Trojaner-Board - Regelmäßige Bluescreens und der Verdacht durch Rougekiller auf einen IRP Hook Rootkit

Danke für die schnelle Rückmeldung.

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015

Ran by X(administrator) on VENICE on 29-03-2015 08:34:39

Running from C:\Users\x\Downloads\New Loads

Loaded Profiles: X & Login & Guest (Available profiles:x & Login & Guest)

Platform: Windows 7 Enterprise Service Pack 1 (X64) OS Language: Englisch (USA)

Internet Explorer Version 11 (Default browser: FF)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(AMD) C:\Windows\System32\atiesrxx.exe

(Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe

(AMD) C:\Windows\System32\atieclxx.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgfws.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe

(Rosetta Stone Ltd.) C:\Program Files (x86)\RosettaStoneLtdServices\RosettaStoneDaemon.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgnsa.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgemca.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

(FNet Co., Ltd.) C:\Program Files (x86)\XFastUsb\XFastUsb.exe

(Creative Technology Ltd) C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe

(Zemana Ltd.) C:\Program Files (x86)\AntiLogger\AntiLogger.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgui.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Advanced Micro Devices Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\MOM.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe

(ATI Technologies Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\CCC.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgrsa.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe

(Microsoft Corporation) C:\Windows\System32\mobsync.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13307496 2011-10-17] (Realtek Semiconductor)

HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [444904 2012-09-20] (Adobe Systems Incorporated)

HKLM\...\Run: [CDAServer] => C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe

HKLM-x32\...\Run: [XFastUsb] => C:\Program Files (x86)\XFastUsb\XFastUsb.exe [4942336 2011-11-17] (FNet Co., Ltd.)

HKLM-x32\...\Run: [VolPanel] => C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe [241789 2009-05-04] (Creative Technology Ltd)

HKLM-x32\...\Run: [UpdReg] => C:\Windows\UpdReg.EXE [90112 2000-05-11] (Creative Technology Ltd.)

HKLM-x32\...\Run: [NBAgent] => C:\Program Files (x86)\Nero\Nero 11\Nero BackItUp\NBAgent.exe [1493288 2011-09-20] (Nero AG)

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [AdobeCS5.5ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe [1523360 2011-01-12] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [AntiLogger] => C:\Program Files (x86)\AntiLogger\AntiLogger.exe [14268328 2014-11-06] (Zemana Ltd.)

HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2014\avgui.exe [5188112 2014-12-16] (AVG Technologies CZ, s.r.o.)

HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2014-11-20] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [508800 2014-12-17] (Oracle Corporation)

HKU\S-1-5-21-2798733552-1552239651-28545706-1006 Group Policy restriction on software: %HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRoot% <====== ATTENTION

HKU\S-1-5-21-2798733552-1552239651-28545706-1006 Group Policy restriction on software: %HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir% <====== ATTENTION

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKU\S-1-5-21-2798733552-1552239651-28545706-1000\...\Run: [Xvid] => C:\Program Files (x86)\Xvid\CheckUpdate.exe [8192 2011-01-17] ()

HKU\S-1-5-21-2798733552-1552239651-28545706-1000\...\Run: [DAEMON Tools Pro Agent] => C:\Program Files (x86)\DAEMON Tools Pro\DTAgent.exe [3108480 2012-10-23] (DT Soft Ltd)

HKU\S-1-5-21-2798733552-1552239651-28545706-1000\...\Run: [AdobeBridge] => [X]

HKU\S-1-5-21-2798733552-1552239651-28545706-1000\...\Policies\system: [LogonHoursAction] 2

HKU\S-1-5-21-2798733552-1552239651-28545706-1000\...\Policies\system: [DontDisplayLogonHoursWarnings] 1

HKU\S-1-5-21-2798733552-1552239651-28545706-1000\...\MountPoints2: {24edd907-c5e2-11e2-9f54-002522df2e49} - H:\setup.exe

HKU\S-1-5-21-2798733552-1552239651-28545706-1000\...\MountPoints2: {27c791c0-c7b3-11e2-b5cc-806e6f6e6963} - F:\setup.exe

HKU\S-1-5-21-2798733552-1552239651-28545706-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\scrnsave.scr [11264 2009-07-14] (Microsoft Corporation)

HKU\S-1-5-21-2798733552-1552239651-28545706-1000.bak\...\Policies\system: [LogonHoursAction] 2

HKU\S-1-5-21-2798733552-1552239651-28545706-1000.bak\...\Policies\system: [DontDisplayLogonHoursWarnings] 1

HKU\S-1-5-21-2798733552-1552239651-28545706-1006\...\Policies\system: [LogonHoursAction] 2

HKU\S-1-5-21-2798733552-1552239651-28545706-1006\...\Policies\system: [DontDisplayLogonHoursWarnings] 1

HKU\S-1-5-21-2798733552-1552239651-28545706-1006\...\MountPoints2: {27c791c0-c7b3-11e2-b5cc-806e6f6e6963} - F:\setup.exe

SSODL-x32: 0aMCPClient - {F5DF91F9-15E9-416B-A7C3-7519B11ECBFC} -  No File

GroupPolicyUsers\S-1-5-21-2798733552-1552239651-28545706-1006\User: Group Policy restriction detected <======= ATTENTION
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKU\S-1-5-21-2798733552-1552239651-28545706-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/de-de/?pc=U270&ocid=U270DHP

HKU\S-1-5-21-2798733552-1552239651-28545706-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.chatzum.com/?q={searchTerms}

SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.chatzum.com/?q={searchTerms}

SearchScopes: HKU\S-1-5-21-2798733552-1552239651-28545706-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?FORM=U270DF&PC=U270&q={searchTerms}&src=IE-SearchBox

SearchScopes: HKU\S-1-5-21-2798733552-1552239651-28545706-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?FORM=U270DF&PC=U270&q={searchTerms}&src=IE-SearchBox

SearchScopes: HKU\S-1-5-21-2798733552-1552239651-28545706-1000 -> {5F0F0327-80EE-4263-8733-C92B7DCE6461} URL = https://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=926458&p={searchTerms}

SearchScopes: HKU\S-1-5-21-2798733552-1552239651-28545706-1000 -> {C0E80575-5F2E-4a99-9BF4-6540E02AEE59} URL = hxxp://www.google.com/custom?client=pub-3794288947762788&forid=1&channel=5480255188&ie=UTF-8&oe=UTF-8&safe=active&cof=GALT%3A%23008000%3BGL%3A1%3BDIV%3A%23336699%3BVLC%3A663399%3BAH%3Acenter%3BBGC%3AFFFFFF%3BLBGC%3A336699%3BALC%3A0000FF%3BLC%3A0000FF%3BT%3A000000%3BGFNT%3A0000FF%3BGIMP%3A0000FF%3BFORID%3A1&hl=de&q={searchTerms}

BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2015-02-10] (Microsoft Corporation)

BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll [2014-10-18] (Oracle Corporation)

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18] (Microsoft Corporation)

BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL [2014-01-23] (Microsoft Corporation)

BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2015-01-21] (Microsoft Corporation)

BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll [2014-10-18] (Oracle Corporation)

BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2015-02-10] (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-02-09] (Oracle Corporation)

BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18] (Microsoft Corporation)

BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL [2014-01-22] (Microsoft Corporation)

BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2015-01-21] (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-02-09] (Oracle Corporation)

Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2014-03-12] (Microsoft Corporation)

Handler-x32: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\3.2.0\ViProtocol.dll [2014-08-29] (AVG Secure Search)

Hosts: 127.0.0.1 activate.adobe.com

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
 

FireFox:

========

FF ProfilePath: C:\Users\X\AppData\Roaming\Mozilla\Firefox\Profiles\baat342e.default

FF DefaultSearchEngine: Yahoo!

FF SelectedSearchEngine: Yahoo!

FF Homepage: google.de

FF Keyword.URL: https://de.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=926458&p=

FF NetworkProxy: "backup.ftp", "62.81.176.0"

FF NetworkProxy: "backup.ftp_port", 1265

FF NetworkProxy: "backup.socks", "62.81.176.0"

FF NetworkProxy: "backup.socks_port", 1265

FF NetworkProxy: "backup.ssl", "62.81.176.0"

FF NetworkProxy: "backup.ssl_port", 1265

FF NetworkProxy: "ftp", "88.23.164.170"

FF NetworkProxy: "ftp_port", 8080

FF NetworkProxy: "share_proxy_settings", true

FF NetworkProxy: "socks", "88.23.164.170"

FF NetworkProxy: "socks_port", 8080

FF NetworkProxy: "ssl", "88.23.164.170"

FF NetworkProxy: "ssl_port", 8080

FF NetworkProxy: "type", 0

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_134.dll [2015-03-23] ()

FF Plugin: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll [2014-10-18] (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll [2014-10-18] (Oracle Corporation)

FF Plugin: @microsoft.com/GENUINE -> disabled No File

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)

FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)

FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll [2012-09-20] (Adobe Systems)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_134.dll [2015-03-23] ()

FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1213153.dll [2014-06-24] (Adobe Systems, Inc.)

FF Plugin-x32: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin -> C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\3.2.0\\npsitesafety.dll No File

FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-02-09] (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-02-09] (Oracle Corporation)

FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File

FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2013-10-17] (Microsoft Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-22] (Microsoft Corporation)

FF Plugin-x32: @Nero.com/KM -> C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL [2011-09-23] (Nero AG)

FF Plugin-x32: @videolan.org/vlc,version=2.0.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2012-12-13] (VideoLAN)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)

FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll [2012-09-20] (Adobe Systems)

FF Plugin HKU\S-1-5-21-2798733552-1552239651-28545706-1000: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Die Siedler 7\Data\Base\_Dbg\Bin\Release\orbit\npuplaypc.dll No File

FF user.js: detected! => C:\Users\Feisal\AppData\Roaming\Mozilla\Firefox\Profiles\baat342e.default\user.js [2014-05-21]

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2013-10-17] (Microsoft Corporation)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)

FF SearchPlugin: C:\Users\X\AppData\Roaming\Mozilla\Firefox\Profiles\baat342e.default\searchplugins\Ask.xml [2013-09-08]

FF SearchPlugin: C:\Users\X\AppData\Roaming\Mozilla\Firefox\Profiles\baat342e.default\searchplugins\avg-secure-search.xml [2014-10-07]

FF SearchPlugin: C:\Users\X\AppData\Roaming\Mozilla\Firefox\Profiles\baat342e.default\searchplugins\google-images.xml [2014-09-29]

FF SearchPlugin: C:\Users\X\AppData\Roaming\Mozilla\Firefox\Profiles\baat342e.default\searchplugins\google-maps.xml [2014-09-29]

FF SearchPlugin: C:\Users\X\AppData\Roaming\Mozilla\Firefox\Profiles\baat342e.default\searchplugins\s-amazon-de.xml [2012-01-20]

FF SearchPlugin: C:\Users\Feisal\AppData\Roaming\Mozilla\Firefox\Profiles\baat342e.default\searchplugins\skipity-search.xml [2012-03-08]

FF SearchPlugin: C:\Users\X\AppData\Roaming\Mozilla\Firefox\Profiles\baat342e.default\searchplugins\yahoo_ff.xml [2015-03-28]

FF SearchPlugin: C:\Users\X\AppData\Roaming\Mozilla\Firefox\Profiles\baat342e.default\searchplugins\zonealarm.xml [2014-05-21]

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\Ask.xml [2013-09-08]

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\wtu-secure-search.xml [2014-10-06]

FF Extension: Bitdefender QuickScan - C:\Users\Feisal\AppData\Roaming\Mozilla\Firefox\Profiles\baat342e.default\Extensions\{e001c731-5e37-4538-a5cb-8168736a2360} [2015-03-28]

FF Extension: MEGA - C:\Users\X\AppData\Roaming\Mozilla\Firefox\Profiles\baat342e.default\Extensions\firefox@mega.co.nz.xpi [2014-11-28]

FF Extension: Screengrab  (fix version) - C:\Users\Feisal\AppData\Roaming\Mozilla\Firefox\Profiles\baat342e.default\Extensions\{02450914-cdd9-410f-b1da-db004e18c671}.xpi [2014-12-10]

FF Extension: NoScript - C:\Users\X\AppData\Roaming\Mozilla\Firefox\Profiles\baat342e.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-10-30]

FF Extension: Video DownloadHelper - C:\Users\X\AppData\Roaming\Mozilla\Firefox\Profiles\baat342e.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}.xpi [2015-03-14]

FF HKU\S-1-5-21-2798733552-1552239651-28545706-1000\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff

FF HKU\S-1-5-21-2798733552-1552239651-28545706-1000\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\X\AppData\Roaming\Mozilla\Firefox\Profiles\baat342e.default\extensions\cliqz@cliqz.com

FF Extension: No Name - C:\Users\Feisal\AppData\Roaming\Mozilla\Firefox\Profiles\baat342e.default\extensions\avg@toolbar [Not Found]
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 avgfws; C:\Program Files (x86)\AVG\AVG2014\avgfws.exe [1417160 2014-12-16] (AVG Technologies CZ, s.r.o.)

