Trojaner-Board - Bundestrojaner vor 1 Monat "entfernt", jedoch NICHT vollständig

Sehr geehrtes Team,

ein Freund von mir hatte vor 1 Monat ungefähr den Bundestrojaner und hat ihn dann selbst entfernt, indem er ihn aus den Diensten? gelöscht hat. Ich weiß nicht genau wie er dies angestellt hat, jedoch bin ich mir ziemlich sicher dass er nur den lestigen Desktop-Screen entfernen konnte und im Hintergrund noch Trojaner werkeln.

Er hat sich an mich gewandt, da beim Anmelden auf einmal die Meldung: "Der RPC-Server konnte nicht gestartet werden" auftauchte.
Weiteres erzählte er mir dies mit dem Bundestrojaner und somit wende ich mich an euch, da ich selbst nicht in der Lage bin die Logfiles auszulesen.

Hier mal die üblichen Logfiles:

defogger_disable:

Code:

defogger_disable by jpshortstuff (23.02.10.1)

Log created at 23:29 on 02/08/2013 (Administrator)
 

Checking for autostart values...

HKCU\~\Run values retrieved.

HKLM\~\Run values retrieved.
 

Checking for services/drivers...
 

-=E.O.F=-

FRST:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-08-2013

Ran by Administrator (administrator) on 02-08-2013 23:30:18

Running from C:\Users\Administrator\Desktop

Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Safe Mode (minimal)
 

==================== Processes (Whitelisted) =================
 

(DigitalPersona, Inc.) c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [HPPowerAssistant] - C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe [2919992 2011-01-27] (Hewlett-Packard Company)

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2679592 2011-02-04] (Synaptics Incorporated)

HKLM\...\Run: [AtherosBtStack] - C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [615584 2011-01-07] (Atheros Communications)

HKLM\...\Run: [AthBtTray] - C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe [379040 2011-01-07] (Atheros Commnucations)

HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [835072 2011-01-27] (IDT, Inc.)

HKLM\...\Run: [MfeEpePcMonitor] - C:\Program Files\Hewlett-Packard\Drive Encryption\EpePcMonitor.exe [200704 2011-02-09] ()

HKLM\...\Run: [XeroxScanUtility] - C:\Program Files\Xerox\Scan_Utility\xrxzipui.exe [2371072 2010-02-10] (Xerox Corporation)

HKLM\...\Run: [XeroxEndeavorBackgroundTask] - C:\windows\system32\xgchabgnd.exe [102912 2009-11-02] ()

HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe,

HKCU\...\RunOnce: [mctadmin] - C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)

HKLM-x32\...\Run: [PDF Complete] - C:\Program Files (x86)\PDF Complete\pdfsty.exe [656920 2011-02-01] (PDF Complete Inc)

HKLM-x32\...\Run: [QLBController] - C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\QLBController.exe [299576 2011-01-29] (Hewlett-Packard Company)

HKLM-x32\...\Run: [File Sanitizer] - C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\CoreShredder.exe [12274688 2011-02-07] (Hewlett-Packard)

HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2011-01-26] (Intel Corporation)

HKLM-x32\...\Run: [HP HD Webcam [Fixed]_Monitor] - C:\Program Files (x86)\HP HD Webcam [Fixed]\monitor.exe [267128 2010-11-26] ()

HKLM-x32\...\Run: [DTRun] - c:\Program Files (x86)\ArcSoft\TotalMedia Suite\TotalMedia Theatre 3\uDTRun.exe [517456 2010-11-24] (ArcSoft Inc.)

HKLM-x32\...\Run: [HPConnectionManager] - c:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe [94264 2011-04-05] (Hewlett-Packard Development Company L.P.)

HKLM-x32\...\Run: [] -  [x]

HKLM-x32\...\Run: [HPQuickWebProxy] - c:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe [76344 2011-02-11] (Hewlett-Packard Company)

HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)

HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254696 2012-01-18] (Sun Microsystems, Inc.)

HKLM-x32\...\Run: [ApnUpdater] - C:\Program Files (x86)\Ask.com\Updater\Updater.exe [1564872 2012-06-06] (Ask)

HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [PROFIS AutoUpdate] - C:\Program Files (x86)\Hilti\PROFIS AutoUpdate\Hilti.AutoUpdate.Tray.exe [474112 2011-11-02] (Agito d.o.o.)

HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-05-15] (Apple Inc.)

HKLM-x32\...\Run: [avast] - C:\Program Files\AVAST Software\Avast\avastUI.exe [4858968 2013-05-09] (AVAST Software)

Lsa: [Notification Packages] EpePcNp64 DPPassFilter scecli

Startup: C:\Users\Katharina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk

ShortcutTarget: Facebook Messenger.lnk -> C:\Users\Administrator\AppData\Local\Facebook\Messenger\2.1.4814.0\FacebookMessenger.exe (No File)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPCOM/4

HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = hxxp://g.uk.msn.com/HPCOM/4

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCOM/4

SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKLM - {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=CMNTDF

SearchScopes: HKLM - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=CMNTDF

SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKLM-x32 - {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=CMNTDF

SearchScopes: HKLM-x32 - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=CMNTDF

BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)

BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

BHO-x32: File Sanitizer for HP ProtectTools - {3134413B-49B4-425C-98A5-893C1F195601} - C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\IEBHO.dll (Hewlett-Packard)

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)

BHO-x32: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)

BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\BingExt.dll (Microsoft Corporation.)

BHO-x32: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)

Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)

Toolbar: HKLM-x32 - Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)

Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\BingExt.dll (Microsoft Corporation.)

Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

Toolbar: HKLM-x32 - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

DPF: HKLM-x32 {1ABA5FAC-1417-422B-BA82-45C35E2C908B} hxxp://kitchenplanner.ikea.com/AT/Core/Player/2020PlayerAX_IKEA_Win32.cab

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
 

==================== Services (Whitelisted) =================
 

S3 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)

S2 Atheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [138400 2011-01-07] (Atheros)

S2 Autodesk Content Service; C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [18656 2011-02-02] ()

S2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808 2013-05-09] (AVAST Software)

S2 DpHost; c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe [481104 2011-02-12] (DigitalPersona, Inc.)

S3 FLCDLOCK; c:\Windows\SysWOW64\flcdlock.exe [464480 2011-02-04] (Hewlett-Packard Company)

S2 hasplms; C:\windows\system32\hasplms.exe [4889032 2011-12-30] (SafeNet Inc.)

S2 Hilti PROFIS AutoUpdate Service; C:\Program Files (x86)\Hilti\PROFIS AutoUpdate\Hilti.AutoUpdate.Service.exe [206336 2011-11-02] (Agito d.o.o.)

S3 HP ProtectTools Service; c:\Program Files (x86)\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe [36864 2011-01-12] (Hewlett-Packard Development Company, L.P)

S2 HPDayStarterService; c:\Program Files\Hewlett-Packard\HP DayStarter\32-bit\HPDayStarterService.exe [133688 2011-01-28] (Hewlett-Packard Company)

S2 hpHotkeyMonitor; C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\HpHotkeyMonitor.exe [281656 2011-01-29] (Hewlett-Packard Company)

S2 McAfee Endpoint Encryption Agent; C:\Program Files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeHost.exe [1318912 2011-02-09] ()

S2 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [1127448 2011-02-01] (PDF Complete Inc)

S2 uArcCapture; C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe [502464 2010-11-11] (ArcSoft, Inc.)

S2 XobniService; C:\Program Files (x86)\Xobni\XobniService.exe [62184 2011-03-07] (Xobni Corporation)
 

==================== Drivers (Whitelisted) ====================
 

S3 ARCVCAM; C:\Windows\System32\DRIVERS\ArcSoftVCapture.sys [32192 2010-11-11] (ArcSoft, Inc.)

S2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [33400 2013-05-09] (AVAST Software)

S2 aswMonFlt; C:\windows\system32\drivers\aswMonFlt.sys [80816 2013-05-09] (AVAST Software)

S1 aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [72016 2013-05-09] (AVAST Software)

S0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65336 2013-05-09] ()

S1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [1030952 2013-07-12] (AVAST Software)

S1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [378944 2013-07-12] (AVAST Software)

S1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-05-09] (AVAST Software)

S0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [189936 2013-07-12] ()

S3 DAMDrv; C:\Windows\System32\DRIVERS\DAMDrv64.sys [63336 2011-02-07] (Hewlett-Packard Company)

S2 hardlock; C:\windows\system32\drivers\hardlock.sys [321536 2011-09-28] (SafeNet Inc.)

R0 MfeEpePc; C:\Windows\System32\Drivers\MfeEpePc.sys [168008 2011-02-09] (McAfee, Inc.)

S3 mod7700; C:\Windows\System32\DRIVERS\dvb7700all.sys [865344 2009-11-02] (DiBcom)

S3 SPUVCbv; C:\Windows\System32\Drivers\SPUVCbv_x64.sys [2611704 2011-01-12] (Sunplus Technology)

S3 HMXProjExt64; system32\DRIVERS\HMXExGrp64.sys [x]

S3 HMXProjMir64; system32\DRIVERS\HMXMrGrp64.sys [x]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-08-02 23:29 - 2013-08-02 23:29 - 00000488 _____ C:\Users\Administrator\Desktop\defogger_disable.log

2013-08-02 23:29 - 2013-08-02 23:29 - 00000000 _____ C:\Users\Administrator\defogger_reenable

2013-08-02 23:29 - 2013-08-02 23:26 - 01781485 _____ (Farbar) C:\Users\Administrator\Desktop\FRST64.exe

2013-08-02 23:29 - 2013-08-02 23:26 - 00377856 _____ C:\Users\Administrator\Desktop\gmer_2.1.19163.exe

2013-08-02 23:29 - 2013-08-02 23:24 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Administrator\Desktop\mbam-setup-1.75.0.1300.exe

2013-08-02 23:29 - 2013-08-02 23:24 - 00050477 _____ C:\Users\Administrator\Desktop\Defogger.exe

2013-08-02 23:26 - 2013-08-02 23:26 - 00141312 _____ C:\Users\ADMINI~1\AppData\Local\GDIPFONTCACHEV1.DAT

2013-08-02 22:39 - 2010-11-20 15:24 - 00345088 _____ (Microsoft Corporation) C:\windows\system32\Utilman.exe

2013-08-02 22:35 - 2013-08-02 22:35 - 00063958 _____ C:\Users\Potti\GPReport.html

2013-08-02 22:30 - 2013-08-02 22:30 - 00045285 _____ C:\acadminidump.dmp

2013-08-02 22:29 - 2013-08-02 22:29 - 00000000 ____D C:\Users\ADMINI~1\AppData\Local\Auer - Die Bausoftware GmbH

2013-08-02 22:16 - 2013-08-02 23:29 - 00000000 ____D C:\Users\Administrator

2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Vorlagen

2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Startmenü

2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Netzwerkumgebung

2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Lokale Einstellungen

2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Eigene Dateien

2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Druckumgebung

2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Documents\Eigene Musik

2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Documents\Eigene Bilder

2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programme

2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Anwendungsdaten

2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\ADMINI~1\AppData\Local\Verlauf

2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\ADMINI~1\AppData\Local\Anwendungsdaten

2013-08-02 22:16 - 2011-10-17 22:49 - 00000000 ____D C:\Users\ADMINI~1\AppData\Local\Microsoft Help

2013-08-02 22:16 - 2009-07-27 16:09 - 00000020 ___SH C:\Users\Administrator\ntuser.ini

2013-08-02 22:16 - 2009-07-14 06:54 - 00000000 ___RD C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories

2013-08-02 22:16 - 2009-07-14 06:49 - 00000000 ___RD C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance

2013-07-16 18:40 - 2013-08-03 08:04 - 00000000 ___RD C:\Sandbox

2013-07-16 18:39 - 2013-08-03 08:04 - 00000000 ____D C:\Program Files\Sandboxie

2013-07-15 19:28 - 2013-07-15 19:28 - 00000000 ____D C:\Users\Katharina\AppData\Roaming\TeamViewer

2013-07-12 23:26 - 2013-07-12 23:26 - 00000175 _____ C:\windows\system32\Drivers\aswVmm.sys.sum

2013-07-12 23:26 - 2013-07-12 23:26 - 00000175 _____ C:\windows\system32\Drivers\aswSP.sys.sum

2013-07-12 23:26 - 2013-07-12 23:26 - 00000175 _____ C:\windows\system32\Drivers\aswSnx.sys.sum

2013-07-12 23:18 - 2013-05-02 02:06 - 00278800 _____ (Microsoft Corporation) C:\windows\system32\MpSigStub.exe

2013-07-12 23:16 - 2013-08-02 22:08 - 00003924 _____ C:\windows\System32\Tasks\avast! Emergency Update

2013-07-12 23:16 - 2013-08-02 22:08 - 00001922 _____ C:\Users\Public\Desktop\avast! Free Antivirus.lnk

2013-07-12 23:16 - 2013-08-02 22:08 - 00000000 _____ C:\windows\SysWOW64\config.nt

2013-07-12 23:16 - 2013-07-12 23:26 - 01030952 _____ (AVAST Software) C:\windows\system32\Drivers\aswSnx.sys

2013-07-12 23:16 - 2013-07-12 23:26 - 00378944 _____ (AVAST Software) C:\windows\system32\Drivers\aswSP.sys

2013-07-12 23:16 - 2013-07-12 23:26 - 00189936 _____ C:\windows\system32\Drivers\aswVmm.sys

2013-07-12 23:16 - 2013-05-09 10:59 - 00080816 _____ (AVAST Software) C:\windows\system32\Drivers\aswMonFlt.sys

2013-07-12 23:16 - 2013-05-09 10:59 - 00072016 _____ (AVAST Software) C:\windows\system32\Drivers\aswRdr2.sys

2013-07-12 23:16 - 2013-05-09 10:59 - 00065336 _____ C:\windows\system32\Drivers\aswRvrt.sys

2013-07-12 23:16 - 2013-05-09 10:59 - 00064288 _____ (AVAST Software) C:\windows\system32\Drivers\aswTdi.sys

2013-07-12 23:16 - 2013-05-09 10:59 - 00033400 _____ (AVAST Software) C:\windows\system32\Drivers\aswFsBlk.sys

2013-07-12 23:16 - 2013-05-09 10:58 - 00287840 _____ (AVAST Software) C:\windows\system32\aswBoot.exe

2013-07-12 23:15 - 2013-07-12 23:15 - 00000000 ____D C:\Program Files\AVAST Software

2013-07-12 23:15 - 2013-05-09 10:58 - 00041664 _____ (AVAST Software) C:\windows\avastSS.scr

2013-07-12 18:59 - 2013-07-12 18:59 - 00001162 _____ C:\Users\Public\Desktop\TeamViewer 8.lnk

2013-07-12 18:59 - 2013-07-12 18:59 - 00000000 ____D C:\Program Files (x86)\TeamViewer

2013-07-12 18:52 - 2013-07-12 23:15 - 00000000 ____D C:\ProgramData\AVAST Software

2013-07-12 18:42 - 2013-07-12 18:42 - 00000002 _____ C:\AvastSetup.log

2013-07-11 16:34 - 2013-06-12 01:43 - 02877440 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll

2013-07-11 16:34 - 2013-06-12 01:43 - 01141248 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll

2013-07-11 16:34 - 2013-06-12 01:43 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll

2013-07-11 16:34 - 2013-06-12 01:43 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll

2013-07-11 16:34 - 2013-06-12 01:42 - 02046976 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll

2013-07-11 16:34 - 2013-06-12 01:42 - 00391168 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll

2013-07-11 16:34 - 2013-06-12 01:42 - 00109056 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll

2013-07-11 16:34 - 2013-06-12 01:42 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll

2013-07-11 16:34 - 2013-06-12 01:42 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll

2013-07-11 16:34 - 2013-06-12 01:26 - 01365504 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll

2013-07-11 16:34 - 2013-06-12 01:26 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe

2013-07-11 16:34 - 2013-06-12 01:25 - 03958784 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll

2013-07-11 16:34 - 2013-06-12 01:25 - 02648576 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll

2013-07-11 16:34 - 2013-06-12 01:25 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll

2013-07-11 16:34 - 2013-06-12 01:25 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll

2013-07-11 16:34 - 2013-06-12 01:25 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll

2013-07-11 16:34 - 2013-06-12 01:25 - 00136704 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll

2013-07-11 16:34 - 2013-06-12 01:25 - 00067072 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll

2013-07-11 16:34 - 2013-06-12 01:25 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll

2013-07-11 16:34 - 2013-06-12 00:51 - 00071680 _____ (Microsoft Corporation) C:\windows\SysWOW64\RegisterIEPKEYs.exe

2013-07-11 16:34 - 2013-06-12 00:50 - 00089600 _____ (Microsoft Corporation) C:\windows\system32\RegisterIEPKEYs.exe

2013-07-11 16:34 - 2013-06-07 05:22 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb

2013-07-11 16:34 - 2013-06-07 04:37 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb

2013-07-11 16:33 - 2013-06-12 01:43 - 14329856 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll

2013-07-11 16:33 - 2013-06-12 01:43 - 01767936 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll

2013-07-11 16:33 - 2013-06-12 01:43 - 00039424 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll

2013-07-11 16:33 - 2013-06-12 01:42 - 13760512 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll

2013-07-11 16:33 - 2013-06-12 01:26 - 02241024 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll

2013-07-11 16:33 - 2013-06-12 01:25 - 19238912 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll

2013-07-11 16:33 - 2013-06-12 01:25 - 15404032 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll

2013-07-11 16:33 - 2013-06-12 01:25 - 00053248 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll

2013-07-11 15:03 - 2013-07-11 15:03 - 00000000 ____D C:\Users\Katharina\Documents\Monika

2013-07-11 14:17 - 2013-06-05 05:34 - 03153920 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys

2013-07-11 14:17 - 2013-06-04 08:00 - 00624128 _____ (Microsoft Corporation) C:\windows\system32\qedit.dll

2013-07-11 14:17 - 2013-06-04 06:53 - 00509440 _____ (Microsoft Corporation) C:\windows\SysWOW64\qedit.dll

2013-07-11 14:17 - 2013-05-06 08:03 - 01887744 _____ (Microsoft Corporation) C:\windows\system32\WMVDECOD.DLL

2013-07-11 14:17 - 2013-05-06 06:56 - 01620480 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMVDECOD.DLL

2013-07-11 14:17 - 2013-04-10 01:34 - 01247744 _____ (Microsoft Corporation) C:\windows\SysWOW64\DWrite.dll

2013-07-11 14:17 - 2013-04-03 00:51 - 01643520 _____ (Microsoft Corporation) C:\windows\system32\DWrite.dll

2013-07-11 13:56 - 2013-07-11 13:56 - 00141312 _____ C:\Users\Gast\AppData\Local\GDIPFONTCACHEV1.DAT

2013-07-11 13:56 - 2013-07-11 13:56 - 00000000 ____D C:\Users\Gast\Documents\Bluetooth Folder

2013-07-11 13:56 - 2013-07-11 13:56 - 00000000 ____D C:\Users\Gast\AppData\Roaming\Intel Corporation

2013-07-11 13:56 - 2013-07-11 13:56 - 00000000 ____D C:\Users\Gast\AppData\Roaming\hpqLog

2013-07-11 13:56 - 2013-07-11 13:56 - 00000000 ____D C:\Users\Gast\AppData\Roaming\HILTI

2013-07-11 13:56 - 2013-07-11 13:56 - 00000000 ____D C:\Users\Gast\AppData\Roaming\Apple Computer

2013-07-11 13:56 - 2013-07-11 13:56 - 00000000 ____D C:\Users\Gast\AppData\Local\PDFC

2013-07-11 13:56 - 2013-07-11 13:56 - 00000000 ____D C:\Users\Gast\AppData\Local\BMExplorer

2013-07-11 13:55 - 2013-07-11 13:55 - 00000000 ___RD C:\Users\Gast\Virtual Machines

2013-07-11 13:55 - 2013-07-11 13:55 - 00000000 ____D C:\Users\Gast\AppData\Roaming\Synaptics

2013-07-11 13:55 - 2013-07-11 13:55 - 00000000 ____D C:\Users\Gast\AppData\Roaming\Adobe

2013-07-11 13:54 - 2013-07-11 13:55 - 00000000 ____D C:\Users\Gast

2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Vorlagen

2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Startmenü

2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Netzwerkumgebung

2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Lokale Einstellungen

2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Eigene Dateien

2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Druckumgebung

2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Documents\Eigene Musik

2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Documents\Eigene Bilder

2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\AppData\Local\Verlauf

2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\AppData\Local\Anwendungsdaten

2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Anwendungsdaten

2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 ____D C:\Users\Gast\AppData\Roaming\DigitalPersona

2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 ____D C:\Users\Gast\AppData\Local\VirtualStore

2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 ____D C:\Users\Gast\AppData\Local\DigitalPersona

2013-07-11 13:54 - 2011-10-17 22:49 - 00000000 ____D C:\Users\Gast\AppData\Local\Microsoft Help

2013-07-11 13:54 - 2009-07-27 16:09 - 00000020 ___SH C:\Users\Gast\ntuser.ini

188
 

==================== One Month Modified Files and Folders =======
 

2013-08-03 08:05 - 2013-05-22 18:19 - 00000000 ____D C:\Program Files\iTunes

2013-08-03 08:05 - 2013-05-22 18:19 - 00000000 ____D C:\Program Files\iPod

2013-08-03 08:05 - 2013-05-22 18:19 - 00000000 ____D C:\Program Files (x86)\iTunes

2013-08-03 08:05 - 2012-04-29 21:00 - 00000000 ____D C:\Users\Katharina\AppData\Roaming\vlc

2013-08-03 08:05 - 2011-11-28 21:36 - 00000000 ____D C:\ProgramData\Apple Computer

2013-08-03 08:05 - 2011-10-14 19:15 - 00000000 ____D C:\Users\Katharina

2013-08-03 08:05 - 2011-06-21 02:44 - 00000000 ____D C:\ProgramData\FLEXnet

2013-08-03 08:05 - 2009-07-14 05:20 - 00000000 ____D C:\windows\AppCompat

2013-08-03 08:04 - 2013-07-16 18:40 - 00000000 ___RD C:\Sandbox

2013-08-03 08:04 - 2013-07-16 18:39 - 00000000 ____D C:\Program Files\Sandboxie

2013-08-03 08:04 - 2009-07-14 05:20 - 00000000 ____D C:\windows\registration

2013-08-02 23:30 - 2013-08-02 23:30 - 00000000 ____D C:\FRST

2013-08-02 23:29 - 2013-08-02 23:29 - 00000488 _____ C:\Users\Administrator\Desktop\defogger_disable.log

2013-08-02 23:29 - 2013-08-02 23:29 - 00000000 _____ C:\Users\Administrator\defogger_reenable

2013-08-02 23:29 - 2013-08-02 22:16 - 00000000 ____D C:\Users\Administrator

2013-08-02 23:29 - 2011-06-21 02:34 - 00700168 _____ C:\windows\system32\perfh007.dat

2013-08-02 23:29 - 2011-06-21 02:34 - 00148964 _____ C:\windows\system32\perfc007.dat

2013-08-02 23:29 - 2009-07-14 07:13 - 01621244 _____ C:\windows\system32\PerfStringBackup.INI

2013-08-02 23:26 - 2013-08-02 23:29 - 01781485 _____ (Farbar) C:\Users\Administrator\Desktop\FRST64.exe

2013-08-02 23:26 - 2013-08-02 23:29 - 00377856 _____ C:\Users\Administrator\Desktop\gmer_2.1.19163.exe

2013-08-02 23:26 - 2013-08-02 23:26 - 00141312 _____ C:\Users\ADMINI~1\AppData\Local\GDIPFONTCACHEV1.DAT

2013-08-02 23:24 - 2013-08-02 23:29 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Administrator\Desktop\mbam-setup-1.75.0.1300.exe

2013-08-02 23:24 - 2013-08-02 23:29 - 00050477 _____ C:\Users\Administrator\Desktop\Defogger.exe

2013-08-02 23:20 - 2012-10-15 11:51 - 00000000 ____D C:\Program Files (x86)\Pythagoras

2013-08-02 22:52 - 2011-06-21 02:48 - 00000000 ____D C:\ProgramData\PDFC

2013-08-02 22:52 - 2011-06-21 02:45 - 00000000 ____D C:\ProgramData\HPQLOG

2013-08-02 22:50 - 2009-07-14 07:08 - 00000006 ____H C:\windows\Tasks\SA.DAT

2013-08-02 22:50 - 2009-07-14 06:51 - 00116098 _____ C:\windows\setupact.log

2013-08-02 22:35 - 2013-08-02 22:35 - 00063958 _____ C:\Users\Potti\GPReport.html

2013-08-02 22:35 - 2013-03-15 22:13 - 00000000 ____D C:\Users\Potti

2013-08-02 22:33 - 2013-03-15 22:44 - 00141312 _____ C:\Users\Potti\AppData\Local\GDIPFONTCACHEV1.DAT

2013-08-02 22:30 - 2013-08-02 22:30 - 00045285 _____ C:\acadminidump.dmp

2013-08-02 22:29 - 2013-08-02 22:29 - 00000000 ____D C:\Users\ADMINI~1\AppData\Local\Auer - Die Bausoftware GmbH

2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Vorlagen

2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Startmenü

2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Netzwerkumgebung

2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Lokale Einstellungen

2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Eigene Dateien

2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Druckumgebung

2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Documents\Eigene Musik

2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Documents\Eigene Bilder

2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programme

2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Anwendungsdaten

2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\ADMINI~1\AppData\Local\Verlauf

2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\ADMINI~1\AppData\Local\Anwendungsdaten

2013-08-02 22:11 - 2011-08-30 19:01 - 01778510 _____ C:\windows\WindowsUpdate.log

2013-08-02 22:11 - 2009-07-14 06:45 - 00020944 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-08-02 22:11 - 2009-07-14 06:45 - 00020944 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-08-02 22:08 - 2013-07-12 23:16 - 00003924 _____ C:\windows\System32\Tasks\avast! Emergency Update

2013-08-02 22:08 - 2013-07-12 23:16 - 00001922 _____ C:\Users\Public\Desktop\avast! Free Antivirus.lnk

2013-08-02 22:08 - 2013-07-12 23:16 - 00000000 _____ C:\windows\SysWOW64\config.nt

2013-08-02 22:06 - 2013-01-01 12:26 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job

2013-07-28 23:46 - 2012-11-18 18:59 - 01070416 _____ C:\xxbgtask.log

2013-07-25 21:17 - 2011-10-15 09:43 - 00000000 ____D C:\Users\Katharina\AppData\Local\cache

2013-07-21 23:00 - 2011-11-10 19:34 - 00000000 ____D C:\Users\Katharina\Documents\Veldidena

2013-07-21 20:25 - 2011-11-10 16:55 - 00005934 _____ C:\Users\Katharina\Documents\plot.log

2013-07-15 19:59 - 2012-07-17 18:24 - 00001116 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job

2013-07-15 19:39 - 2013-01-01 12:26 - 00003822 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater

2013-07-15 19:39 - 2012-11-12 21:09 - 00692104 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe

2013-07-15 19:39 - 2012-11-12 21:09 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl

2013-07-15 19:28 - 2013-07-15 19:28 - 00000000 ____D C:\Users\Katharina\AppData\Roaming\TeamViewer

2013-07-15 19:27 - 2012-07-17 18:24 - 00001112 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job

2013-07-15 19:27 - 2011-10-20 10:56 - 00000035 _____ C:\Users\Public\Documents\AtherosServiceConfig.ini

2013-07-14 23:48 - 2012-04-17 17:38 - 00001154 _____ C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-751829164-2267940102-591571508-1001UA.job

2013-07-14 17:48 - 2012-04-17 17:38 - 00001132 _____ C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-751829164-2267940102-591571508-1001Core.job

2013-07-13 14:00 - 2012-09-20 20:22 - 00002183 _____ C:\Users\Public\Desktop\Google Chrome.lnk

2013-07-13 13:54 - 2012-07-17 18:24 - 00004112 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA

2013-07-13 13:54 - 2012-07-17 18:24 - 00003860 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore

2013-07-12 23:26 - 2013-07-12 23:26 - 00000175 _____ C:\windows\system32\Drivers\aswVmm.sys.sum

2013-07-12 23:26 - 2013-07-12 23:26 - 00000175 _____ C:\windows\system32\Drivers\aswSP.sys.sum

2013-07-12 23:26 - 2013-07-12 23:26 - 00000175 _____ C:\windows\system32\Drivers\aswSnx.sys.sum

2013-07-12 23:26 - 2013-07-12 23:16 - 01030952 _____ (AVAST Software) C:\windows\system32\Drivers\aswSnx.sys

2013-07-12 23:26 - 2013-07-12 23:16 - 00378944 _____ (AVAST Software) C:\windows\system32\Drivers\aswSP.sys

2013-07-12 23:26 - 2013-07-12 23:16 - 00189936 _____ C:\windows\system32\Drivers\aswVmm.sys

2013-07-12 23:15 - 2013-07-12 23:15 - 00000000 ____D C:\Program Files\AVAST Software

2013-07-12 23:15 - 2013-07-12 18:52 - 00000000 ____D C:\ProgramData\AVAST Software

2013-07-12 23:02 - 2012-02-28 15:32 - 00000000 ____D C:\ProgramData\Electronic Arts

2013-07-12 22:58 - 2011-08-30 19:27 - 00487972 _____ C:\windows\PFRO.log

2013-07-12 22:58 - 2011-08-30 19:22 - 00000000 ____D C:\ProgramData\Norton

2013-07-12 22:54 - 2011-10-14 19:24 - 00141312 _____ C:\Users\Katharina\AppData\Local\GDIPFONTCACHEV1.DAT

2013-07-12 22:53 - 2009-07-14 06:45 - 00492616 _____ C:\windows\system32\FNTCACHE.DAT

2013-07-12 18:59 - 2013-07-12 18:59 - 00001162 _____ C:\Users\Public\Desktop\TeamViewer 8.lnk

2013-07-12 18:59 - 2013-07-12 18:59 - 00000000 ____D C:\Program Files (x86)\TeamViewer

2013-07-12 18:42 - 2013-07-12 18:42 - 00000002 _____ C:\AvastSetup.log

2013-07-11 22:13 - 2009-07-14 07:08 - 00032640 _____ C:\windows\Tasks\SCHEDLGU.TXT

2013-07-11 22:11 - 2013-03-15 04:03 - 00000000 ____D C:\Program Files\Microsoft Silverlight

2013-07-11 22:11 - 2013-03-15 04:03 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight

2013-07-11 22:11 - 2009-07-27 16:36 - 00000000 ____D C:\Program Files\Windows Journal

2013-07-11 22:11 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender

2013-07-11 22:11 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender

2013-07-11 16:35 - 2011-10-14 19:36 - 00000000 ____D C:\ProgramData\Microsoft Help

2013-07-11 15:03 - 2013-07-11 15:03 - 00000000 ____D C:\Users\Katharina\Documents\Monika

2013-07-11 14:05 - 2013-07-11 13:56 - 00000000 ____D C:\Users\Gast\Documents\Bluetooth Folder

