Continue Live Installation lässt sich nicht entfernen.

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 11-03-2015
Ran by Andreas (administrator) on ANDREAS-MSI on 12-03-2015 20:05:15
Running from C:\Users\Andreas\Desktop
Loaded Profiles: Andreas (Available profiles: Andreas)
Platform: Microsoft Windows 7 Starter  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 8 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(ArcSoft Inc.) C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
(Micro-Star International Co., Ltd.) C:\Program Files\System Control Manager\MSIService.exe
() C:\Users\Andreas\AppData\Roaming\00000000-1425492588-0000-0000-406186B6FEAB\jnsp274E.tmp
(Microsoft Corp.) C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Micro-Star International Co., Ltd.) C:\Program Files\System Control Manager\MGSysCtrl.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe
(ArcSoft Inc.) C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
(ArcSoft Inc.) C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(Microsoft Corporation) C:\Windows\SoftwareDistribution\Download\Install\Windows-KB890830-V5.22.exe
(Microsoft Corporation) C:\83c2b2a725fa11d4c0b15da0\mrtstub.exe
(Microsoft Corporation) C:\Windows\System32\MRT.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_16_0_0_305.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_16_0_0_305.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [8555040 2010-04-06] (Realtek Semiconductor)
HKLM\...\Run: [MGSysCtrl] => C:\Program Files\System Control Manager\MGSysCtrl.exe [2408448 2010-04-03] (Micro-Star International Co., Ltd.)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [703280 2015-03-11] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [Avira Systray] => C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe [127792 2015-02-12] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [ArcSoft Connection Service] => C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [207424 2010-10-27] (ArcSoft Inc.)
HKU\S-1-5-21-1040275345-4236665489-3623780555-1000\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-1040275345-4236665489-3623780555-1000\...\MountPoints2: {495f0f89-3f12-11e2-b060-406186b6feab} - E:\AutoRun.exe
HKU\S-1-5-21-1040275345-4236665489-3623780555-1000\...\MountPoints2: {bfb0e6e9-374c-11e2-b379-406186b6feab} - E:\AutoRun.exe
HKU\S-1-5-21-1040275345-4236665489-3623780555-1000\...\MountPoints2: {bfb0e6ed-374c-11e2-b379-406186b6feab} - E:\AutoRun.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
Startup: C:\Users\Andreas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Ross-Tech VCDS DRV Updater-PCI.lnk
ShortcutTarget: Ross-Tech VCDS DRV Updater-PCI.lnk -> D:\PCI-Tuning\VCDS-PCI\VCDS.exe (No File)
Startup: C:\Users\Andreas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Ross-Tech VCDS DRV Updater.lnk
ShortcutTarget: Ross-Tech VCDS DRV Updater.lnk -> D:\PCI-Tuning\VCDS-PCI\VCDS.exe (No File)
Startup: C:\Users\Andreas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Ross-Tech VCDS Updater-DRV1.lnk
ShortcutTarget: Ross-Tech VCDS Updater-DRV1.lnk -> C:\Ross-Tech\VCDS-DRV\VCDS.exe (Ross-Tech, LLC)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
SearchScopes: HKLM -> {D112C151-F902-43B6-9F4F-35B55A908BEB} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSITDF&pc=MAMI&src=IE-SearchBox
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-1040275345-4236665489-3623780555-1000 -> {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = hxxp://www.luckysearches.com/web/?utm_source=b&utm_medium=exp&utm_campaign=install_ie&utm_content=ds&from=exp&uid=HitachiXHTS545025B9A300_100410PBN2061SFPP7MTX&ts=1425491765&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1040275345-4236665489-3623780555-1000 -> {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = hxxp://www.luckysearches.com/web/?utm_source=b&utm_medium=exp&utm_campaign=install_ie&utm_content=ds&from=exp&uid=HitachiXHTS545025B9A300_100410PBN2061SFPP7MTX&ts=1425491765&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1040275345-4236665489-3623780555-1000 -> {D112C151-F902-43B6-9F4F-35B55A908BEB} URL = hxxp://www.luckysearches.com/web/?utm_source=b&utm_medium=exp&utm_campaign=install_ie&utm_content=ds&from=exp&uid=HitachiXHTS545025B9A300_100410PBN2061SFPP7MTX&ts=1425491765&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1040275345-4236665489-3623780555-1000 -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = hxxp://www.luckysearches.com/web/?utm_source=b&utm_medium=exp&utm_campaign=install_ie&utm_content=ds&from=exp&uid=HitachiXHTS545025B9A300_100410PBN2061SFPP7MTX&ts=1425491765&type=default&q={searchTerms}
BHO: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll [2014-04-09] (McAfee, Inc.)
BHO: No Name -> {5C255C8A-E604-49b4-9D64-90988571CECB} ->  No File
BHO: Search Helper -> {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} -> C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll [2009-01-14] (Microsoft Corp.)
BHO: Windows Live Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll [2011-06-30] (Sun Microsystems, Inc.)
BHO: Windows Live Toolbar Helper -> {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} -> C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06] (Microsoft Corporation)
Toolbar: HKLM - &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06] (Microsoft Corporation)
Toolbar: HKU\S-1-5-21-1040275345-4236665489-3623780555-1000 -> &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06] (Microsoft Corporation)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll [2009-07-26] (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll [2009-07-26] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Andreas\AppData\Roaming\Mozilla\Firefox\Profiles\td8dftq3.default
FF DefaultSearchEngine: Ecosia
FF SelectedSearchEngine: luckysearches
FF Homepage: https://www.google.de/
FF Keyword.URL: hxxp://scour.com/search/web/
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF32_16_0_0_305.dll [2015-02-16] ()
FF Plugin: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf -> C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2011-02-23] (Foxit Corporation)
FF Plugin: @java.com/JavaPlugin -> C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll [2011-05-04] (Sun Microsystems, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=14.0.8081.0709 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2009-07-10] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll [2011-05-04] (Sun Microsystems, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll [2012-10-07] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll [2012-10-07] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll [2012-10-07] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll [2012-10-07] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll [2012-10-07] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin6.dll [2012-10-07] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin7.dll [2012-10-07] (Apple Inc.)
FF SearchPlugin: C:\Users\Andreas\AppData\Roaming\Mozilla\Firefox\Profiles\td8dftq3.default\searchplugins\ecosia.xml [2015-03-12]
FF SearchPlugin: C:\Users\Andreas\AppData\Roaming\Mozilla\Firefox\Profiles\td8dftq3.default\searchplugins\google-images.xml [2014-11-09]
FF SearchPlugin: C:\Users\Andreas\AppData\Roaming\Mozilla\Firefox\Profiles\td8dftq3.default\searchplugins\google-maps.xml [2014-11-09]
FF SearchPlugin: C:\Users\Andreas\AppData\Roaming\Mozilla\Firefox\Profiles\td8dftq3.default\searchplugins\luckysearches.xml [2015-03-04]
FF Extension: Avira Browser Safety - C:\Users\Andreas\AppData\Roaming\Mozilla\Firefox\Profiles\td8dftq3.default\Extensions\abs@avira.com [2015-03-09]
FF Extension: YouTube™ Flash® Player - C:\Users\Andreas\AppData\Roaming\Mozilla\Firefox\Profiles\td8dftq3.default\Extensions\jid1-HAV2inXAnQPIeA@jetpack.xpi [2014-11-24]
FF Extension: Ecosia — The search engine that plants trees! - C:\Users\Andreas\AppData\Roaming\Mozilla\Firefox\Profiles\td8dftq3.default\Extensions\{d04b0b40-3dab-4f0b-97a6-04ec3eddbfb0}.xpi [2014-11-09]
FF HKU\S-1-5-21-1040275345-4236665489-3623780555-1000\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: McAfee Security Scan Plus - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]

