.) C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5225064 2014-11-14] (AVAST Software)
HKLM\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [41056 2013-05-08] (Adobe Systems Incorporated)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKU\S-1-5-21-2708201434-1965334668-4040377041-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation)
HKU\S-1-5-21-2708201434-1965334668-4040377041-1000\...\Run: [WMPNSCFG] => C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-19] (Microsoft Corporation)
HKU\S-1-5-21-2708201434-1965334668-4040377041-1000\...\Run: [WinPatrol] => C:\Users\Herrin\Desktop\Sicherheit\winpatrol.exe -expressboot
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk
ShortcutTarget: Microsoft Office.lnk -> C:\Program Files\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software)
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:52644;https=127.0.0.1:52644;
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-2708201434-1965334668-4040377041-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-2708201434-1965334668-4040377041-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.yahoo.com/?fr=mkg029
URLSearchHook: HKLM - Default Value = {855F3B16-6D32-4fe6-8A56-BBB695989046}
URLSearchHook: HKLM - (No Name) - {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - No File
HKU\S-1-5-21-2708201434-1965334668-4040377041-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
SearchScopes: HKLM -> DefaultScope {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL =
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search
SearchScopes: HKU\S-1-5-21-2708201434-1965334668-4040377041-1000 -> DefaultScope {2AEA96DD-CC4B-45F3-97D0-65FBC2888F47} URL = https://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-2708201434-1965334668-4040377041-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search
SearchScopes: HKU\S-1-5-21-2708201434-1965334668-4040377041-1000 -> {2AEA96DD-CC4B-45F3-97D0-65FBC2888F47} URL = https://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-2708201434-1965334668-4040377041-1000 -> {4F6CF4C1-C88D-44C8-97FB-821F288D0212} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=vc_trans_8140&type=foxysecurity
SearchScopes: HKU\S-1-5-21-2708201434-1965334668-4040377041-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={sear
BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Herrin\AppData\Roaming\Mozilla\Firefox\Profiles\apekw9zh.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_223.dll ()
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin: @java.com/DTPlugin -> C:\Program Files\Java\jre6\bin\npDeployJava1.dll (Sun Microsystems, Inc.)
FF Plugin: @java.com/JavaPlugin -> C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: Adblock Plus - C:\Users\Herrin\AppData\Roaming\Mozilla\Firefox\Profiles\apekw9zh.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-11-19]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-12-29]
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-11-14]
FF Extension: No Name - wrc@avast.com [Not Found]
Chrome:
=======
CHR HomePage: Default -> https://www.google.de/
CHR Profile: C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-11-14]
CHR Extension: (Google Docs) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-11-14]
CHR Extension: (Google Drive) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-11-14]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-11-14]
CHR Extension: (WOT) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bhmmomiinigofkjcapegjjndpbikblnp [2014-11-17]
CHR Extension: (YouTube) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-11-14]
CHR Extension: (Google Search) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-11-14]
CHR Extension: (Google Sheets) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-11-14]
CHR Extension: (Avira Browser Safety) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2014-11-14]
CHR Extension: (AdBlock) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-11-15]
CHR Extension: (Avast Online Security) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-11-14]
CHR Extension: (Google Wallet) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-11-14]
CHR Extension: (NotScripts) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\odjhifogjcknibkahlpidmdajjpkkcfn [2014-11-17]
CHR Extension: (Gmail) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-11-14]
CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-11-14]
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-11-14] (AVAST Software)
R2 avast! Firewall; C:\Program Files\AVAST Software\Avast\afwServ.exe [104416 2014-11-14] (AVAST Software)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [24184 2014-11-14] ()
R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [26136 2014-11-14] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [70384 2014-11-14] (AVAST Software)
R0 aswNdis; C:\Windows\System32\DRIVERS\aswNdis.sys [12112 2014-11-14] (ALWIL Software)
R0 aswNdis2; C:\Windows\system32\Drivers\aswNdis2.sys [253640 2014-11-14] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr.sys [55240 2014-11-14] (AVAST Software)
R0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [49944 2014-11-14] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [787800 2014-11-14] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [422760 2014-11-14] (AVAST Software)
R1 aswTdi; C:\Windows\system32\drivers\aswTdi.sys [57928 2014-11-14] (AVAST Software)
R0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [206248 2014-11-14] ()
S3 PROCEXP113; C:\Windows\system32\Drivers\PROCEXP113.SYS [12568 2014-11-13] (Sysinternals - www.sysinternals.com) [File not signed]
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-11-24 07:23 - 2014-11-24 07:23 - 00001576 _____ () C:\Windows\PFRO.log
2014-11-23 22:41 - 2014-11-23 22:41 - 00055088 _____ () C:\Users\Herrin\AppData\Local\GDIPFONTCACHEV1.DAT
2014-11-23 20:58 - 2014-11-23 20:59 - 08676128 _____ (Microsoft Corporation) C:\Users\Herrin\Downloads\Windows7UpgradeAdvisorSetup.exe
2014-11-23 20:09 - 2014-11-23 20:09 - 00000000 ____D () C:\Users\Herrin\AppData\Local\Macromedia
2014-11-22 16:12 - 2014-11-22 16:13 - 00250352 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-11-22 03:26 - 2014-11-22 03:26 - 00000218 _____ () C:\Users\Herrin\AppData\Local\recently-used.xbel
2014-11-22 03:20 - 2014-11-22 04:07 - 00000000 ____D () C:\Users\Herrin\AppData\Local\gtk-2.0
2014-11-21 00:55 - 2014-11-21 00:55 - 00000000 ____D () C:\Users\Herrin\AppData\Local\webkit
2014-11-20 15:38 - 2014-11-20 15:38 - 00000000 ____D () C:\Program Files\VS Revo Group
2014-11-20 15:27 - 2014-11-20 15:27 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware
2014-11-20 15:19 - 2014-11-20 15:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinPatrol
2014-11-20 15:19 - 2014-11-20 15:19 - 00000000 ____D () C:\ProgramData\InstallMate
2014-11-20 15:19 - 2014-11-20 15:19 - 00000000 ____D () C:\Program Files\Ruiware
2014-11-20 03:03 - 2014-10-24 02:03 - 00499200 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-11-19 17:15 - 2014-11-19 17:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpywareBlaster
2014-11-19 17:15 - 2014-11-19 17:15 - 00000000 ____D () C:\ProgramData\Licenses
2014-11-19 17:01 - 2014-11-19 17:01 - 00000000 ____D () C:\Users\Herrin\AppData\Roaming\WinPatrol
2014-11-19 16:13 - 2014-11-25 20:14 - 00000000 ____D () C:\FRST
2014-11-18 23:02 - 2014-11-25 10:38 - 00000000 ____D () C:\Users\Herrin\.gimp-2.8
2014-11-18 23:01 - 2014-11-18 23:02 - 00000834 _____ () C:\Users\Herrin\Desktop\Gimp 2.8.lnk
2014-11-18 22:49 - 2014-11-18 22:49 - 00000842 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GIMP 2.lnk
2014-11-18 22:38 - 2014-11-18 22:47 - 00000000 ____D () C:\Program Files\GIMP 2
2014-11-18 17:51 - 2014-11-11 20:04 - 00979456 _____ () C:\Users\Herrin\Documents\~WRL2275.tmp
2014-11-18 15:16 - 2014-11-18 15:16 - 00001662 _____ () C:\Users\Public\Desktop\Defraggler.lnk
2014-11-18 15:12 - 2014-11-18 15:17 - 00000000 ____D () C:\Program Files\Defraggler
2014-11-17 19:32 - 2014-11-18 13:44 - 00000000 ____D () C:\ProgramData\DataCardService
2014-11-17 19:32 - 2014-11-17 19:33 - 00000000 ____D () C:\ProgramData\Mobile Partner
2014-11-17 15:51 - 2014-11-17 15:53 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Mozilla
2014-11-17 15:51 - 2014-11-17 15:51 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Mozilla
2014-11-17 15:49 - 2014-11-17 15:49 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\AVAST Software
2014-11-17 15:49 - 2014-11-17 15:49 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Adobe
2014-11-17 15:48 - 2014-11-17 15:48 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Google
2014-11-17 15:46 - 2014-11-18 13:44 - 00000000 ____D () C:\Users\Administrator
2014-11-17 00:56 - 2014-11-17 01:04 - 00000000 ____D () C:\AdwCleaner
2014-11-17 00:42 - 2014-11-17 00:42 - 00000000 ____D () C:\Users\Herrin\AppData\Local\Secunia PSI
2014-11-17 00:32 - 2014-11-24 19:40 - 00000000 ____D () C:\ProgramData\TEMP
2014-11-17 00:32 - 2014-11-18 13:03 - 00000000 ____D () C:\Program Files\SpywareBlaster
2014-11-16 23:17 - 2014-11-16 23:35 - 00000972 _____ () C:\DelFix.txt
2014-11-16 20:52 - 2014-11-16 20:52 - 00000000 ____D () C:\Program Files\Common Files\Java
2014-11-16 20:48 - 2014-11-16 20:48 - 00000000 ____D () C:\ProgramData\Oracle
2014-11-16 20:21 - 2014-11-16 20:22 - 00638888 _____ (Oracle Corporation) C:\Users\Herrin\Desktop\chromeinstall-8u25.exe
2014-11-16 19:35 - 2014-11-16 19:39 - 00002425 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader 9.lnk
2014-11-16 19:25 - 2014-11-25 19:56 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-11-16 19:24 - 2014-11-16 19:27 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-11-16 01:42 - 2014-11-16 01:42 - 00000000 ____D () C:\Users\Herrin\AppData\Local\fontconfig
2014-11-16 01:41 - 2014-11-16 01:41 - 00000000 ____D () C:\Users\Herrin\AppData\Local\gegl-0.2
2014-11-15 17:33 - 2014-11-15 17:33 - 00000806 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-11-15 17:32 - 2014-11-15 17:33 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-11-15 17:32 - 2014-11-15 17:32 - 00000000 ____D () C:\ProgramData\Mozilla
2014-11-15 17:32 - 2014-11-15 17:32 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-11-14 22:23 - 2007-06-26 15:57 - 00192512 _____ (Intel Corporation) C:\Windows\system32\igfxres.dll
2014-11-14 22:05 - 2014-11-16 23:17 - 00000000 ____D () C:\Windows\ERUNT
2014-11-14 20:44 - 2014-11-20 15:29 - 00114904 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-11-14 20:42 - 2014-11-20 15:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-11-14 20:41 - 2014-11-14 20:41 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-11-14 20:41 - 2014-10-01 11:11 - 00075480 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-11-14 20:41 - 2014-10-01 11:11 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-11-14 20:41 - 2014-10-01 11:11 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-11-14 19:18 - 2014-11-14 19:18 - 00001837 _____ () C:\Users\Public\Desktop\Avast Internet Security.lnk
2014-11-14 19:13 - 2014-11-14 19:12 - 00026136 _____ (AVAST Software) C:\Windows\system32\Drivers\aswKbd.sys
2014-11-14 19:13 - 2014-11-14 19:11 - 00253640 _____ (AVAST Software) C:\Windows\system32\Drivers\aswNdis2.sys
2014-11-14 19:13 - 2014-11-14 18:35 - 00291352 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-11-14 19:11 - 2014-11-14 19:11 - 00012112 _____ (ALWIL Software) C:\Windows\system32\Drivers\aswNdis.sys
2014-11-14 19:07 - 2014-11-14 19:07 - 00000000 ____D () C:\Program Files\Dropbox
2014-11-14 19:05 - 2014-11-14 19:05 - 00000000 ____D () C:\Users\Herrin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-11-14 18:54 - 2014-11-14 19:08 - 00000000 ____D () C:\Users\Herrin\AppData\Roaming\Dropbox
2014-11-14 18:40 - 2014-11-14 18:40 - 00000000 ____D () C:\Users\Herrin\AppData\Roaming\AVAST Software
2014-11-14 18:39 - 2014-11-14 19:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2014-11-14 18:36 - 2014-11-14 18:36 - 00422760 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2014-11-14 18:36 - 2014-11-14 18:36 - 00206248 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-11-14 18:36 - 2014-11-14 18:36 - 00070384 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-11-14 18:36 - 2014-11-14 18:36 - 00057928 _____ (AVAST Software) C:\Windows\system32\Drivers\aswTdi.sys
2014-11-14 18:36 - 2014-11-14 18:36 - 00055240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr.sys
2014-11-14 18:36 - 2014-11-14 18:36 - 00049944 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-11-14 18:36 - 2014-11-14 18:36 - 00024184 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2014-11-14 18:36 - 2014-11-14 18:34 - 00787800 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2014-11-14 18:35 - 2014-11-14 18:35 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-11-14 18:31 - 2014-11-14 18:31 - 00000000 ____D () C:\Program Files\AVAST Software
2014-11-14 18:20 - 2014-11-14 18:31 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-11-14 16:52 - 2014-11-14 16:52 - 00039402 _____ () C:\Users\Herrin\Documents\Ereignisse.txt
2014-11-14 14:37 - 2014-11-21 02:04 - 00001923 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-11-14 14:37 - 2014-11-14 14:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-11-13 20:10 - 2014-11-25 20:14 - 00000000 ____D () C:\Users\Herrin\Desktop\Sicherheit
2014-11-13 19:33 - 2014-11-13 19:33 - 00012568 _____ (Sysinternals - www.sysinternals.com) C:\Windows\system32\Drivers\PROCEXP113.SYS
2014-11-13 18:01 - 2014-11-13 19:22 - 00000000 ____D () C:\Windows\erdnt
2014-11-13 03:32 - 2014-10-10 02:01 - 00449536 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2014-11-13 03:32 - 2014-10-10 02:00 - 01259008 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-11-13 03:32 - 2014-10-10 02:00 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2014-11-13 03:32 - 2014-10-10 00:22 - 00619520 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2014-11-13 03:31 - 2014-08-27 01:55 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-11-13 03:31 - 2014-08-27 01:55 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-11-13 03:29 - 2014-10-24 02:04 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-11-13 03:29 - 2014-09-19 01:50 - 00278528 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-11-13 03:28 - 2014-08-12 03:25 - 00729600 _____ (Microsoft Corporation) C:\Windows\system32\IMJP10K.DLL
2014-11-13 03:23 - 2014-10-18 02:08 - 00564224 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2014-11-13 03:23 - 2014-10-03 02:18 - 00274432 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2014-11-13 03:23 - 2014-10-03 02:17 - 00396800 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2014-11-13 03:23 - 2014-10-03 02:17 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2014-11-13 03:23 - 2014-10-03 02:17 - 00170496 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2014-11-13 03:04 - 2014-10-13 00:34 - 02054656 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-11-12 18:40 - 2014-11-12 18:40 - 00000000 ____D () C:\Users\Herrin\AppData\Roaming\AdvancedSystemProtector
2014-11-12 18:27 - 2014-11-12 18:27 - 00000000 ____D () C:\Users\Herrin\AppData\Roaming\dlg
2014-11-12 11:16 - 2014-10-31 08:17 - 06004736 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 11082752 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 02006016 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 01469440 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-11-12 11:15 - 2014-10-31 08:17 - 01214976 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 00916992 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 00630784 _____ (Microsoft Corporation) C:\Windows\system32\mstime.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 00630272 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 00387584 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 00164352 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-11-12 11:15 - 2014-10-31 08:16 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\corpol.dll
2014-11-12 11:15 - 2014-10-31 03:37 - 00385024 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2014-11-12 11:15 - 2014-10-31 03:30 - 00174080 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-11-12 11:15 - 2014-10-31 03:30 - 00133632 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-11-12 11:15 - 2014-10-31 03:29 - 01638912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-11-12 11:15 - 2014-10-31 03:29 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-11-10 12:08 - 2014-11-10 12:08 - 00000000 ____D () C:\Users\Herrin\AppData\Roaming\Daichi
2014-11-10 10:28 - 2014-11-18 13:42 - 00000000 ____D () C:\Users\Herrin\Desktop\Sounds
2014-11-09 21:38 - 2014-11-09 21:38 - 00000000 ____D () C:\Program Files\Common Files\Avid
2014-11-09 21:28 - 2014-11-09 22:01 - 00000000 ____D () C:\Program Files\Common Files\VST3
2014-11-07 20:49 - 2014-11-07 20:49 - 00000000 ____D () C:\Users\Herrin\Documents\CabraProjects
2014-11-07 20:48 - 2014-11-07 20:49 - 00678093 _____ () C:\Users\Herrin\Desktop\Cabra_0.7.0.jar
2014-11-06 18:04 - 2014-11-06 18:04 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
2014-11-06 14:41 - 2012-11-22 04:54 - 00353280 _____ (Microsoft Corporation) C:\Windows\system32\shlwapi.dll
2014-11-06 14:35 - 2014-11-06 14:35 - 00000000 ____D () C:\Users\Herrin\AppData\Local\AviraSpeedup
2014-11-06 13:20 - 2014-06-26 23:17 - 00619664 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2014-11-06 13:20 - 2014-06-26 23:17 - 00099480 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2014-11-06 13:20 - 2014-06-26 23:17 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2014-11-06 13:19 - 2014-06-06 05:28 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-11-06 13:16 - 2014-06-15 23:18 - 01131664 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll
2014-11-06 13:16 - 2014-06-13 19:22 - 00156824 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll
2014-11-06 13:16 - 2014-06-13 19:22 - 00081560 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll
2014-11-06 12:52 - 2014-09-09 07:24 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-11-06 12:22 - 2014-08-23 02:03 - 00297984 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-11-06 11:44 - 2012-11-08 04:48 - 01314816 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
2014-11-06 11:10 - 2014-11-13 03:23 - 00000000 ____D () C:\Windows\system32\MRT
2014-11-05 21:45 - 2014-11-05 21:45 - 00000000 ____D () C:\e1bf55fb68ca2ff1452d
2014-11-05 21:44 - 2014-09-05 00:27 - 00143360 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fastfat.sys
2014-11-05 21:41 - 2012-07-26 03:46 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\Wdfres.dll
2014-11-05 21:41 - 2012-06-02 15:57 - 00000003 _____ () C:\Windows\system32\Drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf
2014-11-05 21:40 - 2012-07-26 04:39 - 00047720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdfLdr.sys
