JustJojo | 28.12.2013 22:14 | Einmal Additions Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 28-12-2013 01
Ran by Kathrin at 2013-12-28 22:10:54
Running from C:\Users\Kathrin\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: G Data InternetSecurity 2014 (Enabled - Up to date) {545C8713-0744-B079-87F8-349A6D5C8CF0}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: G Data InternetSecurity 2014 (Enabled - Up to date) {EF3D66F7-217E-BFF7-BD48-0FE816DBC64D}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: G Data Personal Firewall (Enabled) {6C670636-4D2B-B121-ACA7-9DAF938FCB8B}
==================== Installed Programs ======================
7-Zip 9.20 (x64 edition) (Version: 9.20.00.0)
Adobe Reader XI (11.0.05) - Deutsch (x32 Version: 11.0.05)
Aloha TriPeaks (x32 Version: 2.2.0.98)
Bejeweled 3 (x32 Version: 2.2.0.98)
Chuzzle Deluxe (x32 Version: 2.2.0.95)
Empress of the Deep - The Darkest Secret (x32 Version: 2.2.0.98)
Feven 1.5 (x32 Version: 1.32.153.0) <==== ATTENTION
G Data InternetSecurity 2014 (x32 Version: 24.0.3.4)
Intel AppUp(SM) center (x32 Version: 3.6.1.33268.15)
Intel(R) Management Engine Components (x32 Version: 8.1.0.1252)
Intel(R) Processor Graphics (x32 Version: 9.17.10.2828)
Intel(R) Rapid Storage Technology (x32 Version: 11.5.2.1001)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (x32 Version: 2.0.0.37149)
Intel® Trusted Connect Service Client (Version: 1.24.388.1)
Island Tribe (x32 Version: 2.2.0.98)
Jewel Quest Solitaire 2 (x32 Version: 2.2.0.98)
Magic Academy (x32 Version: 2.2.0.98)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)
Microsoft Office (x32 Version: 14.0.6120.5004)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Nero 12 Essentials Toshiba (x32 Version: 12.0.00400)
Nero BackItUp (x32 Version: 12.0.1000)
Nero BackItUp Help (CHM) (x32 Version: 12.0.3000)
Nero Blu-ray Player (x32 Version: 12.0.12600)
Nero Blu-ray Player Help (CHM) (x32 Version: 12.0.3000)
Nero BurnRights (x32 Version: 12.0.3000)
Nero BurnRights Help (CHM) (x32 Version: 12.0.3000)
Nero ControlCenter (x32 Version: 11.0.14800.0.48)
Nero ControlCenter Help (CHM) (x32 Version: 12.0.3000)
Nero Core Components (x32 Version: 11.0.17600.2.3)
Nero Express (x32 Version: 12.0.14001)
Nero Express Help (CHM) (x32 Version: 12.0.3000)
Nero Kwik Media (x32 Version: 1.18.16800)
Nero Kwik Media Help (CHM) (x32 Version: 12.0.4000)
Nero Kwik Themes Basic (x32 Version: 12.0.11500)
Nero Launcher (x32 Version: 12.2.1000)
Nero RescueAgent (x32 Version: 12.0.7002)
Nero RescueAgent Help (CHM) (x32 Version: 12.0.3000)
Nero SharedVideoCodecs (x32 Version: 1.0.12100.2.0)
Nero Update (x32 Version: 11.0.11800.31.0)
OpenOffice.org 3.4.1 (x32 Version: 3.41.9593)
Peggle Nights (x32 Version: 2.2.0.98)
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.98)
Polar Bowler (x32 Version: 2.2.0.97)
Premium Sound HD (Version: 1.12.4600)
Prerequisite installer (x32 Version: 12.0.0002)
Realtek Ethernet Controller Driver (x32 Version: 8.3.730.2012)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6687)
Realtek USB 2.0 Card Reader (x32 Version: 6.1.8400.30136)
Realtek WLAN Driver (x32 Version: 2.00.0020)
Shared C Run-time for x64 (Version: 10.0.0)
Skype™ 6.11 (x32 Version: 6.11.102)
Synaptics Pointing Device Driver (Version: 16.2.10.3)
TOSHIBA Desktop Assist (Version: 1.00.0007.00002)
TOSHIBA Function Key (Version: 1.00.6425)
TOSHIBA Manuals (x32 Version: 10.10)
Toshiba Password Utility (x32 Version: 2.00.910)
TOSHIBA PC Health Monitor (Version: 1.8.17.640104)
Toshiba Places Icon Utility (Version: 2.1.1)
TOSHIBA Recovery Media Creator (x32 Version: 2.2.0.54043005)
TOSHIBA Resolution+ Plug-in for Windows Media Player (x32 Version: 1.2.2.00)
TOSHIBA Service Station (Version: 2.4.4)
TOSHIBA System Driver (x32 Version: 1.00.0012)
TOSHIBA System Settings (x32 Version: 1.00.0002.32002)
TOSHIBA VIDEO PLAYER (Version: 5.1.0.12-A)
Update Installer for WildTangent Games App (x32)
Virtual Villagers 4 - The Tree of Life (x32 Version: 2.2.0.98)
VLC media player 2.0.5 (Version: 2.0.5)
Waldmeister Sause - Winteredition (Gratisversion) (x32)
Welcome App (Start-up experience) (x32 Version: 12.0.13000)
WildTangent Games (x32 Version: 1.0.3.0)
WildTangent Games App (Toshiba Games) (x32 Version: 4.0.5.37)
WPM17.8.0.3159 (x32 Version: 17.8.0.3159) <==== ATTENTION
Zylom Games Player Plugin (x32)
==================== Restore Points =========================
11-12-2013 17:50:05 Windows Update
15-12-2013 19:55:40 Windows Update
26-12-2013 11:42:25 Windows Update
==================== Hosts content: ==========================
2012-07-26 06:26 - 2012-07-26 06:26 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {1AAFF332-5C62-4558-9991-DAA649C4C9C5} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
Task: {23A5D8BE-9196-40EB-BD89-794398B2B073} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {32AEFB24-8026-47D2-A52C-52A7509451E3} - System32\Tasks\Synaptics TouchPad Enhancements => \Program Files\Synaptics\SynTP\SynTPEnh.exe [2012-08-14] (Synaptics Incorporated)
Task: {7B3A0A83-21B7-42C4-B726-E228FD487912} - System32\Tasks\{80250C81-F329-40D6-ADA4-F6A980789BC9} => Iexplore.exe hxxp://ui.skype.com/ui/0/6.6.0.106/de/eula