Chrome: 
=======
CHR HKLM\...\Chrome\Extension: [bopakagnckmlgajfccecajhnimjiiedh] - hxxp://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 ACDaemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [432888 2015-03-11] (Avira Operations GmbH & Co. KG)
S4 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [432888 2015-03-11] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe [184056 2015-02-12] (Avira Operations GmbH & Co. KG)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [235696 2014-04-09] (McAfee, Inc.)
R2 Micro Star SCM; C:\Program Files\System Control Manager\MSIService.exe [160768 2009-07-09] (Micro-Star International Co., Ltd.) [File not signed]
R2 nerelefe; C:\Users\Andreas\AppData\Roaming\00000000-1425492588-0000-0000-406186B6FEAB\jnsp274E.tmp [103424 2015-03-04] () [File not signed]
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 ArcSoftKsUFilter; C:\windows\System32\DRIVERS\ArcSoftKsUFilter.sys [17408 2009-05-26] (ArcSoft, Inc.)
R2 avgntflt; C:\windows\System32\DRIVERS\avgntflt.sys [105864 2015-03-11] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\windows\System32\DRIVERS\avipbb.sys [136216 2015-03-11] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-25] (Avira Operations GmbH & Co. KG)
S2 hardlock; C:\windows\system32\drivers\hardlock.sys [408576 2003-08-16] (Aladdin Knowledge Systems) [File not signed]
S3 RT-USB; C:\windows\System32\drivers\RT-USB.SYS [80256 2014-05-12] (Ross-Tech LLC)
R1 ssmdrv; C:\windows\System32\DRIVERS\ssmdrv.sys [28520 2013-03-02] (Avira GmbH)
S3 USBAAPL; C:\windows\System32\Drivers\usbaapl.sys [44032 2012-07-09] (Apple, Inc.) [File not signed]
S3 fspad_wlh32; \SystemRoot\system32\DRIVERS\fspad_wlh32.sys [X]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-12 20:05 - 2015-03-12 20:06 - 00015564 _____ () C:\Users\Andreas\Desktop\FRST.txt
2015-03-12 20:05 - 2015-03-12 20:05 - 00000000 ____D () C:\FRST
2015-03-12 20:04 - 2015-03-12 20:04 - 01135104 _____ (Farbar) C:\Users\Andreas\Desktop\FRST.exe
2015-03-12 19:55 - 2015-03-12 19:55 - 00000000 ____D () C:\windows\system32\MRT
2015-03-12 19:55 - 2015-03-12 19:55 - 00000000 ____D () C:\83c2b2a725fa11d4c0b15da0
2015-03-12 19:45 - 2015-03-12 19:45 - 00001069 _____ () C:\Users\Andreas\Desktop\Continue Live Installation.lnk
2015-03-11 18:25 - 2015-03-11 18:25 - 271597204 _____ () C:\windows\MEMORY.DMP
2015-03-11 18:25 - 2015-03-11 18:25 - 00145632 _____ () C:\windows\Minidump\031115-33072-01.dmp
2015-03-11 18:25 - 2015-03-11 18:25 - 00000000 ____D () C:\windows\Minidump
2015-03-10 06:50 - 2015-03-10 06:50 - 00000000 ___SD () C:\windows\system32\CompatTel
2015-03-10 06:50 - 2015-03-10 06:50 - 00000000 ____D () C:\windows\system32\appraiser
2015-03-10 02:07 - 2014-10-18 02:33 - 03209728 _____ (Microsoft Corporation) C:\windows\system32\mf.dll
2015-03-10 02:07 - 2014-07-07 02:40 - 00103424 _____ (Microsoft Corporation) C:\windows\system32\mfps.dll
2015-03-10 02:07 - 2014-07-07 02:39 - 00050176 _____ (Microsoft Corporation) C:\windows\system32\rrinstaller.exe
2015-03-10 02:07 - 2014-07-07 02:39 - 00023040 _____ (Microsoft Corporation) C:\windows\system32\mfpmp.exe
2015-03-10 02:07 - 2014-07-07 02:37 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\mferror.dll
2015-03-10 01:46 - 2015-01-09 00:44 - 00419936 _____ () C:\windows\system32\locale.nls
2015-03-10 01:07 - 2014-06-27 02:45 - 02285056 _____ (Microsoft Corporation) C:\windows\system32\msmpeg2vdec.dll
2015-03-10 00:26 - 2014-06-30 23:14 - 00008856 _____ (Microsoft Corporation) C:\windows\system32\icardres.dll
2015-03-10 00:26 - 2014-06-06 07:16 - 00035480 _____ (Microsoft Corporation) C:\windows\system32\TsWpfWrp.exe
2015-03-10 00:26 - 2014-03-09 22:47 - 00619672 _____ (Microsoft Corporation) C:\windows\system32\icardagt.exe
2015-03-10 00:26 - 2014-03-09 22:47 - 00099480 _____ (Microsoft Corporation) C:\windows\system32\infocardapi.dll
2015-03-09 23:28 - 2013-05-10 05:56 - 12625408 _____ (Microsoft Corporation) C:\windows\system32\wmploc.DLL
2015-03-09 23:28 - 2013-05-10 05:56 - 11410432 _____ (Microsoft Corporation) C:\windows\system32\wmp.dll
2015-03-09 22:28 - 2015-01-14 06:44 - 03972544 _____ (Microsoft Corporation) C:\windows\system32\ntkrnlpa.exe
2015-03-09 22:28 - 2015-01-14 06:44 - 03917760 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2015-03-09 22:28 - 2014-12-19 02:34 - 00116224 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxdav.sys
2015-03-09 22:28 - 2014-11-11 03:44 - 00550912 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll
2015-03-09 22:27 - 2015-01-15 08:46 - 00136640 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys
2015-03-09 22:27 - 2015-01-15 08:46 - 00067520 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecdd.sys
2015-03-09 22:27 - 2015-01-15 08:43 - 00100352 _____ (Microsoft Corporation) C:\windows\system32\sspicli.dll
2015-03-09 22:27 - 2015-01-15 08:43 - 00015872 _____ (Microsoft Corporation) C:\windows\system32\sspisrv.dll
2015-03-09 22:27 - 2015-01-15 08:42 - 01061376 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll
2015-03-09 22:27 - 2015-01-15 08:42 - 00050176 _____ (Microsoft Corporation) C:\windows\system32\auditpol.exe
2015-03-09 22:27 - 2015-01-15 08:42 - 00022528 _____ (Microsoft Corporation) C:\windows\system32\lsass.exe
2015-03-09 22:27 - 2015-01-15 08:42 - 00022016 _____ (Microsoft Corporation) C:\windows\system32\secur32.dll
2015-03-09 22:27 - 2015-01-15 08:39 - 00146432 _____ (Microsoft Corporation) C:\windows\system32\msaudite.dll
2015-03-09 22:27 - 2015-01-15 08:39 - 00060416 _____ (Microsoft Corporation) C:\windows\system32\msobjs.dll
2015-03-09 22:27 - 2015-01-15 08:37 - 00686080 _____ (Microsoft Corporation) C:\windows\system32\adtschema.dll
2015-03-09 22:27 - 2015-01-15 05:21 - 00369968 _____ (Microsoft Corporation) C:\windows\system32\Drivers\cng.sys
2015-03-09 22:27 - 2013-10-12 03:04 - 00121856 _____ (Microsoft Corporation) C:\windows\system32\wshom.ocx
2015-03-09 22:27 - 2013-10-12 03:03 - 00163840 _____ (Microsoft Corporation) C:\windows\system32\scrrun.dll
2015-03-09 22:27 - 2013-10-12 02:15 - 00141824 _____ (Microsoft Corporation) C:\windows\system32\wscript.exe
2015-03-09 22:27 - 2013-10-12 02:15 - 00126976 _____ (Microsoft Corporation) C:\windows\system32\cscript.exe
2015-03-09 22:26 - 2014-04-25 03:06 - 00626688 _____ (Microsoft Corporation) C:\windows\system32\usp10.dll
2015-03-09 22:24 - 2015-01-09 03:48 - 00635904 _____ (Microsoft Corporation) C:\windows\system32\perftrack.dll
2015-03-09 22:24 - 2015-01-09 03:48 - 00076800 _____ (Microsoft Corporation) C:\windows\system32\wdi.dll
2015-03-09 22:24 - 2015-01-09 03:48 - 00027136 _____ (Microsoft Corporation) C:\windows\system32\powertracker.dll
2015-03-09 22:24 - 2014-03-04 10:17 - 00538112 _____ (Microsoft Corporation) C:\windows\system32\objsel.dll
2015-03-09 22:24 - 2014-03-04 10:17 - 00293376 _____ (Microsoft Corporation) C:\windows\system32\KernelBase.dll
2015-03-09 22:24 - 2014-03-04 10:17 - 00051200 _____ (Microsoft Corporation) C:\windows\system32\cngprovider.dll
2015-03-09 22:24 - 2014-03-04 10:17 - 00049664 _____ (Microsoft Corporation) C:\windows\system32\adprovider.dll
2015-03-09 22:24 - 2014-03-04 10:17 - 00048128 _____ (Microsoft Corporation) C:\windows\system32\capiprovider.dll
2015-03-09 22:24 - 2014-03-04 10:17 - 00047616 _____ (Microsoft Corporation) C:\windows\system32\dpapiprovider.dll
2015-03-09 22:24 - 2014-03-04 10:17 - 00036864 _____ (Microsoft Corporation) C:\windows\system32\dimsroam.dll
2015-03-09 22:24 - 2014-03-04 10:17 - 00035328 _____ (Microsoft Corporation) C:\windows\system32\wincredprovider.dll
2015-03-09 22:23 - 2013-12-04 03:03 - 00428032 _____ (Microsoft Corporation) C:\windows\system32\secproc.dll
2015-03-09 22:23 - 2013-12-04 03:03 - 00423936 _____ (Microsoft Corporation) C:\windows\system32\secproc_isv.dll
2015-03-09 22:23 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\windows\system32\secproc_ssp_isv.dll
2015-03-09 22:23 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\windows\system32\secproc_ssp.dll
2015-03-09 22:23 - 2013-12-04 03:02 - 00390144 _____ (Microsoft Corporation) C:\windows\system32\msdrm.dll
2015-03-09 22:23 - 2013-12-04 02:54 - 00594944 _____ (Microsoft Corporation) C:\windows\system32\RMActivate_isv.exe
2015-03-09 22:23 - 2013-12-04 02:54 - 00572416 _____ (Microsoft Corporation) C:\windows\system32\RMActivate.exe
2015-03-09 22:23 - 2013-12-04 02:54 - 00510976 _____ (Microsoft Corporation) C:\windows\system32\RMActivate_ssp.exe
2015-03-09 22:23 - 2013-12-04 02:54 - 00508928 _____ (Microsoft Corporation) C:\windows\system32\RMActivate_ssp_isv.exe
2015-03-09 22:22 - 2014-07-17 02:40 - 00157696 _____ (Microsoft Corporation) C:\windows\system32\winsta.dll
2015-03-09 22:22 - 2014-07-17 02:39 - 01051136 _____ (Microsoft Corporation) C:\windows\system32\mstsc.exe
2015-03-09 22:22 - 2014-07-17 02:39 - 00304128 _____ (Microsoft Corporation) C:\windows\system32\winlogon.exe