R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe [3247120 2014-12-16] (AVG Technologies CZ, s.r.o.)

R2 avgwd; C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe [289328 2014-12-16] (AVG Technologies CZ, s.r.o.)

S3 Creative ALchemy AL6 Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [79360 2011-11-17] (Creative Labs) [File not signed]

S3 Creative Audio Engine Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [79360 2011-11-17] (Creative Labs) [File not signed]

R2 CTAudSvcService; C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe [307200 2009-02-23] (Creative Technology Ltd) [File not signed]

S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]

S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [1910640 2015-03-04] (Electronic Arts)

S3 Sound Blaster X-Fi MB Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\XMBLicensing.exe [79360 2011-11-17] (Creative Labs) [File not signed]

S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]

S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

S2 AntiVirWebService; "C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE" [X]

S3 OpenVPNService; "C:\Program Files (x86)\OkayFreedom\bin\openvpnserv.exe" [X]

S2 ZAPrivacyService; "C:\Program Files (x86)\CheckPoint\ZoneAlarm\ZAPrivacyService.exe" [X]
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R1 AntiLog32; C:\Windows\system32\drivers\AntiLog64.sys [49752 2014-11-08] (Zemana Ltd.)

R0 asahci64; C:\Windows\System32\DRIVERS\asahci64.sys [49760 2011-09-21] (Asmedia Technology)

R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [152344 2014-06-30] (AVG Technologies CZ, s.r.o.)

R1 Avgfwfd; C:\Windows\System32\DRIVERS\avgfwd6a.sys [57144 2013-09-26] (AVG Technologies CZ, s.r.o.)

R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [244504 2014-07-21] (AVG Technologies CZ, s.r.o.)

R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [190744 2014-06-17] (AVG Technologies CZ, s.r.o.)

R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [237848 2014-10-24] (AVG Technologies CZ, s.r.o.)

R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [328984 2014-06-17] (AVG Technologies CZ, s.r.o.)

R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [123672 2014-10-29] (AVG Technologies CZ, s.r.o.)

R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31512 2014-06-17] (AVG Technologies CZ, s.r.o.)

R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [269080 2014-10-20] (AVG Technologies CZ, s.r.o.)

R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [50976 2014-08-29] (AVG Technologies)

R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2013-05-28] (DT Soft Ltd)

S3 flashusb; C:\Windows\System32\DRIVERS\flashusb.sys [19968 2012-02-27] (Danish Wireless Design A/S)

S3 FNETTBOH_305; C:\Windows\System32\drivers\FNETTBOH_305.SYS [31808 2011-11-17] (FNet Co., Ltd.)

R1 FNETURPX; C:\Windows\System32\drivers\FNETURPX.SYS [15936 2011-11-17] (FNet Co., Ltd.)

S3 MEMSWEEP2; C:\Windows\system32\E95B.tmp [6144 2009-06-18] (Sophos Plc) [File not signed]

R0 sptd; C:\Windows\System32\Drivers\sptd.sys [564824 2013-05-28] (Duplex Secure Ltd.)

S3 ssudserd; C:\Windows\System32\DRIVERS\ssudserd.sys [204568 2013-08-20] (DEVGURU Co., LTD.(www.devguru.co.kr))

S1 StarOpen; C:\Windows\SysWow64\Drivers\StarOpen.sys [5632 2006-07-24] ()

S3 tun3326; C:\Windows\System32\DRIVERS\tun3326.sys [32368 2013-03-22] (The OpenVPN Project)

S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [52736 2012-04-25] (Apple, Inc.) [File not signed]

S3 usbrndis6; C:\Windows\System32\DRIVERS\usb80236.sys [19968 2013-02-12] (Microsoft Corporation)

U3 aaqrdla0; C:\Windows\System32\Drivers\aaqrdla0.sys [0 ] (Asmedia Technology) <==== ATTENTION (zero size file/folder)

S3 AsrCDDrv; \??\C:\Windows\SysWOW64\Drivers\AsrCDDrv.sys [X]

S0 iaStor; system32\DRIVERS\iaStor.sys [X]

S3 keycrypt; system32\DRIVERS\KeyCrypt64.sys [X]

S3 usbbus; system32\DRIVERS\lgx64bus.sys [X]

S3 UsbDiag; system32\DRIVERS\lgx64diag.sys [X]

S3 USBModem; system32\DRIVERS\lgx64modem.sys [X]

S3 VGPU; System32\drivers\rdvgkmd.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2015-03-28 21:04 - 2015-03-29 08:34 - 00000000 ____D () C:\FRST

2015-03-28 20:43 - 2015-03-28 20:44 - 00007473 _____ () C:\Users\X\Desktop\whocrashed.txt

2015-03-28 20:43 - 2015-03-28 20:43 - 00012310 _____ () C:\Users\X\Desktop\WhoCrashedOutput.htm

2015-03-28 19:56 - 2015-03-28 19:56 - 00002432 _____ () C:\Users\X\Desktop\RKreport_SCN_03282015_183221.log

2015-03-28 17:29 - 2015-03-28 17:29 - 00002807 _____ () C:\Users\X\Unigine_Heaven_Benchmark_4.0_20150328_1629.html

2015-03-28 17:23 - 2015-03-28 17:29 - 00000000 ____D () C:\Users\X\Heaven

2015-03-28 17:22 - 2015-03-28 17:22 - 01065984 _____ () C:\Users\X\AppData\Local\file__0.localstorage

2015-03-28 17:21 - 2015-03-28 17:21 - 00002117 _____ () C:\Users\Public\Desktop\Heaven Benchmark 4.0.lnk

2015-03-28 17:21 - 2015-03-28 17:21 - 00000000 ____D () C:\Program Files (x86)\Unigine

2015-03-28 16:48 - 2015-03-28 16:48 - 00000000 _____ () C:\Users\X\Desktop\Neues Textdokument.txt

2015-03-28 13:43 - 2015-03-29 08:22 - 00000000 ____D () C:\Program Files\WinToUSB

2015-03-28 13:07 - 2015-03-28 13:07 - 00000000 ____D () C:\Users\X\Downloads\Win7U_64

2015-03-28 11:28 - 2015-03-28 14:58 - 00000440 __RSH () C:\ProgramData\ntuser.pol

2015-03-28 10:29 - 2015-03-29 08:24 - 00037624 _____ () C:\Windows\system32\Drivers\TrueSight.sys

2015-03-28 10:29 - 2015-03-28 10:42 - 00000000 ____D () C:\ProgramData\RogueKiller

2015-03-28 10:12 - 2015-03-28 10:12 - 00000000 ____D () C:\Users\X\AppData\Roaming\Chip Digital GmbH

2015-03-28 09:19 - 2015-03-28 11:27 - 00000000 ____D () C:\Users\X\AppData\Roaming\QuickScan

2015-03-28 08:37 - 2015-03-28 15:23 - 00253628 _____ () C:\Windows\PFRO.log

2015-03-27 22:40 - 2015-03-27 22:40 - 00000000 ____D () C:\Users\X\AppData\Roaming\com.ohnoo.Tormentum

2015-03-27 20:50 - 2015-03-27 22:41 - 00000000 ____D () C:\Program Files (x86)\Tormentum

2015-03-27 20:50 - 2015-03-27 20:50 - 00001097 _____ () C:\Users\Public\Desktop\Tormentum.lnk

2015-03-27 10:13 - 2015-03-27 10:13 - 00001102 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2015-03-27 09:12 - 2015-03-29 08:18 - 00000784 _____ () C:\Windows\setupact.log

2015-03-27 09:12 - 2015-03-27 09:12 - 00000000 _____ () C:\Windows\setuperr.log

2015-03-26 20:53 - 2015-03-26 20:53 - 00000000 ____D () C:\Program Files\Intel

2015-03-26 20:26 - 2015-03-01 11:41 - 00287344 _____ () C:\Windows\Minidump\030115-45068-01.dmp

2015-03-26 20:26 - 2015-03-01 08:56 - 00287348 _____ () C:\Windows\Minidump\030115-90714-01.dmp

2015-03-26 19:55 - 2015-03-28 20:41 - 00000000 ____D () C:\Program Files\WhoCrashed

2015-03-26 19:55 - 2015-03-26 19:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WhoCrashed

2015-03-26 17:10 - 2015-03-26 17:10 - 00000000 ____D () C:\Windows\SysWOW64\Atheros_L1e

2015-03-25 00:35 - 2015-03-25 01:03 - 00003169 _____ () C:\Users\X\Desktop\Opfer.txt

2015-03-24 20:15 - 2015-03-24 20:15 - 00000000 ____D () C:\Users\X\AppData\Roaming\Schein

2015-03-24 20:15 - 2015-03-24 20:15 - 00000000 ____D () C:\Users\X\AppData\Local\Schein

2015-03-24 16:41 - 2010-08-24 18:55 - 00076912 _____ (Atheros Communications, Inc.) C:\Windows\system32\Drivers\L1C62x64.sys

2015-03-23 22:42 - 2015-03-23 22:43 - 00000000 ____D () C:\Users\X\Downloads\Johan.und.der.Federkoenig.2014.German.DL.PAL.DVDR-ETM

2015-03-23 15:42 - 2015-03-23 15:42 - 00000000 ____D () C:\Users\X\Downloads\Der.Lorax.2012.German.DTS.DL.1080p.BluRay.x264-LeetHD

2015-03-23 09:37 - 2015-03-23 09:37 - 00000000 _____ () C:\Users\X\Desktop\Neues Textdokument (3).txt

2015-03-22 09:11 - 2015-03-22 09:11 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2015-03-21 11:16 - 2015-03-28 20:39 - 00000000 ____D () C:\Users\X\Desktop\Minidump

2015-03-11 08:32 - 2015-02-20 06:41 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll

2015-03-11 08:32 - 2015-02-20 06:40 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll

2015-03-11 08:32 - 2015-02-20 06:40 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll

2015-03-11 08:32 - 2015-02-20 06:40 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll

2015-03-11 08:32 - 2015-02-20 06:13 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll

2015-03-11 08:32 - 2015-02-20 06:13 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll

2015-03-11 08:32 - 2015-02-20 06:13 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll

2015-03-11 08:32 - 2015-02-20 06:12 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll

2015-03-11 08:32 - 2015-02-20 05:29 - 00372224 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll

2015-03-11 08:32 - 2015-02-20 05:09 - 00299008 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll

2015-03-11 08:32 - 2015-02-03 05:34 - 05554104 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2015-03-11 08:32 - 2015-02-03 05:34 - 00693176 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi

2015-03-11 08:32 - 2015-02-03 05:34 - 00094656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys

2015-03-11 08:32 - 2015-02-03 05:33 - 00616360 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi

2015-03-11 08:32 - 2015-02-03 05:31 - 14632960 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll

2015-03-11 08:32 - 2015-02-03 05:31 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll

2015-03-11 08:32 - 2015-02-03 05:31 - 01574400 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll

2015-03-11 08:32 - 2015-02-03 05:31 - 01424896 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll

2015-03-11 08:32 - 2015-02-03 05:31 - 00782848 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmsdk.dll

2015-03-11 08:32 - 2015-02-03 05:31 - 00641024 _____ (Microsoft Corporation) C:\Windows\system32\msscp.dll

2015-03-11 08:32 - 2015-02-03 05:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll

2015-03-11 08:32 - 2015-02-03 05:31 - 00500224 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll

2015-03-11 08:32 - 2015-02-03 05:31 - 00432128 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll

2015-03-11 08:32 - 2015-02-03 05:31 - 00371712 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll

2015-03-11 08:32 - 2015-02-03 05:31 - 00325632 _____ (Microsoft Corporation) C:\Windows\system32\msnetobj.dll

2015-03-11 08:32 - 2015-02-03 05:31 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll

2015-03-11 08:32 - 2015-02-03 05:31 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll

2015-03-11 08:32 - 2015-02-03 05:31 - 00188416 _____ (Microsoft Corporation) C:\Windows\system32\pcasvc.dll

2015-03-11 08:32 - 2015-02-03 05:31 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll

2015-03-11 08:32 - 2015-02-03 05:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll

2015-03-11 08:32 - 2015-02-03 05:31 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\pcadm.dll

2015-03-11 08:32 - 2015-02-03 05:31 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msmmsp.dll

2015-03-11 08:32 - 2015-02-03 05:30 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll

2015-03-11 08:32 - 2015-02-03 05:30 - 01202176 _____ (Microsoft Corporation) C:\Windows\system32\drmv2clt.dll

2015-03-11 08:32 - 2015-02-03 05:30 - 01069056 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll

2015-03-11 08:32 - 2015-02-03 05:30 - 00842240 _____ (Microsoft Corporation) C:\Windows\system32\blackbox.dll

2015-03-11 08:32 - 2015-02-03 05:30 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll

2015-03-11 08:32 - 2015-02-03 05:30 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll

2015-03-11 08:32 - 2015-02-03 05:30 - 00497664 _____ (Microsoft Corporation) C:\Windows\system32\drmmgrtn.dll