2013-07-11 13:56 - 2013-07-11 13:56 - 00141312 _____ C:\Users\Gast\AppData\Local\GDIPFONTCACHEV1.DAT

2013-07-11 13:56 - 2013-07-11 13:56 - 00000000 ____D C:\Users\Gast\AppData\Roaming\Intel Corporation

2013-07-11 13:56 - 2013-07-11 13:56 - 00000000 ____D C:\Users\Gast\AppData\Roaming\hpqLog

2013-07-11 13:56 - 2013-07-11 13:56 - 00000000 ____D C:\Users\Gast\AppData\Roaming\HILTI

2013-07-11 13:56 - 2013-07-11 13:56 - 00000000 ____D C:\Users\Gast\AppData\Roaming\Apple Computer

2013-07-11 13:56 - 2013-07-11 13:56 - 00000000 ____D C:\Users\Gast\AppData\Local\PDFC

2013-07-11 13:56 - 2013-07-11 13:56 - 00000000 ____D C:\Users\Gast\AppData\Local\BMExplorer

2013-07-11 13:56 - 2011-08-30 19:13 - 00000000 ____D C:\Users\Public\Documents\Atheros

2013-07-11 13:55 - 2013-07-11 13:55 - 00000000 ___RD C:\Users\Gast\Virtual Machines

2013-07-11 13:55 - 2013-07-11 13:55 - 00000000 ____D C:\Users\Gast\AppData\Roaming\Synaptics

2013-07-11 13:55 - 2013-07-11 13:55 - 00000000 ____D C:\Users\Gast\AppData\Roaming\Adobe

2013-07-11 13:55 - 2013-07-11 13:54 - 00000000 ____D C:\Users\Gast

2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Vorlagen

2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Startmenü

2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Netzwerkumgebung

2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Lokale Einstellungen

2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Eigene Dateien

2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Druckumgebung

2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Documents\Eigene Musik

2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Documents\Eigene Bilder

2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\AppData\Local\Verlauf

2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\AppData\Local\Anwendungsdaten

2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Anwendungsdaten

2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 ____D C:\Users\Gast\AppData\Roaming\DigitalPersona

2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 ____D C:\Users\Gast\AppData\Local\VirtualStore

2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 ____D C:\Users\Gast\AppData\Local\DigitalPersona

2013-07-08 21:15 - 2011-10-17 22:03 - 00000052 _____ C:\windows\SysWOW64\DOErrors.log

2013-07-07 09:59 - 2011-11-01 11:45 - 00000348 _____ C:\windows\Tasks\HPCeeScheduleForKatharina.job

2013-07-06 02:59 - 2011-11-01 11:45 - 00003210 _____ C:\windows\System32\Tasks\HPCeeScheduleForKatharina
 

Files to move or delete:

====================

C:\ProgramData\0466116.bat

C:\ProgramData\0466116.pad

C:\ProgramData\0466116.reg

C:\ProgramData\1280261.bat

C:\ProgramData\1280261.pad

C:\ProgramData\1280261.reg

C:\Users\Katharina\6116640.dll
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-07-25 19:21
 

==================== End Of Log ============================

--- --- ---

Addition:

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 01-08-2013

Ran by Administrator at 2013-08-02 23:31:38

Running from C:\Users\Administrator\Desktop

Boot Mode: Safe Mode (minimal)

==========================================================
 
 

==================== Installed Programs =======================
 

   

 Update for Microsoft Office 2007 (KB2508958) (x32)

2007 Microsoft Office system (x32 Version: 12.0.6612.1000)

64 Bit HP CIO Components Installer (Version: 6.2.2)

ActiveCheck component for HP Active Support Library (x32 Version: 3.0.0.3)

Adobe Flash Player 11 ActiveX (x32 Version: 11.8.800.94)

Adobe Reader X (10.1.7) - Deutsch (x32 Version: 10.1.7)

Agatha Christie - Peril at End House (x32 Version: 2.2.0.95)

Apple Application Support (x32 Version: 2.3.4)

Apple Mobile Device Support (Version: 6.1.0.13)

Apple Software Update (x32 Version: 2.1.3.127)

ArcSoft TotalMedia (x32 Version: 1.0.48.25)

ArcSoft TotalMedia (x32 Version: 2.0.39.12)

ArcSoft Webcam Sharing Manager (x32 Version: 2.0.0.30)

Ask Toolbar (x32 Version: 1.15.4.0)

Atheros Driver Installation Program (x32 Version: 9.2)

AUER Success.6 Lernversion (x32 Version: 06.00.0228)

AutoCAD 2012 Language Pack - Deutsch (Version: 18.2.51.0)

AutoCAD LT 2012 - Deutsch (Version: 18.2.51.0)

AutoCAD LT 2012 Language Pack - Deutsch (Version: 18.2.51.0)

Autodesk Content Service (x32 Version: 2.0.90)

Autodesk Inventor Fusion 2012 (Version: 1.0.0.79)

Autodesk Inventor Fusion 2012 Language Pack (Version: 1.0.0.79)

Autodesk Inventor Fusion Plugin for AutoCAD 2012 (Version: 0.0.1.138)

Autodesk Inventor Fusion plug-in for AutoCAD 2012 (Version: 0.0.1.138)

Autodesk Inventor Fusion Plugin Language Pack for AutoCAD 2012 (Version: 0.0.1.138)

Autodesk Material Library 2012 (x32 Version: 2.5.0.8)

Autodesk Material Library Base Resolution Image Library 2012 (x32 Version: 2.5.0.8)

avast! Free Antivirus (x32 Version: 8.0.1489.0)

Bejeweled 2 Deluxe (x32 Version: 2.2.0.95)

Bing Bar (x32 Version: 7.1.361.0)

Bing Rewards Client Installer (x32 Version: 16.0.345.0)

Blasterball 3 (x32 Version: 2.2.0.95)

Bluetooth Win7 Suite (64) (Version: 7.02.000.55)

Bonjour (Version: 3.0.0.10)

Bounce Symphony (x32 Version: 2.2.0.95)

Build-a-Lot - The Elizabethan Era (x32 Version: 2.2.0.95)

Cake Mania (x32 Version: 2.2.0.95)

Chuzzle Deluxe (x32 Version: 2.2.0.95)

Cinergy T USB XXS V2.03.03.29 (x32 Version: 2.03.03.29)

Cisco EAP-FAST Module (x32 Version: 2.2.14)

Cisco LEAP Module (x32 Version: 1.0.19)

Cisco PEAP Module (x32 Version: 1.1.6)

D3DX10 (x32 Version: 15.4.2368.0902)

Device Access Manager for HP ProtectTools (Version: 6.0.0.9)

Die Sims™ 3 (x32 Version: 1.19.44)

Die Sims™ 3 Design-Garten-Accessoires (x32 Version: 7.0.55)

Die Sims™ 3 Gib Gas-Accessoires (x32 Version: 5.0.44)

Die Sims™ 3 Reiseabenteuer (x32 Version: 2.0.86)

Diner Dash 2 Restaurant Rescue (x32 Version: 2.2.0.95)

Drive Encryption For HP ProtectTools (Version: 6.0.33.24411)

Energy Star Digital Logo (x32 Version: 1.0.1)

Evernote v. 4.2.2 (x32 Version: 4.2.2.3979)

Face Recognition for HP ProtectTools (Version: 6.00.4303)

Facebook Messenger 2.1.4814.0 (x32 Version: 2.1.4814.0)

Farm Frenzy (x32 Version: 2.2.0.95)

FARO LS 1.1.406.58 (x32 Version: 4.6.58.2)

FATE (x32 Version: 2.2.0.95)

File Sanitizer For HP ProtectTools (x32 Version: 6.0.0.8)

Galerie de photos Windows Live (x32 Version: 15.4.3502.0922)

GeoGebra (x32 Version: 4.0.21.0)

Google Chrome (x32 Version: 28.0.1500.72)

Google Toolbar for Internet Explorer (x32 Version: 1.0.0)

Google Toolbar for Internet Explorer (x32 Version: 7.5.4209.2358)

Google Update Helper (x32 Version: 1.3.21.153)

Hilti PROFIS Anchor (x32 Version: 2.3.0000)

Hilti PROFIS AutoUpdate (x32 Version: 1.6.0)

HP 3D DriveGuard (Version: 4.1.4.1)

HP Auto (Version: 1.0.12494.3472)

HP Connection Manager (x32 Version: 4.1.10.1)

HP Customer Experience Enhancements (x32 Version: 6.0.1.7)

HP DayStarter (Version: 2.0.0.12)

HP Documentation (x32 Version: 1.2.0.0)

HP ESU for Microsoft Windows 7 (x32 Version: 1.1.11.1)

HP Game Console (x32)

HP Games (x32 Version: 1.0.1.5)

HP HD Webcam [Fixed] (x32 Version: 3.3.4.07)

HP HotKey Support (Version: 4.0.10.1)

HP Power Assistant (Version: 2.0.2.0)

HP ProtectTools Security Manager (Version: 6.00.888)

HP QuickWeb (x32 Version: 3.0.0.9057)

HP Setup (x32 Version: 8.5.4526.3645)

HP SoftPaq Download Manager (x32 Version: 3.2.0.0)

HP Software Framework (x32 Version: 4.0.112.1)

HP Software Setup (x32 Version: 8.2.1.1)

HP Support Assistant (x32 Version: 5.2.3.4)

HP System Default Settings (x32 Version: 2.1.2)

HP Wallpaper (x32 Version: 2.00)

HPAsset component for HP Active Support Library (x32 Version: 3.0.2.2)

IDT Audio (x32 Version: 1.0.6325.0)

Insaniquarium Deluxe (x32 Version: 2.2.0.95)

Intel(R) Identity Protection Technology 1.0.71.0 (x32 Version: 1.0.71.0)

Intel(R) Management Engine Components (x32 Version: 7.0.0.1144)

Intel(R) Processor Graphics (x32 Version: 8.15.10.2342)

Intel(R) Rapid Storage Technology (x32 Version: 10.1.2.1004)

iTunes (Version: 11.0.3.42)

Java Auto Updater (x32 Version: 2.0.7.1)

Java(TM) 6 Update 31 (x32 Version: 6.0.310)

Jewel Quest II (x32 Version: 2.2.0.95)

Jewel Quest Solitaire (x32 Version: 2.2.0.95)

JMicron Flash Media Controller Driver (x32 Version: 1.0.57.2)

John Deere Drive Green (x32 Version: 2.2.0.95)

Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)

Microsoft .NET Framework 4 Extended (Version: 4.0.30319)

Microsoft Application Error Reporting (Version: 12.0.6015.5000)

Microsoft Office 2007 Service Pack 3 (SP3) (x32)

Microsoft Office 2010 (x32 Version: 14.0.4763.1000)

Microsoft Office Access MUI (German) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000)

Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Professional Hybrid 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014)

Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32)

Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000)

Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Silverlight (Version: 5.1.20513.0)

Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)

Microsoft SQL Server 2008 Management Objects (Version: 10.1.2531.0)

Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336)

Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)

Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336)

Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.59192)

Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (Version: 10.0.30319)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)

Microsoft WSE 3.0 Runtime (x32 Version: 3.0.5305.0)

Microsoft_VC90_CRT_x86 (x32 Version: 1.0.0)

MSVCRT (x32 Version: 15.4.2862.0708)

MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)

MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)

oCAD 2012 - Deutsch (Version: 18.2.51.0)

PDF Complete Special Edition (x32 Version: 4.0.33)

Penguins! (x32 Version: 2.2.0.95)

Plants vs. Zombies (x32 Version: 2.2.0.95)

PlayReady PC Runtime amd64 (Version: 1.3.0)

Polar Bowler (x32 Version: 2.2.0.95)

Privacy Manager for HP ProtectTools (Version: 6.00.831)

ProVI2010_x64 5.1 (x32 Version: 5.1)

Pythagoras (x32 Version: 12.26)

Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922)

Realtek Ethernet Controller All-In-One Windows Driver (x32 Version: 1.12.0016)

RuckZuck (x32 Version: 6.0.10)

SDK (x32 Version: 2.24.025)

Skype™ 5.10 (x32 Version: 5.10.116)

Slingo Deluxe (x32 Version: 2.2.0.95)

SQL Server System CLR Types (Version: 10.1.2531.0)

Synaptics Pointing Device Driver (Version: 15.2.11.1)

TeamViewer 8 (x32 Version: 8.0.19617)

Theft Recovery for HP ProtectTools (x32 Version: 6.0.0.30)

Update for 2007 Microsoft Office System (KB967642) (x32)

Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)

Update for Microsoft .NET Framework 4 Client Profile (KB2473228) (x32 Version: 1)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)

Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)

Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)

Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1)

Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1)

Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1)

Update for Microsoft .NET Framework 4 Extended (KB2836939) (x32 Version: 1)

Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (x32)

Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition (x32)

Update for Microsoft Office 2007 suites (KB2596802) 32-Bit Edition (x32)

Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition (x32)

Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (x32)

Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (x32)

Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (x32)

Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2817563) 32-Bit Edition (x32)

Update für Microsoft Office Excel 2007 Help (KB963678) (x32)

Update für Microsoft Office Outlook 2007 Help (KB963677) (x32)

Update für Microsoft Office Powerpoint 2007 Help (KB963669) (x32)

Update für Microsoft Office Word 2007 Help (KB963665) (x32)

Validity Fingerprint Sensor Driver (Version: 4.3.117.0)

VIP Access SDK x64(1.0.0.50)  (x32 Version: 1.0.0.50)

Virtual Villagers - The Secret City (x32 Version: 2.2.0.95)

VLC media player 2.0.1 (x32 Version: 2.0.1)

Wedding Dash (x32 Version: 2.2.0.95)

Windows Live (x32 Version: 15.4.3502.0922)

Windows Live Communications Platform (x32 Version: 15.4.3502.0922)

Windows Live Essentials (x32 Version: 15.4.3502.0922)

Windows Live Fotogalerie (x32 Version: 15.4.3502.0922)

Windows Live ID Sign-in Assistant (Version: 7.250.4225.0)

Windows Live Installer (x32 Version: 15.4.3502.0922)

Windows Live Language Selector (Version: 15.4.3502.0922)

Windows Live Movie Maker (x32 Version: 15.4.3502.0922)

Windows Live Photo Common (x32 Version: 15.4.3502.0922)

Windows Live Photo Gallery (x32 Version: 15.4.3502.0922)

Windows Live PIMT Platform (x32 Version: 15.4.3502.0922)

Windows Live SOXE (x32 Version: 15.4.3502.0922)

Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922)

Windows Live UX Platform (x32 Version: 15.4.3502.0922)

Windows Live UX Platform Language Pack (x32 Version: 15.4.3502.0922)

WinZip 14.5 (x32 Version: 14.5.9095)

Xobni (x32 Version: 1.9.5.13282)

Xobni Core (x32 Version: 1.0.0)

Zuma Deluxe (x32 Version: 2.2.0.95)
 

==================== Restore Points  =========================
 

23-07-2013 16:30:55 Windows Update

26-07-2013 18:49:15 Windows Update
 

==================== Hosts content: ==========================
 

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts
 

==================== Scheduled Tasks (whitelisted) =============
 

Task: {24D104BA-E059-4042-BBCD-091B8B1DDBEA} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-07-17] (Google Inc.)

Task: {4FFE6CAC-D9A9-4ABF-BDE0-CC9362A7660E} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)

Task: {5BED5862-9232-44B6-9FD4-595A7C0857DC} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\windows\System32\lpksetup.exe [2010-11-20] (Microsoft Corporation)

Task: {61D00D3F-C3F8-4657-8CB9-EFA933017D98} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2010-12-10] (Hewlett-Packard Company)

Task: {640BFA6E-B405-4D1A-9882-4D45F0CDFFEF} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-751829164-2267940102-591571508-1001UA => C:\Users\Katharina\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-12] (Facebook Inc.)