2015-03-09 22:22 - 2014-07-17 02:39 - 00130048 _____ (Microsoft Corporation) C:\windows\system32\rdpcorekmts.dll
2015-03-09 22:22 - 2014-07-17 02:03 - 00184320 _____ (Microsoft Corporation) C:\windows\system32\Drivers\rdpwd.sys
2015-03-09 22:22 - 2014-07-17 02:02 - 00031232 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tssecsrv.sys
2015-03-09 22:20 - 2014-08-01 12:35 - 00793600 _____ (Microsoft Corporation) C:\windows\system32\TSWorkspace.dll
2015-03-09 22:20 - 2013-08-28 01:57 - 00434688 _____ (Microsoft Corporation) C:\windows\system32\scavengeui.dll
2015-03-09 22:17 - 2014-09-19 10:23 - 00259584 _____ (Microsoft Corporation) C:\windows\system32\msv1_0.dll
2015-03-09 22:17 - 2014-09-19 10:23 - 00248832 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll
2015-03-09 22:17 - 2014-09-19 10:23 - 00221184 _____ (Microsoft Corporation) C:\windows\system32\ncrypt.dll
2015-03-09 22:17 - 2014-09-19 10:23 - 00172032 _____ (Microsoft Corporation) C:\windows\system32\wdigest.dll
2015-03-09 22:17 - 2014-09-19 10:23 - 00065536 _____ (Microsoft Corporation) C:\windows\system32\TSpkg.dll
2015-03-09 22:17 - 2014-09-19 10:23 - 00017408 _____ (Microsoft Corporation) C:\windows\system32\credssp.dll
2015-03-09 22:17 - 2014-02-04 03:07 - 00234432 _____ (Microsoft Corporation) C:\windows\system32\Drivers\msiscsi.sys
2015-03-09 22:17 - 2014-02-04 03:07 - 00149440 _____ (Microsoft Corporation) C:\windows\system32\Drivers\storport.sys
2015-03-09 22:17 - 2014-02-04 03:07 - 00027072 _____ (Microsoft Corporation) C:\windows\system32\Drivers\Diskdump.sys
2015-03-09 22:17 - 2014-02-04 03:00 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\iologmsg.dll
2015-03-09 22:17 - 2013-07-09 05:46 - 00103936 _____ (Microsoft Corporation) C:\windows\system32\cryptnet.dll
2015-03-09 22:16 - 2015-02-04 03:54 - 00482304 _____ (Microsoft Corporation) C:\windows\system32\generaltel.dll
2015-03-09 22:16 - 2015-02-04 03:53 - 00767488 _____ (Microsoft Corporation) C:\windows\system32\appraiser.dll
2015-03-09 22:16 - 2015-02-04 03:53 - 00621056 _____ (Microsoft Corporation) C:\windows\system32\invagent.dll
2015-03-09 22:16 - 2015-02-04 03:53 - 00325632 _____ (Microsoft Corporation) C:\windows\system32\devinv.dll
2015-03-09 22:16 - 2015-02-04 03:53 - 00202752 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2015-03-09 22:16 - 2015-02-04 03:53 - 00159744 _____ (Microsoft Corporation) C:\windows\system32\aepic.dll
2015-03-09 22:16 - 2015-02-04 03:49 - 00886784 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2015-03-09 22:16 - 2015-01-28 00:36 - 01167520 _____ (Microsoft Corporation) C:\windows\system32\aitstatic.exe
2015-03-09 22:16 - 2014-06-25 02:41 - 12874240 _____ (Microsoft Corporation) C:\windows\system32\shell32.dll
2015-03-09 22:16 - 2013-11-26 09:16 - 03419136 _____ (Microsoft Corporation) C:\windows\system32\d2d1.dll
2015-03-09 22:16 - 2013-07-26 02:55 - 00180224 _____ (Microsoft Corporation) C:\windows\system32\shdocvw.dll
2015-03-09 22:14 - 2013-07-04 12:57 - 00205824 _____ (Microsoft Corporation) C:\windows\system32\WebClnt.dll
2015-03-09 22:14 - 2013-07-04 12:51 - 00081920 _____ (Microsoft Corporation) C:\windows\system32\davclnt.dll
2015-03-09 22:09 - 2013-11-23 19:26 - 00417792 _____ (Microsoft Corporation) C:\windows\system32\WMPhoto.dll
2015-03-09 22:09 - 2013-08-29 02:50 - 01289096 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll
2015-03-09 22:09 - 2013-08-29 02:50 - 00619520 _____ (Microsoft Corporation) C:\windows\system32\tdh.dll
2015-03-09 22:09 - 2013-08-29 02:48 - 00640512 _____ (Microsoft Corporation) C:\windows\system32\advapi32.dll
2015-03-09 22:05 - 2014-11-11 03:44 - 00186880 _____ (Microsoft Corporation) C:\windows\system32\pku2u.dll
2015-03-09 22:05 - 2014-08-23 02:46 - 00305152 _____ (Microsoft Corporation) C:\windows\system32\gdi32.dll
2015-03-09 22:04 - 2014-06-16 02:44 - 00730048 _____ (Microsoft Corporation) C:\windows\system32\Drivers\dxgkrnl.sys
2015-03-09 22:04 - 2014-06-16 02:44 - 00219072 _____ (Microsoft Corporation) C:\windows\system32\Drivers\dxgmms1.sys
2015-03-09 22:04 - 2014-06-16 02:40 - 00107520 _____ (Microsoft Corporation) C:\windows\system32\cdd.dll
2015-03-09 22:04 - 2013-10-04 02:58 - 00152576 _____ (Microsoft Corporation) C:\windows\system32\SmartcardCredentialProvider.dll
2015-03-09 22:04 - 2013-10-04 02:56 - 00168960 _____ (Microsoft Corporation) C:\windows\system32\credui.dll
2015-03-09 22:03 - 2015-01-09 02:45 - 02380288 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2015-03-09 22:03 - 2014-12-19 03:43 - 00164864 _____ (Microsoft Corporation) C:\windows\system32\profsvc.dll
2015-03-09 22:03 - 2014-12-12 06:07 - 01174528 _____ (Microsoft Corporation) C:\windows\system32\crypt32.dll
2015-03-09 22:03 - 2014-09-04 06:04 - 00372736 _____ (Microsoft Corporation) C:\windows\system32\rastls.dll
2015-03-09 22:03 - 2014-07-07 02:40 - 00179200 _____ (Microsoft Corporation) C:\windows\system32\wintrust.dll
2015-03-09 22:03 - 2014-07-07 02:40 - 00143872 _____ (Microsoft Corporation) C:\windows\system32\cryptsvc.dll
2015-03-09 22:03 - 2014-06-24 03:59 - 01987584 _____ (Microsoft Corporation) C:\windows\system32\d3d10warp.dll
2015-03-09 22:03 - 2014-06-18 02:51 - 00646144 _____ (Microsoft Corporation) C:\windows\system32\osk.exe
2015-03-09 22:03 - 2014-06-03 10:30 - 00101824 _____ (Microsoft Corporation) C:\windows\system32\consent.exe
2015-03-09 22:03 - 2014-06-03 10:29 - 01805824 _____ (Microsoft Corporation) C:\windows\system32\authui.dll
2015-03-09 22:03 - 2014-06-03 10:29 - 00337408 _____ (Microsoft Corporation) C:\windows\system32\msihnd.dll
2015-03-09 22:03 - 2014-03-26 15:27 - 01389056 _____ (Microsoft Corporation) C:\windows\system32\msxml6.dll
2015-03-09 22:03 - 2014-03-26 15:25 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\msxml6r.dll
2015-03-09 22:03 - 2013-10-19 02:36 - 00159232 _____ (Microsoft Corporation) C:\windows\system32\imagehlp.dll
2015-03-09 22:03 - 2013-09-08 03:03 - 00231424 _____ (Microsoft Corporation) C:\windows\system32\mswsock.dll
2015-03-09 22:03 - 2013-07-03 05:02 - 00036352 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbscan.sys
2015-03-09 22:03 - 2013-07-03 04:36 - 00055808 _____ (Microsoft Corporation) C:\windows\system32\Drivers\hidclass.sys
2015-03-09 22:03 - 2013-07-03 04:36 - 00025728 _____ (Microsoft Corporation) C:\windows\system32\Drivers\hidparse.sys
2015-03-09 22:03 - 2013-06-25 23:56 - 00527064 _____ (Microsoft Corporation) C:\windows\system32\Drivers\Wdf01000.sys
2015-03-09 22:02 - 2014-12-06 04:50 - 00242688 _____ (Microsoft Corporation) C:\windows\system32\nlasvc.dll
2015-03-09 22:02 - 2014-11-08 03:45 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\tzres.dll
2015-03-09 22:02 - 2014-10-14 02:50 - 02363904 _____ (Microsoft Corporation) C:\windows\system32\msi.dll
2015-03-09 22:02 - 2014-10-04 02:42 - 03221504 _____ (Microsoft Corporation) C:\windows\system32\mstscax.dll
2015-03-09 22:02 - 2014-10-04 02:42 - 00131584 _____ (Microsoft Corporation) C:\windows\system32\aaclient.dll
2015-03-09 22:02 - 2014-08-21 07:26 - 01237504 _____ (Microsoft Corporation) C:\windows\system32\msxml3.dll
2015-03-09 22:02 - 2014-08-21 07:23 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\msxml3r.dll
2015-03-09 22:02 - 2014-06-18 23:23 - 01131664 _____ (Microsoft Corporation) C:\windows\system32\dfshim.dll
2015-03-09 22:02 - 2014-06-18 23:23 - 00156824 _____ (Microsoft Corporation) C:\windows\system32\mscorier.dll
2015-03-09 22:02 - 2014-06-18 23:23 - 00081560 _____ (Microsoft Corporation) C:\windows\system32\mscories.dll
2015-03-09 22:02 - 2014-04-05 03:25 - 01294272 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tcpip.sys
2015-03-09 22:02 - 2014-04-05 03:24 - 00187840 _____ (Microsoft Corporation) C:\windows\system32\Drivers\FWPKCLNT.SYS
2015-03-09 22:02 - 2014-03-04 10:17 - 00868352 _____ (Microsoft Corporation) C:\windows\system32\kernel32.dll
2015-03-09 22:02 - 2014-01-29 03:06 - 00381440 _____ (Microsoft Corporation) C:\windows\system32\wer.dll
2015-03-09 22:02 - 2013-11-26 12:11 - 00240576 _____ (Microsoft Corporation) C:\windows\system32\Drivers\netio.sys
2015-03-09 22:02 - 2013-08-29 02:12 - 00028160 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbser.sys
2015-03-09 22:02 - 2013-08-05 02:56 - 00133056 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ataport.sys
2015-03-09 22:02 - 2013-08-02 02:50 - 00169984 _____ (Microsoft Corporation) C:\windows\system32\winsrv.dll