2014-11-05 21:40 - 2012-07-26 04:21 - 00196608 _____ (Microsoft Corporation) C:\Windows\system32\WUDFHost.exe
2014-11-05 21:40 - 2012-07-26 04:20 - 00613888 _____ (Microsoft Corporation) C:\Windows\system32\WUDFx.dll
2014-11-05 21:40 - 2012-07-26 04:20 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\WUDFPlatform.dll
2014-11-05 21:40 - 2012-07-26 04:20 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\WUDFSvc.dll
2014-11-05 21:40 - 2012-07-26 04:20 - 00038912 _____ (Microsoft Corporation) C:\Windows\system32\WUDFCoinstaller.dll
2014-11-05 21:40 - 2012-07-26 03:33 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WUDFPf.sys
2014-11-05 21:40 - 2012-07-26 03:32 - 00155136 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WUDFRd.sys
2014-11-05 21:40 - 2009-07-14 13:12 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\winusb.dll
2014-11-05 16:58 - 2014-06-02 11:31 - 02263552 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-11-05 16:58 - 2014-06-02 11:31 - 00332800 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-11-05 16:58 - 2014-06-02 11:30 - 01993728 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-11-05 16:58 - 2014-06-02 11:30 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2014-11-05 16:58 - 2014-06-02 09:56 - 00082432 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2014-11-05 16:58 - 2014-04-26 17:01 - 00502784 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2014-11-05 16:58 - 2014-03-25 14:26 - 11587584 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-11-05 16:58 - 2013-08-27 03:47 - 01029120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll
2014-11-05 16:58 - 2013-08-27 03:47 - 00219648 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll
2014-11-05 16:58 - 2013-08-27 03:47 - 00189952 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll
2014-11-05 16:58 - 2013-08-27 03:47 - 00160768 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll
2014-11-05 16:58 - 2013-08-27 02:52 - 01172480 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-11-05 16:58 - 2013-08-27 02:50 - 00486400 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2014-11-05 16:58 - 2013-08-27 02:32 - 00683008 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2014-11-05 16:58 - 2013-08-27 02:28 - 01069056 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2014-11-05 16:58 - 2013-08-27 02:28 - 00798208 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2014-11-05 16:58 - 2013-06-15 14:22 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\icaapi.dll
2014-11-05 16:58 - 2013-06-15 12:23 - 00024064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2014-11-05 16:57 - 2014-04-05 03:42 - 00905664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-11-05 16:57 - 2013-12-22 16:42 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-11-05 16:57 - 2013-10-30 03:12 - 00335360 _____ (Microsoft Corporation) C:\Windows\system32\SysFxUI.dll
2014-11-05 16:57 - 2013-10-30 02:43 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmk.sys
2014-11-05 16:57 - 2013-10-30 01:43 - 00167936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys
2014-11-05 16:57 - 2013-07-20 11:44 - 00102608 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2014-11-05 16:57 - 2013-07-10 10:47 - 00783360 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2014-11-05 16:57 - 2012-11-02 11:18 - 00376320 _____ (Microsoft Corporation) C:\Windows\system32\dpnet.dll
2014-11-05 16:57 - 2012-11-02 09:26 - 00023040 _____ (Microsoft Corporation) C:\Windows\system32\dpnsvr.exe
2014-11-05 16:55 - 2014-06-14 01:44 - 00638400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-11-05 16:55 - 2014-06-14 01:33 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2014-11-05 16:55 - 2014-06-06 09:59 - 00506880 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-11-05 16:55 - 2012-08-21 12:47 - 00224640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\volsnap.sys
2014-11-05 16:53 - 2012-11-20 05:22 - 00204288 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2014-11-05 16:52 - 2013-10-11 03:08 - 00444928 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2014-11-05 16:52 - 2013-10-11 03:07 - 00596480 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2014-11-05 16:52 - 2013-10-11 01:39 - 00218228 _____ () C:\Windows\system32\WFP.TMF
2014-11-05 16:20 - 2014-05-30 07:53 - 00273408 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-11-05 16:20 - 2013-06-29 03:07 - 00226304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-11-05 16:20 - 2013-06-29 03:07 - 00197632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-11-05 16:20 - 2013-06-29 03:06 - 00006016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-11-05 16:20 - 2013-03-03 20:07 - 01082232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-11-05 16:20 - 2011-05-05 14:54 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-11-05 16:20 - 2011-05-05 14:54 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-11-05 16:19 - 2014-03-10 02:22 - 01401344 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2014-11-05 16:18 - 2014-11-24 19:17 - 00000000 ____D () C:\Users\Herrin\Desktop\Webdesign
2014-11-05 16:16 - 2014-11-05 16:16 - 00001596 _____ () C:\Users\Herrin\Desktop\Webocton - Scriptly.lnk
2014-11-05 16:16 - 2014-11-05 16:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Webocton - Scriptly
2014-11-05 16:15 - 2014-11-05 16:16 - 00000000 ____D () C:\Users\Herrin\Webocton - Scriptly
2014-11-05 16:15 - 2014-11-05 16:16 - 00000000 ____D () C:\Users\Herrin\AppData\Roaming\Webocton - Scriptly
2014-11-05 16:14 - 2013-05-02 05:04 - 00443904 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2014-11-05 16:14 - 2013-05-02 05:03 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\printcom.dll
2014-11-05 16:13 - 2013-07-09 13:10 - 01205168 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2014-11-05 16:13 - 2013-07-08 05:55 - 03603904 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2014-11-05 16:13 - 2013-07-08 05:55 - 03551680 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-11-05 16:13 - 2013-03-09 04:45 - 00049152 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2014-11-05 16:13 - 2013-03-09 02:28 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2014-11-05 16:13 - 2013-03-08 04:53 - 00376320 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2014-11-05 16:09 - 2014-11-24 05:47 - 00001199 _____ () C:\Users\Herrin\.lmmsrc.xml
2014-11-05 16:09 - 2014-11-05 16:09 - 00000726 _____ () C:\Users\Herrin\Desktop\LMMS.lnk
2014-11-05 16:08 - 2014-11-05 16:08 - 00000000 ____D () C:\Users\Herrin\lmms
2014-11-05 16:07 - 2013-10-11 03:08 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2014-11-05 16:07 - 2013-10-11 03:08 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx
2014-11-05 16:07 - 2013-10-11 03:08 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wshcon.dll
2014-11-05 16:07 - 2013-10-11 01:35 - 00155648 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe
2014-11-05 16:07 - 2013-10-11 01:35 - 00135168 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe
2014-11-05 16:07 - 2013-10-03 13:45 - 00993792 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2014-11-05 16:06 - 2014-11-05 16:07 - 00000000 ____D () C:\Program Files\LMMS
2014-11-05 16:06 - 2013-08-02 05:09 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2014-11-05 16:06 - 2013-04-24 05:00 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\certenc.dll
2014-11-05 16:06 - 2013-04-24 02:46 - 00812544 _____ (Microsoft Corporation) C:\Windows\system32\certutil.exe
2014-11-05 16:02 - 2014-11-05 16:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LMMS 1.0.3
2014-11-05 15:38 - 2014-02-06 02:56 - 00894464 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-11-05 15:38 - 2013-06-27 00:01 - 00527064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2014-11-05 15:37 - 2013-10-22 08:19 - 00158208 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2014-11-05 14:59 - 2013-07-16 05:35 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\themeui.dll
2014-11-05 14:58 - 2013-06-04 05:16 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2014-11-05 14:58 - 2013-06-04 02:49 - 00293376 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2014-11-05 14:57 - 2013-03-08 04:52 - 02067968 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-11-05 14:56 - 2013-07-04 05:21 - 00532480 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2014-11-05 14:07 - 2014-01-30 08:46 - 00876032 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
2014-11-05 13:17 - 2013-04-17 13:30 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\cryptdlg.dll
2014-11-05 13:16 - 2013-07-03 03:33 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbscan.sys
2014-11-05 13:16 - 2013-07-03 03:10 - 00025472 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2014-11-05 13:15 - 2013-02-12 02:57 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usb8023.sys
2014-11-05 13:14 - 2013-07-08 05:20 - 00172544 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2014-11-05 13:14 - 2013-07-08 05:16 - 00133120 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2014-11-05 13:14 - 2013-07-08 05:16 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2014-11-05 11:10 - 2012-09-25 17:19 - 00075776 _____ (Microsoft Corporation) C:\Windows\system32\synceng.dll
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-11-25 20:09 - 2006-11-02 13:51 - 01392940 _____ () C:\Windows\WindowsUpdate.log
2014-11-25 19:35 - 2006-11-02 13:46 - 00003664 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-11-25 19:35 - 2006-11-02 13:46 - 00003664 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-11-25 19:27 - 2010-07-09 14:57 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-11-25 17:37 - 2010-07-09 14:57 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-11-25 17:35 - 2006-11-02 14:00 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-11-25 11:51 - 2006-11-02 14:00 - 00032534 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-11-23 21:01 - 2006-11-02 11:33 - 01566310 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-11-23 04:29 - 2009-05-17 08:11 - 00000000 ____D () C:\ProgramData\Skype
2014-11-22 05:14 - 2009-03-29 11:59 - 00000000 ____D () C:\Windows\Minidump
2014-11-22 05:13 - 2012-01-08 10:26 - 00000000 __SHD () C:\Users\Herrin\UserData
2014-11-18 23:02 - 2008-12-24 09:42 - 00000000 ____D () C:\Users\Herrin
2014-11-18 13:44 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\system32\Msdtc
2014-11-18 13:43 - 2006-11-02 11:22 - 50331648 _____ () C:\Windows\system32\config\components_previous
2014-11-18 13:43 - 2006-11-02 11:22 - 39583744 _____ () C:\Windows\system32\config\software_previous
2014-11-18 13:43 - 2006-11-02 11:22 - 17825792 _____ () C:\Windows\system32\config\system_previous
2014-11-18 13:43 - 2006-11-02 11:22 - 00262144 _____ () C:\Windows\system32\config\security_previous
2014-11-18 13:43 - 2006-11-02 11:22 - 00262144 _____ () C:\Windows\system32\config\default_previous
2014-11-18 13:43 - 2006-11-02 11:22 - 00061440 _____ () C:\Windows\system32\config\sam_previous
2014-11-18 13:42 - 2008-12-25 09:38 - 00000000 ____D () C:\Users\Herrin\AppData\Roaming\vlc
2014-11-18 13:42 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\system32\spool
2014-11-18 13:42 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\registration
2014-11-17 22:09 - 2008-12-24 23:16 - 00000000 ____D () C:\Users\Herrin\AppData\Roaming\Mozilla
2014-11-17 19:33 - 2009-08-22 21:27 - 00000000 ____D () C:\Program Files\Mobile Partner
2014-11-16 20:45 - 2010-08-02 14:21 - 00000000 ____D () C:\Program Files\Java
2014-11-16 20:29 - 2008-12-25 09:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2014-11-16 20:19 - 2008-12-24 11:39 - 00000000 ____D () C:\Users\Herrin\AppData\Local\Adobe
2014-11-16 19:35 - 2011-03-13 20:56 - 00000000 ____D () C:\Program Files\Common Files\Adobe
2014-11-16 19:35 - 2008-12-24 11:38 - 00000000 ____D () C:\ProgramData\Adobe
2014-11-16 19:27 - 2011-05-13 05:53 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-11-16 19:15 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\system32\LogFiles
2014-11-16 12:30 - 2008-12-25 09:41 - 00000000 ____D () C:\Users\Herrin\Desktop\Büro
2014-11-14 21:52 - 2012-02-16 20:28 - 00000000 ____D () C:\temp
2014-11-14 18:34 - 2006-11-02 13:35 - 00000000 ____D () C:\Program Files\Windows Sidebar
2014-11-14 14:38 - 2009-05-17 00:15 - 00000000 ____D () C:\Users\Herrin\AppData\Local\Google
2014-11-14 14:37 - 2009-05-17 00:14 - 00000000 ____D () C:\Program Files\Google
2014-11-14 14:03 - 2011-12-15 23:36 - 00000000 ____D () C:\Users\Herrin\AppData\Roaming\Skype
2014-11-13 19:33 - 2006-11-02 12:18 - 00000000 __RHD () C:\Users\Default
2014-11-13 19:33 - 2006-11-02 12:18 - 00000000 ___RD () C:\Users\Public
2014-11-13 19:17 - 2006-11-02 11:23 - 00000215 _____ () C:\Windows\system.ini
2014-11-13 09:49 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\rescache
2014-11-13 09:01 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-11-13 08:44 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\system32\de-DE
2014-11-13 03:08 - 2006-11-02 11:24 - 100445232 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-11-12 22:25 - 2010-07-03 07:33 - 00000000 ____D () C:\ProgramData\ICQ
2014-11-12 19:44 - 2008-12-24 09:42 - 00001356 _____ () C:\Users\Herrin\AppData\Local\d3d9caps.dat
2014-11-07 09:42 - 2012-02-20 18:54 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-11-06 23:25 - 2012-02-20 18:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-11-06 13:37 - 2006-11-02 13:35 - 00000000 ____D () C:\Program Files\Windows Journal
2014-11-06 13:36 - 2006-11-02 13:35 - 00000000 ____D () C:\Windows\system32\XPSViewer
2014-11-06 09:03 - 2006-11-02 16:46 - 00000000 ____D () C:\Windows\system32\Drivers\de-DE
2014-11-05 13:07 - 2009-11-11 20:02 - 00000000 ____D () C:\Program Files\Yahoo!
2014-11-05 12:55 - 2012-02-19 18:42 - 00000000 ____D () C:\ProgramData\Yahoo!
2014-11-04 14:30 - 2009-11-17 20:16 - 00229000 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-11-25 17:41
==================== End Of Log ============================
--- --- --- Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 23-11-2014
Ran by Herrin at 2014-11-25 20:18:38
Running from C:\Users\Herrin\Desktop\Sicherheit
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
FW: avast! Antivirus (Enabled) {2F96FC65-F07D-9D1E-5A6E-3DA5C487EAF0}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Flash Player 15 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 15.0.0.223 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 15.0.0.223 - Adobe Systems Incorporated)
Adobe Reader 9.5.5 - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-A95000000001}) (Version: 9.5.5 - Adobe Systems Incorporated)
Avast Internet Security (HKLM\...\Avast) (Version: 10.0.2208 - AVAST Software)
CCleaner (HKLM\...\CCleaner) (Version: 3.11 - Piriform)
Defraggler (HKLM\...\Defraggler) (Version: 2.18 - Piriform)
Dropbox (HKU\S-1-5-21-2708201434-1965334668-4040377041-1000\...\Dropbox) (Version: 2.10.52 - Dropbox, Inc.)
DVD Shrink 3.1.4 (HKLM\...\DVD Shrink_is1) (Version: - DVD Shrink)
GIMP 2.8.14 (HKLM\...\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team)
Google Chrome (HKLM\...\Google Chrome) (Version: 39.0.2171.65 - Google Inc.)
Google Earth (HKLM\...\{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}) (Version: 6.1.0.5001 - Google)
Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden
Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: - )
Java(TM) 6 Update 20 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83216020FF}) (Version: 6.0.200 - Sun Microsystems, Inc.)
LMMS 1.0.3 (HKLM\...\LMMS) (Version: 1.0.3 - LMMS Developers)
Malwarebytes Anti-Malware Version 2.0.3.1025 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.3.1025 - Malwarebytes Corporation)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version: - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office XP Professional mit FrontPage (HKLM\...\{90280407-6000-11D3-8CFE-0050048383C9}) (Version: 10.0.2701.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 33.1 (x86 de) (HKLM\...\Mozilla Firefox 33.1 (x86 de)) (Version: 33.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 33.1 - Mozilla)
Picasa 3 (HKLM\...\Picasa 3) (Version: 3.8 - Google, Inc.)
QuickTime (HKLM\...\QuickTime) (Version: - )
Revo Uninstaller 1.95 (HKLM\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Spelling Dictionaries Support For Adobe Reader 9 (HKLM\...\{AC76BA86-7AD7-5464-3428-900000000004}) (Version: 9.0.0 - Adobe Systems Incorporated)
SpywareBlaster 5.0 (HKLM\...\SpywareBlaster_is1) (Version: 5.0.0 - BrightFort LLC)
VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)
Webocton - Scriptly 0.8.95.6 (HKLM\...\Webocton - Scriptly_is1) (Version: 0.8.95.6 - Webocton)
WinPatrol (HKLM\...\{6A206A04-6BC1-411B-AA04-4E52EDEEADF2}) (Version: 32.0.2014.5 - Ruiware)
Yahoo! Software Update (HKLM\...\Yahoo! Software Update) (Version: - )
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-2708201434-1965334668-4040377041-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Herrin\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2708201434-1965334668-4040377041-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Herrin\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2708201434-1965334668-4040377041-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Herrin\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2708201434-1965334668-4040377041-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Herrin\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2708201434-1965334668-4040377041-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Herrin\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2708201434-1965334668-4040377041-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Herrin\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2708201434-1965334668-4040377041-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Herrin\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2708201434-1965334668-4040377041-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Herrin\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
==================== Restore Points =========================
18-11-2014 21:31:04 Revo Uninstaller's restore point - GIMP 2.8.14
19-11-2014 18:32:13 Geplanter Prüfpunkt
20-11-2014 02:00:23 Windows Update
20-11-2014 14:12:47 Revo Uninstaller's restore point - WinPatrol
21-11-2014 22:01:05 Geplanter Prüfpunkt
22-11-2014 17:30:44 Geplanter Prüfpunkt
23-11-2014 03:24:49 Removed Skype™ 6.11
24-11-2014 05:12:24 Geplanter Prüfpunkt
24-11-2014 20:26:51 Geplanter Prüfpunkt
25-11-2014 17:00:26 Windows Update
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2006-11-02 11:23 - 2014-11-13 19:11 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {22D776E8-92AC-41F3-865C-0661FA2EFFDD} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-11-14] (AVAST Software)
Task: {75194B80-6BF9-4D8F-B1E6-15F8DDD6DD3A} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-11-05] (Google Inc.)