Task: {7FBE12B0-5D8D-48C8-B4E3-A3BF3012EDC5} - System32\Tasks\Scheduled Update for Ask Toolbar => C:\Program Files (x86)\Ask.com\UpdateTask.exe [2012-06-06] ()

Task: {9DCC5731-D6F9-4BA2-A49D-BEC942790A41} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => c:\program files\windows defender\MpCmdRun.exe [2009-07-14] (Microsoft Corporation)

Task: {ADDEEFDD-8CE2-4028-9E08-406DB63E1831} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task

Task: {BB2A30B6-AA5E-410A-85F6-BBA46DDC42D6} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Tuneup => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2010-12-10] (Hewlett-Packard Company)

Task: {BD9ECD7B-DEA9-4699-8EDD-43363518684D} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-23] (Microsoft Corporation)

Task: {C19F0537-A9A4-4264-8F9D-5FA7EDEE3481} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-07-17] (Google Inc.)

Task: {C2A47E9E-FDAD-4936-80CA-1320BE893337} - System32\Tasks\NetworkWizardVCW => C:\Program Files (x86)\Hewlett-Packard\HP Setup\RemEngine.exe [2011-01-25] ()

Task: {C918E184-1B71-442E-9F72-9D5511750F1C} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HPSAObjUtilTask => C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\UtilTask.exe [2013-06-04] (Microsoft)

Task: {C98F4C41-99A8-46C4-B6D5-28D024BAE592} - System32\Tasks\HPCeeScheduleForKATHARINA-HP$ => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14] (Hewlett-Packard)

Task: {D11A732F-6A33-4773-835C-1195C30E12A4} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\Windows\ehome\mcupdate.exe [2010-11-20] (Microsoft Corporation)

Task: {D1702CDF-A97F-461E-AFE5-8EBE38DF1B6C} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-07-15] (Adobe Systems Incorporated)

Task: {DBC78FF0-E72F-4638-AD0C-86C5910CE5A2} - System32\Tasks\HPCeeScheduleForKatharina => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14] (Hewlett-Packard)

Task: {DECBB6D4-CE38-4365-A131-CB1C3312F1F6} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-751829164-2267940102-591571508-1001Core => C:\Users\Katharina\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-12] (Facebook Inc.)

Task: {EFE5C061-8B09-49D3-BDF3-D5A4E63EA749} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2013-05-09] (AVAST Software)

Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-751829164-2267940102-591571508-1001Core.job => C:\Users\Katharina\AppData\Local\Facebook\Update\FacebookUpdate.exe

Task: C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-751829164-2267940102-591571508-1001UA.job => C:\Users\Katharina\AppData\Local\Facebook\Update\FacebookUpdate.exe

Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\windows\Tasks\HPCeeScheduleForKATHARINA-HP$.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe

Task: C:\windows\Tasks\HPCeeScheduleForKatharina.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
 

==================== Faulty Device Manager Devices =============
 

Name: Security Processor Loader Driver

Description: Security Processor Loader Driver

Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}

Manufacturer: 

Service: spldr

Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)

Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.

Devices stay in this state if they have been prepared for removal.

After you remove the device, this error disappears.Remove the device, and this error should be resolved.
 

Name: aswRvrt

Description: aswRvrt

Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}

Manufacturer: 

Service: aswRvrt

Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)

Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.

Devices stay in this state if they have been prepared for removal.

After you remove the device, this error disappears.Remove the device, and this error should be resolved.
 

Name: aswVmm

Description: aswVmm

Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}

Manufacturer: 

Service: aswVmm

Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)

Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.

Devices stay in this state if they have been prepared for removal.

After you remove the device, this error disappears.Remove the device, and this error should be resolved.
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (08/02/2013 10:52:10 PM) (Source: Wininit) (User: )

Description: Ein kritischer Systemprozess C:\windows\system32\lsass.exe ist fehlgeschlagen mit den Statuscode c0000005. Der Computer muss neu gestartet werden.
 

Error: (08/02/2013 10:52:10 PM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: lsass.exe, Version: 6.1.7601.17725, Zeitstempel: 0x4ec483fc

Name des fehlerhaften Moduls: PTLsaFltr64.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x4d2ddffa

Ausnahmecode: 0xc0000005

Fehleroffset: 0x000007fef8d4a0ea

ID des fehlerhaften Prozesses: 0x290

Startzeit der fehlerhaften Anwendung: 0xlsass.exe0

Pfad der fehlerhaften Anwendung: lsass.exe1

Pfad des fehlerhaften Moduls: lsass.exe2

Berichtskennung: lsass.exe3
 

Error: (08/02/2013 10:48:53 PM) (Source: Wininit) (User: )

Description: Ein kritischer Systemprozess C:\windows\system32\lsass.exe ist fehlgeschlagen mit den Statuscode c0000005. Der Computer muss neu gestartet werden.
 

Error: (08/02/2013 10:48:53 PM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: lsass.exe, Version: 6.1.7601.17725, Zeitstempel: 0x4ec483fc

Name des fehlerhaften Moduls: PTLsaFltr64.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x4d2ddffa

Ausnahmecode: 0xc0000005

Fehleroffset: 0x000007fef9c2a0ea

ID des fehlerhaften Prozesses: 0x2a8

Startzeit der fehlerhaften Anwendung: 0xlsass.exe0

Pfad der fehlerhaften Anwendung: lsass.exe1

Pfad des fehlerhaften Moduls: lsass.exe2

Berichtskennung: lsass.exe3
 

Error: (08/02/2013 10:45:30 PM) (Source: Wininit) (User: )

Description: Ein kritischer Systemprozess C:\windows\system32\lsass.exe ist fehlgeschlagen mit den Statuscode c0000005. Der Computer muss neu gestartet werden.
 

Error: (08/02/2013 10:45:30 PM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: lsass.exe, Version: 6.1.7601.17725, Zeitstempel: 0x4ec483fc

Name des fehlerhaften Moduls: PTLsaFltr64.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x4d2ddffa

Ausnahmecode: 0xc0000005

Fehleroffset: 0x000007fef908a0ea

ID des fehlerhaften Prozesses: 0x290

Startzeit der fehlerhaften Anwendung: 0xlsass.exe0

Pfad der fehlerhaften Anwendung: lsass.exe1

Pfad des fehlerhaften Moduls: lsass.exe2

Berichtskennung: lsass.exe3
 

Error: (08/02/2013 10:42:12 PM) (Source: Wininit) (User: )

Description: Ein kritischer Systemprozess C:\windows\system32\lsass.exe ist fehlgeschlagen mit den Statuscode c0000005. Der Computer muss neu gestartet werden.
 

Error: (08/02/2013 10:42:12 PM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: lsass.exe, Version: 6.1.7601.17725, Zeitstempel: 0x4ec483fc

Name des fehlerhaften Moduls: PTLsaFltr64.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x4d2ddffa

Ausnahmecode: 0xc0000005

Fehleroffset: 0x000007fef92fa0ea

ID des fehlerhaften Prozesses: 0x294

Startzeit der fehlerhaften Anwendung: 0xlsass.exe0

Pfad der fehlerhaften Anwendung: lsass.exe1

Pfad des fehlerhaften Moduls: lsass.exe2

Berichtskennung: lsass.exe3
 

Error: (08/02/2013 10:19:43 PM) (Source: Wininit) (User: )

Description: Ein kritischer Systemprozess C:\windows\system32\lsass.exe ist fehlgeschlagen mit den Statuscode c0000005. Der Computer muss neu gestartet werden.
 

Error: (08/02/2013 10:19:43 PM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: lsass.exe, Version: 6.1.7601.17725, Zeitstempel: 0x4ec483fc

Name des fehlerhaften Moduls: PTLsaFltr64.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x4d2ddffa

Ausnahmecode: 0xc0000005

Fehleroffset: 0x000007fef9bfa0ea

ID des fehlerhaften Prozesses: 0x2bc

Startzeit der fehlerhaften Anwendung: 0xlsass.exe0

Pfad der fehlerhaften Anwendung: lsass.exe1

Pfad des fehlerhaften Moduls: lsass.exe2

Berichtskennung: lsass.exe3
 
 

System errors:

=============

Error: (08/02/2013 11:30:07 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 

%%1068
 

Error: (08/02/2013 11:18:30 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "PnP-X-IP-Busenumerator" ist vom Dienst "Funktionssuchanbieter-Host" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 

%%1068
 

Error: (08/02/2013 11:17:03 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 

%%1068
 

Error: (08/02/2013 11:17:03 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 

%%1068
 

Error: (08/02/2013 11:17:03 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 

%%1068
 

Error: (08/02/2013 11:17:03 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 

%%1068
 

Error: (08/02/2013 11:17:03 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 

%%1068
 

Error: (08/02/2013 11:17:02 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 

%%1068
 

Error: (08/02/2013 11:17:03 PM) (Source: DCOM) (User: )

Description: 1084WSearch{9E175B6D-F52A-11D8-B9A5-505054503030}
 

Error: (08/02/2013 11:16:59 PM) (Source: DCOM) (User: )

Description: 1084WSearch{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
 
 

Microsoft Office Sessions:

=========================
 

==================== Memory info =========================== 
 

Percentage of memory in use: 16%

Total physical RAM: 4030.37 MB

Available physical RAM: 3378.78 MB

Total Pagefile: 8058.92 MB

Available Pagefile: 7456.89 MB

Total Virtual: 8192 MB

Available Virtual: 8191.83 MB
 

==================== Drives ================================
 

Drive c: () (Fixed) (Total:442.57 GB) (Free:53.1 GB) NTFS (Disk=0 Partition=2) ==>[System with boot components (obtained from reading drive)]

Drive d: (GONNA_WORK) (Removable) (Total:0.24 GB) (Free:0.23 GB) FAT (Disk=1 Partition=1)

Drive e: (HP_RECOVERY) (Fixed) (Total:17.89 GB) (Free:2.72 GB) NTFS (Disk=0 Partition=3) ==>[System with boot components (obtained from reading drive)]

Drive f: (HP_TOOLS) (Fixed) (Total:4.98 GB) (Free:2.13 GB) FAT32 (Disk=0 Partition=4)
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 13B7DE8A)

Partition 1: (Active) - (Size=300 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=443 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=18 GB) - (Type=07 NTFS)

Partition 4: (Not Active) - (Size=5 GB) - (Type=0C)
 

========================================================

Disk: 1 (MBR Code: Windows 7 or 8) (Size: 250 MB) (Disk ID: 00000000)

Partition 1: (Active) - (Size=250 MB) - (Type=06)
 

==================== End Of Log ============================

GMER:

Code:

GMER 2.1.19163 - hxxp://www.gmer.net

Rootkit scan 2013-08-02 23:46:02

Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST950042 rev.0006 465,76GB

Running: gmer_2.1.19163.exe; Driver: C:\Users\ADMINI~1\AppData\Local\Temp\uflcquoc.sys
 
 

---- Registry - GMER 2.1 ----
 

Reg  HKLM\SYSTEM\ControlSet001\services\BTHPORT\Parameters\Keys\d0df9aa889dc (not active ControlSet)  

Reg  HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\d0df9aa889dc                      

Reg  HKLM\SYSTEM\ControlSet003\services\BTHPORT\Parameters\Keys\d0df9aa889dc (not active ControlSet)  
 

---- EOF - GMER 2.1 ----

Vielen Dank schon im Voraus!!

Liebe Grüße,
pflanz!

Hallo Schrauber,

danke für die schnelle Unterstützung sogar am Wochenende!!

Eine Frage: Glaubst du ist das Problem mit dem RPC-Server durch Entfernen der Viren gelöst oder hat das System sonst einen Schaden? Ich komme nämlich nicht in den normalen Modus. Habe auch diese Tests nun im Abgesicherten Modus ausgeführt (MBAM natürlich mit Netzwerktreibern).
Frage mich nämlich auch ob man ihn nicht überhaupt komplett neu aufsetzen sollte? Oder kriegen wir das mit der Bereinigung hin?
Danke schon im Voraus!!

Hier die gewünschten LOGS:

AdwCleaner:

Code:

# AdwCleaner v2.306 - Datei am 04/08/2013 um 11:08:26 erstellt

# Aktualisiert am 19/07/2013 von Xplode

# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)

# Benutzer : Administrator - KATHARINA-HP

# Bootmodus : Abgesicherter Modus

# Ausgeführt unter : C:\Users\Administrator\Desktop\adwcleaner.exe

# Option [Löschen]
 
 

**** [Dienste] ****
 
 

***** [Dateien / Ordner] *****
 

Ordner Gelöscht : C:\Program Files (x86)\Ask.com

Ordner Gelöscht : C:\ProgramData\Ask

Ordner Gelöscht : C:\Users\Gast\AppData\LocalLow\AskToolbar

Ordner Gelöscht : C:\Users\Katharina\AppData\LocalLow\AskToolbar

Ordner Gelöscht : C:\Users\Potti\AppData\LocalLow\AskToolbar

Ordner Gelöscht : C:\windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
 

***** [Registrierungsdatenbank] *****
 

Schlüssel Gelöscht : HKLM\Software\APN

Schlüssel Gelöscht : HKLM\Software\AskToolbar

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL

Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF

Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF

Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnUpdater]
 

***** [Internet Browser] *****
 

-\\ Internet Explorer v10.0.9200.16635
 

[OK] Die Registrierungsdatenbank ist sauber.
 

*************************
 

AdwCleaner[S1].txt - [3083 octets] - [04/08/2013 11:08:26]
 

########## EOF - C:\AdwCleaner[S1].txt - [3143 octets] ##########

MBAM:

Code:

Malwarebytes Anti-Malware 1.75.0.1300

www.malwarebytes.org
 

Datenbank Version: v2013.08.04.01
 

Windows 7 Service Pack 1 x64 NTFS (Abgesichertenmodus/Netzwerkfähig)

Internet Explorer 10.0.9200.16635

Administrator :: KATHARINA-HP [Administrator]
 

04.08.2013 11:15:31

mbam-log-2013-08-04 (11-15-31).txt
 

Art des Suchlaufs: Quick-Scan

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 294824

Laufzeit: 4 Minute(n), 1 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-08-2013

Ran by Administrator (administrator) on 04-08-2013 11:23:17

Running from C:\Users\Administrator\Desktop

Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Safe Mode (with Networking)
 

==================== Processes (Whitelisted) =================
 

(DigitalPersona, Inc.) c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [HPPowerAssistant] - C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe [2919992 2011-01-27] (Hewlett-Packard Company)

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2679592 2011-02-04] (Synaptics Incorporated)

HKLM\...\Run: [AtherosBtStack] - C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [615584 2011-01-07] (Atheros Communications)

HKLM\...\Run: [AthBtTray] - C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe [379040 2011-01-07] (Atheros Commnucations)

HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [835072 2011-01-27] (IDT, Inc.)