2015-03-09 22:02 - 2013-08-02 02:48 - 00005120 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-03-09 22:02 - 2013-08-02 02:48 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-03-09 22:02 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-03-09 22:02 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-03-09 22:02 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-03-09 22:02 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-03-09 22:02 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-03-09 22:02 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-03-09 22:02 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-03-09 22:02 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-03-09 22:02 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-03-09 22:02 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-03-09 22:02 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-03-09 22:02 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-03-09 22:02 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-03-09 22:02 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-03-09 22:02 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-03-09 22:02 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-03-09 22:02 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-03-09 22:02 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-03-09 22:02 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-03-09 22:02 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-03-09 22:02 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-03-09 22:02 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-03-09 22:02 - 2013-08-02 01:52 - 00271360 _____ (Microsoft Corporation) C:\windows\system32\conhost.exe
2015-03-09 22:02 - 2013-08-02 01:43 - 00006144 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-03-09 22:02 - 2013-08-02 01:43 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-03-09 22:02 - 2013-08-02 01:43 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-03-09 22:02 - 2013-08-02 01:43 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-03-09 22:01 - 2014-12-11 18:47 - 00046592 _____ (Microsoft Corporation) C:\windows\system32\TSWbPrxy.exe
2015-03-09 22:01 - 2014-11-26 04:32 - 00571904 _____ (Microsoft Corporation) C:\windows\system32\oleaut32.dll
2015-03-09 22:01 - 2014-11-11 02:32 - 00074752 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tdx.sys
2015-03-09 22:01 - 2014-10-30 02:45 - 00155136 _____ (Microsoft Corporation) C:\windows\system32\charmap.exe
2015-03-09 22:01 - 2014-10-25 02:32 - 00067584 _____ (Microsoft Corporation) C:\windows\system32\packager.dll
2015-03-09 22:01 - 2014-10-03 02:44 - 00475136 _____ (Microsoft Corporation) C:\windows\system32\audiosrv.dll
2015-03-09 22:01 - 2014-10-03 02:44 - 00442880 _____ (Microsoft Corporation) C:\windows\system32\AUDIOKSE.dll
2015-03-09 22:01 - 2014-10-03 02:44 - 00374784 _____ (Microsoft Corporation) C:\windows\system32\AudioEng.dll
2015-03-09 22:01 - 2014-10-03 02:44 - 00275968 _____ (Microsoft Corporation) C:\windows\system32\EncDump.dll
2015-03-09 22:01 - 2014-10-03 02:44 - 00195584 _____ (Microsoft Corporation) C:\windows\system32\AudioSes.dll
2015-03-09 22:01 - 2014-09-25 02:40 - 00519680 _____ (Microsoft Corporation) C:\windows\system32\qdvd.dll
2015-03-09 22:01 - 2014-08-12 02:36 - 00701440 _____ (Microsoft Corporation) C:\windows\system32\IMJP10K.DLL
2015-03-09 22:01 - 2014-07-14 02:42 - 00654336 _____ (Microsoft Corporation) C:\windows\system32\rpcrt4.dll
2015-03-09 22:01 - 2014-06-06 10:44 - 00509440 _____ (Microsoft Corporation) C:\windows\system32\qedit.dll
2015-03-09 22:01 - 2014-05-30 07:36 - 00338944 _____ (Microsoft Corporation) C:\windows\system32\Drivers\afd.sys
2015-03-09 22:01 - 2014-01-28 03:07 - 00185344 _____ (Microsoft Corporation) C:\windows\system32\wwansvc.dll
2015-03-09 22:01 - 2014-01-24 03:18 - 01212352 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ntfs.sys
2015-03-09 22:01 - 2013-12-10 03:02 - 00428032 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2015-03-09 22:01 - 2013-11-27 02:14 - 00258560 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbhub.sys
2015-03-09 22:01 - 2013-11-27 02:13 - 00284672 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbport.sys
2015-03-09 22:01 - 2013-11-27 02:13 - 00076288 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbccgp.sys
2015-03-09 22:01 - 2013-11-27 02:13 - 00043520 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbehci.sys
2015-03-09 22:01 - 2013-11-27 02:13 - 00024064 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbuhci.sys
2015-03-09 22:01 - 2013-11-27 02:13 - 00020480 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbohci.sys
2015-03-09 22:01 - 2013-11-27 02:13 - 00006016 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbd.sys
2015-03-09 22:01 - 2013-10-30 03:19 - 00301568 _____ (Microsoft Corporation) C:\windows\system32\msieftp.dll
2015-03-09 22:01 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\windows\system32\nshwfp.dll
2015-03-09 22:01 - 2013-10-12 03:01 - 00679424 _____ (Microsoft Corporation) C:\windows\system32\IKEEXT.DLL
2015-03-09 22:01 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\windows\system32\FWPUCLNT.DLL
2015-03-09 22:01 - 2013-10-04 02:49 - 00081408 _____ (Microsoft Corporation) C:\windows\system32\Drivers\drmk.sys
2015-03-09 22:01 - 2013-10-04 02:17 - 00177152 _____ (Microsoft Corporation) C:\windows\system32\Drivers\portcls.sys
2015-03-09 22:01 - 2013-07-25 09:57 - 01620992 _____ (Microsoft Corporation) C:\windows\system32\WMVDECOD.DLL
2015-03-09 22:01 - 2013-07-20 11:33 - 00102608 _____ (Microsoft Corporation) C:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-03-09 22:01 - 2013-07-12 11:08 - 00146816 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbvideo.sys
2015-03-09 22:01 - 2013-07-12 11:07 - 00086016 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbcir.sys
2015-03-09 22:01 - 2013-07-04 12:50 - 00530432 _____ (Microsoft Corporation) C:\windows\system32\comctl32.dll
2015-03-09 22:01 - 2013-06-06 05:52 - 00026112 _____ (Microsoft Corporation) C:\windows\system32\lpk.dll
2015-03-09 22:01 - 2013-06-06 05:51 - 00070656 _____ (Microsoft Corporation) C:\windows\system32\fontsub.dll
2015-03-09 22:01 - 2013-06-06 05:50 - 00010240 _____ (Microsoft Corporation) C:\windows\system32\dciman32.dll
2015-03-09 22:01 - 2013-06-06 04:01 - 00295424 _____ (Adobe Systems Incorporated) C:\windows\system32\atmfd.dll
2015-03-09 22:01 - 2013-06-06 04:01 - 00034304 _____ (Adobe Systems) C:\windows\system32\atmlib.dll
2015-03-09 21:59 - 2014-12-08 03:46 - 00308224 _____ (Microsoft Corporation) C:\windows\system32\scesrv.dll
2015-03-09 21:59 - 2014-10-14 02:50 - 00523776 _____ (Microsoft Corporation) C:\windows\system32\termsrv.dll
2015-03-09 21:07 - 2015-01-13 03:49 - 01230336 _____ (Microsoft Corporation) C:\windows\system32\WindowsCodecs.dll
2015-03-09 21:07 - 2014-10-03 02:45 - 01177088 _____ (Microsoft Corporation) C:\windows\system32\WsmSvc.dll
2015-03-09 21:07 - 2014-10-03 02:45 - 00248832 _____ (Microsoft Corporation) C:\windows\system32\WSManMigrationPlugin.dll
2015-03-09 21:07 - 2014-10-03 02:45 - 00214016 _____ (Microsoft Corporation) C:\windows\system32\WsmWmiPl.dll
2015-03-09 21:07 - 2014-10-03 02:45 - 00145920 _____ (Microsoft Corporation) C:\windows\system32\WsmAuto.dll
2015-03-09 21:07 - 2014-10-03 02:44 - 00198656 _____ (Microsoft Corporation) C:\windows\system32\WSManHTTPConfig.exe
2015-03-09 20:33 - 2014-05-14 17:23 - 01973728 _____ (Microsoft Corporation) C:\windows\system32\wuaueng.dll
2015-03-09 20:33 - 2014-05-14 17:23 - 00054240 _____ (Microsoft Corporation) C:\windows\system32\wuauclt.exe
2015-03-09 20:33 - 2014-05-14 17:23 - 00045536 _____ (Microsoft Corporation) C:\windows\system32\wups2.dll
2015-03-09 20:33 - 2014-05-14 17:17 - 02425856 _____ (Microsoft Corporation) C:\windows\system32\wucltux.dll
2015-03-09 20:32 - 2014-05-14 17:23 - 00581600 _____ (Microsoft Corporation) C:\windows\system32\wuapi.dll
2015-03-09 20:32 - 2014-05-14 17:23 - 00036320 _____ (Microsoft Corporation) C:\windows\system32\wups.dll
2015-03-09 20:32 - 2014-05-14 17:17 - 00092672 _____ (Microsoft Corporation) C:\windows\system32\wudriver.dll
2015-03-09 20:32 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\windows\system32\wuwebv.dll
2015-03-09 20:32 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\windows\system32\wuapp.exe
2015-03-09 20:16 - 2015-03-09 20:16 - 02171392 _____ () C:\Users\Andreas\Desktop\adwcleaner_4.112.exe
2015-03-08 15:53 - 2015-03-08 15:53 - 00001196 _____ () C:\Users\Andreas\Desktop\Revo Uninstaller.lnk
2015-03-08 15:53 - 2015-03-08 15:53 - 00000000 ____D () C:\Program Files\VS Revo Group
2015-03-06 15:04 - 2015-03-06 15:05 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2015-03-04 19:48 - 2015-03-11 21:32 - 00000000 ____D () C:\AdwCleaner
2015-03-04 19:20 - 2015-03-11 21:23 - 00000000 ____D () C:\Users\Andreas\AppData\Local\00000000-1425496826-0000-0000-406186B6FEAB
2015-03-04 19:09 - 2015-03-10 06:44 - 00000000 ____D () C:\Users\Andreas\AppData\Roaming\00000000-1425492588-0000-0000-406186B6FEAB
2015-03-04 19:05 - 2015-03-09 20:12 - 00000000 ____D () C:\ProgramData\{dbff1b6c-1c94-6d86-dbff-f1b6c1c96db0}
2015-03-02 20:23 - 2015-03-03 19:55 - 00000000 ____D () C:\Program Files\Mozilla Thunderbird
2015-02-21 13:02 - 2015-02-12 12:13 - 00019771 ____R () C:\Users\Andreas\Desktop\Kombiinstrument Fehlerbeschreibung.odt