Task: {87BE7DD4-F78D-4FE1-8589-5591305A7A9F} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-11-16] (Adobe Systems Incorporated)
Task: {CE973C16-5E83-49E7-A9A8-C1E7F965B1D9} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-11-05] (Google Inc.)
Task: {F5CC19B5-4CE1-45AB-AFBA-C39033771C4C} - System32\Tasks\{D998DDF7-BDDF-4B9B-BB67-F7F3D6D35605} => C:\Program Files\Skype\Phone\Skype.exe
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2014-11-25 10:35 - 2014-11-25 10:35 - 02903552 _____ () C:\Program Files\AVAST Software\Avast\defs\14112500\algo.dll
2014-11-14 18:35 - 2014-11-14 18:35 - 38562088 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2008-12-24 11:09 - 2007-06-26 15:55 - 00249856 _____ () C:\Windows\system32\igfxTMM.dll
2014-11-21 02:03 - 2014-11-14 22:15 - 09009480 _____ () C:\Program Files\Google\Chrome\Application\39.0.2171.65\pdf.dll
2014-11-21 02:02 - 2014-11-14 22:15 - 01677128 _____ () C:\Program Files\Google\Chrome\Application\39.0.2171.65\ffmpegsumo.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\ProgramData\TEMP:5C321E34
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
========================= Accounts: ==========================
Administrator (S-1-5-21-2708201434-1965334668-4040377041-500 - Administrator - Disabled)
Gast (S-1-5-21-2708201434-1965334668-4040377041-501 - Limited - Disabled)
Herrin (S-1-5-21-2708201434-1965334668-4040377041-1000 - Administrator - Enabled) => C:\Users\Herrin
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (11/22/2014 05:12:23 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\HERRIN\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\P3IKZU2D\ZZZZZZZZZZZ.ZZZ> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (11/22/2014 05:12:23 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\HERRIN\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\8WAE1SP4\ZZZZZZZZZZZZZZZZZ.ZZZ> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (11/22/2014 05:12:23 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\HERRIN\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\8WAE1SP4\ZZZZZZZZZZZZ.ZZZ> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (11/22/2014 05:12:22 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\HERRIN\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\N0CFJ5ZN\ZZZZZZZZZZZZ.ZZZ> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (11/22/2014 05:12:22 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\HERRIN\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\8WAE1SP4\ZZZZZZZZZZ.ZZZ> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (11/22/2014 05:12:22 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\HERRIN\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\8WAE1SP4\ZZZZZZZZ.ZZZ> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (11/22/2014 05:12:22 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\HERRIN\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\N0CFJ5ZN\ZZZZ.ZZZ> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (11/22/2014 05:12:22 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\HERRIN\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\8WAE1SP4\ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ.ZZZ> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (11/22/2014 05:12:21 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\HERRIN\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\8WAE1SP4\ZZZZZZZZZZ.ZZZ> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (11/22/2014 05:12:21 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\HERRIN\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\8WAE1SP4\ZZZZZZZZZZZZZZ.ZZZ> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
System errors:
=============
Error: (11/25/2014 06:14:43 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: 0x80070643Definition Update for Windows Defender - KB915597 (Definition 1.189.620.0){D72D73DA-DB87-4FF8-B61E-675837A91548}200
Error: (11/25/2014 05:53:24 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {752073A1-23F2-4396-85F0-8FDB879ED0ED}
Error: (11/25/2014 11:51:22 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {C2BFE331-6739-4270-86C9-493D9A04CD38}
Error: (11/23/2014 10:23:53 PM) (Source: Server) (EventID: 2505) (User: )
Description: Aufgrund eines doppelten Netzwerknamens konnte zu der Transportschicht \Device\NetBT_Tcpip_{D7843502-9177-48BB-BEA0-98A833E831F7} vom Serverdienst nicht gebunden werden. Der Serverdienst konnte nicht gestartet werden.
Error: (11/23/2014 06:25:22 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {C2BFE331-6739-4270-86C9-493D9A04CD38}
Error: (11/22/2014 07:19:58 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {C2BFE331-6739-4270-86C9-493D9A04CD38}
Error: (11/21/2014 04:54:49 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
Error: (11/21/2014 04:52:06 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: 0x80070643Definition Update for Windows Defender - KB915597 (Definition 1.189.400.0){F12EA978-53CA-4097-8C10-0F88C6BA17CE}200
Error: (11/21/2014 03:49:35 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: Windows Update
Error: (11/21/2014 05:10:55 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {C2BFE331-6739-4270-86C9-493D9A04CD38}
Microsoft Office Sessions:
=========================
Error: (11/22/2014 05:12:23 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
C:\USERS\HERRIN\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\P3IKZU2D\ZZZZZZZZZZZ.ZZZ
Error: (11/22/2014 05:12:23 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
C:\USERS\HERRIN\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\8WAE1SP4\ZZZZZZZZZZZZZZZZZ.ZZZ
Error: (11/22/2014 05:12:23 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
C:\USERS\HERRIN\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\8WAE1SP4\ZZZZZZZZZZZZ.ZZZ
Error: (11/22/2014 05:12:22 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
C:\USERS\HERRIN\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\N0CFJ5ZN\ZZZZZZZZZZZZ.ZZZ
Error: (11/22/2014 05:12:22 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
C:\USERS\HERRIN\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\8WAE1SP4\ZZZZZZZZZZ.ZZZ
Error: (11/22/2014 05:12:22 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
C:\USERS\HERRIN\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\8WAE1SP4\ZZZZZZZZ.ZZZ
Error: (11/22/2014 05:12:22 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
C:\USERS\HERRIN\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\N0CFJ5ZN\ZZZZ.ZZZ
Error: (11/22/2014 05:12:22 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
C:\USERS\HERRIN\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\8WAE1SP4\ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ.ZZZ
Error: (11/22/2014 05:12:21 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
C:\USERS\HERRIN\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\8WAE1SP4\ZZZZZZZZZZ.ZZZ
Error: (11/22/2014 05:12:21 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
C:\USERS\HERRIN\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\8WAE1SP4\ZZZZZZZZZZZZZZ.ZZZ
CodeIntegrity Errors:
===================================
Date: 2014-11-25 20:18:10.519
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-11-25 20:18:09.415
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-11-25 20:18:08.372
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-11-25 20:18:07.258
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-11-25 20:18:05.190
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-11-25 20:18:04.122
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-11-25 20:18:03.021
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-11-25 20:18:01.928
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-11-24 07:10:49.963
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-11-24 07:10:48.949
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Processor: Intel(R) Core(TM)2 Duo CPU T7500 @ 2.20GHz
Percentage of memory in use: 87%
Total physical RAM: 1013.63 MB
Available physical RAM: 127.2 MB
Total Pagefile: 2490.95 MB
Available Pagefile: 1102.67 MB
Total Virtual: 2047.88 MB
Available Virtual: 1930.44 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:74.53 GB) (Free:31.16 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 74.5 GB) (Disk ID: 23F12D67)
Partition 1: (Active) - (Size=74.5 GB) - (Type=07 NTFS)
==================== End Of Log ============================
|
|
26.11.2014, 21:09
| #24 |
| /// the machine /// TB-Ausbilder | Windows Vista: Adware und anderes Zeugs Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:52644;https=127.0.0.1:52644;
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
HKU\S-1-5-21-2708201434-1965334668-4040377041-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Nochmal ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
27.11.2014, 21:25
| #25 |
| | Windows Vista: Adware und anderes Zeugs FRST.exe wurde von Avast als Bedrohung erkannt und in den Container verschoben?! |
|
28.11.2014, 18:18
| #26 |
| /// the machine /// TB-Ausbilder | Windows Vista: Adware und anderes Zeugs Avast is doof. Avast aus, FRST neu laden und Fix durchführen.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
30.11.2014, 10:59
| #27 |
| | Windows Vista: Adware und anderes Zeugs Hat leider etwas gedauert, war die Tage nicht hier. Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 26-11-2014 01
Ran by Herrin at 2014-11-30 10:52:50 Run:3
Running from C:\Users\Herrin\Desktop\Sicherheit
Loaded Profile: Herrin (Available profiles: Herrin)
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:52644;https=127.0.0.1:52644;
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
HKU\S-1-5-21-2708201434-1965334668-4040377041-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
*****************
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable => value deleted successfully.
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => value deleted successfully.
"HKLM\SOFTWARE\Policies\Google" => Key deleted successfully.
"HKU\S-1-5-21-2708201434-1965334668-4040377041-1000\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.
==== End of Fixlog ====
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 26-11-2014 01
Ran by Herrin (administrator) on HERRIN-PC on 30-11-2014 10:29:11
Running from C:\Users\Herrin\Desktop\Sicherheit
Loaded Profile: Herrin (Available profiles: Herrin)
Platform: Microsoft® Windows Vista™ Ultimate Service Pack 2 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 8
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\afwServ.exe
(Yahoo! Inc.) C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Webocton) C:\Users\Herrin\Webocton - Scriptly\webocton_scriptly.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5225064 2014-11-14] (AVAST Software)
HKLM\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [41056 2013-05-08] (Adobe Systems Incorporated)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKU\S-1-5-21-2708201434-1965334668-4040377041-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation)
HKU\S-1-5-21-2708201434-1965334668-4040377041-1000\...\Run: [WMPNSCFG] => C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-19] (Microsoft Corporation)
HKU\S-1-5-21-2708201434-1965334668-4040377041-1000\...\Run: [WinPatrol] => C:\Users\Herrin\Desktop\Sicherheit\winpatrol.exe -expressboot
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk
ShortcutTarget: Microsoft Office.lnk -> C:\Program Files\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software)
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:52644;https=127.0.0.1:52644;
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-2708201434-1965334668-4040377041-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-2708201434-1965334668-4040377041-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.yahoo.com/?fr=mkg029
URLSearchHook: HKLM - Default Value = {855F3B16-6D32-4fe6-8A56-BBB695989046}
URLSearchHook: HKLM - (No Name) - {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - No File
HKU\S-1-5-21-2708201434-1965334668-4040377041-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
SearchScopes: HKLM -> DefaultScope {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL =
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search
SearchScopes: HKU\S-1-5-21-2708201434-1965334668-4040377041-1000 -> DefaultScope {2AEA96DD-CC4B-45F3-97D0-65FBC2888F47} URL = https://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-2708201434-1965334668-4040377041-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search
SearchScopes: HKU\S-1-5-21-2708201434-1965334668-4040377041-1000 -> {2AEA96DD-CC4B-45F3-97D0-65FBC2888F47} URL = https://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-2708201434-1965334668-4040377041-1000 -> {4F6CF4C1-C88D-44C8-97FB-821F288D0212} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=vc_trans_8140&type=foxysecurity
SearchScopes: HKU\S-1-5-21-2708201434-1965334668-4040377041-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={sear
BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Herrin\AppData\Roaming\Mozilla\Firefox\Profiles\apekw9zh.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_223.dll ()
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin: @java.com/DTPlugin -> C:\Program Files\Java\jre6\bin\npDeployJava1.dll (Sun Microsystems, Inc.)
FF Plugin: @java.com/JavaPlugin -> C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: Adblock Plus - C:\Users\Herrin\AppData\Roaming\Mozilla\Firefox\Profiles\apekw9zh.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-11-19]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-12-29]
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-11-14]
FF Extension: No Name - wrc@avast.com [Not Found]
Chrome:
=======
CHR HomePage: Default -> https://www.google.de/
CHR Profile: C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-11-14]
CHR Extension: (Google Docs) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-11-14]
CHR Extension: (Google Drive) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-11-14]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-11-14]
CHR Extension: (WOT) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bhmmomiinigofkjcapegjjndpbikblnp [2014-11-17]
CHR Extension: (YouTube) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-11-14]
CHR Extension: (Google Search) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-11-14]
CHR Extension: (Google Sheets) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-11-14]
CHR Extension: (AdBlock) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-11-15]
CHR Extension: (Avast Online Security) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-11-14]
CHR Extension: (Google Wallet) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-11-14]
CHR Extension: (NotScripts) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\odjhifogjcknibkahlpidmdajjpkkcfn [2014-11-17]
CHR Extension: (Gmail) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-11-14]
CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-11-14]
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-11-14] (AVAST Software)
R2 avast! Firewall; C:\Program Files\AVAST Software\Avast\afwServ.exe [104416 2014-11-14] (AVAST Software)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [24184 2014-11-14] ()
R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [26136 2014-11-14] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [70384 2014-11-14] (AVAST Software)
R0 aswNdis; C:\Windows\System32\DRIVERS\aswNdis.sys [12112 2014-11-14] (ALWIL Software)
R0 aswNdis2; C:\Windows\system32\Drivers\aswNdis2.sys [253640 2014-11-14] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr.sys [55240 2014-11-14] (AVAST Software)
R0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [49944 2014-11-14] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [787800 2014-11-14] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [422760 2014-11-14] (AVAST Software)
R1 aswTdi; C:\Windows\system32\drivers\aswTdi.sys [57928 2014-11-14] (AVAST Software)
R0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [206248 2014-11-14] ()
S3 PROCEXP113; C:\Windows\system32\Drivers\PROCEXP113.SYS [12568 2014-11-13] (Sysinternals - www.sysinternals.com) [File not signed]
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-11-30 07:43 - 2014-11-30 07:43 - 00000887 _____ () C:\Users\Herrin\AppData\Local\recently-used.xbel
2014-11-28 11:06 - 2014-11-28 11:06 - 00000104 _____ () C:\Users\Herrin\Desktop\Papierkorb - Verknüpfung.lnk
2014-11-28 02:35 - 2014-11-28 02:35 - 00000000 ____D () C:\Users\Herrin\.thumbnails
2014-11-27 22:31 - 2014-11-27 07:16 - 00981504 _____ () C:\Users\Herrin\Documents\~WRL1067.tmp
2014-11-24 07:23 - 2014-11-24 07:23 - 00001576 _____ () C:\Windows\PFRO.log
2014-11-23 22:41 - 2014-11-23 22:41 - 00055088 _____ () C:\Users\Herrin\AppData\Local\GDIPFONTCACHEV1.DAT
2014-11-23 20:58 - 2014-11-23 20:59 - 08676128 _____ (Microsoft Corporation) C:\Users\Herrin\Downloads\Windows7UpgradeAdvisorSetup.exe
2014-11-23 20:09 - 2014-11-23 20:09 - 00000000 ____D () C:\Users\Herrin\AppData\Local\Macromedia
2014-11-22 16:12 - 2014-11-22 16:13 - 00250352 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-11-22 03:20 - 2014-11-30 07:43 - 00000000 ____D () C:\Users\Herrin\AppData\Local\gtk-2.0
2014-11-21 00:55 - 2014-11-21 00:55 - 00000000 ____D () C:\Users\Herrin\AppData\Local\webkit
2014-11-20 15:38 - 2014-11-20 15:38 - 00000000 ____D () C:\Program Files\VS Revo Group
2014-11-20 15:27 - 2014-11-20 15:27 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware
2014-11-20 15:19 - 2014-11-20 15:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinPatrol
2014-11-20 15:19 - 2014-11-20 15:19 - 00000000 ____D () C:\ProgramData\InstallMate
2014-11-20 15:19 - 2014-11-20 15:19 - 00000000 ____D () C:\Program Files\Ruiware
2014-11-20 03:03 - 2014-10-24 02:03 - 00499200 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-11-19 17:15 - 2014-11-19 17:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpywareBlaster
2014-11-19 17:15 - 2014-11-19 17:15 - 00000000 ____D () C:\ProgramData\Licenses
2014-11-19 17:01 - 2014-11-19 17:01 - 00000000 ____D () C:\Users\Herrin\AppData\Roaming\WinPatrol
2014-11-19 16:13 - 2014-11-30 10:29 - 00000000 ____D () C:\FRST
2014-11-18 23:02 - 2014-11-30 07:47 - 00000000 ____D () C:\Users\Herrin\.gimp-2.8
2014-11-18 23:01 - 2014-11-18 23:02 - 00000834 _____ () C:\Users\Herrin\Desktop\Gimp 2.8.lnk
2014-11-18 22:49 - 2014-11-18 22:49 - 00000842 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GIMP 2.lnk
2014-11-18 22:38 - 2014-11-18 22:47 - 00000000 ____D () C:\Program Files\GIMP 2
2014-11-18 17:51 - 2014-11-11 20:04 - 00979456 _____ () C:\Users\Herrin\Documents\~WRL2275.tmp
2014-11-18 15:16 - 2014-11-18 15:16 - 00001662 _____ () C:\Users\Public\Desktop\Defraggler.lnk
2014-11-18 15:12 - 2014-11-18 15:17 - 00000000 ____D () C:\Program Files\Defraggler
2014-11-17 19:32 - 2014-11-18 13:44 - 00000000 ____D () C:\ProgramData\DataCardService
2014-11-17 19:32 - 2014-11-17 19:33 - 00000000 ____D () C:\ProgramData\Mobile Partner
2014-11-17 15:51 - 2014-11-17 15:53 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Mozilla
2014-11-17 15:51 - 2014-11-17 15:51 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Mozilla
2014-11-17 15:49 - 2014-11-17 15:49 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\AVAST Software
2014-11-17 15:49 - 2014-11-17 15:49 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Adobe