2015-03-11 08:32 - 2015-02-03 05:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll

2015-03-11 08:32 - 2015-02-03 05:30 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe

2015-03-11 08:32 - 2015-02-03 05:30 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll

2015-03-11 08:32 - 2015-02-03 05:30 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll

2015-03-11 08:32 - 2015-02-03 05:30 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll

2015-03-11 08:32 - 2015-02-03 05:30 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe

2015-03-11 08:32 - 2015-02-03 05:30 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll

2015-03-11 08:32 - 2015-02-03 05:30 - 00126464 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe

2015-03-11 08:32 - 2015-02-03 05:30 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe

2015-03-11 08:32 - 2015-02-03 05:30 - 00082432 _____ (Microsoft Corporation) C:\Windows\system32\cryptsp.dll

2015-03-11 08:32 - 2015-02-03 05:30 - 00058880 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll

2015-03-11 08:32 - 2015-02-03 05:30 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe

2015-03-11 08:32 - 2015-02-03 05:30 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll

2015-03-11 08:32 - 2015-02-03 05:30 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll

2015-03-11 08:32 - 2015-02-03 05:30 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe

2015-03-11 08:32 - 2015-02-03 05:30 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe

2015-03-11 08:32 - 2015-02-03 05:30 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\pcawrk.exe

2015-03-11 08:32 - 2015-02-03 05:30 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\pcalua.exe

2015-03-11 08:32 - 2015-02-03 05:19 - 00663552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\PEAuth.sys

2015-03-11 08:32 - 2015-02-03 05:16 - 03973048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe

2015-03-11 08:32 - 2015-02-03 05:16 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe

2015-03-11 08:32 - 2015-02-03 05:12 - 11411968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll

2015-03-11 08:32 - 2015-02-03 05:12 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll

2015-03-11 08:32 - 2015-02-03 05:12 - 01329664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\quartz.dll

2015-03-11 08:32 - 2015-02-03 05:12 - 01230848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll

2015-03-11 08:32 - 2015-02-03 05:12 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll

2015-03-11 08:32 - 2015-02-03 05:12 - 01005056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptui.dll

2015-03-11 08:32 - 2015-02-03 05:12 - 00988160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmv2clt.dll

2015-03-11 08:32 - 2015-02-03 05:12 - 00744960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\blackbox.dll

2015-03-11 08:32 - 2015-02-03 05:12 - 00617984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmdrmsdk.dll

2015-03-11 08:32 - 2015-02-03 05:12 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll

2015-03-11 08:32 - 2015-02-03 05:12 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscp.dll

2015-03-11 08:32 - 2015-02-03 05:12 - 00489984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\evr.dll

2015-03-11 08:32 - 2015-02-03 05:12 - 00442880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll

2015-03-11 08:32 - 2015-02-03 05:12 - 00406016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmmgrtn.dll

2015-03-11 08:32 - 2015-02-03 05:12 - 00374784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll

2015-03-11 08:32 - 2015-02-03 05:12 - 00354816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfplat.dll

2015-03-11 08:32 - 2015-02-03 05:12 - 00265216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msnetobj.dll

2015-03-11 08:32 - 2015-02-03 05:12 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll

2015-03-11 08:32 - 2015-02-03 05:12 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll

2015-03-11 08:32 - 2015-02-03 05:12 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll

2015-03-11 08:32 - 2015-02-03 05:12 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll

2015-03-11 08:32 - 2015-02-03 05:12 - 00103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll

2015-03-11 08:32 - 2015-02-03 05:12 - 00081408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsp.dll

2015-03-11 08:32 - 2015-02-03 05:12 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll

2015-03-11 08:32 - 2015-02-03 05:12 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll

2015-03-11 08:32 - 2015-02-03 05:11 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe

2015-03-11 08:32 - 2015-02-03 05:11 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe

2015-03-11 08:32 - 2015-02-03 04:32 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys

2015-03-11 08:32 - 2014-11-01 00:24 - 00619056 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe

2015-03-11 08:31 - 2015-02-03 05:31 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll

2015-03-11 08:31 - 2015-02-03 05:31 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx

2015-03-11 08:31 - 2015-02-03 05:31 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll

2015-03-11 08:31 - 2015-02-03 05:30 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL

2015-03-11 08:31 - 2015-02-03 05:29 - 00008704 _____ (Microsoft Corporation) C:\Windows\system32\pcaevts.dll

2015-03-11 08:31 - 2015-02-03 05:28 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll

2015-03-11 08:31 - 2015-02-03 05:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll

2015-03-11 08:31 - 2015-02-03 05:12 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll

2015-03-11 08:31 - 2015-02-03 05:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx

2015-03-11 08:31 - 2015-02-03 05:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll

2015-03-11 08:31 - 2015-02-03 05:11 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL

2015-03-11 08:31 - 2015-02-03 05:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll

2015-03-11 08:31 - 2015-02-03 05:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll

2015-03-11 08:30 - 2015-03-06 07:56 - 00155576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys

2015-03-11 08:30 - 2015-03-06 07:56 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys

2015-03-11 08:30 - 2015-03-06 07:42 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll

2015-03-11 08:30 - 2015-03-06 07:42 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll

2015-03-11 08:30 - 2015-03-06 07:42 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll

2015-03-11 08:30 - 2015-03-06 07:42 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll

2015-03-11 08:30 - 2015-03-06 07:42 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll

2015-03-11 08:30 - 2015-03-06 07:42 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll

2015-03-11 08:30 - 2015-03-06 07:42 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll

2015-03-11 08:30 - 2015-03-06 07:42 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll

2015-03-11 08:30 - 2015-03-06 07:42 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll

2015-03-11 08:30 - 2015-03-06 07:42 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll

2015-03-11 08:30 - 2015-03-06 07:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll

2015-03-11 08:30 - 2015-03-06 07:41 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe

2015-03-11 08:30 - 2015-03-06 07:41 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe

2015-03-11 08:30 - 2015-03-06 07:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll

2015-03-11 08:30 - 2015-03-06 07:38 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll

2015-03-11 08:30 - 2015-03-06 07:36 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll

2015-03-11 08:30 - 2015-03-06 07:10 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll

2015-03-11 08:30 - 2015-03-06 07:10 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll

2015-03-11 08:30 - 2015-03-06 07:10 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll

2015-03-11 08:30 - 2015-03-06 07:10 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll

2015-03-11 08:30 - 2015-03-06 07:10 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll

2015-03-11 08:30 - 2015-03-06 07:10 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll

2015-03-11 08:30 - 2015-03-06 07:10 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll

2015-03-11 08:30 - 2015-03-06 07:10 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll

2015-03-11 08:30 - 2015-03-06 07:09 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll

2015-03-11 08:30 - 2015-03-06 07:09 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe

2015-03-11 08:30 - 2015-03-06 07:07 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll

2015-03-11 08:30 - 2015-03-06 07:07 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll

2015-03-11 08:30 - 2015-03-06 07:06 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll

2015-03-11 08:30 - 2015-02-13 07:26 - 12875264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll

2015-03-11 08:30 - 2015-02-13 07:22 - 14177280 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll

2015-03-11 08:30 - 2015-02-03 05:31 - 00215552 _____ (Microsoft Corporation) C:\Windows\system32\ubpm.dll

2015-03-11 08:30 - 2015-02-03 05:12 - 00171520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ubpm.dll

2015-03-11 08:30 - 2015-01-31 01:56 - 00459336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys

2015-03-11 08:29 - 2015-01-17 04:48 - 01067520 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll

2015-03-11 08:29 - 2015-01-17 04:30 - 00828928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msctf.dll

2015-03-11 08:28 - 2015-02-26 05:25 - 03204096 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2015-03-11 08:28 - 2015-02-24 05:15 - 00389800 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2015-03-11 08:28 - 2015-02-24 04:32 - 00342696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2015-03-11 08:28 - 2015-02-21 03:16 - 25021440 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2015-03-11 08:28 - 2015-02-21 02:41 - 12827648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2015-03-11 08:28 - 2015-02-21 02:27 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2015-03-11 08:28 - 2015-02-21 02:27 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2015-03-11 08:28 - 2015-02-21 02:25 - 19720192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2015-03-11 08:28 - 2015-02-21 01:58 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2015-03-11 08:28 - 2015-02-21 01:32 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2015-03-11 08:28 - 2015-02-20 05:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2015-03-11 08:28 - 2015-02-20 05:05 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2015-03-11 08:28 - 2015-02-20 04:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2015-03-11 08:28 - 2015-02-20 04:49 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2015-03-11 08:28 - 2015-02-20 04:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2015-03-11 08:28 - 2015-02-20 04:48 - 02886144 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2015-03-11 08:28 - 2015-02-20 04:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2015-03-11 08:28 - 2015-02-20 04:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2015-03-11 08:28 - 2015-02-20 04:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2015-03-11 08:28 - 2015-02-20 04:36 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2015-03-11 08:28 - 2015-02-20 04:35 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2015-03-11 08:28 - 2015-02-20 04:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2015-03-11 08:28 - 2015-02-20 04:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2015-03-11 08:28 - 2015-02-20 04:32 - 06035456 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2015-03-11 08:28 - 2015-02-20 04:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2015-03-11 08:28 - 2015-02-20 04:22 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2015-03-11 08:28 - 2015-02-20 04:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2015-03-11 08:28 - 2015-02-20 04:13 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2015-03-11 08:28 - 2015-02-20 04:09 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2015-03-11 08:28 - 2015-02-20 04:08 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2015-03-11 08:28 - 2015-02-20 04:08 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2015-03-11 08:28 - 2015-02-20 04:08 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2015-03-11 08:28 - 2015-02-20 04:06 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll

2015-03-11 08:28 - 2015-02-20 04:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2015-03-11 08:28 - 2015-02-20 04:03 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2015-03-11 08:28 - 2015-02-20 04:01 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2015-03-11 08:28 - 2015-02-20 04:00 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2015-03-11 08:28 - 2015-02-20 03:58 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2015-03-11 08:28 - 2015-02-20 03:56 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2015-03-11 08:28 - 2015-02-20 03:56 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2015-03-11 08:28 - 2015-02-20 03:49 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2015-03-11 08:28 - 2015-02-20 03:49 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2015-03-11 08:28 - 2015-02-20 03:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2015-03-11 08:28 - 2015-02-20 03:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2015-03-11 08:28 - 2015-02-20 03:43 - 14398976 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2015-03-11 08:28 - 2015-02-20 03:41 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2015-03-11 08:28 - 2015-02-20 03:37 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2015-03-11 08:28 - 2015-02-20 03:30 - 04300288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2015-03-11 08:28 - 2015-02-20 03:28 - 02358784 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2015-03-11 08:28 - 2015-02-20 03:24 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2015-03-11 08:28 - 2015-02-20 03:24 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2015-03-11 08:28 - 2015-02-20 03:23 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2015-03-11 08:28 - 2015-02-20 03:16 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2015-03-11 08:28 - 2015-02-20 03:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2015-03-11 08:28 - 2015-02-20 03:01 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2015-03-11 08:28 - 2015-02-20 02:57 - 01311232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2015-03-11 08:28 - 2015-02-20 02:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2015-03-11 08:28 - 2015-01-31 05:48 - 01113088 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll

2015-03-11 08:28 - 2015-01-31 05:05 - 00162816 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll

2015-03-11 08:28 - 2015-01-31 05:04 - 00020992 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpvideominiport.sys

2015-03-11 08:17 - 2015-02-04 05:16 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll

2015-03-11 08:17 - 2015-02-04 04:54 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll

2015-03-07 23:05 - 2015-03-07 23:05 - 00000000 ____D () C:\Users\X\Documents\DyingLight

2015-03-05 21:05 - 2015-03-05 21:05 - 00000000 ____D () C:\Users\X\AppData\Local\Neckbolt

2015-03-05 21:04 - 2015-03-05 21:05 - 00000000 ____D () C:\Program Files (x86)\Belladonna

2015-03-05 08:47 - 2015-03-05 08:47 - 00001083 _____ () C:\Users\Public\Desktop\Apotheon.lnk

2015-03-05 08:46 - 2015-03-05 22:24 - 00000000 ____D () C:\Program Files (x86)\Apotheon

2015-03-04 17:19 - 2015-03-04 17:22 - 00000000 ____D () C:\Users\X

\Documents\FIFA 15

2015-02-28 09:04 - 2015-02-28 09:18 - 00000000 ____D () C:\Users\X\Downloads\Dragonball.Xenoverse
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2015-03-29 08:34 - 2015-01-28 08:45 - 00000000 ____D () C:\Users\X\Downloads\New Loads

2015-03-29 08:34 - 2011-11-17 21:07 - 01718833 _____ () C:\Windows\WindowsUpdate.log

2015-03-29 08:28 - 2014-08-20 09:48 - 00000000 ____D () C:\Users\X\AppData\Local\Adobe