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-12 20:04 - 2010-10-12 18:59 - 01975198 _____ () C:\windows\WindowsUpdate.log
2015-03-12 19:30 - 2009-07-14 05:34 - 00012304 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-03-12 19:30 - 2009-07-14 05:34 - 00012304 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-03-12 19:29 - 2010-09-07 16:23 - 04264316 _____ () C:\windows\system32\PerfStringBackup.INI
2015-03-12 19:29 - 2010-09-07 00:07 - 00730020 _____ () C:\windows\system32\perfh010.dat
2015-03-12 19:29 - 2010-09-07 00:07 - 00145902 _____ () C:\windows\system32\perfc010.dat
2015-03-12 19:21 - 2009-07-14 05:53 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2015-03-12 19:21 - 2009-07-14 05:39 - 00201484 _____ () C:\windows\setupact.log
2015-03-11 21:19 - 2012-09-26 18:29 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2015-03-11 19:26 - 2009-07-14 03:37 - 00000000 ____D () C:\windows\Microsoft.NET
2015-03-11 17:42 - 2009-07-14 03:37 - 00000000 ____D () C:\windows\tracing
2015-03-11 17:42 - 2009-07-14 03:37 - 00000000 ____D () C:\windows\system32\it-IT
2015-03-11 17:42 - 2009-07-14 03:37 - 00000000 ____D () C:\windows\system32\fr-FR
2015-03-11 17:42 - 2009-07-14 03:37 - 00000000 ____D () C:\windows\system32\de-DE
2015-03-11 17:33 - 2013-05-07 17:47 - 00037896 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avnetflt.sys
2015-03-11 17:33 - 2013-03-02 17:22 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avipbb.sys
2015-03-11 17:33 - 2013-03-02 17:22 - 00105864 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avgntflt.sys
2015-03-11 17:25 - 2009-07-14 05:46 - 00001515 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2015-03-10 06:56 - 2011-02-23 19:18 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2015-03-10 06:56 - 2009-07-14 05:33 - 00289912 _____ () C:\windows\system32\FNTCACHE.DAT
2015-03-10 06:50 - 2009-07-14 03:37 - 00000000 ____D () C:\windows\AppCompat
2015-03-09 23:55 - 2011-02-27 17:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-03-09 21:46 - 2010-09-07 16:22 - 00000000 ____D () C:\Program Files\ArcSoft
2015-03-09 21:45 - 2010-09-07 16:11 - 00000000 ___HD () C:\Program Files\InstallShield Installation Information
2015-03-08 20:25 - 2009-07-14 03:37 - 00000000 ____D () C:\windows\system32\NDF
2015-03-07 08:29 - 2012-05-23 19:52 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2015-03-05 19:54 - 2011-02-25 20:06 - 00326662 _____ () C:\windows\PFRO.log
2015-03-05 16:55 - 2014-08-10 11:10 - 00000000 ____D () C:\ProgramData\Package Cache
2015-03-05 16:54 - 2013-03-02 17:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-03-05 16:54 - 2013-03-02 17:22 - 00000000 ____D () C:\Program Files\Avira
2015-03-04 19:26 - 2015-01-24 10:40 - 00001079 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-03-04 19:26 - 2015-01-24 10:30 - 00001091 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-02-26 21:20 - 2011-03-15 07:43 - 119837696 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2015-02-24 04:23 - 2011-02-23 20:08 - 00246920 ____N (Microsoft Corporation) C:\windows\system32\MpSigStub.exe
2015-02-16 11:38 - 2012-09-26 18:29 - 00701616 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerApp.exe
2015-02-16 11:38 - 2011-10-11 19:39 - 00071344 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerCPLApp.cpl
2015-02-16 07:33 - 2009-07-14 05:53 - 00032632 _____ () C:\windows\Tasks\SCHEDLGU.TXT