HKLM\...\Run: [MfeEpePcMonitor] - C:\Program Files\Hewlett-Packard\Drive Encryption\EpePcMonitor.exe [200704 2011-02-09] ()

HKLM\...\Run: [XeroxScanUtility] - C:\Program Files\Xerox\Scan_Utility\xrxzipui.exe [2371072 2010-02-10] (Xerox Corporation)

HKLM\...\Run: [XeroxEndeavorBackgroundTask] - C:\windows\system32\xgchabgnd.exe [102912 2009-11-02] ()

HKLM\...\Run: [combofix] - C:\ComboFix\CF5585.3XE /c C:\ComboFix\Combobatch.bat [x]

HKLM\...\Runonce: [combofix] - C:\ComboFix\CF5585.3XE /c C:\ComboFixCombobatch.bat [x]

HKLM-x32\...\RunOnce: [Malwarebytes Anti-Malware] - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent [532040 2013-04-04] (Malwarebytes Corporation)

HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe,

HKCU\...\RunOnce: [Report] - C:\AdwCleaner[S1].txt [3200 2013-08-04] ()

HKLM-x32\...\Run: [PDF Complete] - C:\Program Files (x86)\PDF Complete\pdfsty.exe [656920 2011-02-01] (PDF Complete Inc)

HKLM-x32\...\Run: [QLBController] - C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\QLBController.exe [299576 2011-01-29] (Hewlett-Packard Company)

HKLM-x32\...\Run: [File Sanitizer] - C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\CoreShredder.exe [12274688 2011-02-07] (Hewlett-Packard)

HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2011-01-26] (Intel Corporation)

HKLM-x32\...\Run: [HP HD Webcam [Fixed]_Monitor] - C:\Program Files (x86)\HP HD Webcam [Fixed]\monitor.exe [267128 2010-11-26] ()

HKLM-x32\...\Run: [DTRun] - c:\Program Files (x86)\ArcSoft\TotalMedia Suite\TotalMedia Theatre 3\uDTRun.exe [517456 2010-11-24] (ArcSoft Inc.)

HKLM-x32\...\Run: [HPConnectionManager] - c:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe [94264 2011-04-05] (Hewlett-Packard Development Company L.P.)

HKLM-x32\...\Run: [HPQuickWebProxy] - c:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe [76344 2011-02-11] (Hewlett-Packard Company)

HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)

HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254696 2012-01-18] (Sun Microsystems, Inc.)

HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [PROFIS AutoUpdate] - C:\Program Files (x86)\Hilti\PROFIS AutoUpdate\Hilti.AutoUpdate.Tray.exe [474112 2011-11-02] (Agito d.o.o.)

HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-05-15] (Apple Inc.)

HKLM-x32\...\Run: [avast] - C:\Program Files\AVAST Software\Avast\avastUI.exe [4858968 2013-05-09] (AVAST Software)

Lsa: [Notification Packages] DPPassFilter scecli

Startup: C:\Users\Katharina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk

ShortcutTarget: Facebook Messenger.lnk -> C:\Users\Administrator\AppData\Local\Facebook\Messenger\2.1.4814.0\FacebookMessenger.exe (No File)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPCOM/4

HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = hxxp://g.uk.msn.com/HPCOM/4

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

SearchScopes: HKLM - DefaultScope value is missing.

SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)

BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

BHO-x32: File Sanitizer for HP ProtectTools - {3134413B-49B4-425C-98A5-893C1F195601} - C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\IEBHO.dll (Hewlett-Packard)

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)

BHO-x32: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)

BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\BingExt.dll (Microsoft Corporation.)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)

Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)

Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\BingExt.dll (Microsoft Corporation.)

Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

Toolbar: HKLM-x32 - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

DPF: HKLM-x32 {1ABA5FAC-1417-422B-BA82-45C35E2C908B} hxxp://kitchenplanner.ikea.com/AT/Core/Player/2020PlayerAX_IKEA_Win32.cab

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 10.0.0.138
 

==================== Services (Whitelisted) =================
 

S3 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)

S2 Atheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [138400 2011-01-07] (Atheros)

S2 Autodesk Content Service; C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [18656 2011-02-02] ()

S2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808 2013-05-09] (AVAST Software)

S2 DpHost; c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe [481104 2011-02-12] (DigitalPersona, Inc.)

S3 FLCDLOCK; c:\Windows\SysWOW64\flcdlock.exe [464480 2011-02-04] (Hewlett-Packard Company)

S2 hasplms; C:\windows\system32\hasplms.exe [4889032 2011-12-30] (SafeNet Inc.)

S2 Hilti PROFIS AutoUpdate Service; C:\Program Files (x86)\Hilti\PROFIS AutoUpdate\Hilti.AutoUpdate.Service.exe [206336 2011-11-02] (Agito d.o.o.)

S3 HP ProtectTools Service; c:\Program Files (x86)\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe [36864 2011-01-12] (Hewlett-Packard Development Company, L.P)

S2 HPDayStarterService; c:\Program Files\Hewlett-Packard\HP DayStarter\32-bit\HPDayStarterService.exe [133688 2011-01-28] (Hewlett-Packard Company)

S2 hpHotkeyMonitor; C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\HpHotkeyMonitor.exe [281656 2011-01-29] (Hewlett-Packard Company)

S2 McAfee Endpoint Encryption Agent; C:\Program Files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeHost.exe [1318912 2011-02-09] ()

S2 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [1127448 2011-02-01] (PDF Complete Inc)

S2 uArcCapture; C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe [502464 2010-11-11] (ArcSoft, Inc.)

S2 XobniService; C:\Program Files (x86)\Xobni\XobniService.exe [62184 2011-03-07] (Xobni Corporation)

S2 WinDefend; %ProgramFiles(x86)%\Windows Defender\mpsvc.dll [x]
 

==================== Drivers (Whitelisted) ====================
 

S3 ARCVCAM; C:\Windows\System32\DRIVERS\ArcSoftVCapture.sys [32192 2010-11-11] (ArcSoft, Inc.)

S2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [33400 2013-05-09] (AVAST Software)

S2 aswMonFlt; C:\windows\system32\drivers\aswMonFlt.sys [80816 2013-05-09] (AVAST Software)

R1 aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [72016 2013-05-09] (AVAST Software)

S0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65336 2013-05-09] ()

S1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [1030952 2013-07-12] (AVAST Software)

S1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [378944 2013-07-12] (AVAST Software)

S1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-05-09] (AVAST Software)

S0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [189936 2013-07-12] ()

S3 DAMDrv; C:\Windows\System32\DRIVERS\DAMDrv64.sys [63336 2011-02-07] (Hewlett-Packard Company)

S2 hardlock; C:\windows\system32\drivers\hardlock.sys [321536 2011-09-28] (SafeNet Inc.)

R0 MfeEpePc; C:\Windows\System32\Drivers\MfeEpePc.sys [168008 2011-02-09] (McAfee, Inc.)

S3 mod7700; C:\Windows\System32\DRIVERS\dvb7700all.sys [865344 2009-11-02] (DiBcom)

S3 SPUVCbv; C:\Windows\System32\Drivers\SPUVCbv_x64.sys [2611704 2011-01-12] (Sunplus Technology)

S3 catchme; \??\C:\ComboFix\catchme.sys [x]

S3 HMXProjExt64; system32\DRIVERS\HMXExGrp64.sys [x]

S3 HMXProjMir64; system32\DRIVERS\HMXMrGrp64.sys [x]
 

==================== NetSvcs (Whitelisted) ===================
 

NETSVCx32: AppInfo -> C:\Windows\SysWOW64\appinfo.dll ==> No File.

NETSVCx32: browser -> C:\Windows\SysWOW64\browser.dll ==> No File.

NETSVCx32: EapHost -> C:\Windows\SysWOW64\eapsvc.dll ==> No File.

NETSVCx32: hkmsvc -> C:\Windows\SysWOW64\kmsvc.dll ==> No File.

NETSVCx32: IKEEXT -> C:\Windows\SysWOW64\ikeext.dll ==> No File.

NETSVCx32: MMCSS -> C:\Windows\SysWOW64\mmcss.dll ==> No File.

NETSVCx32: ProfSvc -> C:\Windows\SysWOW64\profsvc.dll ==> No File.

NETSVCx32: seclogon -> %windir%\SysWOW64\seclogon.dll ==> No File.

NETSVCx32: wercplsupport -> C:\Windows\SysWOW64\wercplsupport.dll ==> No File.

NETSVCx32: BDESVC -> C:\Windows\SysWOW64\bdesvc.dll ==> No File.
 

==================== One Month Created Files and Folders ========
 

2013-08-04 11:14 - 2013-08-04 11:14 - 00001105 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-08-04 11:14 - 2013-08-04 11:14 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Malwarebytes

2013-08-04 11:14 - 2013-08-04 11:14 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-08-04 11:14 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys

2013-08-04 11:08 - 2013-08-04 11:08 - 00003200 _____ C:\AdwCleaner[S1].txt

2013-08-04 11:07 - 2013-08-04 11:03 - 00666633 _____ C:\Users\Administrator\Desktop\adwcleaner.exe

2013-08-03 22:41 - 2013-08-04 00:31 - 00000000 ____D C:\Kaspersky Rescue Disk 10.0

2013-08-03 11:51 - 2013-08-03 11:51 - 00030922 _____ C:\ComboFix.txt

2013-08-03 11:41 - 2013-05-08 08:39 - 01910632 _____ (Microsoft Corporation) C:\windows\SysWOW64\Drivers\tcpip.sys

2013-08-03 11:41 - 2010-11-20 12:52 - 00057856 _____ (Microsoft Corporation) C:\windows\SysWOW64\Drivers\ndproxy.sys

2013-08-03 11:41 - 2010-11-20 11:23 - 00261632 _____ (Microsoft Corporation) C:\windows\SysWOW64\Drivers\netbt.sys

2013-08-03 11:41 - 2010-11-20 11:21 - 00119296 _____ (Microsoft Corporation) C:\windows\SysWOW64\Drivers\tdx.sys

2013-08-03 11:41 - 2010-11-20 11:19 - 00147456 _____ (Microsoft Corporation) C:\windows\SysWOW64\Drivers\cdrom.sys

2013-08-03 11:41 - 2009-07-14 02:10 - 00023040 _____ (Microsoft Corporation) C:\windows\SysWOW64\Drivers\asyncmac.sys

2013-08-03 11:41 - 2009-07-14 02:10 - 00021504 _____ (Microsoft Corporation) C:\windows\SysWOW64\Drivers\ws2ifsl.sys

2013-08-03 11:41 - 2009-07-14 02:00 - 00094208 _____ (Microsoft Corporation) C:\windows\SysWOW64\Drivers\Serial.sys

2013-08-03 11:41 - 2009-07-14 01:19 - 00105472 _____ (Microsoft Corporation) C:\windows\SysWOW64\Drivers\i8042prt.sys

2013-08-03 11:40 - 2012-08-22 20:12 - 00950128 _____ (Microsoft Corporation) C:\windows\SysWOW64\Drivers\ndis.sys

2013-08-03 11:40 - 2011-03-29 05:32 - 00052224 _____ (Microsoft Corporation) C:\windows\SysWOW64\Drivers\usbehci.sys

2013-08-03 11:40 - 2010-11-20 12:50 - 00056832 _____ (Microsoft Corporation) C:\windows\SysWOW64\Drivers\ndisuio.sys

2013-08-03 11:40 - 2009-07-14 02:09 - 00044544 _____ (Microsoft Corporation) C:\windows\SysWOW64\Drivers\netbios.sys

2013-08-03 11:40 - 2009-07-14 01:19 - 00062464 _____ (Microsoft Corporation) C:\windows\SysWOW64\Drivers\intelppm.sys

2013-08-03 11:39 - 2011-12-28 06:01 - 00498176 _____ (Microsoft Corporation) C:\windows\SysWOW64\Drivers\afd.sys

2013-08-03 11:38 - 2009-07-14 01:19 - 00006144 _____ (Microsoft Corporation) C:\windows\SysWOW64\Drivers\null.sys

2013-08-03 11:28 - 2011-06-26 08:45 - 00256000 _____ C:\windows\PEV.exe

2013-08-03 11:28 - 2010-11-07 19:20 - 00208896 _____ C:\windows\MBR.exe

2013-08-03 11:28 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe

2013-08-03 11:28 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe

2013-08-03 11:28 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe

2013-08-03 11:28 - 2000-08-31 02:00 - 00098816 _____ C:\windows\sed.exe

2013-08-03 11:28 - 2000-08-31 02:00 - 00080412 _____ C:\windows\grep.exe

2013-08-03 11:28 - 2000-08-31 02:00 - 00068096 _____ C:\windows\zip.exe

2013-08-03 11:25 - 2013-08-03 11:51 - 00000000 ____D C:\Qoobox

2013-08-03 11:25 - 2013-08-03 11:25 - 00000000 ___RD C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

2013-08-03 11:25 - 2013-08-03 11:25 - 00000000 ___RD C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools

2013-08-03 11:24 - 2013-08-03 11:49 - 00000000 ____D C:\windows\erdnt

2013-08-03 11:24 - 2013-08-03 11:19 - 05097855 ____R (Swearware) C:\Users\Administrator\Desktop\ComboFix.exe

2013-08-02 23:36 - 2013-08-02 23:36 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Adobe

2013-08-02 23:30 - 2013-08-02 23:30 - 00000000 ____D C:\FRST

2013-08-02 23:29 - 2013-08-02 23:29 - 00000000 _____ C:\Users\Administrator\defogger_reenable

2013-08-02 23:29 - 2013-08-02 23:26 - 01781485 _____ (Farbar) C:\Users\Administrator\Desktop\FRST64.exe

2013-08-02 23:29 - 2013-08-02 23:26 - 00377856 _____ C:\Users\Administrator\Desktop\gmer_2.1.19163.exe

2013-08-02 23:29 - 2013-08-02 23:24 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Administrator\Desktop\mbam-setup-1.75.0.1300.exe

2013-08-02 23:29 - 2013-08-02 23:24 - 00050477 _____ C:\Users\Administrator\Desktop\Defogger.exe

2013-08-02 23:26 - 2013-08-02 23:26 - 00141312 _____ C:\Users\ADMINI~1\AppData\Local\GDIPFONTCACHEV1.DAT

2013-08-02 22:39 - 2010-11-20 15:24 - 00345088 _____ (Microsoft Corporation) C:\windows\system32\Utilman.exe

2013-08-02 22:35 - 2013-08-02 22:35 - 00063958 _____ C:\Users\Potti\GPReport.html

2013-08-02 22:30 - 2013-08-03 19:00 - 00046805 _____ C:\acadminidump.dmp

2013-08-02 22:29 - 2013-08-02 22:29 - 00000000 ____D C:\Users\ADMINI~1\AppData\Local\Auer - Die Bausoftware GmbH

2013-08-02 22:16 - 2013-08-02 23:29 - 00000000 ____D C:\Users\Administrator

2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Vorlagen

2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Startmenü

2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Netzwerkumgebung

2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Lokale Einstellungen

2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Eigene Dateien

2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Druckumgebung

2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Documents\Eigene Musik

2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Documents\Eigene Bilder

2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programme

2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Anwendungsdaten

2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\ADMINI~1\AppData\Local\Verlauf

2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\ADMINI~1\AppData\Local\Anwendungsdaten

2013-08-02 22:16 - 2011-10-17 22:49 - 00000000 ____D C:\Users\ADMINI~1\AppData\Local\Microsoft Help

2013-08-02 22:16 - 2009-07-27 16:09 - 00000020 ___SH C:\Users\Administrator\ntuser.ini

2013-08-02 22:16 - 2009-07-14 06:54 - 00000000 ___RD C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories

2013-08-02 22:16 - 2009-07-14 06:49 - 00000000 ___RD C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance

2013-07-16 18:40 - 2013-08-03 08:04 - 00000000 ___RD C:\Sandbox

2013-07-16 18:39 - 2013-08-03 08:04 - 00000000 ____D C:\Program Files\Sandboxie

2013-07-15 19:28 - 2013-07-15 19:28 - 00000000 ____D C:\Users\Katharina\AppData\Roaming\TeamViewer

2013-07-12 23:26 - 2013-07-12 23:26 - 00000175 _____ C:\windows\system32\Drivers\aswVmm.sys.sum

2013-07-12 23:26 - 2013-07-12 23:26 - 00000175 _____ C:\windows\system32\Drivers\aswSP.sys.sum

2013-07-12 23:26 - 2013-07-12 23:26 - 00000175 _____ C:\windows\system32\Drivers\aswSnx.sys.sum