2015-03-29 08:28 - 2011-11-17 23:26 - 00000000 ____D () C:\ProgramData\MFAData

2015-03-29 08:23 - 2011-11-18 00:39 - 00700978 _____ () C:\Windows\system32\perfh007.dat

2015-03-29 08:23 - 2011-11-18 00:39 - 00150390 _____ () C:\Windows\system32\perfc007.dat

2015-03-29 08:23 - 2009-07-14 07:13 - 01629772 _____ () C:\Windows\system32\PerfStringBackup.INI

2015-03-29 08:18 - 2012-01-04 14:35 - 00000266 _____ () C:\Windows\Tasks\AutoKMS.job

2015-03-29 08:18 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2015-03-28 23:17 - 2011-11-23 19:52 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2015-03-28 20:42 - 2013-02-14 20:51 - 00000000 ____D () C:\Windows\Minidump

2015-03-28 17:36 - 2012-08-16 23:13 - 00000000 ____D () C:\Program Files (x86)\HIS iTurbo

2015-03-28 17:29 - 2011-11-17 21:06 - 00000000 ____D () C:\Users\X

2015-03-28 15:12 - 2014-03-23 01:45 - 00000000 ____D () C:\Users\X\AppData\Local\JDownloader 2.0

2015-03-28 11:28 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\GroupPolicy

2015-03-28 10:53 - 2012-01-11 20:43 - 00000000 __SHD () C:\Users\X\AppData\Local\{75518ca9-6410-5815-b974-a366e7a074cb}

2015-03-28 09:09 - 2013-07-04 18:58 - 01600624 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI

2015-03-28 08:52 - 2011-11-18 04:00 - 00287348 ____N () C:\Windows\Minidump\032815-49109-01.dmp

2015-03-27 23:45 - 2009-07-14 06:45 - 00031296 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2015-03-27 23:45 - 2009-07-14 06:45 - 00031296 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2015-03-27 20:49 - 2013-05-28 18:15 - 00000000 ____D () C:\Users\X\AppData\Roaming\DAEMON Tools Pro

2015-03-27 20:17 - 2013-01-26 01:56 - 00000000 ____D () C:\Users\X\AppData\Roaming\vlc

2015-03-27 18:11 - 2013-01-31 18:26 - 00000000 ____D () C:\Users\X\AppData\Roaming\dvdcss

2015-03-27 13:48 - 2011-11-17 23:21 - 00000000 ____D () C:\Users\X\AppData\Roaming\Winamp

2015-03-27 13:05 - 2013-05-04 19:51 - 00000121 _____ () C:\Users\Public\LMDebug.log

2015-03-27 11:09 - 2014-05-26 09:23 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2015-03-27 10:13 - 2014-05-26 09:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2015-03-27 10:13 - 2014-05-26 09:23 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2015-03-27 09:33 - 2011-11-18 04:00 - 00287348 ____N () C:\Windows\Minidump\032715-56519-01.dmp

2015-03-26 20:53 - 2014-03-19 18:12 - 00000000 ____D () C:\ProgramData\Package Cache

2015-03-26 19:26 - 2013-09-08 09:36 - 00000000 ____D () C:\Program Files (x86)\PDFCreator

2015-03-26 19:26 - 2012-05-23 19:40 - 00000000 ____D () C:\Program Files (x86)\Steam

2015-03-26 19:25 - 2011-10-10 18:18 - 00000000 ____D () C:\Windows\Panther

2015-03-26 17:10 - 2011-11-17 21:39 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information

2015-03-25 10:54 - 2015-02-17 00:28 - 00000000 ____D () C:\Users\X\AppData\Roaming\Music Editor Free

2015-03-24 10:08 - 2012-10-18 09:20 - 00000000 ____D () C:\Fraps

2015-03-24 10:08 - 2011-11-26 23:40 - 00000000 ____D () C:\Program Files (x86)\Ubisoft

2015-03-24 09:55 - 2011-11-17 21:59 - 00118176 _____ () C:\Users\Feisal\AppData\Local\GDIPFONTCACHEV1.DAT

2015-03-24 09:54 - 2009-07-14 06:45 - 05006584 _____ () C:\Windows\system32\FNTCACHE.DAT

2015-03-24 09:50 - 2015-01-30 20:32 - 00000009 _____ () C:\Windows\ULEAD32.INI

2015-03-24 08:38 - 2009-07-14 07:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD

2015-03-23 08:44 - 2011-11-23 19:52 - 00778928 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2015-03-23 08:44 - 2011-11-23 19:52 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2015-03-23 08:44 - 2011-11-18 01:04 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2015-03-23 08:35 - 2012-09-04 19:11 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

2015-03-21 11:37 - 2014-05-24 01:10 - 00000000 ____D () C:\Program Files\CyberGhost 5

2015-03-19 22:46 - 2015-02-05 09:05 - 00000000 ____D () C:\Users\X.Venice

2015-03-19 22:46 - 2014-11-12 14:45 - 00000000 ____D () C:\Users\Guest

2015-03-19 22:46 - 2014-06-05 12:26 - 00000000 ____D () C:\Users\Login

2015-03-17 20:17 - 2014-07-01 11:28 - 00000000 ____D () C:\Users\X\Documents\Scan

2015-03-17 16:12 - 2013-05-06 13:51 - 00000000 ____D () C:\ProgramData\boost_interprocess

2015-03-12 15:17 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache

2015-03-12 08:16 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism

2015-03-12 08:15 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\Dism

2015-03-12 00:31 - 2013-05-28 13:44 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013

2015-03-12 00:31 - 2011-11-17 22:24 - 00000000 ____D () C:\ProgramData\Microsoft Help

2015-03-12 00:19 - 2009-07-14 04:34 - 00000565 _____ () C:\Windows\win.ini

2015-03-12 00:17 - 2013-07-16 15:32 - 00000000 ____D () C:\Windows\system32\MRT

2015-03-12 00:12 - 2014-06-20 01:00 - 122905848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2015-03-06 16:55 - 2013-05-06 13:51 - 00000000 ____D () C:\Users\X\Documents\Scannen

2015-03-05 10:49 - 2013-07-27 01:45 - 00000000 ____D () C:\Users\X\Documents\Benutzerdefinierte Office-Vorlagen

2015-03-04 17:18 - 2011-12-24 00:33 - 00000000 ____D () C:\ProgramData\Origin

2015-03-04 17:18 - 2011-12-24 00:33 - 00000000 ____D () C:\Program Files (x86)\Origin

2015-02-27 08:56 - 2009-07-14 07:08 - 00032608 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
 

==================== Files in the root of some directories =======
 

2014-06-10 15:45 - 2015-01-12 09:49 - 0000132 _____ () C:\Users\X\AppData\Roaming\Adobe BMP Format CS5 Prefs

2012-07-14 22:00 - 2015-02-16 09:59 - 0000132 _____ () C:\Users\X\AppData\Roaming\Adobe PNG Format CS5 Prefs

2012-10-18 09:11 - 2012-10-28 12:37 - 0018910 _____ () C:\Users\X\AppData\Roaming\fefe

2012-10-28 13:54 - 2012-10-28 13:54 - 1169224 _____ (Microsoft Corporation) C:\Users\X\AppData\Roaming\T8WPAKPUI7.exe

2015-03-28 17:22 - 2015-03-28 17:22 - 1065984 _____ () C:\Users\X\AppData\Local\file__0.localstorage

2014-05-29 14:14 - 2014-05-29 14:14 - 0001223 _____ () C:\Users\X\AppData\Local\recently-used.xbel

2013-07-08 08:27 - 2014-05-28 09:02 - 0007605 _____ () C:\Users\X\AppData\Local\resmon.resmoncfg

2013-01-20 18:18 - 2014-02-19 12:43 - 0000000 _____ () C:\ProgramData\LauncherAccess.dt

2012-04-19 00:15 - 2012-04-19 00:15 - 2097590 _____ () C:\ProgramData\SPL19E6.tmp

2012-04-19 00:40 - 2012-04-19 00:40 - 4736838 _____ () C:\ProgramData\SPL57F3.tmp
 

Some content of TEMP:

====================

C:\Users\X\AppData\Local\Temp\7z920.exe

C:\Users\X\AppData\Local\Temp\CH.dll

C:\Users\X\AppData\Local\Temp\Copy.dll

C:\Users\X\AppData\Local\Temp\dllnt_dump.dll

C:\Users\X\AppData\Local\Temp\drm_dialogs.dll

C:\Users\X\AppData\Local\Temp\DseShExt-x64.dll

C:\Users\X\AppData\Local\Temp\DseShExt-x86.dll

C:\Users\X\AppData\Local\Temp\HitmanPro.exe

C:\Users\X\AppData\Local\Temp\ICReinstall_FreeYouTubeToMP3Converter.exe

C:\Users\X\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe

C:\Users\X\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exe

C:\Users\X\AppData\Local\Temp\Kickstarter.exe

C:\Users\X\AppData\Local\Temp\PidGenX.dll

C:\Users\X\AppData\Local\Temp\proxy_vole8216552691486519215.dll

C:\Users\X\AppData\Local\Temp\raptr_stub.exe

C:\Users\X\AppData\Local\Temp\SDShelEx-win32.dll

C:\Users\X\AppData\Local\Temp\SDShelEx-x64.dll

C:\Users\X\AppData\Local\Temp\tmd_34011087.exe

C:\Users\X\AppData\Local\Temp\tmd_34017743.exe

C:\Users\X\AppData\Local\Temp\tmd_34018483.exe

C:\Users\X\AppData\Local\Temp\tmp55CC.exe

C:\Users\X\AppData\Local\Temp\tmp6C7E.exe

C:\Users\X\AppData\Local\Temp\tmp983E.exe

C:\Users\X\AppData\Local\Temp\tmpBAE.exe

C:\Users\X\AppData\Local\Temp\uninst1.exe

C:\Users\X\AppData\Local\Temp\Uninstall.exe

C:\Users\X\AppData\Local\Temp\WatermarkImageSetup.3.4.2.6.exe

C:\Users\X\AppData\Local\Temp\ZAL4894.exe

C:\Users\X\AppData\Local\Temp\ZALD6B7.exe
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2015-03-25 14:58
 

==================== End Of Log ============================

--- --- ---

--- --- ---

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-03-2015

Ran by X at 2015-03-29 08:35:34

Running from C:\Users\X\Downloads\New Loads

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

(If an entry is included in the fixlist, it will be removed.)
 

AV: AVG Internet Security 2014 (Enabled - Up to date) {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}

AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: AVG Internet Security 2014 (Enabled - Up to date) {B5F5C120-2089-702E-0001-553BB0D5A664}

FW: AVG Internet Security 2014 (Enabled) {36AFA1E1-4CDC-7EF8-11EE-C77C3581ABA2}
 

==================== Installed Programs ======================
 

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.1.0.4880 - Adobe Systems Incorporated)

Adobe Community Help (HKLM-x32\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 3.4.980 - Adobe Systems Incorporated.)

Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.305 - Adobe Systems Incorporated)

Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.134 - Adobe Systems Incorporated)

Adobe Photoshop CS5.1 (HKLM-x32\...\{9158FF30-78D7-40EF-B83E-451AC5334640}) (Version: 12.1 - Adobe Systems Incorporated)

Adobe Reader X (10.1.13) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.13 - Adobe Systems Incorporated)

Adobe Shockwave Player 12.1 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.1.3.153 - Adobe Systems, Inc.)

AMD Catalyst Install Manager (HKLM\...\{F2A7CE36-57BF-5C86-952D-90DBF3746D82}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.)

AntiLogger (HKLM-x32\...\AntiLogger) (Version:  - Zemana Ltd.)

AntiLogger (x32 Version: 1.9.3.527 - Zemana Ltd.) Hidden

Apotheon (HKLM-x32\...\Apotheon_is1) (Version:  - Alientrap)

Application Profiles (x32 Version: 2.0.4331.36041 - Ihr Firmenname) Hidden

Asmedia ASM106x SATA Host Controller Driver (HKLM-x32\...\{61942EF5-2CD8-47D4-869C-2E9A8BB085F1}) (Version: 1.3.1.000 - Asmedia Technology)

ASRock App Charger v1.0.4 (HKLM\...\ASRock App Charger_is1) (Version:  - ASRock Inc.)

Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 1.0.0.35 - Atheros Communications Inc.)

AVG 2014 (HKLM\...\AVG) (Version: 2014.0.4800 - AVG Technologies)

AVG 2014 (Version: 14.0.4311 - AVG Technologies) Hidden

AVG 2014 (Version: 14.0.4800 - AVG Technologies) Hidden

AVG Web TuneUp (HKLM-x32\...\AVG Web TuneUp) (Version: 3.2.0.18 - AVG Technologies)

AVS Audio Editor 7.3 (HKLM-x32\...\AVS Audio Editor_is1) (Version: 7.3.1.493 - Online Media Technologies Ltd.)