==================== Files in the root of some directories =======

2011-10-23 17:03 - 2011-10-24 19:57 - 0000000 ____H () C:\Users\Andreas\AppData\Roaming\windrvconfig.txt

Some content of TEMP:
====================
C:\Users\Andreas\AppData\Local\Temp\avgnt.exe
C:\Users\Andreas\AppData\Local\Temp\Quarantine.exe
C:\Users\Andreas\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\windows\explorer.exe => File is digitally signed
C:\windows\system32\winlogon.exe => File is digitally signed
C:\windows\system32\wininit.exe => File is digitally signed
C:\windows\system32\svchost.exe => File is digitally signed
C:\windows\system32\services.exe => File is digitally signed
C:\windows\system32\User32.dll => File is digitally signed
C:\windows\system32\userinit.exe => File is digitally signed
C:\windows\system32\rpcss.dll => File is digitally signed
C:\windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-12-03 19:38

==================== End Of Log ============================
         

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 11-03-2015
Ran by Andreas at 2015-03-12 20:07:34
Running from C:\Users\Andreas\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 10 ActiveX (HKLM\...\{24762012-C6C8-4AAD-A02D-71A009FA1683}) (Version: 10.0.42.34 - Adobe Systems, Inc.)
Adobe Flash Player 16 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
ArcSoft Magic-i Visual Effects 2 (HKLM\...\{8E90189A-A5D4-4C0E-A908-06C4236F98EE}) (Version: 2.0.10.94 - ArcSoft)
ArcSoft Print Creations - Album Page (HKLM\...\{E6B4117F-AC59-4B13-9274-EB136E8897EE}) (Version:  - ArcSoft)
ArcSoft Print Creations - Brochures & Flyers (HKLM\...\{01A1A019-E1D8-482A-BE17-5E118D17C0A0}) (Version:  - ArcSoft)
ArcSoft Print Creations - Funhouse (HKLM\...\{9591C049-5CAE-4E89-A8D9-191F1899628B}) (Version:  - ArcSoft)
ArcSoft Print Creations - Funhouse II (HKLM\...\{3CE47E6B-AE27-4E40-AC54-329EED96B933}) (Version:  - ArcSoft)
ArcSoft Print Creations - Greeting Card (HKLM\...\{F04F9557-81A9-4293-BC49-2C216FA325A7}) (Version:  - ArcSoft)
ArcSoft Print Creations - Photo Book (HKLM\...\{56589DFE-0C29-4DFE-8E42-887B771ECD23}) (Version:  - ArcSoft)
ArcSoft Print Creations - Photo Calendar (HKLM\...\{CA9ED5E4-1548-485B-A293-417840060158}) (Version:  - ArcSoft)
ArcSoft Print Creations - Photo Prints (HKLM\...\{95F875CC-1B85-43E6-B3E0-13EA04F3D995}) (Version:  - ArcSoft)
ArcSoft Print Creations - Poster Creator (HKLM\...\{5D1C82E7-7EC0-4404-A8AD-36C3B444BC34}) (Version:  - ArcSoft)
ArcSoft Print Creations - Scrapbook (HKLM\...\{B0D83FCD-9D42-43ED-8315-250326AADA02}) (Version:  - ArcSoft)
ArcSoft Print Creations - Slimline Card (HKLM\...\{007B37D9-0C45-4202-834B-DD5FAAE99D63}) (Version:  - ArcSoft)
ArcSoft Print Creations (HKLM\...\{A3324BBB-3A83-40CE-AA8C-759D849B7EA1}) (Version: 3.0.255.487 - ArcSoft)
Avira (HKLM\...\{d9ed6dcf-6bfc-4fbb-802e-81dd5b767d6e}) (Version: 1.1.32.25147 - Avira Operations & Co. KG)
Avira (Version: 1.1.32.25147 - Avira Operations & Co. KG) Hidden
Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 15.0.8.650 - Avira)
BurnRecovery (HKLM\...\{2892E1B7-E24D-4CCB-B8A7-B63D4B66F89F}) (Version: 3.0.1007.2701 - Micro-Star International Co., Ltd.)
EasyFace Logon (HKLM\...\{0A960933-4D39-4495-A3F5-E5149943D761}) (Version: 1.1.0.32 - msi)
ElsterFormular (HKLM\...\ElsterFormular) (Version: 15.1.13904 - Landesfinanzdirektion Thüringen)
Foxit Reader (HKLM\...\Foxit Reader) (Version: 4.3.1.118 - Foxit Corporation)
Garmin USB Drivers (HKLM\...\{ABA5E381-EC46-425C-86C5-5CD15BBFB4BF}) (Version: 2.3.1.0 - Garmin Ltd or its subsidiaries)
Garmin WebUpdater (HKLM\...\{AE1EC58E-B2AC-4959-A4C2-C38202A25239}) (Version: 2.5.6 - Garmin Ltd or its subsidiaries)
Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: 8.14.10.2117 - Intel Corporation)
IrfanView (remove only) (HKLM\...\IrfanView) (Version: 4.30 - Irfan Skiljan)
Java(TM) 6 Update 26 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83216022FF}) (Version: 6.0.260 - Oracle)
Junk Mail filter update (Version: 14.0.8089.726 - Microsoft Corporation) Hidden
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.150.1 - McAfee, Inc.)
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Extended DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Sync Framework Runtime Native v1.0 (x86) (HKLM\...\{8A74E887-8F0F-4017-AF53-CBA42211AAA5}) (Version: 1.0.1215.0 - Microsoft Corporation)
Microsoft Sync Framework Services Native v1.0 (x86) (HKLM\...\{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}) (Version: 1.0.1215.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 36.0.1 (x86 de) (HKLM\...\Mozilla Firefox 36.0.1 (x86 de)) (Version: 36.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 35.0 - Mozilla)
Mozilla Thunderbird 31.5.0 (x86 de) (HKLM\...\Mozilla Thunderbird 31.5.0 (x86 de)) (Version: 31.5.0 - Mozilla)
msi Software Install (HKLM\...\{07690F1C-04B1-4060-9691-6748ED1826B9}) (Version: 3.0.1005.1201 - msi)
MSVC80_x86_v2 (Version: 1.0.3.0 - Nokia) Hidden
MSVC90_x86 (Version: 1.0.1.2 - Nokia) Hidden
Nokia Connectivity Cable Driver (HKLM\...\{A57025CC-5F2E-4D01-B387-06DB10500D43}) (Version: 7.1.78.0 - Nokia)
OpenOffice.org 3.3 (HKLM\...\{4286716B-1287-48E7-9078-3DC8248DBA96}) (Version: 3.3.9567 - OpenOffice.org)
PC Connectivity Solution (HKLM\...\{DA5B2BDC-F654-4A88-A669-4D34BC7846A1}) (Version: 12.0.17.0 - Nokia)
Realtek Ethernet Controller Driver For Windows 7 (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.11.1127.2009 - Realtek)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6083 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30104 - Realtek Semiconductor Corp.)
Revo Uninstaller 1.95 (HKLM\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
System Control Manager (HKLM\...\{ED9C5D25-55DF-48D8-9328-2AC0D75DE5D8}) (Version: 2.210.0402.006.10 - Micro-Star International Co., Ltd.)
System Control Manager Patch (HKLM\...\{A8CD1CD9-7545-4433-8EF6-9F3426E79CE5}) (Version: 1.2010.0402.51 - Micro-Star International Co., Ltd.)
VCDS DRV 14.10 (HKLM\...\VCDS DRV) (Version: DRV 14.10.0 - Ross-Tech, LLC)
Windows Driver Package - Garmin (grmnusb) GARMIN Devices  (04/19/2012 2.3.1.0) (HKLM\...\98157A226B40B173301B0F53C8E98C47805D5152) (Version: 04/19/2012 2.3.1.0 - Garmin)
Windows Live Anmelde-Assistent (HKLM\...\{52B97218-98CB-4B8B-9283-D213C85E1AA4}) (Version: 5.000.818.5 - Microsoft Corporation)
Windows Live Essentials (HKLM\...\WinLiveSuite_Wave3) (Version: 14.0.8089.0726 - Microsoft Corporation)
Windows Live Sync (HKLM\...\{76618402-179D-4699-A66B-D351C59436BC}) (Version: 14.0.8089.726 - Microsoft Corporation)
Windows Live-Uploadtool (HKLM\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
Windows Phone app for desktop (HKLM\...\{19773614-FC22-4ACC-AAA3-E6BDA81ACF92}) (Version: 1.1.2726.0 - Microsoft Corporation)
Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0) (HKLM\...\504244733D18C8F63FF584AEB290E3904E791693) (Version: 08/22/2008 7.0.0.0 - Nokia)
Windows-Treiberpaket - Ross-Tech USB Driver Package (05/12/2014 2.10.00) (HKLM\...\F99E6C5A14B5EBAB27FDFE2637878DF8208069E7) (Version: 05/12/2014 2.10.00 - Ross-Tech)
WinRAR archiver (HKLM\...\WinRAR archiver) (Version:  - )
Wise Registry Cleaner 8.31 (HKLM\...\Wise Registry Cleaner_is1) (Version: 8.31 - WiseCleaner.com, Inc.)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