2014-11-17 15:48 - 2014-11-17 15:48 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Google
2014-11-17 15:46 - 2014-11-18 13:44 - 00000000 ____D () C:\Users\Administrator
2014-11-17 00:56 - 2014-11-17 01:04 - 00000000 ____D () C:\AdwCleaner
2014-11-17 00:42 - 2014-11-17 00:42 - 00000000 ____D () C:\Users\Herrin\AppData\Local\Secunia PSI
2014-11-17 00:32 - 2014-11-26 05:31 - 00000000 ____D () C:\ProgramData\TEMP
2014-11-17 00:32 - 2014-11-18 13:03 - 00000000 ____D () C:\Program Files\SpywareBlaster
2014-11-16 23:17 - 2014-11-16 23:35 - 00000972 _____ () C:\DelFix.txt
2014-11-16 20:52 - 2014-11-16 20:52 - 00000000 ____D () C:\Program Files\Common Files\Java
2014-11-16 20:48 - 2014-11-16 20:48 - 00000000 ____D () C:\ProgramData\Oracle
2014-11-16 20:21 - 2014-11-16 20:22 - 00638888 _____ (Oracle Corporation) C:\Users\Herrin\Desktop\chromeinstall-8u25.exe
2014-11-16 19:35 - 2014-11-16 19:39 - 00002425 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader 9.lnk
2014-11-16 19:25 - 2014-11-30 09:56 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-11-16 19:24 - 2014-11-16 19:27 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-11-16 01:42 - 2014-11-16 01:42 - 00000000 ____D () C:\Users\Herrin\AppData\Local\fontconfig
2014-11-16 01:41 - 2014-11-16 01:41 - 00000000 ____D () C:\Users\Herrin\AppData\Local\gegl-0.2
2014-11-15 17:33 - 2014-11-15 17:33 - 00000806 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-11-15 17:32 - 2014-11-15 17:33 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-11-15 17:32 - 2014-11-15 17:32 - 00000000 ____D () C:\ProgramData\Mozilla
2014-11-15 17:32 - 2014-11-15 17:32 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-11-14 22:23 - 2007-06-26 15:57 - 00192512 _____ (Intel Corporation) C:\Windows\system32\igfxres.dll
2014-11-14 22:05 - 2014-11-16 23:17 - 00000000 ____D () C:\Windows\ERUNT
2014-11-14 20:44 - 2014-11-26 04:11 - 00114904 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-11-14 20:42 - 2014-11-20 15:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-11-14 20:41 - 2014-11-14 20:41 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-11-14 20:41 - 2014-10-01 11:11 - 00075480 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-11-14 20:41 - 2014-10-01 11:11 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-11-14 20:41 - 2014-10-01 11:11 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-11-14 19:18 - 2014-11-14 19:18 - 00001837 _____ () C:\Users\Public\Desktop\Avast Internet Security.lnk
2014-11-14 19:13 - 2014-11-14 19:12 - 00026136 _____ (AVAST Software) C:\Windows\system32\Drivers\aswKbd.sys
2014-11-14 19:13 - 2014-11-14 19:11 - 00253640 _____ (AVAST Software) C:\Windows\system32\Drivers\aswNdis2.sys
2014-11-14 19:13 - 2014-11-14 18:35 - 00291352 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-11-14 19:11 - 2014-11-14 19:11 - 00012112 _____ (ALWIL Software) C:\Windows\system32\Drivers\aswNdis.sys
2014-11-14 19:07 - 2014-11-14 19:07 - 00000000 ____D () C:\Program Files\Dropbox
2014-11-14 19:05 - 2014-11-14 19:05 - 00000000 ____D () C:\Users\Herrin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-11-14 18:54 - 2014-11-14 19:08 - 00000000 ____D () C:\Users\Herrin\AppData\Roaming\Dropbox
2014-11-14 18:40 - 2014-11-14 18:40 - 00000000 ____D () C:\Users\Herrin\AppData\Roaming\AVAST Software
2014-11-14 18:39 - 2014-11-14 19:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2014-11-14 18:36 - 2014-11-14 18:36 - 00422760 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2014-11-14 18:36 - 2014-11-14 18:36 - 00206248 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-11-14 18:36 - 2014-11-14 18:36 - 00070384 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-11-14 18:36 - 2014-11-14 18:36 - 00057928 _____ (AVAST Software) C:\Windows\system32\Drivers\aswTdi.sys
2014-11-14 18:36 - 2014-11-14 18:36 - 00055240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr.sys
2014-11-14 18:36 - 2014-11-14 18:36 - 00049944 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-11-14 18:36 - 2014-11-14 18:36 - 00024184 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2014-11-14 18:36 - 2014-11-14 18:34 - 00787800 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2014-11-14 18:35 - 2014-11-14 18:35 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-11-14 18:31 - 2014-11-14 18:31 - 00000000 ____D () C:\Program Files\AVAST Software
2014-11-14 18:20 - 2014-11-14 18:31 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-11-14 14:37 - 2014-11-26 19:37 - 00001923 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-11-14 14:37 - 2014-11-14 14:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-11-13 20:10 - 2014-11-30 10:29 - 00000000 ____D () C:\Users\Herrin\Desktop\Sicherheit
2014-11-13 19:33 - 2014-11-13 19:33 - 00012568 _____ (Sysinternals - www.sysinternals.com) C:\Windows\system32\Drivers\PROCEXP113.SYS
2014-11-13 18:01 - 2014-11-13 19:22 - 00000000 ____D () C:\Windows\erdnt
2014-11-13 03:32 - 2014-10-10 02:01 - 00449536 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2014-11-13 03:32 - 2014-10-10 02:00 - 01259008 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-11-13 03:32 - 2014-10-10 02:00 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2014-11-13 03:32 - 2014-10-10 00:22 - 00619520 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2014-11-13 03:31 - 2014-08-27 01:55 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-11-13 03:31 - 2014-08-27 01:55 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-11-13 03:29 - 2014-10-24 02:04 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-11-13 03:29 - 2014-09-19 01:50 - 00278528 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-11-13 03:28 - 2014-08-12 03:25 - 00729600 _____ (Microsoft Corporation) C:\Windows\system32\IMJP10K.DLL
2014-11-13 03:23 - 2014-10-18 02:08 - 00564224 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2014-11-13 03:23 - 2014-10-03 02:18 - 00274432 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2014-11-13 03:23 - 2014-10-03 02:17 - 00396800 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2014-11-13 03:23 - 2014-10-03 02:17 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2014-11-13 03:23 - 2014-10-03 02:17 - 00170496 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2014-11-13 03:04 - 2014-10-13 00:34 - 02054656 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-11-12 18:40 - 2014-11-12 18:40 - 00000000 ____D () C:\Users\Herrin\AppData\Roaming\AdvancedSystemProtector
2014-11-12 18:27 - 2014-11-12 18:27 - 00000000 ____D () C:\Users\Herrin\AppData\Roaming\dlg
2014-11-12 11:16 - 2014-10-31 08:17 - 06004736 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 11082752 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 02006016 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 01469440 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-11-12 11:15 - 2014-10-31 08:17 - 01214976 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 00916992 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 00630784 _____ (Microsoft Corporation) C:\Windows\system32\mstime.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 00630272 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 00387584 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 00164352 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-11-12 11:15 - 2014-10-31 08:16 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\corpol.dll
2014-11-12 11:15 - 2014-10-31 03:37 - 00385024 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2014-11-12 11:15 - 2014-10-31 03:30 - 00174080 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-11-12 11:15 - 2014-10-31 03:30 - 00133632 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-11-12 11:15 - 2014-10-31 03:29 - 01638912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-11-12 11:15 - 2014-10-31 03:29 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-11-10 12:08 - 2014-11-10 12:08 - 00000000 ____D () C:\Users\Herrin\AppData\Roaming\Daichi
2014-11-10 10:28 - 2014-11-18 13:42 - 00000000 ____D () C:\Users\Herrin\Desktop\Sounds
2014-11-09 21:38 - 2014-11-09 21:38 - 00000000 ____D () C:\Program Files\Common Files\Avid
2014-11-09 21:28 - 2014-11-09 22:01 - 00000000 ____D () C:\Program Files\Common Files\VST3
2014-11-07 20:49 - 2014-11-07 20:49 - 00000000 ____D () C:\Users\Herrin\Documents\CabraProjects
2014-11-07 20:48 - 2014-11-07 20:49 - 00678093 _____ () C:\Users\Herrin\Desktop\Cabra_0.7.0.jar
2014-11-06 18:04 - 2014-11-06 18:04 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
2014-11-06 14:41 - 2012-11-22 04:54 - 00353280 _____ (Microsoft Corporation) C:\Windows\system32\shlwapi.dll
2014-11-06 14:35 - 2014-11-06 14:35 - 00000000 ____D () C:\Users\Herrin\AppData\Local\AviraSpeedup
2014-11-06 13:20 - 2014-06-26 23:17 - 00619664 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2014-11-06 13:20 - 2014-06-26 23:17 - 00099480 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2014-11-06 13:20 - 2014-06-26 23:17 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2014-11-06 13:19 - 2014-06-06 05:28 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-11-06 13:16 - 2014-06-15 23:18 - 01131664 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll
2014-11-06 13:16 - 2014-06-13 19:22 - 00156824 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll
2014-11-06 13:16 - 2014-06-13 19:22 - 00081560 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll
2014-11-06 12:52 - 2014-09-09 07:24 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-11-06 12:22 - 2014-08-23 02:03 - 00297984 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-11-06 11:44 - 2012-11-08 04:48 - 01314816 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
2014-11-06 11:10 - 2014-11-13 03:23 - 00000000 ____D () C:\Windows\system32\MRT
2014-11-05 21:45 - 2014-11-05 21:45 - 00000000 ____D () C:\e1bf55fb68ca2ff1452d
2014-11-05 21:44 - 2014-09-05 00:27 - 00143360 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fastfat.sys
2014-11-05 21:41 - 2012-07-26 03:46 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\Wdfres.dll
2014-11-05 21:41 - 2012-06-02 15:57 - 00000003 _____ () C:\Windows\system32\Drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf
2014-11-05 21:40 - 2012-07-26 04:39 - 00047720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdfLdr.sys
2014-11-05 21:40 - 2012-07-26 04:21 - 00196608 _____ (Microsoft Corporation) C:\Windows\system32\WUDFHost.exe
2014-11-05 21:40 - 2012-07-26 04:20 - 00613888 _____ (Microsoft Corporation) C:\Windows\system32\WUDFx.dll
2014-11-05 21:40 - 2012-07-26 04:20 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\WUDFPlatform.dll
2014-11-05 21:40 - 2012-07-26 04:20 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\WUDFSvc.dll
2014-11-05 21:40 - 2012-07-26 04:20 - 00038912 _____ (Microsoft Corporation) C:\Windows\system32\WUDFCoinstaller.dll
2014-11-05 21:40 - 2012-07-26 03:33 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WUDFPf.sys
2014-11-05 21:40 - 2012-07-26 03:32 - 00155136 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WUDFRd.sys
2014-11-05 21:40 - 2009-07-14 13:12 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\winusb.dll
2014-11-05 16:58 - 2014-06-02 11:31 - 02263552 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-11-05 16:58 - 2014-06-02 11:31 - 00332800 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-11-05 16:58 - 2014-06-02 11:30 - 01993728 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-11-05 16:58 - 2014-06-02 11:30 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2014-11-05 16:58 - 2014-06-02 09:56 - 00082432 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2014-11-05 16:58 - 2014-04-26 17:01 - 00502784 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2014-11-05 16:58 - 2014-03-25 14:26 - 11587584 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-11-05 16:58 - 2013-08-27 03:47 - 01029120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll
2014-11-05 16:58 - 2013-08-27 03:47 - 00219648 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll
2014-11-05 16:58 - 2013-08-27 03:47 - 00189952 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll
2014-11-05 16:58 - 2013-08-27 03:47 - 00160768 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll
2014-11-05 16:58 - 2013-08-27 02:52 - 01172480 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-11-05 16:58 - 2013-08-27 02:50 - 00486400 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2014-11-05 16:58 - 2013-08-27 02:32 - 00683008 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2014-11-05 16:58 - 2013-08-27 02:28 - 01069056 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2014-11-05 16:58 - 2013-08-27 02:28 - 00798208 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2014-11-05 16:58 - 2013-06-15 14:22 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\icaapi.dll
2014-11-05 16:58 - 2013-06-15 12:23 - 00024064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2014-11-05 16:57 - 2014-04-05 03:42 - 00905664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-11-05 16:57 - 2013-12-22 16:42 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-11-05 16:57 - 2013-10-30 03:12 - 00335360 _____ (Microsoft Corporation) C:\Windows\system32\SysFxUI.dll
2014-11-05 16:57 - 2013-10-30 02:43 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmk.sys
2014-11-05 16:57 - 2013-10-30 01:43 - 00167936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys
2014-11-05 16:57 - 2013-07-20 11:44 - 00102608 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2014-11-05 16:57 - 2013-07-10 10:47 - 00783360 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2014-11-05 16:57 - 2012-11-02 11:18 - 00376320 _____ (Microsoft Corporation) C:\Windows\system32\dpnet.dll
2014-11-05 16:57 - 2012-11-02 09:26 - 00023040 _____ (Microsoft Corporation) C:\Windows\system32\dpnsvr.exe
2014-11-05 16:55 - 2014-06-14 01:44 - 00638400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-11-05 16:55 - 2014-06-14 01:33 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2014-11-05 16:55 - 2014-06-06 09:59 - 00506880 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-11-05 16:55 - 2012-08-21 12:47 - 00224640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\volsnap.sys
2014-11-05 16:53 - 2012-11-20 05:22 - 00204288 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2014-11-05 16:52 - 2013-10-11 03:08 - 00444928 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2014-11-05 16:52 - 2013-10-11 03:07 - 00596480 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2014-11-05 16:52 - 2013-10-11 01:39 - 00218228 _____ () C:\Windows\system32\WFP.TMF
2014-11-05 16:20 - 2014-05-30 07:53 - 00273408 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-11-05 16:20 - 2013-06-29 03:07 - 00226304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-11-05 16:20 - 2013-06-29 03:07 - 00197632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-11-05 16:20 - 2013-06-29 03:06 - 00006016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-11-05 16:20 - 2013-03-03 20:07 - 01082232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-11-05 16:20 - 2011-05-05 14:54 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-11-05 16:20 - 2011-05-05 14:54 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-11-05 16:19 - 2014-03-10 02:22 - 01401344 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2014-11-05 16:18 - 2014-11-27 23:44 - 00000000 ____D () C:\Users\Herrin\Desktop\Webdesign
2014-11-05 16:16 - 2014-11-05 16:16 - 00001596 _____ () C:\Users\Herrin\Desktop\Webocton - Scriptly.lnk
2014-11-05 16:16 - 2014-11-05 16:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Webocton - Scriptly
2014-11-05 16:15 - 2014-11-05 16:16 - 00000000 ____D () C:\Users\Herrin\Webocton - Scriptly
2014-11-05 16:15 - 2014-11-05 16:16 - 00000000 ____D () C:\Users\Herrin\AppData\Roaming\Webocton - Scriptly
2014-11-05 16:14 - 2013-05-02 05:04 - 00443904 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2014-11-05 16:14 - 2013-05-02 05:03 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\printcom.dll
2014-11-05 16:13 - 2013-07-09 13:10 - 01205168 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2014-11-05 16:13 - 2013-07-08 05:55 - 03603904 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2014-11-05 16:13 - 2013-07-08 05:55 - 03551680 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-11-05 16:13 - 2013-03-09 04:45 - 00049152 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2014-11-05 16:13 - 2013-03-09 02:28 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2014-11-05 16:13 - 2013-03-08 04:53 - 00376320 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2014-11-05 16:09 - 2014-11-29 07:45 - 00001472 _____ () C:\Users\Herrin\.lmmsrc.xml
2014-11-05 16:09 - 2014-11-05 16:09 - 00000726 _____ () C:\Users\Herrin\Desktop\LMMS.lnk
2014-11-05 16:08 - 2014-11-05 16:08 - 00000000 ____D () C:\Users\Herrin\lmms
2014-11-05 16:07 - 2013-10-11 03:08 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2014-11-05 16:07 - 2013-10-11 03:08 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx
2014-11-05 16:07 - 2013-10-11 03:08 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wshcon.dll
2014-11-05 16:07 - 2013-10-11 01:35 - 00155648 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe
2014-11-05 16:07 - 2013-10-11 01:35 - 00135168 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe
2014-11-05 16:07 - 2013-10-03 13:45 - 00993792 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2014-11-05 16:06 - 2014-11-05 16:07 - 00000000 ____D () C:\Program Files\LMMS
2014-11-05 16:06 - 2013-08-02 05:09 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2014-11-05 16:06 - 2013-04-24 05:00 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\certenc.dll
2014-11-05 16:06 - 2013-04-24 02:46 - 00812544 _____ (Microsoft Corporation) C:\Windows\system32\certutil.exe
2014-11-05 16:02 - 2014-11-05 16:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LMMS 1.0.3
2014-11-05 15:38 - 2014-02-06 02:56 - 00894464 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-11-05 15:38 - 2013-06-27 00:01 - 00527064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2014-11-05 15:37 - 2013-10-22 08:19 - 00158208 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2014-11-05 14:59 - 2013-07-16 05:35 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\themeui.dll
2014-11-05 14:58 - 2013-06-04 05:16 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2014-11-05 14:58 - 2013-06-04 02:49 - 00293376 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2014-11-05 14:57 - 2013-03-08 04:52 - 02067968 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-11-05 14:56 - 2013-07-04 05:21 - 00532480 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2014-11-05 14:07 - 2014-01-30 08:46 - 00876032 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
2014-11-05 13:17 - 2013-04-17 13:30 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\cryptdlg.dll
2014-11-05 13:16 - 2013-07-03 03:33 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbscan.sys
2014-11-05 13:16 - 2013-07-03 03:10 - 00025472 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2014-11-05 13:15 - 2013-02-12 02:57 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usb8023.sys
2014-11-05 13:14 - 2013-07-08 05:20 - 00172544 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2014-11-05 13:14 - 2013-07-08 05:16 - 00133120 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2014-11-05 13:14 - 2013-07-08 05:16 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2014-11-05 11:10 - 2012-09-25 17:19 - 00075776 _____ (Microsoft Corporation) C:\Windows\system32\synceng.dll