Task: {A72208BF-7A49-4FB8-B684-252375F3443A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
Task: {BA732FA1-0B77-4AA1-98B4-99B006EBB80C} - System32\Tasks\{707569F5-7908-4BC2-9743-59780E7EF192} => Iexplore.exe hxxp://ui.skype.com/ui/0/6.6.0.106/de/abandoninstall?page=tsMain
Task: {C6A88F2D-53D2-4805-9D69-443738A1847C} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {CB66965F-EA98-45CD-B4B7-6DBDB2B0FA02} - System32\Tasks\Microsoft\Windows\Setup\Pre-staged GDR Notification => C:\Windows\System32\NotificationUI.exe [2013-08-16] (Microsoft Corporation)
Task: {EBF06DEC-4228-4813-AC0C-62821AE4E330} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
==================== Loaded Modules (whitelisted) =============
2012-08-06 05:36 - 2012-08-06 05:36 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2012-07-19 02:38 - 2012-07-19 02:38 - 00020904 _____ () C:\Program Files\TOSHIBA\Hotkey\SmoothView.dll
2012-07-19 02:38 - 2012-07-19 02:38 - 00049064 _____ () C:\Program Files\TOSHIBA\Hotkey\Hotkey\FnZ.dll
2012-07-31 08:11 - 2012-07-31 08:11 - 00024576 _____ () C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\de\TosDILangPack.resources.dll
2012-10-27 02:06 - 2012-06-25 18:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2012-08-10 16:51 - 2012-08-10 16:51 - 00985088 _____ () C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll
==================== Alternate Data Streams (whitelisted) =========
==================== Safe Mode (whitelisted) ===================
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (12/26/2013 11:02:03 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: Player.exe, Version: 0.0.0.0, Zeitstempel: 0x52bc64e6
Name des fehlerhaften Moduls: Player.exe, Version: 0.0.0.0, Zeitstempel: 0x52bc64e6
Ausnahmecode: 0xc0000417
Fehleroffset: 0x0000cf8f
ID des fehlerhaften Prozesses: 0x2c10
Startzeit der fehlerhaften Anwendung: 0xPlayer.exe0
Pfad der fehlerhaften Anwendung: Player.exe1
Pfad des fehlerhaften Moduls: Player.exe2
Berichtskennung: Player.exe3
Vollständiger Name des fehlerhaften Pakets: Player.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Player.exe5
Error: (12/06/2013 06:08:27 PM) (Source: Application Hang) (User: )
Description: Programm IEXPLORE.EXE, Version 10.0.9200.16537 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: d48
Startzeit: 01cef2a5a082b97a
Endzeit: 35
Anwendungspfad: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
Berichts-ID: 00ff1174-5e99-11e3-8104-7054d20a452c
Vollständiger Name des fehlerhaften Pakets:
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:
Error: (11/11/2013 03:15:05 PM) (Source: Application Hang) (User: )
Description: Programm IEXPLORE.EXE, Version 10.0.9200.16537 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 8b8
Startzeit: 01cedee845727d99
Endzeit: 8
Anwendungspfad: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
Berichts-ID: a5ee9fc4-4adb-11e3-80ed-7054d20a452c
Vollständiger Name des fehlerhaften Pakets:
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:
Error: (11/09/2013 11:03:16 AM) (Source: Application Hang) (User: )
Description: Programm vlc.exe, Version 2.0.5.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 14cc
Startzeit: 01cedd32e07a195b
Endzeit: 0
Anwendungspfad: C:\Program Files\VideoLAN\VLC\vlc.exe
Berichts-ID: 25102b31-4926-11e3-80e9-7054d20a452c
Vollständiger Name des fehlerhaften Pakets:
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:
Error: (11/09/2013 11:01:20 AM) (Source: Application Hang) (User: )
Description: Programm vlc.exe, Version 2.0.5.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 12a8
Startzeit: 01cedd3290c1063b
Endzeit: 10
Anwendungspfad: C:\Program Files\VideoLAN\VLC\vlc.exe
Berichts-ID: dafe6bb1-4925-11e3-80e9-7054d20a452c
Vollständiger Name des fehlerhaften Pakets:
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:
Error: (09/14/2013 08:05:55 PM) (Source: MsiInstaller) (User: Muttis_Laptop)
Description: Produkt: Adobe Reader XI - Deutsch - Update "{AC76BA86-7AD7-0000-2550-7A8C40011004}" konnte nicht installiert werden. Fehlercode 1625. Windows Installer kann Protokolle erstellen, um bei der Problembehandlung betreffend der Installation von Softwarepaketen behilflich zu sein. Verwenden Sie folgenden Link, um Anweisungen zur Aktivierung der Protokollierungsunterstützung zu erhalten: hxxp://go.microsoft.com/fwlink/?LinkId=23127
Error: (09/12/2013 07:46:35 PM) (Source: Application Hang) (User: )
Description: Programm IEXPLORE.EXE, Version 10.0.9200.16537 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: f28
Startzeit: 01ceafe856af58b3
Endzeit: 23
Anwendungspfad: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
Berichts-ID: a2b4c6bd-1bdb-11e3-80a7-7054d20a452c
Vollständiger Name des fehlerhaften Pakets:
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:
Error: (08/26/2013 04:18:26 PM) (Source: ESENT) (User: )
Description: taskhostex (3632) Versuch, Datei "C:\Users\Kathrin\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat" für den Lesezugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.