09-03-2015 20:31:11 Windows Update
09-03-2015 20:31:11 Windows Update
09-03-2015 21:42:09 Revo Uninstaller's restore point - ArcSoft WebCam Companion 3
09-03-2015 21:44:04 Removed WebCam Companion
09-03-2015 21:49:25 Revo Uninstaller's restore point - McAfee Security Scan Plus
09-03-2015 22:29:42 Windows Update
11-03-2015 17:30:18 Windows Update
12-03-2015 19:30:29 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:04 - 2009-06-10 22:39 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0CB8CFC3-FDA3-4DD9-9086-4E230E95BB81} - System32\Tasks\{F7190C09-5B83-4F6C-855D-F2D64C0AE136} => pcalua.exe -a C:\Users\Andreas\Desktop\WindowsPhone.exe -d C:\Users\Andreas\Desktop
Task: {0E1E7A17-2F80-4A41-97AF-58391E9D370D} - System32\Tasks\{F6EEE6A8-48CF-4751-84F7-440CAEEC2BB7} => pcalua.exe -a C:\PROGRA~1\SearchProtect\Main\bin\uninstall.exe -c /S <==== ATTENTION
Task: {36184513-FF0C-44C8-AB14-B76A8AFF18BD} - System32\Tasks\{22760F11-8D5C-4977-BC2D-75403E671F24} => pcalua.exe -a C:\Users\Andreas\AppData\Roaming\luckysearches\UninstallManager.exe -c  -ptid=exp
Task: {6F110BBB-8366-4E18-B084-47AE2EEA5832} - System32\Tasks\Maintence Service => C:\Program Files\HitsBlender\misc\HitsBlenderUpdate.exe
Task: {71817F1A-718B-4C2A-A4A0-65CC015E7128} - System32\Tasks\Adobe Flash Player Updater => C:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-16] (Adobe Systems Incorporated)
Task: {AAA48309-100D-47C0-9515-50A45941585C} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) ==============

2011-06-22 09:43 - 2011-06-22 09:43 - 00024064 _____ () C:\windows\System32\sst2cl3.dll
2015-03-04 19:10 - 2015-03-04 19:10 - 00103424 _____ () C:\Users\Andreas\AppData\Roaming\00000000-1425492588-0000-0000-406186B6FEAB\jnsp274E.tmp
2015-02-16 11:38 - 2015-02-16 11:38 - 16852144 _____ () C:\windows\system32\Macromed\Flash\NPSWF32_16_0_0_305.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1040275345-4236665489-3623780555-1000\Control Panel\Desktop\\Wallpaper -> %windir%\web\wallpaper\windows\img0.jpg
DNS Servers: 192.168.178.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: ACDaemon => 2
MSCONFIG\Services: AdobeFlashPlayerUpdateSvc => 3
MSCONFIG\Services: Apple Mobile Device => 2
MSCONFIG\Services: Fax => 3
MSCONFIG\Services: iPod Service => 3
MSCONFIG\Services: SDRSVC => 3
MSCONFIG\Services: wuauserv => 2
MSCONFIG\startupreg: AppleSyncNotifier => C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
MSCONFIG\startupreg: APSDaemon => "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
MSCONFIG\startupreg: ArcSoft Connection Service => C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
MSCONFIG\startupreg: EasyFace Agent => C:\Program Files\msi\EasyFace Logon\KillAutoAP.exe
MSCONFIG\startupreg: fspuip => %ProgramFiles%\FSP\fspuip.exe
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: QuickTime Task => "C:\Program Files\QuickTime\QTTask.exe" -atboottime
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

==================== Accounts: =============================

Administrator (S-1-5-21-1040275345-4236665489-3623780555-500 - Administrator - Disabled)
Andreas (S-1-5-21-1040275345-4236665489-3623780555-1000 - Administrator - Enabled) => C:\Users\Andreas
Gast (S-1-5-21-1040275345-4236665489-3623780555-501 - Limited - Disabled)

==================== Faulty Device Manager Devices =============

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (03/11/2015 05:44:09 PM) (Source: Avira Service Host) (EventID: 0) (User: )
Description: Fehler beim Verarbeiten von Sitzungsänderung. System.NullReferenceException: Der Objektverweis wurde nicht auf eine Objektinstanz festgelegt.
   bei Avira.OE.ServiceHost.ServiceHost.OnSessionChange(SessionChangeDescription changeDescription)
   bei System.ServiceProcess.ServiceBase.DeferredSessionChange(Int32 eventType, IntPtr eventData)

Error: (03/10/2015 06:58:28 AM) (Source: .NET Runtime Optimization Service) (EventID: 1107) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - Failed to execute command from the offline queue: uninstall "System.Data.SqlXml, Version=2.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil".  The error returned was Error: The specified assembly is not installed.
.

Error: (03/10/2015 06:58:28 AM) (Source: .NET Runtime Optimization Service) (EventID: 1107) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - Failed to execute command from the offline queue: uninstall "System.Deployment, Version=2.0.0.0, Culture=Neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=msil" /NoDependencies .  The error returned was Error: The specified assembly is not installed.
.

Error: (03/10/2015 03:28:34 AM) (Source: ESENT) (EventID: 104) (User: )
Description: wuaueng.dll (1044) SUS20ClientDataStore: Das Datenbankmodul hat die Instanz (0) mit dem Fehler (-1011) beendet.

Error: (03/09/2015 10:45:18 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: MicrosoftFixit50735.exe, Version: 0.0.0.0, Zeitstempel: 0x4e0c055a
Name des fehlerhaften Moduls: MicrosoftFixit50735.exe, Version: 0.0.0.0, Zeitstempel: 0x4e0c055a
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00001861
ID des fehlerhaften Prozesses: 0xe3c
Startzeit der fehlerhaften Anwendung: 0xMicrosoftFixit50735.exe0
Pfad der fehlerhaften Anwendung: MicrosoftFixit50735.exe1
Pfad des fehlerhaften Moduls: MicrosoftFixit50735.exe2
Berichtskennung: MicrosoftFixit50735.exe3

Error: (03/09/2015 10:44:34 PM) (Source: ESENT) (EventID: 481) (User: )
Description: wuaueng.dll (1044) SUS20ClientDataStore: Versuch, aus Datei "C:\windows\SoftwareDistribution\DataStore\DataStore.edb" bei Offset 17596416 (0x00000000010c8000) für 32768 (0x00008000) Bytes zu lesen, ist nach wuaueng.dll0 Sekunden mit Systemfehler 8 (0x00000008): "Für diesen Befehl ist nicht genügend Speicher verfügbar. " fehlgeschlagen. Fehler -1011 (0xfffffc0d) bei Leseoperation. Wenn dieser Zustand andauert, ist die Datei möglicherweise beschädigt und muss aus einer vorherigen Sicherung wiederhergestellt werden.