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-11-30 10:27 - 2010-07-09 14:57 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-11-30 09:54 - 2006-11-02 13:51 - 01514430 _____ () C:\Windows\WindowsUpdate.log
2014-11-30 09:44 - 2006-11-02 13:46 - 00003664 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-11-30 09:44 - 2006-11-02 13:46 - 00003664 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-11-29 21:47 - 2010-07-09 14:57 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-11-29 21:44 - 2006-11-02 14:00 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-11-29 09:51 - 2006-11-02 14:00 - 00032534 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-11-28 02:35 - 2008-12-24 09:42 - 00000000 ____D () C:\Users\Herrin
2014-11-24 14:04 - 2009-11-17 20:16 - 00229000 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-11-23 21:01 - 2006-11-02 11:33 - 01566310 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-11-23 04:29 - 2009-05-17 08:11 - 00000000 ____D () C:\ProgramData\Skype
2014-11-22 05:14 - 2009-03-29 11:59 - 00000000 ____D () C:\Windows\Minidump
2014-11-22 05:13 - 2012-01-08 10:26 - 00000000 __SHD () C:\Users\Herrin\UserData
2014-11-18 13:44 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\system32\Msdtc
2014-11-18 13:43 - 2006-11-02 11:22 - 50331648 _____ () C:\Windows\system32\config\components_previous
2014-11-18 13:43 - 2006-11-02 11:22 - 39583744 _____ () C:\Windows\system32\config\software_previous
2014-11-18 13:43 - 2006-11-02 11:22 - 17825792 _____ () C:\Windows\system32\config\system_previous
2014-11-18 13:43 - 2006-11-02 11:22 - 00262144 _____ () C:\Windows\system32\config\security_previous
2014-11-18 13:43 - 2006-11-02 11:22 - 00262144 _____ () C:\Windows\system32\config\default_previous
2014-11-18 13:43 - 2006-11-02 11:22 - 00061440 _____ () C:\Windows\system32\config\sam_previous
2014-11-18 13:42 - 2008-12-25 09:38 - 00000000 ____D () C:\Users\Herrin\AppData\Roaming\vlc
2014-11-18 13:42 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\system32\spool
2014-11-18 13:42 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\registration
2014-11-17 22:09 - 2008-12-24 23:16 - 00000000 ____D () C:\Users\Herrin\AppData\Roaming\Mozilla
2014-11-17 19:33 - 2009-08-22 21:27 - 00000000 ____D () C:\Program Files\Mobile Partner
2014-11-16 20:45 - 2010-08-02 14:21 - 00000000 ____D () C:\Program Files\Java
2014-11-16 20:29 - 2008-12-25 09:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2014-11-16 20:19 - 2008-12-24 11:39 - 00000000 ____D () C:\Users\Herrin\AppData\Local\Adobe
2014-11-16 19:35 - 2011-03-13 20:56 - 00000000 ____D () C:\Program Files\Common Files\Adobe
2014-11-16 19:35 - 2008-12-24 11:38 - 00000000 ____D () C:\ProgramData\Adobe
2014-11-16 19:27 - 2011-05-13 05:53 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-11-16 19:15 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\system32\LogFiles
2014-11-16 12:30 - 2008-12-25 09:41 - 00000000 ____D () C:\Users\Herrin\Desktop\Büro
2014-11-14 21:52 - 2012-02-16 20:28 - 00000000 ____D () C:\temp
2014-11-14 18:34 - 2006-11-02 13:35 - 00000000 ____D () C:\Program Files\Windows Sidebar
2014-11-14 14:38 - 2009-05-17 00:15 - 00000000 ____D () C:\Users\Herrin\AppData\Local\Google
2014-11-14 14:37 - 2009-05-17 00:14 - 00000000 ____D () C:\Program Files\Google
2014-11-14 14:03 - 2011-12-15 23:36 - 00000000 ____D () C:\Users\Herrin\AppData\Roaming\Skype
2014-11-13 19:33 - 2006-11-02 12:18 - 00000000 __RHD () C:\Users\Default
2014-11-13 19:33 - 2006-11-02 12:18 - 00000000 ___RD () C:\Users\Public
2014-11-13 19:17 - 2006-11-02 11:23 - 00000215 _____ () C:\Windows\system.ini
2014-11-13 09:49 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\rescache
2014-11-13 09:01 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-11-13 08:44 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\system32\de-DE
2014-11-13 03:08 - 2006-11-02 11:24 - 100445232 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-11-12 22:25 - 2010-07-03 07:33 - 00000000 ____D () C:\ProgramData\ICQ
2014-11-12 19:44 - 2008-12-24 09:42 - 00001356 _____ () C:\Users\Herrin\AppData\Local\d3d9caps.dat
2014-11-07 09:42 - 2012-02-20 18:54 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-11-06 23:25 - 2012-02-20 18:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-11-06 13:37 - 2006-11-02 13:35 - 00000000 ____D () C:\Program Files\Windows Journal
2014-11-06 13:36 - 2006-11-02 13:35 - 00000000 ____D () C:\Windows\system32\XPSViewer
2014-11-06 09:03 - 2006-11-02 16:46 - 00000000 ____D () C:\Windows\system32\Drivers\de-DE
2014-11-05 13:07 - 2009-11-11 20:02 - 00000000 ____D () C:\Program Files\Yahoo!
2014-11-05 12:55 - 2012-02-19 18:42 - 00000000 ____D () C:\ProgramData\Yahoo!
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-11-30 10:23
==================== End Of Log ============================
--- --- --- |
|
30.11.2014, 17:42
| #28 |
| /// the machine /// TB-Ausbilder | Windows Vista: Adware und anderes Zeugs Diese Proxy Dinger nerven langsam. FRST öffnen, Haken setzen bei Addition und scannen, poste bitte beide Logfiles.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
01.12.2014, 11:34
| #29 |
| | Windows Vista: Adware und anderes Zeugs Ähm, und was ist jetzt gemeint mit Proxy Dingern  [CODE]2 FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 01-12-2014
Ran by Herrin (administrator) on HERRIN-PC on 01-12-2014 11:19:15
Running from C:\Users\Herrin\Desktop\Sicherheit
Loaded Profile: Herrin (Available profiles: Herrin)
Platform: Microsoft® Windows Vista™ Ultimate Service Pack 2 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 8
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\afwServ.exe
(Yahoo! Inc.) C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
() C:\Program Files\LMMS\lmms.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5225064 2014-11-14] (AVAST Software)
HKLM\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [41056 2013-05-08] (Adobe Systems Incorporated)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKU\S-1-5-21-2708201434-1965334668-4040377041-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation)
HKU\S-1-5-21-2708201434-1965334668-4040377041-1000\...\Run: [WMPNSCFG] => C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-19] (Microsoft Corporation)
HKU\S-1-5-21-2708201434-1965334668-4040377041-1000\...\Run: [WinPatrol] => C:\Users\Herrin\Desktop\Sicherheit\winpatrol.exe -expressboot
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk
ShortcutTarget: Microsoft Office.lnk -> C:\Program Files\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software)
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:52644;https=127.0.0.1:52644;
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-2708201434-1965334668-4040377041-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-2708201434-1965334668-4040377041-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.yahoo.com/?fr=mkg029
URLSearchHook: HKLM - Default Value = {855F3B16-6D32-4fe6-8A56-BBB695989046}
URLSearchHook: HKLM - (No Name) - {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - No File
SearchScopes: HKLM -> DefaultScope {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL =
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search
SearchScopes: HKU\S-1-5-21-2708201434-1965334668-4040377041-1000 -> DefaultScope {2AEA96DD-CC4B-45F3-97D0-65FBC2888F47} URL = https://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-2708201434-1965334668-4040377041-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search
SearchScopes: HKU\S-1-5-21-2708201434-1965334668-4040377041-1000 -> {2AEA96DD-CC4B-45F3-97D0-65FBC2888F47} URL = https://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-2708201434-1965334668-4040377041-1000 -> {4F6CF4C1-C88D-44C8-97FB-821F288D0212} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=vc_trans_8140&type=foxysecurity
SearchScopes: HKU\S-1-5-21-2708201434-1965334668-4040377041-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={sear
BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Herrin\AppData\Roaming\Mozilla\Firefox\Profiles\apekw9zh.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_223.dll ()
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin: @java.com/DTPlugin -> C:\Program Files\Java\jre6\bin\npDeployJava1.dll (Sun Microsystems, Inc.)
FF Plugin: @java.com/JavaPlugin -> C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: Adblock Plus - C:\Users\Herrin\AppData\Roaming\Mozilla\Firefox\Profiles\apekw9zh.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-11-19]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-12-29]
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-11-14]
FF Extension: No Name - wrc@avast.com [Not Found]
Chrome:
=======
CHR HomePage: Default -> https://www.google.de/
CHR Profile: C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-11-14]
CHR Extension: (Google Docs) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-11-14]
CHR Extension: (Google Drive) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-11-14]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-11-14]
CHR Extension: (WOT) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bhmmomiinigofkjcapegjjndpbikblnp [2014-11-17]
CHR Extension: (YouTube) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-11-14]
CHR Extension: (Google Search) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-11-14]
CHR Extension: (Google Sheets) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-11-14]
CHR Extension: (AdBlock) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-11-15]
CHR Extension: (Avast Online Security) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-11-14]
CHR Extension: (Google Wallet) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-11-14]
CHR Extension: (NotScripts) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\odjhifogjcknibkahlpidmdajjpkkcfn [2014-11-17]
CHR Extension: (Gmail) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-11-14]
CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-11-14]
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-11-14] (AVAST Software)
R2 avast! Firewall; C:\Program Files\AVAST Software\Avast\afwServ.exe [104416 2014-11-14] (AVAST Software)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [24184 2014-11-14] ()
R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [26136 2014-11-14] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [70384 2014-11-14] (AVAST Software)
R0 aswNdis; C:\Windows\System32\DRIVERS\aswNdis.sys [12112 2014-11-14] (ALWIL Software)
R0 aswNdis2; C:\Windows\system32\Drivers\aswNdis2.sys [253640 2014-11-14] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr.sys [55240 2014-11-14] (AVAST Software)
R0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [49944 2014-11-14] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [787800 2014-11-14] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [422760 2014-11-14] (AVAST Software)
R1 aswTdi; C:\Windows\system32\drivers\aswTdi.sys [57928 2014-11-14] (AVAST Software)
R0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [206248 2014-11-14] ()
S3 PROCEXP113; C:\Windows\system32\Drivers\PROCEXP113.SYS [12568 2014-11-13] (Sysinternals - www.sysinternals.com) [File not signed]
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-12-01 11:14 - 2014-12-01 11:15 - 01109504 _____ (Farbar) C:\Users\Herrin\Downloads\FRST (1).exe
2014-12-01 10:20 - 2014-12-01 10:20 - 00000864 _____ () C:\Users\Herrin\AppData\Local\recently-used.xbel
2014-11-28 11:06 - 2014-11-28 11:06 - 00000104 _____ () C:\Users\Herrin\Desktop\Papierkorb - Verknüpfung.lnk
2014-11-28 02:35 - 2014-11-28 02:35 - 00000000 ____D () C:\Users\Herrin\.thumbnails
2014-11-27 22:31 - 2014-11-27 07:16 - 00981504 _____ () C:\Users\Herrin\Documents\~WRL1067.tmp
2014-11-24 07:23 - 2014-11-24 07:23 - 00001576 _____ () C:\Windows\PFRO.log
2014-11-23 22:41 - 2014-11-23 22:41 - 00055088 _____ () C:\Users\Herrin\AppData\Local\GDIPFONTCACHEV1.DAT
2014-11-23 20:58 - 2014-11-23 20:59 - 08676128 _____ (Microsoft Corporation) C:\Users\Herrin\Downloads\Windows7UpgradeAdvisorSetup.exe
2014-11-23 20:09 - 2014-11-23 20:09 - 00000000 ____D () C:\Users\Herrin\AppData\Local\Macromedia
2014-11-22 16:12 - 2014-11-22 16:13 - 00250352 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-11-22 03:20 - 2014-12-01 09:30 - 00000000 ____D () C:\Users\Herrin\AppData\Local\gtk-2.0
2014-11-21 00:55 - 2014-11-21 00:55 - 00000000 ____D () C:\Users\Herrin\AppData\Local\webkit
2014-11-20 15:38 - 2014-11-20 15:38 - 00000000 ____D () C:\Program Files\VS Revo Group
2014-11-20 15:27 - 2014-11-20 15:27 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware
2014-11-20 15:19 - 2014-11-20 15:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinPatrol
2014-11-20 15:19 - 2014-11-20 15:19 - 00000000 ____D () C:\ProgramData\InstallMate
2014-11-20 15:19 - 2014-11-20 15:19 - 00000000 ____D () C:\Program Files\Ruiware
2014-11-20 03:03 - 2014-10-24 02:03 - 00499200 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-11-19 17:15 - 2014-11-19 17:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpywareBlaster
2014-11-19 17:15 - 2014-11-19 17:15 - 00000000 ____D () C:\ProgramData\Licenses
2014-11-19 17:01 - 2014-11-19 17:01 - 00000000 ____D () C:\Users\Herrin\AppData\Roaming\WinPatrol
2014-11-19 16:13 - 2014-12-01 11:19 - 00000000 ____D () C:\FRST
2014-11-18 23:02 - 2014-12-01 10:24 - 00000000 ____D () C:\Users\Herrin\.gimp-2.8
2014-11-18 23:01 - 2014-11-18 23:02 - 00000834 _____ () C:\Users\Herrin\Desktop\Gimp 2.8.lnk
2014-11-18 22:49 - 2014-11-18 22:49 - 00000842 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GIMP 2.lnk
2014-11-18 22:38 - 2014-11-18 22:47 - 00000000 ____D () C:\Program Files\GIMP 2
2014-11-18 17:51 - 2014-11-11 20:04 - 00979456 _____ () C:\Users\Herrin\Documents\~WRL2275.tmp
2014-11-18 15:16 - 2014-11-18 15:16 - 00001662 _____ () C:\Users\Public\Desktop\Defraggler.lnk
2014-11-18 15:12 - 2014-11-18 15:17 - 00000000 ____D () C:\Program Files\Defraggler
2014-11-17 19:32 - 2014-11-18 13:44 - 00000000 ____D () C:\ProgramData\DataCardService
2014-11-17 19:32 - 2014-11-17 19:33 - 00000000 ____D () C:\ProgramData\Mobile Partner
2014-11-17 15:51 - 2014-11-17 15:53 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Mozilla
2014-11-17 15:51 - 2014-11-17 15:51 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Mozilla
2014-11-17 15:49 - 2014-11-17 15:49 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\AVAST Software
2014-11-17 15:49 - 2014-11-17 15:49 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Adobe
2014-11-17 15:48 - 2014-11-17 15:48 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Google
2014-11-17 15:46 - 2014-11-18 13:44 - 00000000 ____D () C:\Users\Administrator
2014-11-17 00:56 - 2014-11-17 01:04 - 00000000 ____D () C:\AdwCleaner
2014-11-17 00:42 - 2014-11-17 00:42 - 00000000 ____D () C:\Users\Herrin\AppData\Local\Secunia PSI
2014-11-17 00:32 - 2014-12-01 09:16 - 00000000 ____D () C:\ProgramData\TEMP
2014-11-17 00:32 - 2014-11-18 13:03 - 00000000 ____D () C:\Program Files\SpywareBlaster
2014-11-16 23:17 - 2014-11-16 23:35 - 00000972 _____ () C:\DelFix.txt
2014-11-16 20:52 - 2014-11-16 20:52 - 00000000 ____D () C:\Program Files\Common Files\Java
2014-11-16 20:48 - 2014-11-16 20:48 - 00000000 ____D () C:\ProgramData\Oracle
2014-11-16 20:21 - 2014-11-16 20:22 - 00638888 _____ (Oracle Corporation) C:\Users\Herrin\Desktop\chromeinstall-8u25.exe
2014-11-16 19:35 - 2014-11-16 19:39 - 00002425 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader 9.lnk
2014-11-16 19:25 - 2014-12-01 10:56 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-11-16 19:24 - 2014-11-16 19:27 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-11-16 01:42 - 2014-11-16 01:42 - 00000000 ____D () C:\Users\Herrin\AppData\Local\fontconfig
2014-11-16 01:41 - 2014-11-16 01:41 - 00000000 ____D () C:\Users\Herrin\AppData\Local\gegl-0.2
2014-11-15 17:33 - 2014-11-15 17:33 - 00000806 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-11-15 17:32 - 2014-11-15 17:33 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-11-15 17:32 - 2014-11-15 17:32 - 00000000 ____D () C:\ProgramData\Mozilla
2014-11-15 17:32 - 2014-11-15 17:32 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-11-14 22:23 - 2007-06-26 15:57 - 00192512 _____ (Intel Corporation) C:\Windows\system32\igfxres.dll
2014-11-14 22:05 - 2014-11-16 23:17 - 00000000 ____D () C:\Windows\ERUNT
2014-11-14 20:44 - 2014-11-26 04:11 - 00114904 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-11-14 20:42 - 2014-11-20 15:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-11-14 20:41 - 2014-11-14 20:41 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-11-14 20:41 - 2014-10-01 11:11 - 00075480 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-11-14 20:41 - 2014-10-01 11:11 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-11-14 20:41 - 2014-10-01 11:11 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-11-14 19:18 - 2014-11-14 19:18 - 00001837 _____ () C:\Users\Public\Desktop\Avast Internet Security.lnk
2014-11-14 19:13 - 2014-11-14 19:12 - 00026136 _____ (AVAST Software) C:\Windows\system32\Drivers\aswKbd.sys
2014-11-14 19:13 - 2014-11-14 19:11 - 00253640 _____ (AVAST Software) C:\Windows\system32\Drivers\aswNdis2.sys
2014-11-14 19:13 - 2014-11-14 18:35 - 00291352 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-11-14 19:11 - 2014-11-14 19:11 - 00012112 _____ (ALWIL Software) C:\Windows\system32\Drivers\aswNdis.sys
2014-11-14 19:07 - 2014-11-14 19:07 - 00000000 ____D () C:\Program Files\Dropbox
2014-11-14 19:05 - 2014-11-14 19:05 - 00000000 ____D () C:\Users\Herrin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-11-14 18:54 - 2014-11-14 19:08 - 00000000 ____D () C:\Users\Herrin\AppData\Roaming\Dropbox
2014-11-14 18:40 - 2014-11-14 18:40 - 00000000 ____D () C:\Users\Herrin\AppData\Roaming\AVAST Software
2014-11-14 18:39 - 2014-11-14 19:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2014-11-14 18:36 - 2014-11-14 18:36 - 00422760 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2014-11-14 18:36 - 2014-11-14 18:36 - 00206248 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-11-14 18:36 - 2014-11-14 18:36 - 00070384 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-11-14 18:36 - 2014-11-14 18:36 - 00057928 _____ (AVAST Software) C:\Windows\system32\Drivers\aswTdi.sys
2014-11-14 18:36 - 2014-11-14 18:36 - 00055240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr.sys
2014-11-14 18:36 - 2014-11-14 18:36 - 00049944 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-11-14 18:36 - 2014-11-14 18:36 - 00024184 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2014-11-14 18:36 - 2014-11-14 18:34 - 00787800 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2014-11-14 18:35 - 2014-11-14 18:35 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-11-14 18:31 - 2014-11-14 18:31 - 00000000 ____D () C:\Program Files\AVAST Software
2014-11-14 18:20 - 2014-11-14 18:31 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-11-14 14:37 - 2014-11-26 19:37 - 00001923 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-11-14 14:37 - 2014-11-14 14:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-11-13 20:10 - 2014-12-01 11:19 - 00000000 ____D () C:\Users\Herrin\Desktop\Sicherheit
2014-11-13 19:33 - 2014-11-13 19:33 - 00012568 _____ (Sysinternals - www.sysinternals.com) C:\Windows\system32\Drivers\PROCEXP113.SYS