Error: (08/05/2013 03:02:23 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: IEXPLORE.EXE, Version: 10.0.9200.16537, Zeitstempel: 0x512347f7
Name des fehlerhaften Moduls: MSHTML.dll, Version: 10.0.9200.16635, Zeitstempel: 0x51b7b287
Ausnahmecode: 0xc0000005
Fehleroffset: 0x005649c3
ID des fehlerhaften Prozesses: 0x13dc
Startzeit der fehlerhaften Anwendung: 0xIEXPLORE.EXE0
Pfad der fehlerhaften Anwendung: IEXPLORE.EXE1
Pfad des fehlerhaften Moduls: IEXPLORE.EXE2
Berichtskennung: IEXPLORE.EXE3
Vollständiger Name des fehlerhaften Pakets: IEXPLORE.EXE4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: IEXPLORE.EXE5
Error: (07/19/2013 09:58:36 PM) (Source: Microsoft-Windows-Immersive-Shell) (User: Muttis_Laptop)
Description: Bei der Aktivierung der App „Microsoft.BingWeather_8wekyb3d8bbwe!App“ ist folgender Fehler aufgetreten: -2144927142. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
System errors:
=============
Error: (12/28/2013 08:36:17 PM) (Source: Microsoft-Windows-Kernel-General) (User: NT-AUTORITÄT)
Description: 0x8000002a171\??\Volume{4fb251d6-ff9a-11e1-a6eb-bf02a4d2de20}\System Volume Information\SPP\SppCbsHiveStore\{cd42efe1-f6f1-427c-b004-033192c625a4}{7DD9AAAE-4F02-4559-9A1A-F4AA49ECCBA1}
Error: (12/28/2013 08:35:58 PM) (Source: Microsoft-Windows-Kernel-General) (User: NT-AUTORITÄT)
Description: 0x8000002a171\??\Volume{4fb251d6-ff9a-11e1-a6eb-bf02a4d2de20}\System Volume Information\SPP\SppCbsHiveStore\{cd42efe1-f6f1-427c-b004-033192c625a4}{9458DE1D-2A45-4FE1-98D7-122E55DE4DB7}
Error: (12/28/2013 08:27:51 PM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert und an den Remoteendpunkt gesendet. Dies kann dazu führen, dass die Verbindung beendet wird. Die schwerwiegende Warnung hat folgenden für das TLS-Protokoll definierten Code: 10. Der Windows-SChannel-Fehlerstatus lautet: 10.
Error: (12/28/2013 04:25:01 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1115
Error: (12/26/2013 10:06:01 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Software Protection" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (12/26/2013 10:06:01 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Software Protection erreicht.
Error: (12/26/2013 10:05:31 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Heimnetzgruppen-Anbieter" ist vom Dienst "Funktionssuche-Ressourcenveröffentlichung" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%2147942405
Error: (12/26/2013 10:05:31 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Funktionssuche-Ressourcenveröffentlichung" wurde mit folgendem Fehler beendet:
%%2147942405
Error: (12/26/2013 02:00:51 PM) (Source: Microsoft-Windows-Kernel-General) (User: NT-AUTORITÄT)
Description: 0x8000002a171\??\Volume{4fb251d6-ff9a-11e1-a6eb-bf02a4d2de20}\System Volume Information\SPP\SppCbsHiveStore\{cd42efe1-f6f1-427c-b004-033192c625a4}{9302CA61-A149-482B-A4B6-604D2E0DE865}
Error: (12/26/2013 00:41:23 PM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert und an den Remoteendpunkt gesendet. Dies kann dazu führen, dass die Verbindung beendet wird. Die schwerwiegende Warnung hat folgenden für das TLS-Protokoll definierten Code: 10. Der Windows-SChannel-Fehlerstatus lautet: 10.
Microsoft Office Sessions:
=========================
Error: (12/26/2013 11:02:03 PM) (Source: Application Error)(User: )
Description: Player.exe0.0.0.052bc64e6Player.exe0.0.0.052bc64e6c00004170000cf8f2c1001cf02861b8f7a37C:\Users\Kathrin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\46RWE4YY\Player.exeC:\Users\Kathrin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\46RWE4YY\Player.exe59c3ee23-6e79-11e3-8117-7054d20a452c
Error: (12/06/2013 06:08:27 PM) (Source: Application Hang)(User: )
Description: IEXPLORE.EXE10.0.9200.16537d4801cef2a5a082b97a35C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE00ff1174-5e99-11e3-8104-7054d20a452c
Error: (11/11/2013 03:15:05 PM) (Source: Application Hang)(User: )
Description: IEXPLORE.EXE10.0.9200.165378b801cedee845727d998C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXEa5ee9fc4-4adb-11e3-80ed-7054d20a452c
Error: (11/09/2013 11:03:16 AM) (Source: Application Hang)(User: )
Description: vlc.exe2.0.5.014cc01cedd32e07a195b0C:\Program Files\VideoLAN\VLC\vlc.exe25102b31-4926-11e3-80e9-7054d20a452c
Error: (11/09/2013 11:01:20 AM) (Source: Application Hang)(User: )
Description: vlc.exe2.0.5.012a801cedd3290c1063b10C:\Program Files\VideoLAN\VLC\vlc.exedafe6bb1-4925-11e3-80e9-7054d20a452c
Error: (09/14/2013 08:05:55 PM) (Source: MsiInstaller)(User: Muttis_Laptop)
Description: Adobe Reader XI - Deutsch{AC76BA86-7AD7-0000-2550-7A8C40011004}1625(NULL)(NULL)(NULL)
Error: (09/12/2013 07:46:35 PM) (Source: Application Hang)(User: )
Description: IEXPLORE.EXE10.0.9200.16537f2801ceafe856af58b323C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXEa2b4c6bd-1bdb-11e3-80a7-7054d20a452c
Error: (08/26/2013 04:18:26 PM) (Source: ESENT)(User: )
Description: taskhostex3632C:\Users\Kathrin\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat-1032 (0xfffffbf8)32 (0x00000020)Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird.