2013-07-12 23:18 - 2013-05-02 02:06 - 00278800 _____ (Microsoft Corporation) C:\windows\system32\MpSigStub.exe

2013-07-12 23:16 - 2013-08-02 22:08 - 00003924 _____ C:\windows\System32\Tasks\avast! Emergency Update

2013-07-12 23:16 - 2013-08-02 22:08 - 00001922 _____ C:\Users\Public\Desktop\avast! Free Antivirus.lnk

2013-07-12 23:16 - 2013-08-02 22:08 - 00000000 _____ C:\windows\SysWOW64\config.nt

2013-07-12 23:16 - 2013-07-12 23:26 - 01030952 _____ (AVAST Software) C:\windows\system32\Drivers\aswSnx.sys

2013-07-12 23:16 - 2013-07-12 23:26 - 00378944 _____ (AVAST Software) C:\windows\system32\Drivers\aswSP.sys

2013-07-12 23:16 - 2013-07-12 23:26 - 00189936 _____ C:\windows\system32\Drivers\aswVmm.sys

2013-07-12 23:16 - 2013-05-09 10:59 - 00080816 _____ (AVAST Software) C:\windows\system32\Drivers\aswMonFlt.sys

2013-07-12 23:16 - 2013-05-09 10:59 - 00072016 _____ (AVAST Software) C:\windows\system32\Drivers\aswRdr2.sys

2013-07-12 23:16 - 2013-05-09 10:59 - 00065336 _____ C:\windows\system32\Drivers\aswRvrt.sys

2013-07-12 23:16 - 2013-05-09 10:59 - 00064288 _____ (AVAST Software) C:\windows\system32\Drivers\aswTdi.sys

2013-07-12 23:16 - 2013-05-09 10:59 - 00033400 _____ (AVAST Software) C:\windows\system32\Drivers\aswFsBlk.sys

2013-07-12 23:16 - 2013-05-09 10:58 - 00287840 _____ (AVAST Software) C:\windows\system32\aswBoot.exe

2013-07-12 23:15 - 2013-07-12 23:15 - 00000000 ____D C:\Program Files\AVAST Software

2013-07-12 23:15 - 2013-05-09 10:58 - 00041664 _____ (AVAST Software) C:\windows\avastSS.scr

2013-07-12 18:59 - 2013-07-12 18:59 - 00001162 _____ C:\Users\Public\Desktop\TeamViewer 8.lnk

2013-07-12 18:59 - 2013-07-12 18:59 - 00000000 ____D C:\Program Files (x86)\TeamViewer

2013-07-12 18:52 - 2013-07-12 23:15 - 00000000 ____D C:\ProgramData\AVAST Software

2013-07-12 18:42 - 2013-07-12 18:42 - 00000002 _____ C:\AvastSetup.log

2013-07-11 16:34 - 2013-06-12 01:43 - 02877440 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll

2013-07-11 16:34 - 2013-06-12 01:43 - 01141248 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll

2013-07-11 16:34 - 2013-06-12 01:43 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll

2013-07-11 16:34 - 2013-06-12 01:43 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll

2013-07-11 16:34 - 2013-06-12 01:42 - 02046976 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll

2013-07-11 16:34 - 2013-06-12 01:42 - 00391168 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll

2013-07-11 16:34 - 2013-06-12 01:42 - 00109056 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll

2013-07-11 16:34 - 2013-06-12 01:42 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll

2013-07-11 16:34 - 2013-06-12 01:42 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll

2013-07-11 16:34 - 2013-06-12 01:26 - 01365504 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll

2013-07-11 16:34 - 2013-06-12 01:26 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe

2013-07-11 16:34 - 2013-06-12 01:25 - 03958784 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll

2013-07-11 16:34 - 2013-06-12 01:25 - 02648576 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll

2013-07-11 16:34 - 2013-06-12 01:25 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll

2013-07-11 16:34 - 2013-06-12 01:25 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll

2013-07-11 16:34 - 2013-06-12 01:25 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll

2013-07-11 16:34 - 2013-06-12 01:25 - 00136704 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll

2013-07-11 16:34 - 2013-06-12 01:25 - 00067072 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll

2013-07-11 16:34 - 2013-06-12 01:25 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll

2013-07-11 16:34 - 2013-06-12 00:51 - 00071680 _____ (Microsoft Corporation) C:\windows\SysWOW64\RegisterIEPKEYs.exe

2013-07-11 16:34 - 2013-06-12 00:50 - 00089600 _____ (Microsoft Corporation) C:\windows\system32\RegisterIEPKEYs.exe

2013-07-11 16:34 - 2013-06-07 05:22 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb

2013-07-11 16:34 - 2013-06-07 04:37 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb

2013-07-11 16:33 - 2013-06-12 01:43 - 14329856 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll

2013-07-11 16:33 - 2013-06-12 01:43 - 01767936 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll

2013-07-11 16:33 - 2013-06-12 01:43 - 00039424 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll

2013-07-11 16:33 - 2013-06-12 01:42 - 13760512 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll

2013-07-11 16:33 - 2013-06-12 01:26 - 02241024 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll

2013-07-11 16:33 - 2013-06-12 01:25 - 19238912 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll

2013-07-11 16:33 - 2013-06-12 01:25 - 15404032 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll

2013-07-11 16:33 - 2013-06-12 01:25 - 00053248 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll

2013-07-11 15:03 - 2013-07-11 15:03 - 00000000 ____D C:\Users\Katharina\Documents\Monika

2013-07-11 14:17 - 2013-06-05 05:34 - 03153920 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys

2013-07-11 14:17 - 2013-06-04 08:00 - 00624128 _____ (Microsoft Corporation) C:\windows\system32\qedit.dll

2013-07-11 14:17 - 2013-06-04 06:53 - 00509440 _____ (Microsoft Corporation) C:\windows\SysWOW64\qedit.dll

2013-07-11 14:17 - 2013-05-06 08:03 - 01887744 _____ (Microsoft Corporation) C:\windows\system32\WMVDECOD.DLL

2013-07-11 14:17 - 2013-05-06 06:56 - 01620480 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMVDECOD.DLL

2013-07-11 14:17 - 2013-04-10 01:34 - 01247744 _____ (Microsoft Corporation) C:\windows\SysWOW64\DWrite.dll

2013-07-11 14:17 - 2013-04-03 00:51 - 01643520 _____ (Microsoft Corporation) C:\windows\system32\DWrite.dll

2013-07-11 13:56 - 2013-07-11 14:05 - 00000000 ____D C:\Users\Gast\Documents\Bluetooth Folder

2013-07-11 13:56 - 2013-07-11 13:56 - 00141312 _____ C:\Users\Gast\AppData\Local\GDIPFONTCACHEV1.DAT

2013-07-11 13:56 - 2013-07-11 13:56 - 00000000 ____D C:\Users\Gast\AppData\Roaming\Intel Corporation

2013-07-11 13:56 - 2013-07-11 13:56 - 00000000 ____D C:\Users\Gast\AppData\Roaming\hpqLog

2013-07-11 13:56 - 2013-07-11 13:56 - 00000000 ____D C:\Users\Gast\AppData\Roaming\HILTI

2013-07-11 13:56 - 2013-07-11 13:56 - 00000000 ____D C:\Users\Gast\AppData\Roaming\Apple Computer

2013-07-11 13:56 - 2013-07-11 13:56 - 00000000 ____D C:\Users\Gast\AppData\Local\PDFC

2013-07-11 13:56 - 2013-07-11 13:56 - 00000000 ____D C:\Users\Gast\AppData\Local\BMExplorer

2013-07-11 13:55 - 2013-07-11 13:55 - 00000000 ___RD C:\Users\Gast\Virtual Machines

2013-07-11 13:55 - 2013-07-11 13:55 - 00000000 ____D C:\Users\Gast\AppData\Roaming\Synaptics

2013-07-11 13:55 - 2013-07-11 13:55 - 00000000 ____D C:\Users\Gast\AppData\Roaming\Adobe

2013-07-11 13:54 - 2013-07-11 13:55 - 00000000 ____D C:\Users\Gast

2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Vorlagen

2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Startmenü

2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Netzwerkumgebung

2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Lokale Einstellungen

2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Eigene Dateien

2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Druckumgebung

2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Documents\Eigene Musik

2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Documents\Eigene Bilder

2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\AppData\Local\Verlauf

2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\AppData\Local\Anwendungsdaten

2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Anwendungsdaten

2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 ____D C:\Users\Gast\AppData\Roaming\DigitalPersona

2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 ____D C:\Users\Gast\AppData\Local\VirtualStore

2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 ____D C:\Users\Gast\AppData\Local\DigitalPersona

2013-07-11 13:54 - 2011-10-17 22:49 - 00000000 ____D C:\Users\Gast\AppData\Local\Microsoft Help

2013-07-11 13:54 - 2009-07-27 16:09 - 00000020 ___SH C:\Users\Gast\ntuser.ini
 

==================== One Month Modified Files and Folders =======
 

2013-08-04 11:14 - 2013-08-04 11:14 - 00001105 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-08-04 11:14 - 2013-08-04 11:14 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Malwarebytes

2013-08-04 11:14 - 2013-08-04 11:14 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-08-04 11:08 - 2013-08-04 11:08 - 00003200 _____ C:\AdwCleaner[S1].txt

2013-08-04 11:03 - 2013-08-04 11:07 - 00666633 _____ C:\Users\Administrator\Desktop\adwcleaner.exe

2013-08-04 00:31 - 2013-08-03 22:41 - 00000000 ____D C:\Kaspersky Rescue Disk 10.0

2013-08-03 19:00 - 2013-08-02 22:30 - 00046805 _____ C:\acadminidump.dmp

2013-08-03 15:12 - 2011-06-21 02:48 - 00000000 ____D C:\ProgramData\PDFC

2013-08-03 15:12 - 2011-06-21 02:45 - 00000000 ____D C:\ProgramData\HPQLOG

2013-08-03 15:10 - 2009-07-14 07:08 - 00000006 ____H C:\windows\Tasks\SA.DAT

2013-08-03 15:10 - 2009-07-14 06:51 - 00117007 _____ C:\windows\setupact.log

2013-08-03 11:51 - 2013-08-03 11:51 - 00030922 _____ C:\ComboFix.txt

2013-08-03 11:51 - 2013-08-03 11:25 - 00000000 ____D C:\Qoobox

2013-08-03 11:49 - 2013-08-03 11:24 - 00000000 ____D C:\windows\erdnt

2013-08-03 11:46 - 2009-07-14 04:34 - 00000215 _____ C:\windows\system.ini

2013-08-03 11:43 - 2011-08-30 19:27 - 00488512 _____ C:\windows\PFRO.log

2013-08-03 11:42 - 2009-07-14 04:34 - 93323264 _____ C:\windows\system32\config\software.bak

2013-08-03 11:42 - 2009-07-14 04:34 - 32243712 _____ C:\windows\system32\config\system.bak

2013-08-03 11:42 - 2009-07-14 04:34 - 00786432 _____ C:\windows\system32\config\default.bak

2013-08-03 11:42 - 2009-07-14 04:34 - 00262144 _____ C:\windows\system32\config\security.bak

2013-08-03 11:42 - 2009-07-14 04:34 - 00262144 _____ C:\windows\system32\config\sam.bak

2013-08-03 11:37 - 2011-10-14 19:15 - 00000000 ____D C:\Users\Katharina

2013-08-03 11:25 - 2013-08-03 11:25 - 00000000 ___RD C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

2013-08-03 11:25 - 2013-08-03 11:25 - 00000000 ___RD C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools

2013-08-03 11:19 - 2013-08-03 11:24 - 05097855 ____R (Swearware) C:\Users\Administrator\Desktop\ComboFix.exe

2013-08-03 08:05 - 2013-05-22 18:19 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69

2013-08-03 08:05 - 2013-05-22 18:19 - 00000000 ____D C:\Program Files\iTunes

2013-08-03 08:05 - 2013-05-22 18:19 - 00000000 ____D C:\Program Files\iPod

2013-08-03 08:05 - 2013-05-22 18:19 - 00000000 ____D C:\Program Files (x86)\iTunes

2013-08-03 08:05 - 2012-04-29 21:00 - 00000000 ____D C:\Users\Katharina\AppData\Roaming\vlc

2013-08-03 08:05 - 2011-11-28 21:36 - 00000000 ____D C:\ProgramData\Apple Computer

2013-08-03 08:05 - 2011-06-21 02:44 - 00000000 ____D C:\ProgramData\FLEXnet

2013-08-03 08:05 - 2009-07-14 05:20 - 00000000 ____D C:\windows\AppCompat

2013-08-03 08:04 - 2013-07-16 18:40 - 00000000 ___RD C:\Sandbox

2013-08-03 08:04 - 2013-07-16 18:39 - 00000000 ____D C:\Program Files\Sandboxie

2013-08-03 08:04 - 2009-07-14 05:20 - 00000000 ____D C:\windows\registration

2013-08-02 23:38 - 2011-08-30 19:01 - 01781084 _____ C:\windows\WindowsUpdate.log

2013-08-02 23:36 - 2013-08-02 23:36 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Adobe

2013-08-02 23:30 - 2013-08-02 23:30 - 00000000 ____D C:\FRST

2013-08-02 23:29 - 2013-08-02 23:29 - 00000000 _____ C:\Users\Administrator\defogger_reenable

2013-08-02 23:29 - 2013-08-02 22:16 - 00000000 ____D C:\Users\Administrator

2013-08-02 23:29 - 2011-06-21 02:34 - 00700168 _____ C:\windows\system32\perfh007.dat

2013-08-02 23:29 - 2011-06-21 02:34 - 00148964 _____ C:\windows\system32\perfc007.dat

2013-08-02 23:29 - 2009-07-14 07:13 - 01621244 _____ C:\windows\system32\PerfStringBackup.INI

2013-08-02 23:26 - 2013-08-02 23:29 - 01781485 _____ (Farbar) C:\Users\Administrator\Desktop\FRST64.exe

2013-08-02 23:26 - 2013-08-02 23:29 - 00377856 _____ C:\Users\Administrator\Desktop\gmer_2.1.19163.exe

2013-08-02 23:26 - 2013-08-02 23:26 - 00141312 _____ C:\Users\ADMINI~1\AppData\Local\GDIPFONTCACHEV1.DAT

2013-08-02 23:24 - 2013-08-02 23:29 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Administrator\Desktop\mbam-setup-1.75.0.1300.exe

2013-08-02 23:24 - 2013-08-02 23:29 - 00050477 _____ C:\Users\Administrator\Desktop\Defogger.exe

2013-08-02 23:20 - 2012-10-15 11:51 - 00000000 ____D C:\Program Files (x86)\Pythagoras

2013-08-02 22:35 - 2013-08-02 22:35 - 00063958 _____ C:\Users\Potti\GPReport.html

2013-08-02 22:35 - 2013-03-15 22:13 - 00000000 ____D C:\Users\Potti

2013-08-02 22:33 - 2013-03-15 22:44 - 00141312 _____ C:\Users\Potti\AppData\Local\GDIPFONTCACHEV1.DAT

2013-08-02 22:29 - 2013-08-02 22:29 - 00000000 ____D C:\Users\ADMINI~1\AppData\Local\Auer - Die Bausoftware GmbH

2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Vorlagen

2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Startmenü

2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Netzwerkumgebung

2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Lokale Einstellungen

2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Eigene Dateien

2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Druckumgebung

2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Documents\Eigene Musik

2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Documents\Eigene Bilder

2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programme

2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Anwendungsdaten

2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\ADMINI~1\AppData\Local\Verlauf

2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\ADMINI~1\AppData\Local\Anwendungsdaten