2014-11-13 18:01 - 2014-11-13 19:22 - 00000000 ____D () C:\Windows\erdnt
2014-11-13 03:32 - 2014-10-10 02:01 - 00449536 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2014-11-13 03:32 - 2014-10-10 02:00 - 01259008 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-11-13 03:32 - 2014-10-10 02:00 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2014-11-13 03:32 - 2014-10-10 00:22 - 00619520 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2014-11-13 03:31 - 2014-08-27 01:55 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-11-13 03:31 - 2014-08-27 01:55 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-11-13 03:29 - 2014-10-24 02:04 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-11-13 03:29 - 2014-09-19 01:50 - 00278528 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-11-13 03:28 - 2014-08-12 03:25 - 00729600 _____ (Microsoft Corporation) C:\Windows\system32\IMJP10K.DLL
2014-11-13 03:23 - 2014-10-18 02:08 - 00564224 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2014-11-13 03:23 - 2014-10-03 02:18 - 00274432 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2014-11-13 03:23 - 2014-10-03 02:17 - 00396800 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2014-11-13 03:23 - 2014-10-03 02:17 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2014-11-13 03:23 - 2014-10-03 02:17 - 00170496 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2014-11-13 03:04 - 2014-10-13 00:34 - 02054656 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-11-12 18:40 - 2014-11-12 18:40 - 00000000 ____D () C:\Users\Herrin\AppData\Roaming\AdvancedSystemProtector
2014-11-12 18:27 - 2014-11-12 18:27 - 00000000 ____D () C:\Users\Herrin\AppData\Roaming\dlg
2014-11-12 11:16 - 2014-10-31 08:17 - 06004736 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 11082752 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 02006016 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 01469440 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-11-12 11:15 - 2014-10-31 08:17 - 01214976 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 00916992 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 00630784 _____ (Microsoft Corporation) C:\Windows\system32\mstime.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 00630272 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 00387584 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 00164352 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2014-11-12 11:15 - 2014-10-31 08:17 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-11-12 11:15 - 2014-10-31 08:16 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\corpol.dll
2014-11-12 11:15 - 2014-10-31 03:37 - 00385024 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2014-11-12 11:15 - 2014-10-31 03:30 - 00174080 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-11-12 11:15 - 2014-10-31 03:30 - 00133632 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-11-12 11:15 - 2014-10-31 03:29 - 01638912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-11-12 11:15 - 2014-10-31 03:29 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-11-10 12:08 - 2014-11-10 12:08 - 00000000 ____D () C:\Users\Herrin\AppData\Roaming\Daichi
2014-11-10 10:28 - 2014-11-18 13:42 - 00000000 ____D () C:\Users\Herrin\Desktop\Sounds
2014-11-09 21:38 - 2014-11-09 21:38 - 00000000 ____D () C:\Program Files\Common Files\Avid
2014-11-09 21:28 - 2014-11-09 22:01 - 00000000 ____D () C:\Program Files\Common Files\VST3
2014-11-07 20:49 - 2014-11-07 20:49 - 00000000 ____D () C:\Users\Herrin\Documents\CabraProjects
2014-11-07 20:48 - 2014-11-07 20:49 - 00678093 _____ () C:\Users\Herrin\Desktop\Cabra_0.7.0.jar
2014-11-06 18:04 - 2014-11-06 18:04 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
2014-11-06 14:41 - 2012-11-22 04:54 - 00353280 _____ (Microsoft Corporation) C:\Windows\system32\shlwapi.dll
2014-11-06 14:35 - 2014-11-06 14:35 - 00000000 ____D () C:\Users\Herrin\AppData\Local\AviraSpeedup
2014-11-06 13:20 - 2014-06-26 23:17 - 00619664 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2014-11-06 13:20 - 2014-06-26 23:17 - 00099480 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2014-11-06 13:20 - 2014-06-26 23:17 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2014-11-06 13:19 - 2014-06-06 05:28 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-11-06 13:16 - 2014-06-15 23:18 - 01131664 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll
2014-11-06 13:16 - 2014-06-13 19:22 - 00156824 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll
2014-11-06 13:16 - 2014-06-13 19:22 - 00081560 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll
2014-11-06 12:52 - 2014-09-09 07:24 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-11-06 12:22 - 2014-08-23 02:03 - 00297984 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-11-06 11:44 - 2012-11-08 04:48 - 01314816 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
2014-11-06 11:10 - 2014-11-13 03:23 - 00000000 ____D () C:\Windows\system32\MRT
2014-11-05 21:45 - 2014-11-05 21:45 - 00000000 ____D () C:\e1bf55fb68ca2ff1452d
2014-11-05 21:44 - 2014-09-05 00:27 - 00143360 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fastfat.sys
2014-11-05 21:41 - 2012-07-26 03:46 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\Wdfres.dll
2014-11-05 21:41 - 2012-06-02 15:57 - 00000003 _____ () C:\Windows\system32\Drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf
2014-11-05 21:40 - 2012-07-26 04:39 - 00047720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdfLdr.sys
2014-11-05 21:40 - 2012-07-26 04:21 - 00196608 _____ (Microsoft Corporation) C:\Windows\system32\WUDFHost.exe
2014-11-05 21:40 - 2012-07-26 04:20 - 00613888 _____ (Microsoft Corporation) C:\Windows\system32\WUDFx.dll
2014-11-05 21:40 - 2012-07-26 04:20 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\WUDFPlatform.dll
2014-11-05 21:40 - 2012-07-26 04:20 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\WUDFSvc.dll
2014-11-05 21:40 - 2012-07-26 04:20 - 00038912 _____ (Microsoft Corporation) C:\Windows\system32\WUDFCoinstaller.dll
2014-11-05 21:40 - 2012-07-26 03:33 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WUDFPf.sys
2014-11-05 21:40 - 2012-07-26 03:32 - 00155136 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WUDFRd.sys
2014-11-05 21:40 - 2009-07-14 13:12 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\winusb.dll
2014-11-05 16:58 - 2014-06-02 11:31 - 02263552 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-11-05 16:58 - 2014-06-02 11:31 - 00332800 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-11-05 16:58 - 2014-06-02 11:30 - 01993728 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-11-05 16:58 - 2014-06-02 11:30 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2014-11-05 16:58 - 2014-06-02 09:56 - 00082432 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2014-11-05 16:58 - 2014-04-26 17:01 - 00502784 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2014-11-05 16:58 - 2014-03-25 14:26 - 11587584 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-11-05 16:58 - 2013-08-27 03:47 - 01029120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll
2014-11-05 16:58 - 2013-08-27 03:47 - 00219648 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll
2014-11-05 16:58 - 2013-08-27 03:47 - 00189952 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll
2014-11-05 16:58 - 2013-08-27 03:47 - 00160768 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll
2014-11-05 16:58 - 2013-08-27 02:52 - 01172480 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-11-05 16:58 - 2013-08-27 02:50 - 00486400 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2014-11-05 16:58 - 2013-08-27 02:32 - 00683008 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2014-11-05 16:58 - 2013-08-27 02:28 - 01069056 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2014-11-05 16:58 - 2013-08-27 02:28 - 00798208 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2014-11-05 16:58 - 2013-06-15 14:22 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\icaapi.dll
2014-11-05 16:58 - 2013-06-15 12:23 - 00024064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2014-11-05 16:57 - 2014-04-05 03:42 - 00905664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-11-05 16:57 - 2013-12-22 16:42 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-11-05 16:57 - 2013-10-30 03:12 - 00335360 _____ (Microsoft Corporation) C:\Windows\system32\SysFxUI.dll
2014-11-05 16:57 - 2013-10-30 02:43 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmk.sys
2014-11-05 16:57 - 2013-10-30 01:43 - 00167936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys
2014-11-05 16:57 - 2013-07-20 11:44 - 00102608 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2014-11-05 16:57 - 2013-07-10 10:47 - 00783360 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2014-11-05 16:57 - 2012-11-02 11:18 - 00376320 _____ (Microsoft Corporation) C:\Windows\system32\dpnet.dll
2014-11-05 16:57 - 2012-11-02 09:26 - 00023040 _____ (Microsoft Corporation) C:\Windows\system32\dpnsvr.exe
2014-11-05 16:55 - 2014-06-14 01:44 - 00638400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-11-05 16:55 - 2014-06-14 01:33 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2014-11-05 16:55 - 2014-06-06 09:59 - 00506880 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-11-05 16:55 - 2012-08-21 12:47 - 00224640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\volsnap.sys
2014-11-05 16:53 - 2012-11-20 05:22 - 00204288 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2014-11-05 16:52 - 2013-10-11 03:08 - 00444928 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2014-11-05 16:52 - 2013-10-11 03:07 - 00596480 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2014-11-05 16:52 - 2013-10-11 01:39 - 00218228 _____ () C:\Windows\system32\WFP.TMF
2014-11-05 16:20 - 2014-05-30 07:53 - 00273408 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-11-05 16:20 - 2013-06-29 03:07 - 00226304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-11-05 16:20 - 2013-06-29 03:07 - 00197632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-11-05 16:20 - 2013-06-29 03:06 - 00006016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-11-05 16:20 - 2013-03-03 20:07 - 01082232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-11-05 16:20 - 2011-05-05 14:54 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-11-05 16:20 - 2011-05-05 14:54 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-11-05 16:19 - 2014-03-10 02:22 - 01401344 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2014-11-05 16:18 - 2014-11-27 23:44 - 00000000 ____D () C:\Users\Herrin\Desktop\Webdesign
2014-11-05 16:16 - 2014-11-05 16:16 - 00001596 _____ () C:\Users\Herrin\Desktop\Webocton - Scriptly.lnk
2014-11-05 16:16 - 2014-11-05 16:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Webocton - Scriptly
2014-11-05 16:15 - 2014-11-05 16:16 - 00000000 ____D () C:\Users\Herrin\Webocton - Scriptly
2014-11-05 16:15 - 2014-11-05 16:16 - 00000000 ____D () C:\Users\Herrin\AppData\Roaming\Webocton - Scriptly
2014-11-05 16:14 - 2013-05-02 05:04 - 00443904 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2014-11-05 16:14 - 2013-05-02 05:03 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\printcom.dll
2014-11-05 16:13 - 2013-07-09 13:10 - 01205168 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2014-11-05 16:13 - 2013-07-08 05:55 - 03603904 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2014-11-05 16:13 - 2013-07-08 05:55 - 03551680 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-11-05 16:13 - 2013-03-09 04:45 - 00049152 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2014-11-05 16:13 - 2013-03-09 02:28 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2014-11-05 16:13 - 2013-03-08 04:53 - 00376320 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2014-11-05 16:09 - 2014-11-29 07:45 - 00001472 _____ () C:\Users\Herrin\.lmmsrc.xml
2014-11-05 16:09 - 2014-11-05 16:09 - 00000726 _____ () C:\Users\Herrin\Desktop\LMMS.lnk
2014-11-05 16:08 - 2014-11-05 16:08 - 00000000 ____D () C:\Users\Herrin\lmms
2014-11-05 16:07 - 2013-10-11 03:08 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2014-11-05 16:07 - 2013-10-11 03:08 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx
2014-11-05 16:07 - 2013-10-11 03:08 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wshcon.dll
2014-11-05 16:07 - 2013-10-11 01:35 - 00155648 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe
2014-11-05 16:07 - 2013-10-11 01:35 - 00135168 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe
2014-11-05 16:07 - 2013-10-03 13:45 - 00993792 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2014-11-05 16:06 - 2014-11-05 16:07 - 00000000 ____D () C:\Program Files\LMMS
2014-11-05 16:06 - 2013-08-02 05:09 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2014-11-05 16:06 - 2013-04-24 05:00 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\certenc.dll
2014-11-05 16:06 - 2013-04-24 02:46 - 00812544 _____ (Microsoft Corporation) C:\Windows\system32\certutil.exe
2014-11-05 16:02 - 2014-11-05 16:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LMMS 1.0.3
2014-11-05 15:38 - 2014-02-06 02:56 - 00894464 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-11-05 15:38 - 2013-06-27 00:01 - 00527064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2014-11-05 15:37 - 2013-10-22 08:19 - 00158208 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2014-11-05 14:59 - 2013-07-16 05:35 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\themeui.dll
2014-11-05 14:58 - 2013-06-04 05:16 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2014-11-05 14:58 - 2013-06-04 02:49 - 00293376 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2014-11-05 14:57 - 2013-03-08 04:52 - 02067968 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-11-05 14:56 - 2013-07-04 05:21 - 00532480 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2014-11-05 14:07 - 2014-01-30 08:46 - 00876032 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
2014-11-05 13:17 - 2013-04-17 13:30 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\cryptdlg.dll
2014-11-05 13:16 - 2013-07-03 03:33 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbscan.sys
2014-11-05 13:16 - 2013-07-03 03:10 - 00025472 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2014-11-05 13:15 - 2013-02-12 02:57 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usb8023.sys
2014-11-05 13:14 - 2013-07-08 05:20 - 00172544 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2014-11-05 13:14 - 2013-07-08 05:16 - 00133120 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2014-11-05 13:14 - 2013-07-08 05:16 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2014-11-05 11:10 - 2012-09-25 17:19 - 00075776 _____ (Microsoft Corporation) C:\Windows\system32\synceng.dll
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-12-01 10:40 - 2006-11-02 13:51 - 01536709 _____ () C:\Windows\WindowsUpdate.log
2014-12-01 10:40 - 2006-11-02 13:46 - 00003664 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-12-01 10:40 - 2006-11-02 13:46 - 00003664 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-12-01 10:27 - 2010-07-09 14:57 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-11-30 21:27 - 2010-07-09 14:57 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-11-30 21:24 - 2006-11-02 14:00 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-11-30 11:16 - 2006-11-02 14:00 - 00032534 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-11-28 02:35 - 2008-12-24 09:42 - 00000000 ____D () C:\Users\Herrin
2014-11-24 14:04 - 2009-11-17 20:16 - 00229000 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-11-23 21:01 - 2006-11-02 11:33 - 01566310 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-11-23 04:29 - 2009-05-17 08:11 - 00000000 ____D () C:\ProgramData\Skype
2014-11-22 05:14 - 2009-03-29 11:59 - 00000000 ____D () C:\Windows\Minidump
2014-11-22 05:13 - 2012-01-08 10:26 - 00000000 __SHD () C:\Users\Herrin\UserData
2014-11-18 13:44 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\system32\Msdtc
2014-11-18 13:43 - 2006-11-02 11:22 - 50331648 _____ () C:\Windows\system32\config\components_previous
2014-11-18 13:43 - 2006-11-02 11:22 - 39583744 _____ () C:\Windows\system32\config\software_previous
2014-11-18 13:43 - 2006-11-02 11:22 - 17825792 _____ () C:\Windows\system32\config\system_previous
2014-11-18 13:43 - 2006-11-02 11:22 - 00262144 _____ () C:\Windows\system32\config\security_previous
2014-11-18 13:43 - 2006-11-02 11:22 - 00262144 _____ () C:\Windows\system32\config\default_previous
2014-11-18 13:43 - 2006-11-02 11:22 - 00061440 _____ () C:\Windows\system32\config\sam_previous
2014-11-18 13:42 - 2008-12-25 09:38 - 00000000 ____D () C:\Users\Herrin\AppData\Roaming\vlc
2014-11-18 13:42 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\system32\spool
2014-11-18 13:42 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\registration
2014-11-17 22:09 - 2008-12-24 23:16 - 00000000 ____D () C:\Users\Herrin\AppData\Roaming\Mozilla
2014-11-17 19:33 - 2009-08-22 21:27 - 00000000 ____D () C:\Program Files\Mobile Partner
2014-11-16 20:45 - 2010-08-02 14:21 - 00000000 ____D () C:\Program Files\Java
2014-11-16 20:29 - 2008-12-25 09:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2014-11-16 20:19 - 2008-12-24 11:39 - 00000000 ____D () C:\Users\Herrin\AppData\Local\Adobe
2014-11-16 19:35 - 2011-03-13 20:56 - 00000000 ____D () C:\Program Files\Common Files\Adobe
2014-11-16 19:35 - 2008-12-24 11:38 - 00000000 ____D () C:\ProgramData\Adobe
2014-11-16 19:27 - 2011-05-13 05:53 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-11-16 19:15 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\system32\LogFiles
2014-11-16 12:30 - 2008-12-25 09:41 - 00000000 ____D () C:\Users\Herrin\Desktop\Büro
2014-11-14 21:52 - 2012-02-16 20:28 - 00000000 ____D () C:\temp
2014-11-14 18:34 - 2006-11-02 13:35 - 00000000 ____D () C:\Program Files\Windows Sidebar
2014-11-14 14:38 - 2009-05-17 00:15 - 00000000 ____D () C:\Users\Herrin\AppData\Local\Google
2014-11-14 14:37 - 2009-05-17 00:14 - 00000000 ____D () C:\Program Files\Google
2014-11-14 14:03 - 2011-12-15 23:36 - 00000000 ____D () C:\Users\Herrin\AppData\Roaming\Skype
2014-11-13 19:33 - 2006-11-02 12:18 - 00000000 __RHD () C:\Users\Default
2014-11-13 19:33 - 2006-11-02 12:18 - 00000000 ___RD () C:\Users\Public
2014-11-13 19:17 - 2006-11-02 11:23 - 00000215 _____ () C:\Windows\system.ini
2014-11-13 09:49 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\rescache
2014-11-13 09:01 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-11-13 08:44 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\system32\de-DE
2014-11-13 03:08 - 2006-11-02 11:24 - 100445232 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-11-12 22:25 - 2010-07-03 07:33 - 00000000 ____D () C:\ProgramData\ICQ
2014-11-12 19:44 - 2008-12-24 09:42 - 00001356 _____ () C:\Users\Herrin\AppData\Local\d3d9caps.dat
2014-11-07 09:42 - 2012-02-20 18:54 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-11-06 23:25 - 2012-02-20 18:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-11-06 13:37 - 2006-11-02 13:35 - 00000000 ____D () C:\Program Files\Windows Journal
2014-11-06 13:36 - 2006-11-02 13:35 - 00000000 ____D () C:\Windows\system32\XPSViewer
2014-11-06 09:03 - 2006-11-02 16:46 - 00000000 ____D () C:\Windows\system32\Drivers\de-DE
2014-11-05 13:07 - 2009-11-11 20:02 - 00000000 ____D () C:\Program Files\Yahoo!