Error: (08/05/2013 03:02:23 PM) (Source: Application Error)(User: )
Description: IEXPLORE.EXE10.0.9200.16537512347f7MSHTML.dll10.0.9200.1663551b7b287c0000005005649c313dc01ce91e1196af4e5C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXEC:\windows\SYSTEM32\MSHTML.dlla60aebeb-fdd7-11e2-8068-7054d20a452c
Error: (07/19/2013 09:58:36 PM) (Source: Microsoft-Windows-Immersive-Shell)(User: Muttis_Laptop)
Description: Microsoft.BingWeather_8wekyb3d8bbwe!App-2144927142
==================== Memory info ===========================
Percentage of memory in use: 57%
Total physical RAM: 3977.22 MB
Available physical RAM: 1699.25 MB
Total Pagefile: 4793.22 MB
Available Pagefile: 2076.12 MB
Total Virtual: 8192 MB
Available Virtual: 8191.77 MB
==================== Drives ================================
Drive c: (Windows) (Fixed) (Total:228.7 GB) (Free:190.2 GB) NTFS
Drive e: (Kathrins Daten) (Fixed) (Total:226.6 GB) (Free:217.92 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 466 GB) (Disk ID: 00000000)
Partition: GPT Partition Type
==================== End Of Log ============================ und Frst.txt
FRST Logfile: Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 28-12-2013 01
Ran by Kathrin (administrator) on MUTTIS_LAPTOP on 28-12-2013 22:10:06
Running from C:\Users\Kathrin\Downloads
Windows 8 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlx64.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
() C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe
(Cherished Technololgy LIMITED) C:\ProgramData\WPM\wprotectmanager.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKBap64.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe
(SRS Labs, Inc.) C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
(Toshiba) C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIMonitor.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\GdBgInx64.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [] - [x]
HKLM\...\Run: [HotKeysCmds] - C:\windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12936848 2012-07-13] (Realtek Semiconductor)
HKLM\...\Run: [TCrdMain] - C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe [2608040 2012-08-14] (TOSHIBA Corporation)
HKLM\...\Run: [TODDMain] - C:\Program Files (x86)\TOSHIBA\System Setting\TODDMain.exe [213136 2012-08-04] ()
HKLM\...\Run: [TecoResident] - C:\Program Files\TOSHIBA\Teco\TecoResident.exe
HKLM\...\Run: [TosWaitSrv] - C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [356776 2012-07-11] (TOSHIBA Corporation)
HKLM\...\Run: [SRS Premium Sound HD] - C:\Program Files\SRS Labs\SRS Control Panel\SRS_Premium_Sound_HD.zip [223245 2012-07-27] ()
HKLM-x32\...\Run: [Intel AppUp(SM) center] - C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [155488 2012-08-01] (Intel Corporation)
HKLM-x32\...\Run: [ToshibaDynamicIconUtility] - C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIMonitor.exe [1498624 2012-08-09] (Toshiba)
HKLM-x32\...\Run: [TPUReg] - C:\Program Files (x86)\TOSHIBA\Password Utility\TosPU.exe [6884352 2012-08-23] (Pegatron Corporation)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [G Data AntiVirus Tray] - C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe [1444472 2013-08-21] (G Data Software AG)
HKLM-x32\...\Run: [GDFirewallTray] - C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe [1854928 2013-03-22] (G Data Software AG)
HKLM-x32\...\RunOnce: [Malwarebytes Anti-Malware] - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent [532040 2013-04-04] (Malwarebytes Corporation)
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,c:\program files (x86)\g data\internetsecurity\avkkid\avkcks.exe
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20584608 2013-11-14] (Skype Technologies S.A.)