Belladonna (HKLM-x32\...\Belladonna_is1) (Version:  - Neckbolt)

CCleaner (HKLM\...\CCleaner) (Version: 4.02 - Piriform)

Common Desktop Agent (Version: 1.62.0 - OEM) Hidden

DAEMON Tools Pro (HKLM-x32\...\DAEMON Tools Pro) (Version: 5.2.0.0348 - DT Soft Ltd)

Dark Souls Prepare to Die Edition (HKLM-x32\...\GFWL_{4E4D0FA1-F880-4CCB-999A-501000008200}) (Version: 1.0.0000.130 - NAMCO BANDAI Games Europe S.A.S.)

Dark Souls Prepare to Die Edition (x32 Version: 1.0.0000.130 - NAMCO BANDAI Games Europe S.A.S.) Hidden

Dark Souls Prepare to Die Edition (x32 Version: 1.0.0002.130 - NAMCO BANDAI Games Europe S.A.S.) Hidden

Dark Souls: Prepare to Die Edition (HKLM-x32\...\Steam App 211420) (Version:  - )

DARK SOULS™ II (HKLM-x32\...\Steam App 236430) (Version:  - FromSoftware, Inc)

EVEREST Ultimate Edition v5.50 (HKLM-x32\...\EVEREST Ultimate Edition_is1) (Version: 5.50 - Lavalys, Inc.)

FLV Player 2.0 (build 25) (HKLM-x32\...\FLV Player) (Version: 2.0 (build 25) - Martijn de Visser)

Free Studio version 6.5.0.219 (HKLM-x32\...\Free Studio_is1) (Version: 6.5.0.219 - DVDVideoSoft Ltd.)

Free Video Editor version 1.4.0.530 (HKLM-x32\...\Free Video Editor_is1) (Version: 1.4.0.530 - DVDVideoSoft Ltd.)

Free YouTube to MP3 Converter version 3.12.35.514 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.35.514 - DVDVideoSoft Ltd.)

Heaven Benchmark version 4.0 (HKLM-x32\...\Unigine Heaven Benchmark (Basic Edition)_is1) (Version: 4.0 - Unigine Corp.)

High-Definition Video Playback (x32 Version: 11.1.10400.2.65 - Nero AG) Hidden

iDRS(tm) OCR Software by I.R.I.S (HKLM-x32\...\iDRS(tm) OCR Software by I.R.I.S) (Version: 1.00.17 (17.04.2012) - Samsung Electronics Co., Ltd.)

IESnap (HKLM-x32\...\IESnap) (Version: 1.2 - Tonec Inc)

Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.1.21.1134 - Intel Corporation)

Intel(R) OpenCL CPU Runtime (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version:  - Intel Corporation)

Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2761 - Intel Corporation)

Intel® Chipsatz-Gerätesoftware (x32 Version: 10.0.26 - Intel(R) Corporation) Hidden

Java 7 Update 71 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F06417071FF}) (Version: 7.0.710 - Oracle)

Java 7 Update 72 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217072FF}) (Version: 7.0.720 - Oracle)

Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)

Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)

JavaFX 2.1.0 (HKLM-x32\...\{1111706F-666A-4037-7777-210328764D10}) (Version: 2.1.0 - Oracle Corporation)

JDownloader 0.9 (HKLM-x32\...\5513-1208-7298-9440) (Version: 0.9 - AppWork GmbH)

JDownloader 2 (HKLM\...\jdownloader2) (Version: 2.0 - AppWork GmbH)

K-Lite Codec Pack 8.9.2 (Basic) (HKLM-x32\...\KLiteCodecPack_is1) (Version: 8.9.2 - )

Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)

MediaInfo 0.7.61 (HKLM\...\MediaInfo) (Version: 0.7.61 - MediaArea.net)

Microsoft .NET Framework 4.5.2 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.51209 - Microsoft Corporation)

Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)

Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{832D9DE0-8AFC-4689-9819-4DBBDEBD3E4F}) (Version: 3.5.92.0 - Microsoft Corporation)

Microsoft Games for Windows Marketplace (HKLM-x32\...\{4CB0307C-565E-4441-86BE-0DF2E4FB828C}) (Version: 3.5.50.0 - Microsoft Corporation)

Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUS) (Version: 15.0.4569.1506 - Microsoft Corporation)

Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUSR) (Version: 15.0.4569.1506 - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}) (Version: 8.0.50727.42 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729 (HKLM\...\{D285FC5F-3021-32E9-9C59-24CA325BDC5C}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{3C3D696B-0DB7-3C6D-A356-3DB8CE541918}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{86CE1746-9EFF-3C9C-8755-81EA8903AC34}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106 (HKLM-x32\...\{8e70e4e1-06d7-470b-9f74-a51bef21088e}) (Version: 11.0.51106.1 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)

Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)

Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)

Minecraft1.6.2 (HKLM-x32\...\Minecraft1.6.2) (Version:  - )

MKVToolNix 6.2.0 (HKLM-x32\...\MKVToolNix) (Version: 6.2.0 - Moritz Bunkus)

MotioninJoy Gamepad tool 0.7.1001 (HKLM\...\{330DAC67-5B62-452A-A0E4-6B4A5923940F}_is1) (Version: 0.7.1001 - www.motioninjoy.com)

Mozilla Firefox 36.0.4 (x86 de) (HKLM-x32\...\Mozilla Firefox 36.0.4 (x86 de)) (Version: 36.0.4 - Mozilla)

Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)

MPC-HC 1.6.5.6366 (HKLM-x32\...\{2624B969-7135-4EB1-B0F6-2D8C397B45F7}_is1) (Version: 1.6.5.6366 - MPC-HC Team)

MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)

MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)

MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)

Music Editor Free v9.9.4 (HKLM-x32\...\Music Editor Free_is1) (Version:  - Copyright(C) 2005-2014 MEFMedia, Inc.)

MyFreeCodec (HKU\S-1-5-21-2798733552-1552239651-28545706-1000\...\MyFreeCodec) (Version:  - )

Nero 11 (HKLM-x32\...\{8A7ABBD4-A617-4AE8-9C6D-1510DE46EC35}) (Version: 11.0.15500 - Nero AG)

Nero Backup Drivers (HKLM\...\{D600D357-5CB9-4DE9-8FD4-14E208BD1970}) (Version: 1.0.10000.1.0 - Nero AG)

Origin (HKLM-x32\...\Origin) (Version: 9.2.1.4399 - Electronic Arts, Inc.)

Outils de vérification linguistique 2013 de Microsoft Office*- Français (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden

PC Inspector smart recovery (HKLM-x32\...\{C9A87D86-FDFD-418B-BF96-EF09320973B3}) (Version: 4.50 - )

PDF Settings CS5 (x32 Version: 10.0 - Adobe Systems Incorporated) Hidden

PDF24 Creator 5.7.0 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)

PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.7.1 - pdfforge)

Pinnacle VideoSpin (HKLM-x32\...\{FEB15887-0932-4D2D-BB85-6AC03FBF1AA8}) (Version: 2.0.0.669 - Pinnacle Systems)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6482 - Realtek Semiconductor Corp.)

Rockstar Games Social Club (HKLM-x32\...\Rockstar Games Social Club) (Version: 1.0.9.5 - Rockstar Games)

roomeon 3D-Planer (HKLM-x32\...\{E94EF5B3-85D9-40C0-97DB-FA2BB29814E5}) (Version: 1.6.2 - roomeon GmbH)

Rosetta Stone Ltd Services (HKLM-x32\...\{7BB2EF8A-5376-4BAE-96D0-38BE49501F40}) (Version: 3.2.17 - Rosetta Stone Ltd.)

Rosetta Stone TOTALe (HKLM-x32\...\com.rosettastone.rosettastonetotale) (Version: 4.1.15.1 - Rosetta Stone, Ltd)

Rosetta Stone TOTALe (x32 Version: 4.1.1 - Rosetta Stone, Ltd) Hidden

Rosetta Stone TOTALe (x32 Version: 4.1.15.1 - Rosetta Stone, Ltd) Hidden

Samsung CLX-3300 Series (HKLM-x32\...\Samsung CLX-3300 Series) (Version: 1.01 (01.05.2012) - Samsung Electronics Co., Ltd.)

Samsung Easy Document Creator (HKLM-x32\...\Samsung Easy Document Creator) (Version: 1.02.09 (25.04.2012) - Samsung Electronics Co., Ltd.)

Samsung Easy Printer Manager (HKLM-x32\...\Samsung Easy Printer Manager) (Version: 1.02.45.02(01.05.2012) - Samsung Electronics Co., Ltd.)

SAMSUNG Mobile Composite Device Software (HKLM\...\SAMSUNG Mobile Composite Device) (Version:  - )

SAMSUNG Mobile Modem Driver Set (HKLM\...\SAMSUNG Mobile Modem) (Version:  - )

Samsung Mobile phone USB driver Drive Software (HKLM\...\Samsung Mobile phone USB driver Drive) (Version:  - )

SAMSUNG Mobile USB Modem 1.0 Software (HKLM\...\SAMSUNG Mobile USB Modem 1.0) (Version:  - )

SAMSUNG Mobile USB Modem Software (HKLM\...\SAMSUNG Mobile USB Modem) (Version:  - )

Samsung Printer Live Update (HKLM-x32\...\Samsung Printer Live Update) (Version: 1.01.00.04 - Samsung Electronics Co., Ltd.)

Samsung Scan Process Machine (x32 Version: 1.00.18.04 - Samsung Electronics Co., Ltd.) Hidden

SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.6.0 - SAMSUNG Electronics Co., Ltd.)

Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{D82063A8-7C8C-4C3B-A9BB-95138CA55D26}) (Version:  - Microsoft)

Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{D82063A8-7C8C-4C3B-A9BB-95138CA55D26}) (Version:  - Microsoft)

Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (Version:  - Microsoft) Hidden

SNS Upload for Easy Document Creator (HKLM-x32\...\{B6B5F07C-88D5-49D3-A1A7-A6D4BC37DCCC}) (Version: 1.0.0 - Samsung Electronics Co.,Ltd)

Sound Blaster X-Fi MB (HKLM-x32\...\{F3D9AC82-30F4-4BB9-B9AB-8697637568C1}) (Version: 1.0 - Creative Technology Limited)

SpyHunter (HKLM-x32\...\{AF549236-6258-4AC6-A043-5B5B89C6EB61}) (Version: 4.17.6.4336 - Enigma Software Group USA, LLC)

Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)

swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden

System Requirements Lab CYRI (HKLM-x32\...\{E5F05232-96B6-4552-A480-785A60A94B21}) (Version: 5.0.6.0 - Husdawg, LLC)

System Requirements Lab for Intel (HKLM-x32\...\{04C4B49D-45D9-4A28-9ED1-B45CBD99B8C7}) (Version: 4.5.24.0 - Husdawg, LLC)

The LEGO Movie - Videogame (HKLM-x32\...\The LEGO Movie - Videogame_is1) (Version:  - Warner Bros. Interactive Entertainment)

Tormentum (HKLM-x32\...\Tormentum_is1) (Version:  - OhNoo Studio)

TSR Watermark Image software version 3.4.2.4 - Free version (HKLM-x32\...\TSR Watermark Image - Free version_is1) (Version: 3.4.2.4 - TSR Software)

Ubisoft Game Launcher (HKLM-x32\...\{888F1505-C2B3-4FDE-835D-36353EBD4754}) (Version: 1.0.0.0 - UBISOFT)

Ulead GIF Animator 5 Test (HKLM-x32\...\{8AF3E926-ED59-11D4-A44B-0000E86D2305}) (Version:  - )

Uplay (HKLM-x32\...\Uplay) (Version: 3.0 - Ubisoft)

Visual Studio 2008 x64 Redistributables (HKLM-x32\...\{FCDBEA60-79F0-4FAE-BBA8-55A26C609A49}) (Version: 10.0.0.2 - AVG Technologies)

Visual Studio 2010 x64 Redistributables (HKLM\...\{21B133D6-5979-47F0-BE1C-F6A6B304693F}) (Version: 13.0.0.1 - AVG Technologies)

Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)

Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)

VLC media player 2.0.5 (HKLM-x32\...\VLC media player) (Version: 2.0.5 - VideoLAN)

vLite (HKLM-x32\...\vLite_is1) (Version: 1.2 - Dino Nuhagic (nuhi))

welcome (x32 Version: 11.0.21500.0.4 - Nero AG) Hidden

WhoCrashed 5.03 (HKLM\...\WhoCrashed_is1) (Version:  - Resplendence Software Projects Sp.)