2014-11-05 12:55 - 2012-02-19 18:42 - 00000000 ____D () C:\ProgramData\Yahoo!
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-12-01 09:48
==================== End Of Log ============================
--- --- --- Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 01-12-2014
Ran by Herrin at 2014-12-01 11:24:13
Running from C:\Users\Herrin\Desktop\Sicherheit
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: avast! Antivirus (Disabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Disabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
FW: avast! Antivirus (Disabled) {2F96FC65-F07D-9D1E-5A6E-3DA5C487EAF0}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Flash Player 15 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 15.0.0.223 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 15.0.0.223 - Adobe Systems Incorporated)
Adobe Reader 9.5.5 - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-A95000000001}) (Version: 9.5.5 - Adobe Systems Incorporated)
Avast Internet Security (HKLM\...\Avast) (Version: 10.0.2208 - AVAST Software)
CCleaner (HKLM\...\CCleaner) (Version: 3.11 - Piriform)
Defraggler (HKLM\...\Defraggler) (Version: 2.18 - Piriform)
Dropbox (HKU\S-1-5-21-2708201434-1965334668-4040377041-1000\...\Dropbox) (Version: 2.10.52 - Dropbox, Inc.)
DVD Shrink 3.1.4 (HKLM\...\DVD Shrink_is1) (Version: - DVD Shrink)
GIMP 2.8.14 (HKLM\...\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team)
Google Chrome (HKLM\...\Google Chrome) (Version: 39.0.2171.71 - Google Inc.)
Google Earth (HKLM\...\{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}) (Version: 6.1.0.5001 - Google)
Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden
Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: - )
Java(TM) 6 Update 20 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83216020FF}) (Version: 6.0.200 - Sun Microsystems, Inc.)
LMMS 1.0.3 (HKLM\...\LMMS) (Version: 1.0.3 - LMMS Developers)
Malwarebytes Anti-Malware Version 2.0.3.1025 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.3.1025 - Malwarebytes Corporation)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version: - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office XP Professional mit FrontPage (HKLM\...\{90280407-6000-11D3-8CFE-0050048383C9}) (Version: 10.0.2701.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 33.1 (x86 de) (HKLM\...\Mozilla Firefox 33.1 (x86 de)) (Version: 33.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 33.1 - Mozilla)
Picasa 3 (HKLM\...\Picasa 3) (Version: 3.8 - Google, Inc.)
QuickTime (HKLM\...\QuickTime) (Version: - )
Revo Uninstaller 1.95 (HKLM\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Spelling Dictionaries Support For Adobe Reader 9 (HKLM\...\{AC76BA86-7AD7-5464-3428-900000000004}) (Version: 9.0.0 - Adobe Systems Incorporated)
SpywareBlaster 5.0 (HKLM\...\SpywareBlaster_is1) (Version: 5.0.0 - BrightFort LLC)
VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)
Webocton - Scriptly 0.8.95.6 (HKLM\...\Webocton - Scriptly_is1) (Version: 0.8.95.6 - Webocton)
WinPatrol (HKLM\...\{6A206A04-6BC1-411B-AA04-4E52EDEEADF2}) (Version: 32.0.2014.5 - Ruiware)
Yahoo! Software Update (HKLM\...\Yahoo! Software Update) (Version: - )
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-2708201434-1965334668-4040377041-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Herrin\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2708201434-1965334668-4040377041-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Herrin\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2708201434-1965334668-4040377041-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Herrin\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2708201434-1965334668-4040377041-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Herrin\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2708201434-1965334668-4040377041-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Herrin\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2708201434-1965334668-4040377041-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Herrin\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2708201434-1965334668-4040377041-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Herrin\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2708201434-1965334668-4040377041-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Herrin\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
==================== Restore Points =========================
21-11-2014 22:01:05 Geplanter Prüfpunkt
22-11-2014 17:30:44 Geplanter Prüfpunkt
23-11-2014 03:24:49 Removed Skype™ 6.11
24-11-2014 05:12:24 Geplanter Prüfpunkt
24-11-2014 20:26:51 Geplanter Prüfpunkt
25-11-2014 17:00:26 Windows Update
27-11-2014 00:10:49 Geplanter Prüfpunkt
28-11-2014 10:01:53 Geplanter Prüfpunkt
28-11-2014 19:02:26 Windows Update
30-11-2014 22:55:44 Geplanter Prüfpunkt
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2006-11-02 11:23 - 2014-11-13 19:11 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {22D776E8-92AC-41F3-865C-0661FA2EFFDD} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-11-14] (AVAST Software)
Task: {75194B80-6BF9-4D8F-B1E6-15F8DDD6DD3A} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-11-05] (Google Inc.)
Task: {87BE7DD4-F78D-4FE1-8589-5591305A7A9F} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-11-16] (Adobe Systems Incorporated)
Task: {CE973C16-5E83-49E7-A9A8-C1E7F965B1D9} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-11-05] (Google Inc.)
Task: {F5CC19B5-4CE1-45AB-AFBA-C39033771C4C} - System32\Tasks\{D998DDF7-BDDF-4B9B-BB67-F7F3D6D35605} => C:\Program Files\Skype\Phone\Skype.exe
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2014-12-01 09:49 - 2014-12-01 09:49 - 02904064 _____ () C:\Program Files\AVAST Software\Avast\defs\14120100\algo.dll
2008-12-24 11:09 - 2007-06-26 15:55 - 00249856 _____ () C:\Windows\system32\igfxTMM.dll
2014-11-14 18:35 - 2014-11-14 18:35 - 38562088 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2014-11-26 19:37 - 2014-11-25 07:39 - 09009480 _____ () C:\Program Files\Google\Chrome\Application\39.0.2171.71\pdf.dll
2014-11-26 19:36 - 2014-11-25 07:39 - 01677128 _____ () C:\Program Files\Google\Chrome\Application\39.0.2171.71\ffmpegsumo.dll
2014-11-14 16:16 - 2014-02-10 12:44 - 04592128 _____ () C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\SwiftShader\3.2.6.45159\libglesv2.dll
2014-11-14 16:16 - 2014-02-10 12:44 - 00112128 _____ () C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\SwiftShader\3.2.6.45159\libegl.dll
2014-07-10 16:37 - 2014-07-10 16:37 - 02125326 _____ () C:\Program Files\LMMS\lmms.exe
2014-03-18 10:49 - 2014-03-18 10:49 - 00103438 _____ () C:\Program Files\LMMS\zlib1.dll
2014-03-18 10:52 - 2014-03-18 10:52 - 00924995 _____ () C:\Program Files\LMMS\libpng16-16.dll
2014-03-18 22:32 - 2014-03-18 22:32 - 00656275 _____ () C:\Program Files\LMMS\SDL.dll
2014-03-21 11:40 - 2014-03-21 11:40 - 00113088 _____ () C:\Program Files\LMMS\libogg-0.dll
2014-03-18 10:45 - 2014-03-18 10:45 - 00996736 _____ () C:\Program Files\LMMS\libportaudio-2.dll
2014-03-21 11:40 - 2014-03-21 11:40 - 01574193 _____ () C:\Program Files\LMMS\libsamplerate-0.dll
2014-03-21 11:45 - 2014-03-21 11:45 - 00978438 _____ () C:\Program Files\LMMS\libsndfile-1.dll
2014-03-21 11:44 - 2014-03-21 11:44 - 00893402 _____ () C:\Program Files\LMMS\libFLAC-8.dll
2014-03-21 11:40 - 2014-03-21 11:40 - 00329653 _____ () C:\Program Files\LMMS\libvorbis-0.dll
2014-03-21 11:40 - 2014-03-21 11:40 - 00736570 _____ () C:\Program Files\LMMS\libvorbisenc-2.dll
2014-03-21 11:40 - 2014-03-21 11:40 - 00129293 _____ () C:\Program Files\LMMS\libvorbisfile-3.dll
2014-07-10 16:37 - 2014-07-10 16:37 - 00131598 _____ () C:\Program Files\LMMS\plugins\amplifier.dll
2014-07-10 16:37 - 2014-07-10 16:37 - 00404494 _____ () C:\Program Files\LMMS\plugins\audiofileprocessor.dll
2014-07-10 16:37 - 2014-07-10 16:37 - 00131086 _____ () C:\Program Files\LMMS\plugins\bassbooster.dll
2014-07-10 16:37 - 2014-07-10 16:37 - 00240654 _____ () C:\Program Files\LMMS\plugins\bitinvader.dll
2014-07-10 16:37 - 2014-07-10 16:37 - 00204302 _____ () C:\Program Files\LMMS\plugins\dualfilter.dll
2014-07-10 16:37 - 2014-07-10 16:37 - 00257550 _____ () C:\Program Files\LMMS\plugins\dynamicsprocessor.dll
2014-07-10 16:37 - 2014-07-10 16:37 - 00225294 _____ () C:\Program Files\LMMS\plugins\flpimport.dll
2014-07-10 16:37 - 2014-07-10 16:37 - 00562190 _____ () C:\Program Files\LMMS\plugins\hydrogenimport.dll
2014-07-10 16:37 - 2014-07-10 16:37 - 00157198 _____ () C:\Program Files\LMMS\plugins\kicker.dll
2014-07-10 16:37 - 2014-07-10 16:37 - 00129550 _____ () C:\Program Files\LMMS\plugins\ladspabrowser.dll
2014-07-10 16:37 - 2014-07-10 16:37 - 00144910 _____ () C:\Program Files\LMMS\plugins\ladspaeffect.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00250382 _____ () C:\Program Files\LMMS\plugins\lb302.dll
2014-07-10 16:40 - 2014-07-10 16:40 - 00967694 _____ () C:\Program Files\LMMS\plugins\libZynAddSubFxCore.dll
2014-07-06 12:26 - 2014-07-06 12:26 - 02169870 _____ () C:\Program Files\LMMS\libfftw3f-3.dll
2014-07-10 16:39 - 2014-07-10 16:39 - 00792590 _____ () C:\Program Files\LMMS\plugins\malletsstk.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00612878 _____ () C:\Program Files\LMMS\plugins\midiimport.dll
2014-07-10 16:39 - 2014-07-10 16:39 - 00313870 _____ () C:\Program Files\LMMS\plugins\OPL2.dll
2014-07-10 16:39 - 2014-07-10 16:39 - 00178702 _____ () C:\Program Files\LMMS\plugins\organic.dll
2014-07-10 16:39 - 2014-07-10 16:39 - 00242702 _____ () C:\Program Files\LMMS\plugins\papu.dll
2014-07-10 16:39 - 2014-07-10 16:39 - 00189966 _____ () C:\Program Files\LMMS\plugins\patman.dll
2014-07-10 16:39 - 2014-07-10 16:39 - 00147982 _____ () C:\Program Files\LMMS\plugins\peakcontrollereffect.dll
2014-07-10 16:39 - 2014-07-10 16:39 - 00252430 _____ () C:\Program Files\LMMS\plugins\sf2player.dll
2014-03-21 11:41 - 2014-03-21 11:41 - 01572606 _____ () C:\Program Files\LMMS\libfluidsynth.dll
2014-07-10 16:39 - 2014-07-10 16:39 - 00265742 _____ () C:\Program Files\LMMS\plugins\sfxr.dll
2014-07-10 16:39 - 2014-07-10 16:39 - 00446478 _____ () C:\Program Files\LMMS\plugins\sid.dll
2014-07-10 16:39 - 2014-07-10 16:39 - 00137230 _____ () C:\Program Files\LMMS\plugins\spectrumanalyzer.dll
2014-07-10 16:39 - 2014-07-10 16:39 - 00113166 _____ () C:\Program Files\LMMS\plugins\stereoenhancer.dll
2014-07-10 16:39 - 2014-07-10 16:39 - 00123918 _____ () C:\Program Files\LMMS\plugins\stereomatrix.dll
2014-07-10 16:39 - 2014-07-10 16:39 - 00214030 _____ () C:\Program Files\LMMS\plugins\tripleoscillator.dll
2014-07-10 16:39 - 2014-07-10 16:39 - 00196110 _____ () C:\Program Files\LMMS\plugins\vibedstrings.dll
2014-07-10 16:39 - 2014-07-10 16:39 - 00179214 _____ () C:\Program Files\LMMS\plugins\vstbase.dll
2014-07-10 16:39 - 2014-07-10 16:39 - 00170510 _____ () C:\Program Files\LMMS\plugins\vsteffect.dll
2014-07-10 16:39 - 2014-07-10 16:39 - 00238094 _____ () C:\Program Files\LMMS\plugins\waveshaper.dll
2014-07-10 16:40 - 2014-07-10 16:40 - 00259598 _____ () C:\Program Files\LMMS\plugins\zynaddsubfx.dll
2014-07-10 16:39 - 2014-07-10 16:39 - 00209422 _____ () C:\Program Files\LMMS\plugins\vestige.dll
2014-03-21 11:45 - 2014-03-21 11:45 - 05717491 _____ () C:\Program Files\LMMS\libfltk.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00016910 _____ () C:\Program Files\LMMS\plugins\ladspa\alias_1407.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00033806 _____ () C:\Program Files\LMMS\plugins\ladspa\allpass_1895.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00018958 _____ () C:\Program Files\LMMS\plugins\ladspa\am_pitchshift_1433.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00021006 _____ () C:\Program Files\LMMS\plugins\ladspa\amp_1181.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00021518 _____ () C:\Program Files\LMMS\plugins\ladspa\bandpass_a_iir_1893.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00023054 _____ () C:\Program Files\LMMS\plugins\ladspa\bandpass_iir_1892.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00019982 _____ () C:\Program Files\LMMS\plugins\ladspa\bode_shifter_1431.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00019982 _____ () C:\Program Files\LMMS\plugins\ladspa\bode_shifter_cv_1432.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00028686 _____ () C:\Program Files\LMMS\plugins\ladspa\butterworth_1902.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 03057678 _____ () C:\Program Files\LMMS\plugins\ladspa\calf.dll
2014-07-10 16:37 - 2014-07-10 16:37 - 01056270 _____ () C:\Program Files\LMMS\plugins\ladspa\caps.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00017934 _____ () C:\Program Files\LMMS\plugins\ladspa\chebstortion_1430.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00204814 _____ () C:\Program Files\LMMS\plugins\ladspa\cmt.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00016910 _____ () C:\Program Files\LMMS\plugins\ladspa\comb_1190.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00033806 _____ () C:\Program Files\LMMS\plugins\ladspa\comb_1887.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00016910 _____ () C:\Program Files\LMMS\plugins\ladspa\comb_splitter_1411.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00016398 _____ () C:\Program Files\LMMS\plugins\ladspa\const_1909.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00016910 _____ () C:\Program Files\LMMS\plugins\ladspa\crossover_dist_1404.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00016398 _____ () C:\Program Files\LMMS\plugins\ladspa\dc_remove_1207.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00018446 _____ () C:\Program Files\LMMS\plugins\ladspa\decay_1886.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00020494 _____ () C:\Program Files\LMMS\plugins\ladspa\decimator_1202.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00017422 _____ () C:\Program Files\LMMS\plugins\ladspa\declip_1195.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00028686 _____ () C:\Program Files\LMMS\plugins\ladspa\delay_1898.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00027662 _____ () C:\Program Files\LMMS\plugins\ladspa\delayorama_1402.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00022030 _____ () C:\Program Files\LMMS\plugins\ladspa\diode_1185.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00021518 _____ () C:\Program Files\LMMS\plugins\ladspa\divider_1186.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00032782 _____ () C:\Program Files\LMMS\plugins\ladspa\dj_eq_1901.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00017422 _____ () C:\Program Files\LMMS\plugins\ladspa\dj_flanger_1438.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00025102 _____ () C:\Program Files\LMMS\plugins\ladspa\dyson_compress_1403.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00019982 _____ () C:\Program Files\LMMS\plugins\ladspa\fad_delay_1192.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00023566 _____ () C:\Program Files\LMMS\plugins\ladspa\fast_lookahead_limiter_1913.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00018958 _____ () C:\Program Files\LMMS\plugins\ladspa\flanger_1191.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00017934 _____ () C:\Program Files\LMMS\plugins\ladspa\foldover_1213.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00017934 _____ () C:\Program Files\LMMS\plugins\ladspa\foverdrive_1196.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00017422 _____ () C:\Program Files\LMMS\plugins\ladspa\freq_tracker_1418.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00024590 _____ () C:\Program Files\LMMS\plugins\ladspa\gate_1410.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00018446 _____ () C:\Program Files\LMMS\plugins\ladspa\giant_flange_1437.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00028686 _____ () C:\Program Files\LMMS\plugins\ladspa\gong_1424.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00021518 _____ () C:\Program Files\LMMS\plugins\ladspa\gong_beater_1439.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00064014 _____ () C:\Program Files\LMMS\plugins\ladspa\gsm_1215.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00029710 _____ () C:\Program Files\LMMS\plugins\ladspa\gverb_1216.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00021518 _____ () C:\Program Files\LMMS\plugins\ladspa\hard_limiter_1413.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00018446 _____ () C:\Program Files\LMMS\plugins\ladspa\harmonic_gen_1220.