MountPoints2: {d86d2097-1d3a-11e3-80a9-7054d20a452c} - "F:\NokiaPCIA_Autorun.exe"
AppInit_DLLs: C:\ProgramData\Wincert\win64cert.dll [8704 2012-12-20] ()
AppInit_DLLs-x32: C:\PROGRA~3\Wincert\WIN32C~1.DLL [7168 2012-12-20] ()
Startup: C:\Users\Kathrin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.t-online.de/
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1388095383&from=tugs&uid=TOSHIBAXMQ01ABD050_62TCSB2QSXX62TCSB2QS&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.nationzoom.com/?type=hp&ts=1388095383&from=tugs&uid=TOSHIBAXMQ01ABD050_62TCSB2QSXX62TCSB2QS
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.nationzoom.com/?type=hp&ts=1388095383&from=tugs&uid=TOSHIBAXMQ01ABD050_62TCSB2QSXX62TCSB2QS
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.nationzoom.com/web/?type=ds&ts=1388095383&from=tugs&uid=TOSHIBAXMQ01ABD050_62TCSB2QSXX62TCSB2QS&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
URLSearchHook: HKCU - (No Name) - {D3D233D5-9F6D-436C-B6C7-E63F77503B30} - No File
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.nationzoom.com/?type=sc&ts=1388095383&from=tugs&uid=TOSHIBAXMQ01ABD050_62TCSB2QSXX62TCSB2QS
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1388095383&from=tugs&uid=TOSHIBAXMQ01ABD050_62TCSB2QSXX62TCSB2QS&q={searchTerms}
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1388095383&from=tugs&uid=TOSHIBAXMQ01ABD050_62TCSB2QSXX62TCSB2QS&q={searchTerms}
SearchScopes: HKLM - {7E5E5301-CF5A-4602-94C2-77D6BD1F6973} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS
SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=390&systemid=406&apn_dtid=BND406&apn_ptnrs=AG6&o=APN10645&apn_uid=2026311881244890&q={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1388095383&from=tugs&uid=TOSHIBAXMQ01ABD050_62TCSB2QSXX62TCSB2QS&q={searchTerms}
SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1388095383&from=tugs&uid=TOSHIBAXMQ01ABD050_62TCSB2QSXX62TCSB2QS&q={searchTerms}
SearchScopes: HKLM-x32 - {7E5E5301-CF5A-4602-94C2-77D6BD1F6973} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS
SearchScopes: HKLM-x32 - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=390&systemid=406&apn_dtid=BND406&apn_ptnrs=AG6&o=APN10645&apn_uid=2026311881244890&q={searchTerms}
SearchScopes: HKCU - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=390&systemid=406&apn_dtid=BND406&apn_ptnrs=AG6&o=APN10645&apn_uid=2026311881244890&q={searchTerms}
SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1388095383&from=tugs&uid=TOSHIBAXMQ01ABD050_62TCSB2QSXX62TCSB2QS&q={searchTerms}
SearchScopes: HKCU - {7E5E5301-CF5A-4602-94C2-77D6BD1F6973} URL =
SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=390&systemid=406&apn_dtid=BND406&apn_ptnrs=AG6&o=APN10645&apn_uid=2026311881244890&q={searchTerms}
SearchScopes: HKCU - {C04B7D22-5AEC-4561-8F49-27F6269208F6} URL = hxxp://www2.inbox.com/search/dispatcher.aspx?tp=bs&qkw={searchTerms}&tbid=80772&lng=de
BHO: DataMngr - {C1ED9DA0-AFD0-4b90-AC6A-D3874F591014} - C:\Program Files (x86)\Search Results Toolbar\Datamngr\x64\BrowserConnection.dll (Bandoo Media Inc)
BHO-x32: DataMngr - {C1ED9DA0-AFD0-4b90-AC6A-D3874F591014} - C:\Program Files (x86)\Search Results Toolbar\Datamngr\BrowserConnection.dll (Bandoo Media Inc)
Toolbar: HKCU - No Name - {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - No File
DPF: HKLM-x32 {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} hxxp://game.zylom.com/activex/zylomgamesplayer.cab
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
==================== Services (Whitelisted) =================
R2 AVKProxy; C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe [1970296 2013-08-26] (G Data Software AG)
R2 AVKService; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe [635000 2013-08-21] (G Data Software AG)
R2 AVKWCtl; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlx64.exe [2562208 2013-10-15] (G Data Software AG)
R3 GDFwSvc; C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe [2942808 2013-10-17] (G Data Software AG)
R3 GDScan; C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe [695416 2013-08-22] (G Data Software AG)
R2 GFNEXSrv; C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe [156672 2011-10-13] ()
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-02] (Microsoft Corporation)
R2 Wpm; C:\ProgramData\WPM\wprotectmanager.exe [499856 2013-12-26] (Cherished Technololgy LIMITED)
==================== Drivers (Whitelisted) ====================
R0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [60248 2013-10-18] (G Data Software AG)
R1 GDMnIcpt; C:\windows\system32\drivers\MiniIcpt.sys [130392 2013-10-18] (G Data Software AG)
R3 GDPkIcpt; C:\windows\system32\drivers\PktIcpt.sys [64856 2013-10-18] (G Data Software AG)
R1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd64.sys [68440 2013-10-22] (G Data Software AG)
S1 GLogin; No ImagePath
R1 GRD; C:\windows\system32\drivers\GRD.sys [106272 2013-12-25] (G Data Software)
R1 HookCentre; C:\windows\system32\drivers\HookCentre.sys [65368 2013-10-18] (G Data Software AG)