Error: (03/09/2015 10:44:34 PM) (Source: ESENT) (EventID: 482) (User: )
Description: wuaueng.dll (1044) SUS20ClientDataStore: Versuch, in Datei "C:\windows\SoftwareDistribution\DataStore\DataStore.edb" bei Offset 1703936 (0x00000000001a0000) für 32768 (0x00008000) Bytes zu schreiben, ist nach wuaueng.dll0 Sekunden mit Systemfehler 8 (0x00000008): "Für diesen Befehl ist nicht genügend Speicher verfügbar. " fehlgeschlagen. Fehler -1011 (0xfffffc0d) bei Schreiboperation. Wenn dieser Zustand andauert, ist die Datei möglicherweise beschädigt und muss aus einer vorherigen Sicherung wiederhergestellt werden.

Error: (03/09/2015 10:44:34 PM) (Source: ESENT) (EventID: 481) (User: )
Description: wuaueng.dll (1044) SUS20ClientDataStore: Versuch, aus Datei "C:\windows\SoftwareDistribution\DataStore\DataStore.edb" bei Offset 17563648 (0x00000000010c0000) für 32768 (0x00008000) Bytes zu lesen, ist nach wuaueng.dll0 Sekunden mit Systemfehler 8 (0x00000008): "Für diesen Befehl ist nicht genügend Speicher verfügbar. " fehlgeschlagen. Fehler -1011 (0xfffffc0d) bei Leseoperation. Wenn dieser Zustand andauert, ist die Datei möglicherweise beschädigt und muss aus einer vorherigen Sicherung wiederhergestellt werden.

Error: (03/09/2015 10:44:34 PM) (Source: ESENT) (EventID: 481) (User: )
Description: wuaueng.dll (1044) SUS20ClientDataStore: Versuch, aus Datei "C:\windows\SoftwareDistribution\DataStore\DataStore.edb" bei Offset 50364416 (0x0000000003008000) für 32768 (0x00008000) Bytes zu lesen, ist nach wuaueng.dll0 Sekunden mit Systemfehler 8 (0x00000008): "Für diesen Befehl ist nicht genügend Speicher verfügbar. " fehlgeschlagen. Fehler -1011 (0xfffffc0d) bei Leseoperation. Wenn dieser Zustand andauert, ist die Datei möglicherweise beschädigt und muss aus einer vorherigen Sicherung wiederhergestellt werden.

Error: (03/09/2015 10:44:34 PM) (Source: ESENT) (EventID: 481) (User: )
Description: wuaueng.dll (1044) SUS20ClientDataStore: Versuch, aus Datei "C:\windows\SoftwareDistribution\DataStore\DataStore.edb" bei Offset 50331648 (0x0000000003000000) für 32768 (0x00008000) Bytes zu lesen, ist nach wuaueng.dll0 Sekunden mit Systemfehler 8 (0x00000008): "Für diesen Befehl ist nicht genügend Speicher verfügbar. " fehlgeschlagen. Fehler -1011 (0xfffffc0d) bei Leseoperation. Wenn dieser Zustand andauert, ist die Datei möglicherweise beschädigt und muss aus einer vorherigen Sicherung wiederhergestellt werden.


System errors:
=============
Error: (03/12/2015 08:03:37 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x800f0902 fehlgeschlagen: Sicherheitsupdate für Windows 7 (KB3030377)

Error: (03/12/2015 08:03:37 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x800f0902 fehlgeschlagen: Update für Windows 7 (KB2970228)

Error: (03/12/2015 07:21:34 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
cdrom

Error: (03/12/2015 07:21:17 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "hardlock" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1117

Error: (03/11/2015 09:34:02 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
cdrom

Error: (03/11/2015 09:33:49 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "hardlock" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1117

Error: (03/11/2015 06:26:59 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
cdrom

Error: (03/11/2015 06:26:22 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Avira Service Host erreicht.

Error: (03/11/2015 06:25:29 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "hardlock" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1117

Error: (03/11/2015 06:25:24 PM) (Source: BugCheck) (EventID: 1001) (User: )
Description: 0x0000008e (0xc0000005, 0x81e57ede, 0x80791b4c, 0x00000000)C:\windows\MEMORY.DMP031115-33072-01


Microsoft Office Sessions:
=========================
Error: (03/11/2015 05:44:09 PM) (Source: Avira Service Host) (EventID: 0) (User: )
Description: Fehler beim Verarbeiten von Sitzungsänderung. System.NullReferenceException: Der Objektverweis wurde nicht auf eine Objektinstanz festgelegt.
   bei Avira.OE.ServiceHost.ServiceHost.OnSessionChange(SessionChangeDescription changeDescription)
   bei System.ServiceProcess.ServiceBase.DeferredSessionChange(Int32 eventType, IntPtr eventData)

Error: (03/10/2015 06:58:28 AM) (Source: .NET Runtime Optimization Service) (EventID: 1107) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - Failed to execute command from the offline queue: uninstall "System.Data.SqlXml, Version=2.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil".  The error returned was Error: The specified assembly is not installed.
.

Error: (03/10/2015 06:58:28 AM) (Source: .NET Runtime Optimization Service) (EventID: 1107) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - Failed to execute command from the offline queue: uninstall "System.Deployment, Version=2.0.0.0, Culture=Neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=msil" /NoDependencies .  The error returned was Error: The specified assembly is not installed.
.

Error: (03/10/2015 03:28:34 AM) (Source: ESENT) (EventID: 104) (User: )
Description: wuaueng.dll1044SUS20ClientDataStore: 0-1011

Error: (03/09/2015 10:45:18 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: MicrosoftFixit50735.exe0.0.0.04e0c055aMicrosoftFixit50735.exe0.0.0.04e0c055ac000000500001861e3c01d05ab251ba6464C:\windows\SoftwareDistribution\Download\Install\MicrosoftFixit50735.exeC:\windows\SoftwareDistribution\Download\Install\MicrosoftFixit50735.exe937989fc-c6a5-11e4-9aa2-406186b6feab

Error: (03/09/2015 10:44:34 PM) (Source: ESENT) (EventID: 481) (User: )
Description: wuaueng.dll1044SUS20ClientDataStore: C:\windows\SoftwareDistribution\DataStore\DataStore.edb17596416 (0x00000000010c8000)32768 (0x00008000)-1011 (0xfffffc0d)8 (0x00000008)Für diesen Befehl ist nicht genügend Speicher verfügbar. 0

Error: (03/09/2015 10:44:34 PM) (Source: ESENT) (EventID: 482) (User: )
Description: wuaueng.dll1044SUS20ClientDataStore: C:\windows\SoftwareDistribution\DataStore\DataStore.edb1703936 (0x00000000001a0000)32768 (0x00008000)-1011 (0xfffffc0d)8 (0x00000008)Für diesen Befehl ist nicht genügend Speicher verfügbar. 0

Error: (03/09/2015 10:44:34 PM) (Source: ESENT) (EventID: 481) (User: )
Description: wuaueng.dll1044SUS20ClientDataStore: C:\windows\SoftwareDistribution\DataStore\DataStore.edb17563648 (0x00000000010c0000)32768 (0x00008000)-1011 (0xfffffc0d)8 (0x00000008)Für diesen Befehl ist nicht genügend Speicher verfügbar. 0

Error: (03/09/2015 10:44:34 PM) (Source: ESENT) (EventID: 481) (User: )
Description: wuaueng.dll1044SUS20ClientDataStore: C:\windows\SoftwareDistribution\DataStore\DataStore.edb50364416 (0x0000000003008000)32768 (0x00008000)-1011 (0xfffffc0d)8 (0x00000008)Für diesen Befehl ist nicht genügend Speicher verfügbar. 10

Error: (03/09/2015 10:44:34 PM) (Source: ESENT) (EventID: 481) (User: )
Description: wuaueng.dll1044SUS20ClientDataStore: C:\windows\SoftwareDistribution\DataStore\DataStore.edb50331648 (0x0000000003000000)32768 (0x00008000)-1011 (0xfffffc0d)8 (0x00000008)Für diesen Befehl ist nicht genügend Speicher verfügbar. 10


==================== Memory info =========================== 

Processor: Intel(R) Atom(TM) CPU N455 @ 1.66GHz
Percentage of memory in use: 62%
Total physical RAM: 2036.88 MB
Available physical RAM: 755.76 MB
Total Pagefile: 4073.77 MB
Available Pagefile: 2446.58 MB
Total Virtual: 2047.88 MB
Available Virtual: 1892.49 MB

==================== Drives ================================

Drive c: (OS_Install) (Fixed) (Total:134.27 GB) (Free:98.82 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (Data) (Fixed) (Total:89.52 GB) (Free:88.17 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 232.9 GB) (Disk ID: FBCFF3FF)
Partition 1: (Not Active) - (Size=9 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=27)
Partition 3: (Not Active) - (Size=134.3 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=89.5 GB) - (Type=07 NTFS)

==================== End Of Log ============================