Winamp (HKLM-x32\...\Winamp) (Version: 5.622  - Nullsoft, Inc)

Winamp Erkennungs-Plug-in (HKU\S-1-5-21-2798733552-1552239651-28545706-1000\...\Winamp Detect) (Version: 1.0.0.1 - Nullsoft, Inc)

Windows Live ID Sign-in Assistant (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation)

Windows-Treiberpaket - Intel (iaStor) hdc  (10/17/2011 10.8.0.1003) (HKLM\...\4D0C3CE71E3E56C85A44C7C0A8F3984B6762569C) (Version: 10/17/2011 10.8.0.1003 - Intel)

Windows-Treiberpaket - Intel (iaStor) SCSIAdapter  (10/17/2011 10.8.0.1003) (HKLM\...\80EA9D0E08E92108D79178D7CF6DB4D92102558C) (Version: 10/17/2011 10.8.0.1003 - Intel)

WinImage (HKU\S-1-5-21-2798733552-1552239651-28545706-1000\...\WinImage) (Version:  - )

WinRAR 4.01 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.01.0 - win.rar GmbH)

XFastUsb (HKLM-x32\...\XFastUsb) (Version:  - )

Xvid Video Codec (HKLM-x32\...\Xvid Video Codec 1.3.2) (Version: 1.3.2 - Xvid Team)
 

==================== Custom CLSID (selected items): ==========================
 

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
 
 

==================== Restore Points  =========================
 
 

==================== Hosts content: ==========================
 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 

2009-07-14 04:34 - 2012-04-05 22:34 - 00000854 ____N C:\Windows\system32\Drivers\etc\hosts

127.0.0.1 activate.adobe.com
 

==================== Scheduled Tasks (whitelisted) =============
 

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
 

Task: {059C920E-263E-4EC2-84C4-86ACDAC8D959} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc

Task: {56E90639-B562-4B24-BD62-9C587501652D} - System32\Tasks\AdobeAAMUpdater-1.0-Venice-Feisal => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2012-09-20] (Adobe Systems Incorporated)

Task: {69821FDB-C0FD-470F-A4E9-8E751F640A81} - System32\Tasks\AutoKMS => C:\Windows\AutoKMS\AutoKMS.exe

Task: {70356A41-FD6B-4528-B393-F03568AAEF48} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)

Task: {7D92BE01-8048-4A5B-8F73-B12D3325C311} - System32\Tasks\{8B0EAC92-DF8A-4C66-BC96-5123535C5C02} => pcalua.exe -a "C:\Users\Feisal\Downloads\New Loads\VirtualDub-1.9.11\auxsetup.exe" -d "C:\Users\X\Downloads\New Loads\VirtualDub-1.9.11"

Task: {84639AF0-09DD-4064-BFBA-4A8A496B8D8B} - System32\Tasks\{EA8886CC-27AD-4372-B7A1-463AD66958DB} => pcalua.exe -a "C:\Users\X\AppData\Roaming\Windows Net Data\uninstaller.exe"

Task: {95908D64-3F0C-4F96-B208-38A6A25BA015} - System32\Tasks\{880FBB0B-7EF4-4C59-88FA-6960214508D9} => pcalua.exe -a E:\INSTALL.EXE -d E:\

Task: {A54B09A3-246B-4662-B830-F0148323B519} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)

Task: {A644007E-12AB-4B06-A320-EC5CD724F26E} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-05-24] (Piriform Ltd)

Task: {B0B33AE0-C1BF-47A1-8D21-1B8431329765} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2014-01-23] (Microsoft Corporation)

Task: {CCBA5D8F-F589-4268-A426-B5ED56BDEA4C} - System32\Tasks\{1E611397-371F-451C-A1FF-B5BBC90F9C05} => pcalua.exe -a "C:\Program Files (x86)\InstallShield Installation Information\{C4A4722E-79F9-417C-BD72-8D359A090C97}\setup.exe" -c -runfromtemp -l0x0007 -removeonly

Task: {FD13169D-9459-4764-8624-0C44CC73C73D} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-03-23] (Adobe Systems Incorporated)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\AutoKMS.job => C:\Windows\AutoKMS\AutoKMS.exe
 

==================== Loaded Modules (whitelisted) ==============
 

2012-01-09 11:47 - 2012-01-09 11:47 - 00034304 _____ () C:\Windows\System32\sst7clm.dll

2011-11-17 23:06 - 2011-05-28 23:05 - 00164864 _____ () C:\Program Files\WinRAR\rarext.dll

2011-11-17 21:45 - 2009-02-06 19:52 - 00073728 _____ () C:\Windows\SysWOW64\CmdRtr.DLL

2011-11-17 21:45 - 2009-04-20 12:55 - 00148480 _____ () C:\Windows\SysWOW64\APOMngr.DLL
 

==================== Alternate Data Streams (whitelisted) =========
 

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
 

AlternateDataStreams: C:\ProgramData\TEMP:2AD33723

AlternateDataStreams: C:\ProgramData\TEMP:3086B95F
 

==================== Safe Mode (whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
 

==================== EXE Association (whitelisted) ===============
 

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
 
 

==================== Other Areas ============================
 

(Currently there is no automatic fix for this section.)
 

HKU\S-1-5-21-2798733552-1552239651-28545706-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Feisal\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg

HKU\S-1-5-21-2798733552-1552239651-28545706-1000.bak\Control Panel\Desktop\\Wallpaper -> C:\Users\Feisal.Venice\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg

HKU\S-1-5-21-2798733552-1552239651-28545706-1006\Control Panel\Desktop\\Wallpaper -> C:\Users\Login\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg

HKU\S-1-5-21-2798733552-1552239651-28545706-501\Control Panel\Desktop\\Wallpaper -> C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg

DNS Servers: 192.168.2.1
 

==================== MSCONFIG/TASK MANAGER disabled items ==
 

(Currently there is no automatic fix for this section.)
 

MSCONFIG\startupreg: PDFPrint => C:\Program Files (x86)\PDF24\pdf24.exe

MSCONFIG\startupreg: RunDLLEntry => C:\Windows\system32\RunDLL32.exe C:\Windows\system32\AmbRunE.dll,RunDLLEntry
 

==================== Accounts: =============================
 

Administrator (S-1-5-21-2798733552-1552239651-28545706-500 - Administrator - Disabled)

Feisal (S-1-5-21-2798733552-1552239651-28545706-1000 - Administrator - Enabled) => C:\Users\Feisal

Guest (S-1-5-21-2798733552-1552239651-28545706-501 - Limited - Enabled) => C:\Users\Guest

HomeGroupUser$ (S-1-5-21-2798733552-1552239651-28545706-1004 - Limited - Enabled)

Login (S-1-5-21-2798733552-1552239651-28545706-1006 - Administrator - Enabled) => C:\Users\Login
 

==================== Faulty Device Manager Devices =============
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (03/29/2015 08:18:35 AM) (Source: Winlogon) (EventID: 4103) (User: )

Description: Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.
 

Error: (03/28/2015 10:21:30 PM) (Source: Winlogon) (EventID: 4103) (User: )

Description: Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.
 

Error: (03/28/2015 08:18:30 PM) (Source: Winlogon) (EventID: 4103) (User: )

Description: Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.
 

Error: (03/28/2015 07:25:14 PM) (Source: Winlogon) (EventID: 4103) (User: )

Description: Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.
 

Error: (03/28/2015 06:04:57 PM) (Source: Winlogon) (EventID: 4103) (User: )

Description: Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.
 

Error: (03/28/2015 05:33:57 PM) (Source: Winlogon) (EventID: 4103) (User: )

Description: Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.
 

Error: (03/28/2015 05:07:19 PM) (Source: Software Protection Platform Service) (EventID: 8193) (User: )

Description: Fehler beim Lizenzaktivierungsplaner (sppuinotify.dll). Fehlercode:

0x80070005
 

Error: (03/28/2015 04:03:58 PM) (Source: Winlogon) (EventID: 4103) (User: )

Description: Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.
 

Error: (03/28/2015 01:51:40 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: Programm rufus-2.1.exe, Version 2.1.649.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
 

Prozess-ID: 14cc
 

Startzeit: 01d0694d40b37289
 

Endzeit: 5498
 

Anwendungspfad: C:\Users\Feisal\Downloads\New Loads\rufus-2.1.exe
 

Berichts-ID: c5a766f2-d540-11e4-aaef-002522df2e49
 

Error: (03/28/2015 01:47:11 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: Programm WinToUSB.exe, Version 0.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
 

Prozess-ID: bec
 

Startzeit: 01d0694c63421bd8
 

Endzeit: 1487
 

Anwendungspfad: C:\Program Files\WinToUSB\bin\WinToUSB.exe
 

Berichts-ID: 2708389d-d540-11e4-aaef-002522df2e49
 
 

System errors:

=============

Error: (03/29/2015 08:34:40 AM) (Source: Service Control Manager) (EventID: 7023) (User: )

Description: Der Dienst "Peer Name Resolution Protocol" wurde mit folgendem Fehler beendet: 

%%-2140993535
 

Error: (03/29/2015 08:34:40 AM) (Source: Service Control Manager) (EventID: 7001) (User: )

Description: Der Dienst "Peer Networking Grouping" ist vom Dienst "Peer Name Resolution Protocol" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 

%%-2140993535
 

Error: (03/29/2015 08:34:40 AM) (Source: Service Control Manager) (EventID: 7023) (User: )

Description: Der Dienst "Peer Name Resolution Protocol" wurde mit folgendem Fehler beendet: 

%%-2140993535
 

Error: (03/29/2015 08:34:40 AM) (Source: Service Control Manager) (EventID: 7001) (User: )

Description: Der Dienst "Peer Networking Grouping" ist vom Dienst "Peer Name Resolution Protocol" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 

%%-2140993535
 

Error: (03/29/2015 08:34:40 AM) (Source: PNRPSvc) (EventID: 102) (User: )

Description: 0x80630801
 

Error: (03/29/2015 08:34:40 AM) (Source: PNRPSvc) (EventID: 102) (User: )

Description: 0x80630801
 

Error: (03/29/2015 08:34:29 AM) (Source: Service Control Manager) (EventID: 7023) (User: )

Description: Der Dienst "Peer Name Resolution Protocol" wurde mit folgendem Fehler beendet: 

%%-2140993535
 

Error: (03/29/2015 08:34:29 AM) (Source: Service Control Manager) (EventID: 7001) (User: )

Description: Der Dienst "Peer Networking Grouping" ist vom Dienst "Peer Name Resolution Protocol" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 

%%-2140993535
 

Error: (03/29/2015 08:34:29 AM) (Source: PNRPSvc) (EventID: 102) (User: )

Description: 0x80630801
 

Error: (03/29/2015 08:18:52 AM) (Source: Service Control Manager) (EventID: 7026) (User: )

Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 

iaStor

StarOpen
 
 

Microsoft Office Sessions:

=========================

Error: (03/29/2015 08:18:35 AM) (Source: Winlogon) (EventID: 4103) (User: )

Description: 0x800700050x00000000
 

Error: (03/28/2015 10:21:30 PM) (Source: Winlogon) (EventID: 4103) (User: )

Description: 0x800700050x00000000
 

Error: (03/28/2015 08:18:30 PM) (Source: Winlogon) (EventID: 4103) (User: )

Description: 0x800700050x00000000
 

Error: (03/28/2015 07:25:14 PM) (Source: Winlogon) (EventID: 4103) (User: )

Description: 0x800700050x00000000
 

Error: (03/28/2015 06:04:57 PM) (Source: Winlogon) (EventID: 4103) (User: )

Description: 0x800700050x00000000
 

Error: (03/28/2015 05:33:57 PM) (Source: Winlogon) (EventID: 4103) (User: )

Description: 0x800700050x00000000
 

Error: (03/28/2015 05:07:19 PM) (Source: Software Protection Platform Service) (EventID: 8193) (User: )

Description: 0x80070005
 

Error: (03/28/2015 04:03:58 PM) (Source: Winlogon) (EventID: 4103) (User: )

Description: 0x800700050x00000000
 

Error: (03/28/2015 01:51:40 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: rufus-2.1.exe2.1.649.014cc01d0694d40b372895498C:\Users\Feisal\Downloads\New Loads\rufus-2.1.exec5a766f2-d540-11e4-aaef-002522df2e49
 

Error: (03/28/2015 01:47:11 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: WinToUSB.exe0.0.0.0bec01d0694c63421bd81487C:\Program Files\WinToUSB\bin\WinToUSB.exe2708389d-d540-11e4-aaef-002522df2e49
 
 

CodeIntegrity Errors:

===================================

  Date: 2014-05-26 21:24:07.060

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\E95B.tmp" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-05-26 21:24:06.980

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\E95B.tmp" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-05-26 21:22:45.750

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\E95B.tmp" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-05-26 21:22:45.670

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\E95B.tmp" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 
 

==================== Memory info =========================== 
 

Processor: Intel(R) Core(TM) i3-2120 CPU @ 3.30GHz

Percentage of memory in use: 51%

Total physical RAM: 8157.18 MB

Available physical RAM: 3996.73 MB

Total Pagefile: 16312.54 MB

Available Pagefile: 12633.06 MB

Total Virtual: 8192 MB

Available Virtual: 8191.83 MB
 

==================== Drives ================================
 

Drive c: () (Fixed) (Total:1953.12 GB) (Free:1312.33 GB) NTFS

Drive f: (IRM_SP1_X64FRE_MUI_DVD) (CDROM) (Total:5.91 GB) (Free:0 GB) UDF
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 2794.5 GB) (Disk ID: E9ADB2BC)
 

Partition: GPT Partition Type.
 

==================== End Of Log ============================

Code:

--------------------------------------------------------------------------------

Welcome to WhoCrashed (HOME EDITION) v 5.03

--------------------------------------------------------------------------------
 

This program checks for drivers which have been crashing your computer. If your computer has displayed a blue screen of death, suddenly rebooted or shut down then this program will help you find the root cause and possibly a solution. 
 