S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwNe64.sys [11400192 2012-06-02] (Intel Corporation)
R2 PEGAGFN; C:\Program Files (x86)\TOSHIBA\Password Utility\PEGAGFN.sys [14344 2009-09-11] (PEGATRON)
S3 RTL8192Ce; C:\Windows\system32\DRIVERS\rtwlane.sys [1496720 2012-08-13] (Realtek Semiconductor Corporation )
R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [1496720 2012-08-13] (Realtek Semiconductor Corporation )
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [43832 2012-08-14] (Synaptics Incorporated)
R3 Thotkey; C:\Windows\System32\drivers\Thotkey.sys [28632 2012-07-31] (Windows (R) Win 7 DDK provider)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-12-28 22:10 - 2013-12-28 22:10 - 00013075 _____ C:\Users\Kathrin\Downloads\FRST.txt
2013-12-28 22:08 - 2013-12-28 22:08 - 00000000 ____D C:\FRST
2013-12-28 22:05 - 2013-12-28 22:07 - 01931176 _____ (Farbar) C:\Users\Kathrin\Downloads\FRST64.exe
2013-12-28 17:50 - 2013-12-28 17:50 - 00001120 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2013-12-28 17:50 - 2013-12-28 17:50 - 00000000 ____D C:\Users\Kathrin\AppData\Roaming\Malwarebytes
2013-12-28 17:50 - 2013-12-28 17:50 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-12-28 17:50 - 2013-12-28 17:50 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-12-28 17:50 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2013-12-28 17:49 - 2013-12-28 17:49 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Kathrin\Downloads\mbam-setup-1.75.0.1300.exe
2013-12-26 23:05 - 2013-12-26 23:05 - 00307904 _____ C:\windows\system32\FNTCACHE.DAT
2013-12-26 23:03 - 2013-12-26 23:03 - 00000000 ____D C:\ProgramData\WPM
2013-12-26 23:03 - 2013-12-26 23:03 - 00000000 ____D C:\Program Files (x86)\Optimizer Pro
2013-12-26 23:03 - 2013-12-26 23:03 - 00000000 ____D C:\Program Files (x86)\Mobogenie
2013-12-26 23:03 - 2013-12-26 23:03 - 00000000 ____D C:\Program Files (x86)\Feven 1.5
2013-12-25 15:04 - 2013-12-25 15:04 - 00106272 _____ (G Data Software) C:\windows\system32\Drivers\GRD.sys
2013-12-19 15:32 - 2013-12-04 01:53 - 00694240 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2013-12-19 15:32 - 2013-12-04 01:53 - 00078304 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-12-11 19:45 - 2013-10-25 07:19 - 02241536 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2013-12-11 19:45 - 2013-10-25 07:19 - 01365504 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2013-12-11 19:45 - 2013-10-25 07:19 - 00915968 _____ (Microsoft Corporation) C:\windows\system32\uxtheme.dll
2013-12-11 19:45 - 2013-10-25 07:19 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2013-12-11 19:45 - 2013-10-25 07:18 - 19271168 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2013-12-11 19:45 - 2013-10-25 07:18 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2013-12-11 19:45 - 2013-10-25 07:17 - 15404032 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2013-12-11 19:45 - 2013-10-25 07:17 - 03959808 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2013-12-11 19:45 - 2013-10-25 07:17 - 02648576 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2013-12-11 19:45 - 2013-10-25 07:17 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2013-12-11 19:45 - 2013-10-25 05:45 - 01767936 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2013-12-11 19:45 - 2013-10-25 05:44 - 14356992 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2013-12-11 19:45 - 2013-10-25 05:44 - 01140736 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2013-12-11 19:45 - 2013-10-25 05:43 - 13761536 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2013-12-11 19:45 - 2013-10-25 05:43 - 02877952 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2013-12-11 19:45 - 2013-10-25 05:43 - 02049024 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2013-12-11 19:45 - 2013-10-25 05:43 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2013-12-11 19:45 - 2013-10-25 05:43 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2013-12-11 19:44 - 2013-11-07 00:18 - 04036608 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2013-12-11 19:44 - 2013-10-19 06:45 - 00062976 _____ (Microsoft Corporation) C:\windows\system32\imagehlp.dll
2013-12-11 19:44 - 2013-10-19 05:04 - 00059392 _____ (Microsoft Corporation) C:\windows\SysWOW64\imagehlp.dll
2013-12-11 19:44 - 2013-09-13 23:36 - 00247296 _____ (Microsoft Corporation) C:\windows\SysWOW64\ubpm.dll
2013-12-11 19:44 - 2013-09-13 23:33 - 00328192 _____ (Microsoft Corporation) C:\windows\system32\ubpm.dll
2013-12-11 19:44 - 2013-08-30 06:43 - 00061784 _____ (Microsoft Corporation) C:\windows\system32\Drivers\crashdmp.sys
2013-12-11 19:44 - 2013-08-30 06:20 - 01173504 _____ (Microsoft Corporation) C:\windows\system32\UIAutomationCore.dll
2013-12-11 19:44 - 2013-08-30 00:48 - 00914432 _____ (Microsoft Corporation) C:\windows\SysWOW64\UIAutomationCore.dll
2013-12-11 19:44 - 2013-08-21 07:39 - 00465240 _____ (Microsoft Corporation) C:\windows\system32\Drivers\fvevol.sys