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00046094 _____ () C:\Program Files\LMMS\plugins\ladspa\hermes_filter_1200.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00022542 _____ () C:\Program Files\LMMS\plugins\ladspa\highpass_iir_1890.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00016910 _____ () C:\Program Files\LMMS\plugins\ladspa\hilbert_1440.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00320014 _____ () C:\Program Files\LMMS\plugins\ladspa\imp_1199.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00016398 _____ () C:\Program Files\LMMS\plugins\ladspa\impulse_1885.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00017422 _____ () C:\Program Files\LMMS\plugins\ladspa\inv_1429.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00022030 _____ () C:\Program Files\LMMS\plugins\ladspa\karaoke_1409.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00014350 _____ () C:\Program Files\LMMS\plugins\ladspa\ladspa-util.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00017422 _____ () C:\Program Files\LMMS\plugins\ladspa\latency_1914.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00026126 _____ () C:\Program Files\LMMS\plugins\ladspa\lcr_delay_1436.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00022542 _____ () C:\Program Files\LMMS\plugins\ladspa\lowpass_iir_1891.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00018958 _____ () C:\Program Files\LMMS\plugins\ladspa\ls_filter_1908.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00018958 _____ () C:\Program Files\LMMS\plugins\ladspa\matrix_ms_st_1421.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00017422 _____ () C:\Program Files\LMMS\plugins\ladspa\matrix_spatialiser_1422.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00016910 _____ () C:\Program Files\LMMS\plugins\ladspa\matrix_st_ms_1420.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00029198 _____ () C:\Program Files\LMMS\plugins\ladspa\mbeq_1197.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00016398 _____ () C:\Program Files\LMMS\plugins\ladspa\mod_delay_1419.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00025102 _____ () C:\Program Files\LMMS\plugins\ladspa\multivoice_chorus_1201.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00024078 _____ () C:\Program Files\LMMS\plugins\ladspa\notch_iir_1894.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00024590 _____ () C:\Program Files\LMMS\plugins\ladspa\phasers_1217.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00022030 _____ () C:\Program Files\LMMS\plugins\ladspa\pitch_scale_1193.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00021518 _____ () C:\Program Files\LMMS\plugins\ladspa\pitch_scale_1194.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00027150 _____ () C:\Program Files\LMMS\plugins\ladspa\plate_1423.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00017934 _____ () C:\Program Files\LMMS\plugins\ladspa\pointer_cast_1910.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00016398 _____ () C:\Program Files\LMMS\plugins\ladspa\rate_shifter_1417.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00020494 _____ () C:\Program Files\LMMS\plugins\ladspa\retro_flange_1208.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00023566 _____ () C:\Program Files\LMMS\plugins\ladspa\revdelay_1605.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00021518 _____ () C:\Program Files\LMMS\plugins\ladspa\ringmod_1188.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00020494 _____ () C:\Program Files\LMMS\plugins\ladspa\satan_maximiser_1408.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00023054 _____ () C:\Program Files\LMMS\plugins\ladspa\sc1_1425.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00023566 _____ () C:\Program Files\LMMS\plugins\ladspa\sc2_1426.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00024590 _____ () C:\Program Files\LMMS\plugins\ladspa\sc3_1427.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00026126 _____ () C:\Program Files\LMMS\plugins\ladspa\sc4_1882.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00025614 _____ () C:\Program Files\LMMS\plugins\ladspa\sc4m_1916.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00025614 _____ () C:\Program Files\LMMS\plugins\ladspa\se4_1883.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00021006 _____ () C:\Program Files\LMMS\plugins\ladspa\shaper_1187.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00039950 _____ () C:\Program Files\LMMS\plugins\ladspa\sifter_1210.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00019982 _____ () C:\Program Files\LMMS\plugins\ladspa\sin_cos_1881.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00022030 _____ () C:\Program Files\LMMS\plugins\ladspa\single_para_1203.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00016398 _____ () C:\Program Files\LMMS\plugins\ladspa\sinus_wavewrapper_1198.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00016398 _____ () C:\Program Files\LMMS\plugins\ladspa\smooth_decimate_1414.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00017934 _____ () C:\Program Files\LMMS\plugins\ladspa\split_1406.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00016910 _____ () C:\Program Files\LMMS\plugins\ladspa\step_muxer_1212.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00017422 _____ () C:\Program Files\LMMS\plugins\ladspa\surround_encoder_1401.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00021006 _____ () C:\Program Files\LMMS\plugins\ladspa\svf_1214.dll
2014-07-10 16:37 - 2014-07-10 16:37 - 00021518 _____ () C:\Program Files\LMMS\plugins\ladspa\tap_autopan.dll
2014-07-10 16:37 - 2014-07-10 16:37 - 00024590 _____ () C:\Program Files\LMMS\plugins\ladspa\tap_chorusflanger.dll
2014-07-10 16:37 - 2014-07-10 16:37 - 00022542 _____ () C:\Program Files\LMMS\plugins\ladspa\tap_deesser.dll
2014-07-10 16:37 - 2014-07-10 16:37 - 00025614 _____ () C:\Program Files\LMMS\plugins\ladspa\tap_doubler.dll
2014-07-10 16:37 - 2014-07-10 16:37 - 00026638 _____ () C:\Program Files\LMMS\plugins\ladspa\tap_dynamics_m.dll
2014-07-10 16:37 - 2014-07-10 16:37 - 00032270 _____ () C:\Program Files\LMMS\plugins\ladspa\tap_dynamics_st.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00022542 _____ () C:\Program Files\LMMS\plugins\ladspa\tap_echo.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00034830 _____ () C:\Program Files\LMMS\plugins\ladspa\tap_eq.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00037902 _____ () C:\Program Files\LMMS\plugins\ladspa\tap_eqbw.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00022030 _____ () C:\Program Files\LMMS\plugins\ladspa\tap_limiter.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00021518 _____ () C:\Program Files\LMMS\plugins\ladspa\tap_pinknoise.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00025102 _____ () C:\Program Files\LMMS\plugins\ladspa\tap_pitch.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00023054 _____ () C:\Program Files\LMMS\plugins\ladspa\tap_reflector.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00045582 _____ () C:\Program Files\LMMS\plugins\ladspa\tap_reverb.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00027662 _____ () C:\Program Files\LMMS\plugins\ladspa\tap_rotspeak.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00021518 _____ () C:\Program Files\LMMS\plugins\ladspa\tap_sigmoid.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00021006 _____ () C:\Program Files\LMMS\plugins\ladspa\tap_tremolo.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00018958 _____ () C:\Program Files\LMMS\plugins\ladspa\tap_tubewarmth.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00022542 _____ () C:\Program Files\LMMS\plugins\ladspa\tap_vibrato.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00023566 _____ () C:\Program Files\LMMS\plugins\ladspa\tape_delay_1211.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00017422 _____ () C:\Program Files\LMMS\plugins\ladspa\transient_1206.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00029198 _____ () C:\Program Files\LMMS\plugins\ladspa\triple_para_1204.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00017422 _____ () C:\Program Files\LMMS\plugins\ladspa\valve_1209.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00017422 _____ () C:\Program Files\LMMS\plugins\ladspa\valve_rect_1405.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00022030 _____ () C:\Program Files\LMMS\plugins\ladspa\vocoder_1337.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00025614 _____ () C:\Program Files\LMMS\plugins\ladspa\vynil_1905.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00018446 _____ () C:\Program Files\LMMS\plugins\ladspa\wave_terrain_1412.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00021518 _____ () C:\Program Files\LMMS\plugins\ladspa\xfade_1915.dll
2014-07-10 16:38 - 2014-07-10 16:38 - 00015886 _____ () C:\Program Files\LMMS\plugins\ladspa\zm1_1428.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\ProgramData\TEMP:5C321E34
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
========================= Accounts: ==========================
Administrator (S-1-5-21-2708201434-1965334668-4040377041-500 - Administrator - Disabled)
Gast (S-1-5-21-2708201434-1965334668-4040377041-501 - Limited - Disabled)
Herrin (S-1-5-21-2708201434-1965334668-4040377041-1000 - Administrator - Enabled) => C:\Users\Herrin
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (11/22/2014 05:12:23 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\HERRIN\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\P3IKZU2D\ZZZZZZZZZZZ.ZZZ> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (11/22/2014 05:12:23 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\HERRIN\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\8WAE1SP4\ZZZZZZZZZZZZZZZZZ.ZZZ> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (11/22/2014 05:12:23 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\HERRIN\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\8WAE1SP4\ZZZZZZZZZZZZ.ZZZ> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (11/22/2014 05:12:22 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\HERRIN\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\N0CFJ5ZN\ZZZZZZZZZZZZ.ZZZ> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (11/22/2014 05:12:22 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\HERRIN\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\8WAE1SP4\ZZZZZZZZZZ.ZZZ> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (11/22/2014 05:12:22 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\HERRIN\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\8WAE1SP4\ZZZZZZZZ.ZZZ> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (11/22/2014 05:12:22 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\HERRIN\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\N0CFJ5ZN\ZZZZ.ZZZ> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (11/22/2014 05:12:22 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\HERRIN\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\8WAE1SP4\ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ.ZZZ> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (11/22/2014 05:12:21 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\HERRIN\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\8WAE1SP4\ZZZZZZZZZZ.ZZZ> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (11/22/2014 05:12:21 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\HERRIN\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\8WAE1SP4\ZZZZZZZZZZZZZZ.ZZZ> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
System errors:
=============
Error: (12/01/2014 07:44:14 AM) (Source: Server) (EventID: 2505) (User: )
Description: Aufgrund eines doppelten Netzwerknamens konnte zu der Transportschicht \Device\NetBT_Tcpip_{D7843502-9177-48BB-BEA0-98A833E831F7} vom Serverdienst nicht gebunden werden. Der Serverdienst konnte nicht gestartet werden.
Error: (11/30/2014 11:15:38 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {C2BFE331-6739-4270-86C9-493D9A04CD38}
Error: (11/30/2014 10:52:54 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
Error: (11/29/2014 09:50:35 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {C2BFE331-6739-4270-86C9-493D9A04CD38}
Error: (11/28/2014 11:51:48 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {C2BFE331-6739-4270-86C9-493D9A04CD38}
Error: (11/27/2014 09:05:58 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Windows Search%%1053
Error: (11/27/2014 09:05:57 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: 30000Windows Search
Error: (11/27/2014 08:52:07 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Windows Search%%1053
Error: (11/27/2014 08:52:07 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: 30000Windows Search
Error: (11/27/2014 08:52:07 PM) (Source: DCOM) (EventID: 10005) (User: )
Description: 1053WSearch{9E175B6D-F52A-11D8-B9A5-505054503030}
Microsoft Office Sessions:
=========================
Error: (11/22/2014 05:12:23 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
C:\USERS\HERRIN\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\P3IKZU2D\ZZZZZZZZZZZ.ZZZ
Error: (11/22/2014 05:12:23 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
C:\USERS\HERRIN\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\8WAE1SP4\ZZZZZZZZZZZZZZZZZ.ZZZ
Error: (11/22/2014 05:12:23 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
C:\USERS\HERRIN\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\8WAE1SP4\ZZZZZZZZZZZZ.ZZZ
Error: (11/22/2014 05:12:22 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
C:\USERS\HERRIN\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\N0CFJ5ZN\ZZZZZZZZZZZZ.ZZZ
Error: (11/22/2014 05:12:22 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
C:\USERS\HERRIN\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\8WAE1SP4\ZZZZZZZZZZ.ZZZ
Error: (11/22/2014 05:12:22 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
C:\USERS\HERRIN\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\8WAE1SP4\ZZZZZZZZ.ZZZ
Error: (11/22/2014 05:12:22 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
C:\USERS\HERRIN\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\N0CFJ5ZN\ZZZZ.ZZZ
Error: (11/22/2014 05:12:22 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
C:\USERS\HERRIN\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\8WAE1SP4\ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ.ZZZ
Error: (11/22/2014 05:12:21 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
C:\USERS\HERRIN\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\8WAE1SP4\ZZZZZZZZZZ.ZZZ
Error: (11/22/2014 05:12:21 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
C:\USERS\HERRIN\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\8WAE1SP4\ZZZZZZZZZZZZZZ.ZZZ
CodeIntegrity Errors:
===================================
Date: 2014-12-01 11:23:24.003
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-12-01 11:23:22.742
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-12-01 11:23:21.507
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-12-01 11:23:20.304
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-12-01 11:23:18.092
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-12-01 11:23:16.807
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-12-01 11:23:15.531
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-12-01 11:23:14.286
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-11-30 10:34:48.289
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-11-30 10:34:47.199
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Processor: Intel(R) Core(TM)2 Duo CPU T7500 @ 2.20GHz
Percentage of memory in use: 90%
Total physical RAM: 1013.63 MB
Available physical RAM: 100.28 MB
Total Pagefile: 2490.95 MB
Available Pagefile: 846.87 MB
Total Virtual: 2047.88 MB
Available Virtual: 1903.48 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:74.53 GB) (Free:31.93 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 74.5 GB) (Disk ID: 23F12D67)
Partition 1: (Active) - (Size=74.5 GB) - (Type=07 NTFS)
==================== End Of Log ============================
|
|
02.12.2014, 09:32
| #30 |
| /// the machine /// TB-Ausbilder | Windows Vista: Adware und anderes Zeugs Die Proxy Einträge die ich die ganze Zeit raus fixen will und einfach nicht verschwinden  Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:52644;https=127.0.0.1:52644;
AlternateDataStreams: C:\ProgramData\TEMP:5C321E34
Emptytemp:
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
Linear-Darstellung