2013-08-02 22:11 - 2009-07-14 06:45 - 00020944 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-08-02 22:11 - 2009-07-14 06:45 - 00020944 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-08-02 22:08 - 2013-07-12 23:16 - 00003924 _____ C:\windows\System32\Tasks\avast! Emergency Update

2013-08-02 22:08 - 2013-07-12 23:16 - 00001922 _____ C:\Users\Public\Desktop\avast! Free Antivirus.lnk

2013-08-02 22:08 - 2013-07-12 23:16 - 00000000 _____ C:\windows\SysWOW64\config.nt

2013-08-02 22:06 - 2013-01-01 12:26 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job

2013-07-28 23:46 - 2012-11-18 18:59 - 01070416 _____ C:\xxbgtask.log

2013-07-25 21:17 - 2011-10-15 09:43 - 00000000 ____D C:\Users\Katharina\AppData\Local\cache

2013-07-21 23:00 - 2011-11-10 19:34 - 00000000 ____D C:\Users\Katharina\Documents\Veldidena

2013-07-21 20:25 - 2011-11-10 16:55 - 00005934 _____ C:\Users\Katharina\Documents\plot.log

2013-07-15 19:59 - 2012-07-17 18:24 - 00001116 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job

2013-07-15 19:39 - 2013-01-01 12:26 - 00003822 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater

2013-07-15 19:39 - 2012-11-12 21:09 - 00692104 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe

2013-07-15 19:39 - 2012-11-12 21:09 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl

2013-07-15 19:28 - 2013-07-15 19:28 - 00000000 ____D C:\Users\Katharina\AppData\Roaming\TeamViewer

2013-07-15 19:27 - 2012-07-17 18:24 - 00001112 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job

2013-07-15 19:27 - 2011-10-20 10:56 - 00000035 _____ C:\Users\Public\Documents\AtherosServiceConfig.ini

2013-07-14 23:48 - 2012-04-17 17:38 - 00001154 _____ C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-751829164-2267940102-591571508-1001UA.job

2013-07-14 17:48 - 2012-04-17 17:38 - 00001132 _____ C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-751829164-2267940102-591571508-1001Core.job

2013-07-13 14:00 - 2012-09-20 20:22 - 00002183 _____ C:\Users\Public\Desktop\Google Chrome.lnk

2013-07-13 13:54 - 2012-07-17 18:24 - 00004112 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA

2013-07-13 13:54 - 2012-07-17 18:24 - 00003860 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore

2013-07-12 23:26 - 2013-07-12 23:26 - 00000175 _____ C:\windows\system32\Drivers\aswVmm.sys.sum

2013-07-12 23:26 - 2013-07-12 23:26 - 00000175 _____ C:\windows\system32\Drivers\aswSP.sys.sum

2013-07-12 23:26 - 2013-07-12 23:26 - 00000175 _____ C:\windows\system32\Drivers\aswSnx.sys.sum

2013-07-12 23:26 - 2013-07-12 23:16 - 01030952 _____ (AVAST Software) C:\windows\system32\Drivers\aswSnx.sys

2013-07-12 23:26 - 2013-07-12 23:16 - 00378944 _____ (AVAST Software) C:\windows\system32\Drivers\aswSP.sys

2013-07-12 23:26 - 2013-07-12 23:16 - 00189936 _____ C:\windows\system32\Drivers\aswVmm.sys

2013-07-12 23:15 - 2013-07-12 23:15 - 00000000 ____D C:\Program Files\AVAST Software

2013-07-12 23:15 - 2013-07-12 18:52 - 00000000 ____D C:\ProgramData\AVAST Software

2013-07-12 23:02 - 2012-02-28 15:32 - 00000000 ____D C:\ProgramData\Electronic Arts

2013-07-12 22:58 - 2011-08-30 19:22 - 00000000 ____D C:\ProgramData\Norton

2013-07-12 22:54 - 2011-10-14 19:24 - 00141312 _____ C:\Users\Katharina\AppData\Local\GDIPFONTCACHEV1.DAT

2013-07-12 22:53 - 2009-07-14 06:45 - 00492616 _____ C:\windows\system32\FNTCACHE.DAT

2013-07-12 18:59 - 2013-07-12 18:59 - 00001162 _____ C:\Users\Public\Desktop\TeamViewer 8.lnk

2013-07-12 18:59 - 2013-07-12 18:59 - 00000000 ____D C:\Program Files (x86)\TeamViewer

2013-07-12 18:42 - 2013-07-12 18:42 - 00000002 _____ C:\AvastSetup.log

2013-07-11 22:13 - 2009-07-14 07:08 - 00032640 _____ C:\windows\Tasks\SCHEDLGU.TXT

2013-07-11 22:11 - 2013-03-15 04:03 - 00000000 ____D C:\Program Files\Microsoft Silverlight

2013-07-11 22:11 - 2013-03-15 04:03 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight

2013-07-11 22:11 - 2009-07-27 16:36 - 00000000 ____D C:\Program Files\Windows Journal

2013-07-11 22:11 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender

2013-07-11 22:11 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender

2013-07-11 16:35 - 2011-10-14 19:36 - 00000000 ____D C:\ProgramData\Microsoft Help

2013-07-11 15:03 - 2013-07-11 15:03 - 00000000 ____D C:\Users\Katharina\Documents\Monika

2013-07-11 14:05 - 2013-07-11 13:56 - 00000000 ____D C:\Users\Gast\Documents\Bluetooth Folder

2013-07-11 13:56 - 2013-07-11 13:56 - 00141312 _____ C:\Users\Gast\AppData\Local\GDIPFONTCACHEV1.DAT

2013-07-11 13:56 - 2013-07-11 13:56 - 00000000 ____D C:\Users\Gast\AppData\Roaming\Intel Corporation

2013-07-11 13:56 - 2013-07-11 13:56 - 00000000 ____D C:\Users\Gast\AppData\Roaming\hpqLog

2013-07-11 13:56 - 2013-07-11 13:56 - 00000000 ____D C:\Users\Gast\AppData\Roaming\HILTI

2013-07-11 13:56 - 2013-07-11 13:56 - 00000000 ____D C:\Users\Gast\AppData\Roaming\Apple Computer

2013-07-11 13:56 - 2013-07-11 13:56 - 00000000 ____D C:\Users\Gast\AppData\Local\PDFC

2013-07-11 13:56 - 2013-07-11 13:56 - 00000000 ____D C:\Users\Gast\AppData\Local\BMExplorer

2013-07-11 13:56 - 2011-08-30 19:13 - 00000000 ____D C:\Users\Public\Documents\Atheros

2013-07-11 13:55 - 2013-07-11 13:55 - 00000000 ___RD C:\Users\Gast\Virtual Machines

2013-07-11 13:55 - 2013-07-11 13:55 - 00000000 ____D C:\Users\Gast\AppData\Roaming\Synaptics

2013-07-11 13:55 - 2013-07-11 13:55 - 00000000 ____D C:\Users\Gast\AppData\Roaming\Adobe

2013-07-11 13:55 - 2013-07-11 13:54 - 00000000 ____D C:\Users\Gast

2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Vorlagen

2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Startmenü

2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Netzwerkumgebung

2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Lokale Einstellungen

2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Eigene Dateien

2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Druckumgebung

2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Documents\Eigene Musik

2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Documents\Eigene Bilder

2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\AppData\Local\Verlauf

2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\AppData\Local\Anwendungsdaten

2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Anwendungsdaten

2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 ____D C:\Users\Gast\AppData\Roaming\DigitalPersona

2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 ____D C:\Users\Gast\AppData\Local\VirtualStore

2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 ____D C:\Users\Gast\AppData\Local\DigitalPersona

2013-07-08 21:15 - 2011-10-17 22:03 - 00000052 _____ C:\windows\SysWOW64\DOErrors.log

2013-07-07 09:59 - 2011-11-01 11:45 - 00000348 _____ C:\windows\Tasks\HPCeeScheduleForKatharina.job

2013-07-06 02:59 - 2011-11-01 11:45 - 00003210 _____ C:\windows\System32\Tasks\HPCeeScheduleForKatharina
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-07-25 19:21
 

==================== End Of Log ============================

--- --- ---

--- --- ---

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 01-08-2013

Ran by Administrator at 2013-08-04 11:23:33

Running from C:\Users\Administrator\Desktop

Boot Mode: Safe Mode (with Networking)

==========================================================
 
 

==================== Installed Programs =======================
 

   

 Update for Microsoft Office 2007 (KB2508958) (x32)

2007 Microsoft Office system (x32 Version: 12.0.6612.1000)

64 Bit HP CIO Components Installer (Version: 6.2.2)

ActiveCheck component for HP Active Support Library (x32 Version: 3.0.0.3)

Adobe Flash Player 11 ActiveX (x32 Version: 11.8.800.94)

Adobe Reader X (10.1.7) - Deutsch (x32 Version: 10.1.7)

Agatha Christie - Peril at End House (x32 Version: 2.2.0.95)

Apple Application Support (x32 Version: 2.3.4)

Apple Mobile Device Support (Version: 6.1.0.13)

Apple Software Update (x32 Version: 2.1.3.127)

ArcSoft TotalMedia (x32 Version: 1.0.48.25)

ArcSoft TotalMedia (x32 Version: 2.0.39.12)

ArcSoft Webcam Sharing Manager (x32 Version: 2.0.0.30)

Atheros Driver Installation Program (x32 Version: 9.2)

AUER Success.6 Lernversion (x32 Version: 06.00.0228)

AutoCAD 2012 Language Pack - Deutsch (Version: 18.2.51.0)

AutoCAD LT 2012 - Deutsch (Version: 18.2.51.0)

AutoCAD LT 2012 Language Pack - Deutsch (Version: 18.2.51.0)

Autodesk Content Service (x32 Version: 2.0.90)

Autodesk Inventor Fusion 2012 (Version: 1.0.0.79)

Autodesk Inventor Fusion 2012 Language Pack (Version: 1.0.0.79)

Autodesk Inventor Fusion Plugin for AutoCAD 2012 (Version: 0.0.1.138)

Autodesk Inventor Fusion plug-in for AutoCAD 2012 (Version: 0.0.1.138)

Autodesk Inventor Fusion Plugin Language Pack for AutoCAD 2012 (Version: 0.0.1.138)

Autodesk Material Library 2012 (x32 Version: 2.5.0.8)

Autodesk Material Library Base Resolution Image Library 2012 (x32 Version: 2.5.0.8)

avast! Free Antivirus (x32 Version: 8.0.1489.0)

Bejeweled 2 Deluxe (x32 Version: 2.2.0.95)

Bing Bar (x32 Version: 7.1.361.0)

Bing Rewards Client Installer (x32 Version: 16.0.345.0)

Blasterball 3 (x32 Version: 2.2.0.95)

Bluetooth Win7 Suite (64) (Version: 7.02.000.55)

Bonjour (Version: 3.0.0.10)

Bounce Symphony (x32 Version: 2.2.0.95)

Build-a-Lot - The Elizabethan Era (x32 Version: 2.2.0.95)

Cake Mania (x32 Version: 2.2.0.95)

Chuzzle Deluxe (x32 Version: 2.2.0.95)

Cinergy T USB XXS V2.03.03.29 (x32 Version: 2.03.03.29)

Cisco EAP-FAST Module (x32 Version: 2.2.14)

Cisco LEAP Module (x32 Version: 1.0.19)

Cisco PEAP Module (x32 Version: 1.1.6)

D3DX10 (x32 Version: 15.4.2368.0902)

Device Access Manager for HP ProtectTools (Version: 6.0.0.9)

Die Sims™ 3 (x32 Version: 1.19.44)

Die Sims™ 3 Design-Garten-Accessoires (x32 Version: 7.0.55)

Die Sims™ 3 Gib Gas-Accessoires (x32 Version: 5.0.44)

Die Sims™ 3 Reiseabenteuer (x32 Version: 2.0.86)

Diner Dash 2 Restaurant Rescue (x32 Version: 2.2.0.95)

Drive Encryption For HP ProtectTools (Version: 6.0.33.24411)

Energy Star Digital Logo (x32 Version: 1.0.1)

Evernote v. 4.2.2 (x32 Version: 4.2.2.3979)

Face Recognition for HP ProtectTools (Version: 6.00.4303)

Facebook Messenger 2.1.4814.0 (x32 Version: 2.1.4814.0)

Farm Frenzy (x32 Version: 2.2.0.95)

FARO LS 1.1.406.58 (x32 Version: 4.6.58.2)

FATE (x32 Version: 2.2.0.95)

File Sanitizer For HP ProtectTools (x32 Version: 6.0.0.8)

Galerie de photos Windows Live (x32 Version: 15.4.3502.0922)

GeoGebra (x32 Version: 4.0.21.0)

Google Chrome (x32 Version: 28.0.1500.72)

Google Toolbar for Internet Explorer (x32 Version: 1.0.0)

Google Toolbar for Internet Explorer (x32 Version: 7.5.4209.2358)

Google Update Helper (x32 Version: 1.3.21.153)

Hilti PROFIS Anchor (x32 Version: 2.3.0000)

Hilti PROFIS AutoUpdate (x32 Version: 1.6.0)

HP 3D DriveGuard (Version: 4.1.4.1)

HP Auto (Version: 1.0.12494.3472)

HP Connection Manager (x32 Version: 4.1.10.1)

HP Customer Experience Enhancements (x32 Version: 6.0.1.7)

HP DayStarter (Version: 2.0.0.12)

HP Documentation (x32 Version: 1.2.0.0)

HP ESU for Microsoft Windows 7 (x32 Version: 1.1.11.1)

HP Game Console (x32)

HP Games (x32 Version: 1.0.1.5)

HP HD Webcam [Fixed] (x32 Version: 3.3.4.07)

HP HotKey Support (Version: 4.0.10.1)

HP Power Assistant (Version: 2.0.2.0)

HP ProtectTools Security Manager (Version: 6.00.888)

HP QuickWeb (x32 Version: 3.0.0.9057)

HP Setup (x32 Version: 8.5.4526.3645)

HP SoftPaq Download Manager (x32 Version: 3.2.0.0)

HP Software Framework (x32 Version: 4.0.112.1)

HP Software Setup (x32 Version: 8.2.1.1)

HP System Default Settings (x32 Version: 2.1.2)

HP Wallpaper (x32 Version: 2.00)

HPAsset component for HP Active Support Library (x32 Version: 3.0.2.2)

IDT Audio (x32 Version: 1.0.6325.0)

Insaniquarium Deluxe (x32 Version: 2.2.0.95)

Intel(R) Identity Protection Technology 1.0.71.0 (x32 Version: 1.0.71.0)

Intel(R) Management Engine Components (x32 Version: 7.0.0.1144)

Intel(R) Processor Graphics (x32 Version: 8.15.10.2342)

Intel(R) Rapid Storage Technology (x32 Version: 10.1.2.1004)

iTunes (Version: 11.0.3.42)

Java Auto Updater (x32 Version: 2.0.7.1)

Java(TM) 6 Update 31 (x32 Version: 6.0.310)

Jewel Quest II (x32 Version: 2.2.0.95)

Jewel Quest Solitaire (x32 Version: 2.2.0.95)

JMicron Flash Media Controller Driver (x32 Version: 1.0.57.2)

John Deere Drive Green (x32 Version: 2.2.0.95)

Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)

Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)

Microsoft .NET Framework 4 Extended (Version: 4.0.30319)

Microsoft Application Error Reporting (Version: 12.0.6015.5000)

Microsoft Office 2007 Service Pack 3 (SP3) (x32)

Microsoft Office 2010 (x32 Version: 14.0.4763.1000)

Microsoft Office Access MUI (German) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000)

Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Professional Hybrid 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014)

Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32)

Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000)

Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Silverlight (Version: 5.1.20513.0)

Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)

Microsoft SQL Server 2008 Management Objects (Version: 10.1.2531.0)

Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336)

Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)

Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336)

Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.59192)

Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (Version: 10.0.30319)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)

Microsoft WSE 3.0 Runtime (x32 Version: 3.0.5305.0)

Microsoft_VC90_CRT_x86 (x32 Version: 1.0.0)

MSVCRT (x32 Version: 15.4.2862.0708)

MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)

MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)

oCAD 2012 - Deutsch (Version: 18.2.51.0)

PDF Complete Special Edition (x32 Version: 4.0.33)

Penguins! (x32 Version: 2.2.0.95)

Plants vs. Zombies (x32 Version: 2.2.0.95)

PlayReady PC Runtime amd64 (Version: 1.3.0)

Polar Bowler (x32 Version: 2.2.0.95)

Privacy Manager for HP ProtectTools (Version: 6.00.831)

ProVI2010_x64 5.1 (x32 Version: 5.1)

Pythagoras (x32 Version: 12.26)

Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922)

Realtek Ethernet Controller All-In-One Windows Driver (x32 Version: 1.12.0016)

RuckZuck (x32 Version: 6.0.10)

SDK (x32 Version: 2.24.025)

Skype™ 5.10 (x32 Version: 5.10.116)

Slingo Deluxe (x32 Version: 2.2.0.95)

SQL Server System CLR Types (Version: 10.1.2531.0)

Synaptics Pointing Device Driver (Version: 15.2.11.1)

TeamViewer 8 (x32 Version: 8.0.19617)

Theft Recovery for HP ProtectTools (x32 Version: 6.0.0.30)

Update for 2007 Microsoft Office System (KB967642) (x32)

Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)

Update for Microsoft .NET Framework 4 Client Profile (KB2473228) (x32 Version: 1)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)

Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)

Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)

Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1)

Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1)

Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1)

Update for Microsoft .NET Framework 4 Extended (KB2836939) (x32 Version: 1)

Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (x32)

Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition (x32)

Update for Microsoft Office 2007 suites (KB2596802) 32-Bit Edition (x32)

Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition (x32)

Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (x32)

Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (x32)

Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (x32)

Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2817563) 32-Bit Edition (x32)

Update für Microsoft Office Excel 2007 Help (KB963678) (x32)

Update für Microsoft Office Outlook 2007 Help (KB963677) (x32)

Update für Microsoft Office Powerpoint 2007 Help (KB963669) (x32)

Update für Microsoft Office Word 2007 Help (KB963665) (x32)

Validity Fingerprint Sensor Driver (Version: 4.3.117.0)

VIP Access SDK x64(1.0.0.50)  (x32 Version: 1.0.0.50)

Virtual Villagers - The Secret City (x32 Version: 2.2.0.95)

VLC media player 2.0.1 (x32 Version: 2.0.1)

Wedding Dash (x32 Version: 2.2.0.95)

Windows Live (x32 Version: 15.4.3502.0922)

Windows Live Communications Platform (x32 Version: 15.4.3502.0922)

Windows Live Essentials (x32 Version: 15.4.3502.0922)

Windows Live Fotogalerie (x32 Version: 15.4.3502.0922)

Windows Live ID Sign-in Assistant (Version: 7.250.4225.0)

Windows Live Installer (x32 Version: 15.4.3502.0922)

Windows Live Language Selector (Version: 15.4.3502.0922)

Windows Live Movie Maker (x32 Version: 15.4.3502.0922)

Windows Live Photo Common (x32 Version: 15.4.3502.0922)

Windows Live Photo Gallery (x32 Version: 15.4.3502.0922)

Windows Live PIMT Platform (x32 Version: 15.4.3502.0922)

Windows Live SOXE (x32 Version: 15.4.3502.0922)

Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922)

Windows Live UX Platform (x32 Version: 15.4.3502.0922)

Windows Live UX Platform Language Pack (x32 Version: 15.4.3502.0922)

WinZip 14.5 (x32 Version: 14.5.9095)

Xobni (x32 Version: 1.9.5.13282)

Xobni Core (x32 Version: 1.0.0)

Zuma Deluxe (x32 Version: 2.2.0.95)
 

==================== Restore Points  =========================
 

23-07-2013 16:30:55 Windows Update

26-07-2013 18:49:15 Windows Update
 

==================== Hosts content: ==========================
 

2009-07-14 04:34 - 2013-08-03 11:46 - 00000027 ____A C:\windows\system32\Drivers\etc\hosts

127.0.0.1       localhost
 

==================== Scheduled Tasks (whitelisted) =============
 

Task: {24D104BA-E059-4042-BBCD-091B8B1DDBEA} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-07-17] (Google Inc.)

Task: {4FFE6CAC-D9A9-4ABF-BDE0-CC9362A7660E} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)

Task: {5BED5862-9232-44B6-9FD4-595A7C0857DC} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\windows\System32\lpksetup.exe [2010-11-20] (Microsoft Corporation)

Task: {61D00D3F-C3F8-4657-8CB9-EFA933017D98} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2010-12-10] (Hewlett-Packard Company)

Task: {640BFA6E-B405-4D1A-9882-4D45F0CDFFEF} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-751829164-2267940102-591571508-1001UA => C:\Users\Katharina\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-12] (Facebook Inc.)

Task: {7FBE12B0-5D8D-48C8-B4E3-A3BF3012EDC5} - System32\Tasks\Scheduled Update for Ask Toolbar => C:\Program Files (x86)\Ask.com\UpdateTask.exe No File

Task: {9DCC5731-D6F9-4BA2-A49D-BEC942790A41} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => c:\program files\windows defender\MpCmdRun.exe [2009-07-14] (Microsoft Corporation)

Task: {ADDEEFDD-8CE2-4028-9E08-406DB63E1831} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task

Task: {BB2A30B6-AA5E-410A-85F6-BBA46DDC42D6} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Tuneup => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2010-12-10] (Hewlett-Packard Company)

Task: {BD9ECD7B-DEA9-4699-8EDD-43363518684D} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-23] (Microsoft Corporation)

Task: {C19F0537-A9A4-4264-8F9D-5FA7EDEE3481} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-07-17] (Google Inc.)

Task: {C2A47E9E-FDAD-4936-80CA-1320BE893337} - System32\Tasks\NetworkWizardVCW => C:\Program Files (x86)\Hewlett-Packard\HP Setup\RemEngine.exe [2011-01-25] ()

Task: {C918E184-1B71-442E-9F72-9D5511750F1C} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HPSAObjUtilTask => C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\UtilTask.exe [2013-06-04] (Microsoft)

Task: {C98F4C41-99A8-46C4-B6D5-28D024BAE592} - System32\Tasks\HPCeeScheduleForKATHARINA-HP$ => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14] (Hewlett-Packard)

Task: {D11A732F-6A33-4773-835C-1195C30E12A4} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\Windows\ehome\mcupdate.exe [2010-11-20] (Microsoft Corporation)

Task: {D1702CDF-A97F-461E-AFE5-8EBE38DF1B6C} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-07-15] (Adobe Systems Incorporated)

Task: {DBC78FF0-E72F-4638-AD0C-86C5910CE5A2} - System32\Tasks\HPCeeScheduleForKatharina => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14] (Hewlett-Packard)

Task: {DECBB6D4-CE38-4365-A131-CB1C3312F1F6} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-751829164-2267940102-591571508-1001Core => C:\Users\Katharina\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-12] (Facebook Inc.)

Task: {EFE5C061-8B09-49D3-BDF3-D5A4E63EA749} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2013-05-09] (AVAST Software)

Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-751829164-2267940102-591571508-1001Core.job => C:\Users\Katharina\AppData\Local\Facebook\Update\FacebookUpdate.exe

Task: C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-751829164-2267940102-591571508-1001UA.job => C:\Users\Katharina\AppData\Local\Facebook\Update\FacebookUpdate.exe

Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\windows\Tasks\HPCeeScheduleForKATHARINA-HP$.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe

Task: C:\windows\Tasks\HPCeeScheduleForKatharina.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
 

==================== Faulty Device Manager Devices =============
 

Name: Security Processor Loader Driver

Description: Security Processor Loader Driver

Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}

Manufacturer: 

Service: spldr

Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)

Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.

Devices stay in this state if they have been prepared for removal.

After you remove the device, this error disappears.Remove the device, and this error should be resolved.
 

Name: aswRvrt

Description: aswRvrt

Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}

Manufacturer: 

Service: aswRvrt

Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)

Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.

Devices stay in this state if they have been prepared for removal.

After you remove the device, this error disappears.Remove the device, and this error should be resolved.
 

Name: avast! Network Shield Support

Description: avast! Network Shield Support

Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}

Manufacturer: 

Service: aswTdi

Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)

Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.

Devices stay in this state if they have been prepared for removal.

After you remove the device, this error disappears.Remove the device, and this error should be resolved.
 

Name: aswVmm

Description: aswVmm

Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}

Manufacturer: 

Service: aswVmm

Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)

Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.

Devices stay in this state if they have been prepared for removal.

After you remove the device, this error disappears.Remove the device, and this error should be resolved.
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (08/03/2013 11:28:17 AM) (Source: System Restore) (User: )

Description: Fehler beim Erstellen des Wiederherstellungspunkts (Prozess = C:\windows\system32\wbem\wmiprvse.exe; Beschreibung = ComboFix created restore point; Fehler = 0x8007043c).
 

Error: (08/03/2013 11:28:17 AM) (Source: VSS) (User: )

Description: Volumeschattenkopie-Dienstfehler: Beim Aufrufen von Routine "CoCreateInstance" ist ein unerwarteter Fehler aufgetreten. hr = 0x8007043c, Der Dienst kann nicht im abgesicherten Modus gestartet werden.

.
 
 

Vorgang:

   VSS-Server wird instanziiert
 

Error: (08/03/2013 11:28:17 AM) (Source: VSS) (User: )

Description: Fehler bei Volumenschattenkopie-Dienst: Der COM-Server mit CLSID "{e579ab5f-1cc4-44b4-bed9-de0991ff0623}" und dem Namen "IVssCoordinatorEx2" kann nicht bei der Ausführung im abgesicherten Modus gestartet werden.

Der Volumenschattenkopie-Dienst kann nicht gestartet werden, während der abgesicherte Modus ausgeführt wird. [0x8007043c, Der Dienst kann nicht im abgesicherten Modus gestartet werden.

]
 
 

Vorgang:

   VSS-Server wird instanziiert
 

Error: (08/02/2013 10:52:10 PM) (Source: Wininit) (User: )

Description: Ein kritischer Systemprozess C:\windows\system32\lsass.exe ist fehlgeschlagen mit den Statuscode c0000005. Der Computer muss neu gestartet werden.
 

Error: (08/02/2013 10:52:10 PM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: lsass.exe, Version: 6.1.7601.17725, Zeitstempel: 0x4ec483fc

Name des fehlerhaften Moduls: PTLsaFltr64.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x4d2ddffa

Ausnahmecode: 0xc0000005

Fehleroffset: 0x000007fef8d4a0ea

ID des fehlerhaften Prozesses: 0x290

Startzeit der fehlerhaften Anwendung: 0xlsass.exe0

Pfad der fehlerhaften Anwendung: lsass.exe1

Pfad des fehlerhaften Moduls: lsass.exe2

Berichtskennung: lsass.exe3
 

Error: (08/02/2013 10:48:53 PM) (Source: Wininit) (User: )

Description: Ein kritischer Systemprozess C:\windows\system32\lsass.exe ist fehlgeschlagen mit den Statuscode c0000005. Der Computer muss neu gestartet werden.
 

Error: (08/02/2013 10:48:53 PM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: lsass.exe, Version: 6.1.7601.17725, Zeitstempel: 0x4ec483fc

Name des fehlerhaften Moduls: PTLsaFltr64.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x4d2ddffa

Ausnahmecode: 0xc0000005

Fehleroffset: 0x000007fef9c2a0ea

ID des fehlerhaften Prozesses: 0x2a8

Startzeit der fehlerhaften Anwendung: 0xlsass.exe0

Pfad der fehlerhaften Anwendung: lsass.exe1

Pfad des fehlerhaften Moduls: lsass.exe2

Berichtskennung: lsass.exe3
 

Error: (08/02/2013 10:45:30 PM) (Source: Wininit) (User: )

Description: Ein kritischer Systemprozess C:\windows\system32\lsass.exe ist fehlgeschlagen mit den Statuscode c0000005. Der Computer muss neu gestartet werden.
 

Error: (08/02/2013 10:45:30 PM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: lsass.exe, Version: 6.1.7601.17725, Zeitstempel: 0x4ec483fc

Name des fehlerhaften Moduls: PTLsaFltr64.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x4d2ddffa

Ausnahmecode: 0xc0000005

Fehleroffset: 0x000007fef908a0ea

ID des fehlerhaften Prozesses: 0x290

Startzeit der fehlerhaften Anwendung: 0xlsass.exe0

Pfad der fehlerhaften Anwendung: lsass.exe1

Pfad des fehlerhaften Moduls: lsass.exe2

Berichtskennung: lsass.exe3
 

Error: (08/02/2013 10:42:12 PM) (Source: Wininit) (User: )

Description: Ein kritischer Systemprozess C:\windows\system32\lsass.exe ist fehlgeschlagen mit den Statuscode c0000005. Der Computer muss neu gestartet werden.
 
 

System errors:

=============

Error: (08/04/2013 11:14:30 AM) (Source: Service Control Manager) (User: )

Description: Der Dienst "PnP-X-IP-Busenumerator" ist vom Dienst "Funktionssuchanbieter-Host" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 

%%1068
 

Error: (08/04/2013 11:13:24 AM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 

%%1068
 

Error: (08/04/2013 11:13:24 AM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 

%%1068
 

Error: (08/04/2013 11:13:24 AM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 

%%1068
 

Error: (08/04/2013 11:13:20 AM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 

%%1068
 

Error: (08/04/2013 11:13:20 AM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 

%%1068
 

Error: (08/04/2013 11:13:20 AM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 

%%1068
 

Error: (08/04/2013 11:13:18 AM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 

%%1068
 

Error: (08/04/2013 11:13:18 AM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 

%%1068
 

Error: (08/04/2013 11:13:18 AM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 

%%1068
 
 

Microsoft Office Sessions:

=========================
 

==================== Memory info =========================== 
 

Percentage of memory in use: 18%

Total physical RAM: 4030.37 MB

Available physical RAM: 3298.77 MB

Total Pagefile: 8058.92 MB

Available Pagefile: 7369.97 MB

Total Virtual: 8192 MB

Available Virtual: 8191.83 MB
 

==================== Drives ================================
 

Drive c: () (Fixed) (Total:442.57 GB) (Free:67.53 GB) NTFS (Disk=0 Partition=2) ==>[System with boot components (obtained from reading drive)]

Drive d: (GONNA_WORK) (Removable) (Total:0.24 GB) (Free:0.23 GB) FAT (Disk=1 Partition=1)

Drive e: (HP_RECOVERY) (Fixed) (Total:17.89 GB) (Free:2.72 GB) NTFS (Disk=0 Partition=3) ==>[System with boot components (obtained from reading drive)]

Drive f: (HP_TOOLS) (Fixed) (Total:4.98 GB) (Free:2.13 GB) FAT32 (Disk=0 Partition=4)
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 13B7DE8A)

Partition 1: (Active) - (Size=300 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=443 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=18 GB) - (Type=07 NTFS)

Partition 4: (Not Active) - (Size=5 GB) - (Type=0C)
 

========================================================

Disk: 1 (MBR Code: Windows 7 or 8) (Size: 250 MB) (Disk ID: 00000000)

Partition 1: (Active) - (Size=250 MB) - (Type=06)
 

==================== End Of Log ============================

Vielen Dank!

Gruß,
pflanz.