Whenever a computer suddenly reboots without displaying any notice or blue screen of death, the first thing that is often thought about is a hardware failure. In reality, on Windows most crashes are caused by malfunctioning device drivers and kernel modules. In case of a kernel error, many computers do not show a blue screen unless they are configured for this. Instead these systems suddenly reboot without any notice. 
 

This program will analyze your crash dumps with the single click of a button. It will tell you what drivers are likely to be responsible for crashing your computer. It will report a conclusion which offers suggestions on how to proceed in any situation while the analysis report will display internet links which will help you further troubleshoot any detected problems. 
 

To obtain technical support visit www.resplendence.com/support
 

Click here to check if you have the latest version or if an update is available. 
 

Just click the Analyze button for a comprehensible report ...
 
 
 

--------------------------------------------------------------------------------

Home Edition Notice

--------------------------------------------------------------------------------
 

This version of WhoCrashed is free for use at home only. If you would like to use this software at work or in a commercial environment you should get the professional edition of WhoCrashed which allows you to perform more thorough and detailed analysis. It also offers a range of additional features such as remote analysis on remote directories and remote computers on the network. 
 

Click here for more information on the professional edition.

Click here to buy the the professional edition of WhoCrashed.
 
 

--------------------------------------------------------------------------------

System Information (local)

--------------------------------------------------------------------------------
 

computer name: VENICE

windows version: Windows 7 Service Pack 1, 6.1, build: 7601

windows dir: C:\Windows

Hardware: ASRock, H61DE/S3

CPU: GenuineIntel Intel(R) Core(TM) i3-2120 CPU @ 3.30GHz Intel586, level: 6

4 logical processors, active mask: 15

RAM: 8553418752 total
 
 
 
 

--------------------------------------------------------------------------------

Crash Dump Analysis

--------------------------------------------------------------------------------
 

Crash dump directory: C:\Windows\Minidump
 

Crash dumps are enabled on your computer.
 

On Sat 28.03.2015 06:50:56 GMT your computer crashed

crash dump file: C:\Windows\Minidump\032815-49109-01.dmp

This was probably caused by the following module: wdf01000.sys (Wdf01000+0x52A46) 

Bugcheck code: 0x10D (0x5, 0x0, 0x1202, 0xFFFFFA800A6A9E40)

Error: WDF_VIOLATION

file path: C:\Windows\system32\drivers\wdf01000.sys

product: Betriebssystem Microsoft® Windows®

company: Microsoft Corporation

description: Kernelmodustreiber-Frameworklaufzeit

Bug check description: This indicates that Kernel-Mode Driver Framework (KMDF) detected that Windows found an error in a framework-based driver.

This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. 

The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time. 
 
 
 

On Fri 27.03.2015 07:31:55 GMT your computer crashed

crash dump file: C:\Windows\Minidump\032715-56519-01.dmp

This was probably caused by the following module: wdf01000.sys (Wdf01000+0x52A46) 

Bugcheck code: 0x10D (0x5, 0x0, 0x1202, 0xFFFFFA80089F4E40)

Error: WDF_VIOLATION

file path: C:\Windows\system32\drivers\wdf01000.sys

product: Betriebssystem Microsoft® Windows®

company: Microsoft Corporation

description: Kernelmodustreiber-Frameworklaufzeit

Bug check description: This indicates that Kernel-Mode Driver Framework (KMDF) detected that Windows found an error in a framework-based driver.

This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. 

The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time. 
 
 
 

On Sun 01.03.2015 09:40:11 GMT your computer crashed

crash dump file: C:\Windows\Minidump\030115-45068-01.dmp

This was probably caused by the following module: wdf01000.sys (Wdf01000+0x52A46) 

Bugcheck code: 0x10D (0x5, 0x0, 0x1202, 0xFFFFFA8009CAB4F0)

Error: WDF_VIOLATION

file path: C:\Windows\system32\drivers\wdf01000.sys

product: Betriebssystem Microsoft® Windows®

company: Microsoft Corporation

description: Kernelmodustreiber-Frameworklaufzeit

Bug check description: This indicates that Kernel-Mode Driver Framework (KMDF) detected that Windows found an error in a framework-based driver.

This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. 

The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time. 
 
 
 

On Sun 01.03.2015 06:54:42 GMT your computer crashed

crash dump file: C:\Windows\Minidump\030115-90714-01.dmp

This was probably caused by the following module: atikmdag.sys (atikmdag+0x7C5CD) 

Bugcheck code: 0x1000007E (0xFFFFFFFFC0000094, 0xFFFFF8800F6B05CD, 0xFFFFF88004682B38, 0xFFFFF88004682390)

Error: SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M

file path: C:\Windows\system32\drivers\atikmdag.sys

product: ATI Radeon Family

company: Advanced Micro Devices, Inc.

description: ATI Radeon Kernel Mode Driver

Bug check description: This indicates that a system thread generated an exception which the error handler did not catch.

This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. 

A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: atikmdag.sys (ATI Radeon Kernel Mode Driver, Advanced Micro Devices, Inc.). 

Google query: Advanced Micro Devices, Inc. SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M

Code:

RogueKiller V10.5.7.0 (x64) [Mar 22 2015] by Adlice Software

Mail : hxxp://www.adlice.com/contact/

Feedback : hxxp://forum.adlice.com

Website : hxxp://www.adlice.com/softwares/roguekiller/

Blog : hxxp://www.adlice.com
 

Betriebssystem : Windows 7 (6.1.7601 Service Pack 1) 64 bits version

gestarted in : normaler Modus

User : X[Administrator]

Started from : C:\Users\X\Downloads\New Loads\RogueKillerX64.exe

Modus : Scannen -- Datum : 03/28/2015  18:32:21
 

¤¤¤ Prozesse : 0 ¤¤¤
 

¤¤¤ Registry : 0 ¤¤¤
 

¤¤¤ Aufgaben : 0 ¤¤¤
 

¤¤¤ Dateien : 0 ¤¤¤
 

¤¤¤ Host Dateien : 1 ¤¤¤

[C:\Windows\System32\drivers\etc\hosts] 127.0.0.1 activate.adobe.com
 

¤¤¤ Antirootkit : 7 (Driver: geladen) ¤¤¤

[IRP:Addr(Hook.IRP)] \SystemRoot\system32\drivers\PCIIDEX.SYS - IRP_MJ_CREATE[0] : Unknown @ 0x66b82c0

[IRP:Addr(Hook.IRP)] \SystemRoot\system32\drivers\PCIIDEX.SYS - IRP_MJ_CLOSE[2] : Unknown @ 0x66b82c0

[IRP:Addr(Hook.IRP)] \SystemRoot\system32\drivers\PCIIDEX.SYS - IRP_MJ_DEVICE_CONTROL[14] : Unknown @ 0x66b82c0

[IRP:Addr(Hook.IRP)] \SystemRoot\system32\drivers\PCIIDEX.SYS - IRP_MJ_INTERNAL_DEVICE_CONTROL[15] : Unknown @ 0x66b82c0

[IRP:Addr(Hook.IRP)] \SystemRoot\system32\drivers\PCIIDEX.SYS - IRP_MJ_POWER[22] : Unknown @ 0x66b82c0

[IRP:Addr(Hook.IRP)] \SystemRoot\system32\drivers\PCIIDEX.SYS - IRP_MJ_SYSTEM_CONTROL[23] : Unknown @ 0x66b82c0

[IRP:Addr(Hook.IRP)] \SystemRoot\system32\drivers\PCIIDEX.SYS - IRP_MJ_PNP[27] : Unknown @ 0x66b82c0
 

¤¤¤ Web Browser : 0 ¤¤¤
 

¤¤¤ MBR Überprüfung : ¤¤¤

+++++ PhysicalDrive0: ST3000DM001-9YN166 ATA Device +++++

--- User ---

[MBR] 0a571fe39c8647b756a9bccc8a21297d

[BSP] acdf01760ccf8cac6a54cc6a1f632d7e : Windows Vista/7/8 MBR Code

Partition table:

0 -  | Offset (sectors): 34 | Size: 127 MB

1 - [MAN-MOUNT] Basic data partition | Offset (sectors): 262144 | Size: 100 MB

2 - [MAN-MOUNT] Basic data partition | Offset (sectors): 466944 | Size: 2000000 MB

3 - Basic data partition | Offset (sectors): 4096466944 | Size: 861359 MB

User = LL1 ... OK

User = LL2 ... OK
 
 

============================================

RKreport_DEL_03282015_095337.log - RKreport_DEL_03282015_164237.log - RKreport_SCN_03282015_094039.log - RKreport_SCN_03282015_095026.log

RKreport_SCN_03282015_095538.log - RKreport_SCN_03282015_164109.log - RKreport_SCN_03282015_164854.log - RKreport_SCN_03282015_181709.log

Und noch die Analyse mit Malwarebytes Anti-Rootkit

Code:

---------------------------------------

Malwarebytes Anti-Rootkit BETA 1.09.1.1004
 

(c) Malwarebytes Corporation 2011-2012
 

OS version: 6.1.7601 Windows 7 Service Pack 1 x64
 

Account is Administrative
 

Internet Explorer version: 11.0.9600.17691
 

File system is: NTFS

Disk drives: C:\ DRIVE_FIXED, E:\ DRIVE_FIXED

CPU speed: 3.292000 GHz

Memory total: 8553418752, free: 5681635328
 

Downloaded database version: v2015.03.29.03

Downloaded database version: v2015.03.26.01

Downloaded database version: v2015.03.09.01

=======================================

Initializing...