2013-12-11 19:44 - 2013-08-10 07:30 - 00151896 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tpm.sys
2013-12-11 19:44 - 2013-08-10 06:21 - 00817152 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll
2013-12-11 19:44 - 2013-08-10 04:58 - 00656896 _____ (Microsoft Corporation) C:\windows\SysWOW64\kerberos.dll
2013-12-11 19:44 - 2013-07-25 00:10 - 10799104 _____ (Microsoft Corporation) C:\windows\SysWOW64\Windows.UI.Xaml.dll
2013-12-11 19:44 - 2013-07-25 00:07 - 13661696 _____ (Microsoft Corporation) C:\windows\system32\Windows.UI.Xaml.dll
2013-12-11 19:44 - 2013-07-12 02:38 - 00599040 _____ (Microsoft Corporation) C:\windows\system32\WSDApi.dll
2013-12-11 19:44 - 2013-07-12 02:30 - 00485376 _____ (Microsoft Corporation) C:\windows\SysWOW64\WSDApi.dll
2013-12-11 19:43 - 2013-10-03 00:25 - 01300992 _____ (Microsoft Corporation) C:\windows\system32\gdi32.dll
2013-12-11 19:43 - 2013-10-01 23:22 - 01022976 _____ (Microsoft Corporation) C:\windows\SysWOW64\gdi32.dll
2013-12-11 19:42 - 2013-10-08 23:27 - 03279872 _____ (Microsoft Corporation) C:\windows\system32\wuaueng.dll
2013-12-11 19:42 - 2013-10-08 23:27 - 00773120 _____ (Microsoft Corporation) C:\windows\system32\wuapi.dll
2013-12-11 19:42 - 2013-10-02 00:37 - 01569280 _____ (Microsoft Corporation) C:\windows\SysWOW64\crypt32.dll
2013-12-11 19:42 - 2013-10-02 00:26 - 01890816 _____ (Microsoft Corporation) C:\windows\system32\crypt32.dll
2013-12-11 19:42 - 2013-09-28 06:48 - 00778752 _____ (Microsoft Corporation) C:\windows\system32\oleaut32.dll
2013-12-11 19:42 - 2013-09-28 04:35 - 00288768 _____ (Microsoft Corporation) C:\windows\system32\Drivers\portcls.sys
2013-12-11 19:42 - 2013-09-19 08:32 - 01455448 _____ (Microsoft Corporation) C:\windows\system32\Drivers\dxgkrnl.sys
2013-12-11 19:42 - 2013-08-30 06:19 - 00626688 _____ (Microsoft Corporation) C:\windows\system32\resutils.dll
2013-12-11 19:42 - 2013-08-30 06:18 - 00374784 _____ (Microsoft Corporation) C:\windows\system32\clusapi.dll
2013-12-11 19:42 - 2013-08-30 00:48 - 00488960 _____ (Microsoft Corporation) C:\windows\SysWOW64\resutils.dll
2013-12-11 19:41 - 2013-10-10 12:53 - 00096600 _____ (Microsoft Corporation) C:\windows\system32\Drivers\wfplwfs.sys
2013-12-11 19:41 - 2013-10-10 10:32 - 00115712 _____ (Microsoft Corporation) C:\windows\SysWOW64\cscript.exe
2013-12-11 19:41 - 2013-10-10 10:30 - 00162304 _____ (Microsoft Corporation) C:\windows\SysWOW64\scrobj.dll
2013-12-11 19:41 - 2013-10-10 10:30 - 00156160 _____ (Microsoft Corporation) C:\windows\SysWOW64\scrrun.dll
2013-12-11 19:41 - 2013-10-10 10:24 - 00143872 _____ (Microsoft Corporation) C:\windows\system32\wshom.ocx
2013-12-11 19:41 - 2013-10-10 10:23 - 00146944 _____ (Microsoft Corporation) C:\windows\system32\cscript.exe
2013-12-11 19:41 - 2013-10-10 10:22 - 00222720 _____ (Microsoft Corporation) C:\windows\system32\scrobj.dll
2013-12-11 19:41 - 2013-10-10 10:22 - 00194048 _____ (Microsoft Corporation) C:\windows\system32\scrrun.dll
2013-12-11 19:41 - 2013-10-10 10:21 - 01160192 _____ (Microsoft Corporation) C:\windows\system32\IKEEXT.DLL
2013-12-11 19:41 - 2013-10-10 10:20 - 00723968 _____ (Microsoft Corporation) C:\windows\system32\BFE.DLL
2013-12-11 19:41 - 2013-10-09 02:33 - 00059416 _____ (Microsoft Corporation) C:\windows\system32\wuauclt.exe
2013-12-11 19:41 - 2013-10-08 23:30 - 00628736 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapi.dll
2013-12-11 19:41 - 2013-10-08 23:30 - 00126976 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuwebv.dll
2013-12-11 19:41 - 2013-10-08 23:30 - 00084992 _____ (Microsoft Corporation) C:\windows\SysWOW64\wudriver.dll
2013-12-11 19:41 - 2013-10-08 23:30 - 00035328 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapp.exe
2013-12-11 19:41 - 2013-10-08 23:28 - 00040448 _____ (Microsoft Corporation) C:\windows\system32\wuapp.exe
2013-12-11 19:41 - 2013-10-08 23:27 - 01622016 _____ (Microsoft Corporation) C:\windows\system32\wucltux.dll
2013-12-11 19:41 - 2013-10-08 23:27 - 00252928 _____ (Microsoft Corporation) C:\windows\system32\WUSettingsProvider.dll
2013-12-11 19:41 - 2013-10-08 23:27 - 00175104 _____ (Microsoft Corporation) C:\windows\system32\storewuauth.dll
2013-12-11 19:41 - 2013-10-08 23:27 - 00142848 _____ (Microsoft Corporation) C:\windows\system32\wuwebv.dll
2013-12-11 19:41 - 2013-10-08 23:27 - 00099328 _____ (Microsoft Corporation) C:\windows\system32\wudriver.dll
2013-12-11 19:41 - 2013-10-05 07:10 - 00285016 _____ (Microsoft Corporation) C:\windows\system32\Drivers\spaceport.sys
2013-12-11 19:41 - 2013-10-03 23:09 - 00385528 _____ C:\windows\system32\ApnDatabase.xml
2013-12-11 19:41 - 2013-10-02 03:50 - 00447320 _____ (Microsoft Corporation) C:\windows\system32\Drivers\USBHUB3.SYS
2013-12-11 19:41 - 2013-09-28 04:58 - 00551424 _____ (Microsoft Corporation) C:\windows\SysWOW64\oleaut32.dll
2013-12-11 19:41 - 2013-09-04 04:11 - 00576512 _____ (Microsoft Corporation) C:\windows\system32\Drivers\afd.sys
2013-12-11 19:41 - 2013-08-30 00:47 - 00302080 _____ (Microsoft Corporation) C:\windows\SysWOW64\clusapi.dll
2013-12-11 19:40 - 2013-11-23 07:43 - 00420864 _____ (Microsoft Corporation) C:\windows\system32\WMPhoto.dll
2013-12-11 19:40 - 2013-11-23 06:05 - 00368640 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMPhoto.dll
2013-12-11 19:40 - 2013-11-01 06:38 - 00312320 _____ (Microsoft Corporation) C:\windows\system32\msieftp.dll
2013-12-11 19:40 - 2013-11-01 04:49 - 00273408 _____ (Microsoft Corporation) C:\windows\SysWOW64\msieftp.dll
2013-12-11 19:40 - 2013-10-02 00:37 - 02035712 _____ (Microsoft Corporation) C:\windows\SysWOW64\authui.dll
2013-12-11 19:40 - 2013-10-02 00:26 - 02304512 _____ (Microsoft Corporation) C:\windows\system32\authui.dll
2013-12-11 19:40 - 2013-08-23 08:22 - 02062848 _____ (Microsoft Corporation) C:\windows\system32\d3d11.dll
2013-12-11 19:40 - 2013-08-23 02:44 - 01711616 _____ (Microsoft Corporation) C:\windows\SysWOW64\d3d11.dll
2013-12-11 19:38 - 2013-09-23 23:30 - 00419328 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll
2013-12-11 19:38 - 2013-09-23 23:30 - 00323072 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll
==================== One Month Modified Files and Folders =======
2013-12-28 22:10 - 2013-12-28 22:10 - 00013075 _____ C:\Users\Kathrin\Downloads\FRST.txt
2013-12-28 22:08 - 2013-12-28 22:08 - 00000000 ____D C:\FRST
2013-12-28 22:07 - 2013-12-28 22:05 - 01931176 _____ (Farbar) C:\Users\Kathrin\Downloads\FRST64.exe
2013-12-28 22:00 - 2012-12-25 14:06 - 00000000 ____D C:\Users\Kathrin\AppData\Roaming\Skype
2013-12-28 22:00 - 2012-07-26 09:12 - 00000000 ____D C:\windows\system32\sru
2013-12-28 19:07 - 2012-07-26 09:12 - 00000000 ____D C:\windows\rescache
2013-12-28 17:50 - 2013-12-28 17:50 - 00001120 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2013-12-28 17:50 - 2013-12-28 17:50 - 00000000 ____D C:\Users\Kathrin\AppData\Roaming\Malwarebytes
2013-12-28 17:50 - 2013-12-28 17:50 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-12-28 17:50 - 2013-12-28 17:50 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-12-28 17:49 - 2013-12-28 17:49 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Kathrin\Downloads\mbam-setup-1.75.0.1300.exe
2013-12-28 17:44 - 2012-08-01 17:38 - 00753134 _____ C:\windows\system32\perfh007.dat
2013-12-28 17:44 - 2012-08-01 17:38 - 00155826 _____ C:\windows\system32\perfc007.dat
2013-12-28 17:44 - 2012-07-26 08:28 - 01745416 _____ C:\windows\system32\PerfStringBackup.INI
2013-12-28 17:39 - 2012-07-26 08:22 - 00000006 ____H C:\windows\Tasks\SA.DAT
2013-12-27 09:53 - 2012-07-26 09:12 - 00000000 ____D C:\windows\system32\NDF
2013-12-27 09:44 - 2012-12-17 22:04 - 00003600 _____ C:\windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-4059626176-2450372524-3070398654-1001
2013-12-26 23:05 - 2013-12-26 23:05 - 00307904 _____ C:\windows\system32\FNTCACHE.DAT
2013-12-26 23:03 - 2013-12-26 23:03 - 00000000 ____D C:\ProgramData\WPM
2013-12-26 23:03 - 2013-12-26 23:03 - 00000000 ____D C:\Program Files (x86)\Optimizer Pro
2013-12-26 23:03 - 2013-12-26 23:03 - 00000000 ____D C:\Program Files (x86)\Mobogenie
2013-12-26 23:03 - 2013-12-26 23:03 - 00000000 ____D C:\Program Files (x86)\Feven 1.5
2013-12-26 23:03 - 2012-12-19 18:05 - 00001738 _____ C:\Users\Kathrin\Desktop\Internet.lnk
2013-12-26 14:27 - 2012-12-17 21:56 - 01402128 _____ C:\windows\WindowsUpdate.log
2013-12-26 14:27 - 2012-07-26 09:12 - 00000000 ___RD C:\windows\ToastData
2013-12-26 14:27 - 2012-07-26 09:12 - 00000000 ____D C:\windows\WinStore
2013-12-26 12:47 - 2013-09-20 20:52 - 00000000 ____D C:\windows\system32\MRT
2013-12-26 12:45 - 2012-07-26 06:38 - 00000000 ____D C:\windows\system32\oobe
2013-12-26 12:01 - 2012-07-26 09:12 - 00000000 ____D C:\windows\AUInstallAgent
2013-12-25 15:04 - 2013-12-25 15:04 - 00106272 _____ (G Data Software) C:\windows\system32\Drivers\GRD.sys
2013-12-25 15:04 - 2013-01-21 20:51 - 00019016 _____ (G Data Software) C:\windows\system32\Drivers\GdPhyMem.sys
2013-12-21 21:36 - 2012-07-26 06:26 - 00262144 ___SH C:\windows\system32\config\BBI
2013-12-18 20:23 - 2012-07-26 09:12 - 00000000 ____D C:\windows\system32\SecureBootUpdates
2013-12-12 21:53 - 2013-02-13 16:10 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-12-12 21:53 - 2012-12-25 14:06 - 00000000 ____D C:\ProgramData\Skype
2013-12-04 01:53 - 2013-12-19 15:32 - 00694240 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2013-12-04 01:53 - 2013-12-19 15:32 - 00078304 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-12-01 14:42 - 2012-12-22 17:16 - 90708896 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
Some content of TEMP:
====================
C:\Users\Kathrin\AppData\Local\Temp\installhelper.dll
C:\Users\Kathrin\AppData\Local\Temp\Install_Nokia_Ovi_Suite.exe
C:\Users\Kathrin\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Kathrin\AppData\Local\Temp\SRAssetsHelper.dll
C:\Users\Kathrin\AppData\Local\Temp\WdfCoInstaller01007.dll
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-12-26 12:41
==================== End Of Log ============================ --- --- --- |