------------ Kernel report ------------

     03/29/2015 10:41:27

------------ Loaded modules -----------

\SystemRoot\system32\ntoskrnl.exe

\SystemRoot\system32\hal.dll

\SystemRoot\system32\kdcom.dll

\SystemRoot\system32\mcupdate_GenuineIntel.dll

\SystemRoot\system32\PSHED.dll

\SystemRoot\system32\CLFS.SYS

\SystemRoot\system32\CI.dll

\SystemRoot\system32\drivers\Wdf01000.sys

\SystemRoot\system32\drivers\WDFLDR.SYS

\SystemRoot\System32\Drivers\sptd.sys

\SystemRoot\system32\drivers\ACPI.sys

\SystemRoot\system32\drivers\WMILIB.SYS

\SystemRoot\system32\drivers\msisadrv.sys

\SystemRoot\system32\drivers\vdrvroot.sys

\SystemRoot\system32\DRIVERS\vsflt67.sys

\SystemRoot\system32\drivers\pci.sys

\SystemRoot\System32\drivers\partmgr.sys

\SystemRoot\system32\drivers\compbatt.sys

\SystemRoot\system32\drivers\BATTC.SYS

\SystemRoot\system32\drivers\volmgr.sys

\SystemRoot\System32\drivers\volmgrx.sys

\SystemRoot\system32\drivers\pciide.sys

\SystemRoot\system32\drivers\PCIIDEX.SYS

\SystemRoot\System32\drivers\mountmgr.sys

\SystemRoot\system32\drivers\atapi.sys

\SystemRoot\system32\drivers\ataport.SYS

\SystemRoot\system32\DRIVERS\asahci64.sys

\SystemRoot\system32\drivers\msahci.sys

\SystemRoot\system32\drivers\amdxata.sys

\SystemRoot\system32\drivers\fltmgr.sys

\SystemRoot\system32\drivers\fileinfo.sys

\SystemRoot\System32\Drivers\Ntfs.sys

\SystemRoot\System32\Drivers\msrpc.sys

\SystemRoot\System32\Drivers\ksecdd.sys

\SystemRoot\System32\Drivers\cng.sys

\SystemRoot\System32\drivers\pcw.sys

\SystemRoot\System32\Drivers\Fs_Rec.sys

\SystemRoot\system32\drivers\ndis.sys

\SystemRoot\system32\drivers\NETIO.SYS

\SystemRoot\System32\Drivers\ksecpkg.sys

\SystemRoot\System32\drivers\tcpip.sys

\SystemRoot\System32\drivers\fwpkclnt.sys

\SystemRoot\system32\drivers\vmstorfl.sys

\SystemRoot\system32\drivers\volsnap.sys

\SystemRoot\System32\Drivers\spldr.sys

\SystemRoot\System32\drivers\rdyboost.sys

\SystemRoot\system32\DRIVERS\NBVol.sys

\SystemRoot\system32\DRIVERS\NBVolUp.sys

\SystemRoot\System32\Drivers\mup.sys

\SystemRoot\System32\drivers\hwpolicy.sys

\SystemRoot\system32\DRIVERS\fltsrv.sys

\SystemRoot\System32\DRIVERS\fvevol.sys

\SystemRoot\system32\drivers\disk.sys

\SystemRoot\system32\drivers\CLASSPNP.SYS

\SystemRoot\system32\DRIVERS\avgrkx64.sys

\SystemRoot\system32\DRIVERS\avgloga.sys

\SystemRoot\system32\DRIVERS\avgmfx64.sys

\SystemRoot\system32\DRIVERS\avgidsha.sys

\SystemRoot\system32\DRIVERS\dtsoftbus01.sys

\SystemRoot\system32\DRIVERS\cdrom.sys

\SystemRoot\System32\Drivers\Null.SYS

\SystemRoot\System32\Drivers\Beep.SYS

\??\C:\Windows\system32\drivers\avgtpx64.sys

\SystemRoot\System32\drivers\FNETURPX.SYS

\SystemRoot\System32\drivers\vga.sys

\SystemRoot\System32\drivers\VIDEOPRT.SYS

\SystemRoot\System32\drivers\watchdog.sys

\SystemRoot\System32\DRIVERS\RDPCDD.sys

\SystemRoot\system32\drivers\rdpencdd.sys

\SystemRoot\system32\drivers\rdprefmp.sys

\SystemRoot\System32\Drivers\Msfs.SYS

\SystemRoot\System32\Drivers\Npfs.SYS

\SystemRoot\system32\DRIVERS\avgfwd6a.sys

\SystemRoot\system32\DRIVERS\tdx.sys

\SystemRoot\system32\DRIVERS\TDI.SYS

\SystemRoot\system32\DRIVERS\avgtdia.sys

\SystemRoot\System32\DRIVERS\netbt.sys

\SystemRoot\system32\drivers\afd.sys

\SystemRoot\system32\DRIVERS\wfplwf.sys

\SystemRoot\system32\DRIVERS\pacer.sys

\SystemRoot\system32\DRIVERS\netbios.sys

\SystemRoot\system32\DRIVERS\serial.sys

\SystemRoot\system32\DRIVERS\wanarp.sys

\SystemRoot\system32\DRIVERS\termdd.sys

\SystemRoot\system32\DRIVERS\rdbss.sys

\SystemRoot\system32\drivers\nsiproxy.sys

\SystemRoot\system32\DRIVERS\mssmbios.sys

\SystemRoot\System32\drivers\discache.sys

\SystemRoot\system32\drivers\csc.sys

\SystemRoot\System32\Drivers\dfsc.sys

\SystemRoot\system32\DRIVERS\blbdrive.sys

\SystemRoot\system32\DRIVERS\avgldx64.sys

\SystemRoot\system32\DRIVERS\avgidsdrivera.sys

\SystemRoot\system32\DRIVERS\avgdiska.sys

\SystemRoot\system32\DRIVERS\AsrAppCharger.sys

\??\C:\Windows\system32\drivers\AntiLog64.sys

\SystemRoot\system32\DRIVERS\tunnel.sys

\SystemRoot\system32\DRIVERS\atikmpag.sys

\SystemRoot\system32\DRIVERS\atikmdag.sys

\SystemRoot\System32\drivers\dxgkrnl.sys

\SystemRoot\System32\drivers\dxgmms1.sys

\SystemRoot\system32\DRIVERS\HDAudBus.sys

\SystemRoot\system32\DRIVERS\HECIx64.sys

\SystemRoot\system32\drivers\usbehci.sys

\SystemRoot\system32\drivers\USBPORT.SYS

\SystemRoot\system32\DRIVERS\L1C62x64.sys

\SystemRoot\system32\DRIVERS\i8042prt.sys

\SystemRoot\system32\DRIVERS\kbdclass.sys

\SystemRoot\system32\DRIVERS\serenum.sys

\SystemRoot\System32\Drivers\aaqrdla0.SYS

\SystemRoot\System32\Drivers\SCSIPORT.SYS

\SystemRoot\system32\DRIVERS\intelppm.sys

\SystemRoot\system32\DRIVERS\CompositeBus.sys

\SystemRoot\system32\DRIVERS\AgileVpn.sys

\SystemRoot\system32\DRIVERS\rasl2tp.sys

\SystemRoot\system32\DRIVERS\ndistapi.sys

\SystemRoot\system32\DRIVERS\ndiswan.sys

\SystemRoot\system32\DRIVERS\raspppoe.sys

\SystemRoot\system32\DRIVERS\raspptp.sys

\SystemRoot\system32\DRIVERS\rassstp.sys

\SystemRoot\system32\DRIVERS\rdpbus.sys

\SystemRoot\system32\DRIVERS\mouclass.sys

\SystemRoot\system32\DRIVERS\swenum.sys

\SystemRoot\system32\DRIVERS\ks.sys

\SystemRoot\system32\DRIVERS\umbus.sys

\SystemRoot\system32\DRIVERS\usbhub.sys

\SystemRoot\System32\Drivers\NDProxy.SYS

\SystemRoot\system32\drivers\AtihdW76.sys

\SystemRoot\system32\drivers\portcls.sys

\SystemRoot\system32\drivers\drmk.sys

\SystemRoot\system32\drivers\ksthunk.sys

\SystemRoot\system32\drivers\RTKVHD64.sys

\SystemRoot\system32\DRIVERS\hidusb.sys

\SystemRoot\system32\DRIVERS\HIDCLASS.SYS

\SystemRoot\system32\DRIVERS\HIDPARSE.SYS

\SystemRoot\system32\DRIVERS\USBD.SYS

\SystemRoot\system32\DRIVERS\mouhid.sys

\SystemRoot\System32\Drivers\fastfat.SYS

\SystemRoot\System32\Drivers\crashdmp.sys

\SystemRoot\System32\Drivers\dump_dumpata.sys

\SystemRoot\System32\Drivers\dump_asahci64.sys

\SystemRoot\System32\Drivers\dump_dumpfve.sys

\SystemRoot\System32\win32k.sys

\SystemRoot\System32\drivers\Dxapi.sys

\SystemRoot\system32\DRIVERS\monitor.sys

\SystemRoot\System32\TSDDD.dll

\SystemRoot\System32\cdd.dll

\SystemRoot\system32\drivers\luafv.sys

\SystemRoot\System32\ATMFD.DLL

\SystemRoot\system32\DRIVERS\lltdio.sys

\SystemRoot\system32\DRIVERS\rspndr.sys

\SystemRoot\system32\drivers\HTTP.sys

\SystemRoot\system32\DRIVERS\bowser.sys

\SystemRoot\System32\drivers\mpsdrv.sys

\SystemRoot\system32\DRIVERS\mrxsmb.sys

\SystemRoot\system32\DRIVERS\mrxsmb10.sys

\SystemRoot\system32\DRIVERS\mrxsmb20.sys

\SystemRoot\system32\drivers\peauth.sys

\SystemRoot\System32\Drivers\secdrv.SYS

\SystemRoot\System32\DRIVERS\srvnet.sys

\??\C:\Windows\system32\Drivers\SSPORT.sys

\SystemRoot\System32\drivers\tcpipreg.sys

\SystemRoot\System32\DRIVERS\srv2.sys

\SystemRoot\System32\DRIVERS\srv.sys

\SystemRoot\system32\DRIVERS\udfs.sys

\??\C:\Windows\system32\drivers\mbamchameleon.sys

\??\C:\Windows\system32\drivers\MBAMSwissArmy.sys

\Windows\System32\ntdll.dll

\Windows\System32\smss.exe

\Windows\System32\apisetschema.dll

----------- End -----------

Done!

IRP handler 0 of \Driver\atapi points to an unknown module

Unhooking enabled.
 

Scan started

Database versions:

  main:    v2015.03.29.03

  rootkit: v2015.03.26.01
 

<<<1>>>

Upper Device Name: \Device\Harddisk0\DR0

Upper Device Object: 0xfffffa8007784060

Upper Device Driver Name: \Driver\Disk\

Lower Device Name: \Device\Ide\IdeDeviceP4T0L0-8\

Lower Device Object: 0xfffffa8007142680

Lower Device Driver Name: \Driver\atapi\

Driver name found: atapi

Initialization returned 0x0

Port sub-driver loaded: \??\C:\Windows\System32\drivers\ataport.sys (0x0)

Load Function returned 0x0

<<<2>>>

Physical Sector Size: 512

Drive: 0, DevicePointer: 0xfffffa8007784060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\

--------- Disk Stack ------

DevicePointer: 0xfffffa8007784b90, DeviceName: Unknown, DriverName: \Driver\partmgr\

DevicePointer: 0xfffffa8007784060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\

DevicePointer: 0xfffffa800764f880, DeviceName: Unknown, DriverName: \Driver\vidsflt67\

DevicePointer: 0xfffffa8007142680, DeviceName: \Device\Ide\IdeDeviceP4T0L0-8\, DriverName: \Driver\atapi\

------------ End ----------

Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\

Upper DeviceData: 0xfffff8a0169ddd10, 0xfffffa8007784060, 0xfffffa800913f500

Lower DeviceData: 0xfffff8a008b959f0, 0xfffffa8007142680, 0xfffffa8007e0d690

<<<3>>>

Volume: C:

File system type: NTFS

SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes

<<<2>>>

<<<3>>>

Volume: C:

File system type: NTFS

SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes

Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...

Done!

Drive 0

This is a System drive

Scanning MBR on drive 0...

Inspecting partition table:

This drive is a GPT Drive.

MBR Signature: 55AA

Disk Signature: E9ADB2BC
 

GPT Protective MBR Partition information:
 

    Partition 0 type is EFI-GPT (0xee)

    Partition is NOT ACTIVE.

    Partition starts at LBA: 1  Numsec = 4294967295
 

    Partition 1 type is Empty (0x0)

    Partition is NOT ACTIVE.

    Partition starts at LBA: 0  Numsec = 0
 

    Partition 2 type is Empty (0x0)

    Partition is NOT ACTIVE.

    Partition starts at LBA: 0  Numsec = 0
 

    Partition 3 type is Empty (0x0)

    Partition is NOT ACTIVE.

    Partition starts at LBA: 0  Numsec = 0
 

GPT Partition information:
 

    GPT Header Signature 4546492050415254

    GPT Header Revision 65536 Size 92 CRC 1487306886

    GPT Header CurrentLba = 1 BackupLba 5860533167

    GPT Header FirstUsableLba 34  LastUsableLba 5860533134

    GPT Header Guid 2af4f230-d613-40f0-a022-5c4f50925fe9

    GPT Header Contains 128 partition entries starting at LBA 2

    GPT Header Partition entry size = 128
 

    Backup GPT header Signature 1397a9c3f04bfdae

    Backup GPT header Revision 3771946998 Size 1921024553 CRC 3547653478

    Backup GPT header CurrentLba = 11274629701026367397 BackupLba 263249483720580154

    Backup GPT header FirstUsableLba 13516675636487801936  LastUsableLba 137890212000288224

    Backup GPT header Guid a8a31040-ab07-1e8a-ce2-f785303b1444

    Backup GPT header Contains 4055782333 partition entries starting at LBA 15279813677734147328

    Backup GPT header Partition entry size = 1438712596
 

    GPT header and Backup GPT header have conflicting data
 

    Backup GPT partition header signature doesn't match "EFI PART" magic
 

    Partition 0 Type c12a7328-f81f-11d2-ba4b-0a0c93ec93b

    Partition ID 25c4782a-48e3-4c2e-3d39-d9127e8a66de

    FirstLBA 34  Last LBA 262143

    Attributes 0

    Partition Name                                     
 

    GPT Partition 0 is bootable

    Partition 1 Type ebd0a0a2-b9e5-4433-87c0-68b6b72699c7

    Partition ID dd189044-7a42-4533-68b9-d2364d407b8c

    FirstLBA 262144  Last LBA 466943

    Attributes 0

    Partition Name                 Basic data partition
 

    Partition 2 Type ebd0a0a2-b9e5-4433-87c0-68b6b72699c7

    Partition ID a2d2ab9-2be0-41fa-658c-baba92f79e41

    FirstLBA 466944  Last LBA 4096466943

    Attributes 0

    Partition Name                 Basic data partition
 

    Partition 3 Type ebd0a0a2-b9e5-4433-87c0-68b6b72699c7

    Partition ID 67e216de-2dce-478e-a093-368d5edb38d3

    FirstLBA 4096466944  Last LBA 5860530175

    Attributes 0

    Partition Name                 Basic data partition
 

Disk Size: 3000592982016 bytes

Sector size: 512 bytes
 

Done!

File "c:\programdata\avg2014\chjw\4296f67e96f671b1.dat:6ba3c12c-da74-4b7f-8d77-b2245fcc7137" is sparse (flags = 32768)

File "c:\programdata\avg2014\chjw\4296f67e96f671b1.dat:a0790f1e-a77e-4625-8671-c20330dc985c" is sparse (flags = 32768)

Scan finished

=======================================
 
 

Removal queue found; removal started

Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-i.mbam...

Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-r.mbam...

Removal finished

Danke, hier nochmal die Logs.
Anbei, könntest du freundlicherweise mir auch dabei Helfen einen Portscan zu analysieren?

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015

Ran by Seufus (administrator) on BRATROLLI on 31-03-2015 08:27:06

Running from C:\Users\Seufus\Desktop

Loaded Profiles: Seufus (Available profiles: Seufus & Blau & Gast)

Platform: Windows 8.1 Pro (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11 (Default browser: FF)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgrsa.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgcsrva.exe

() C:\Program Files (x86)\AVG Web TuneUp\WtuSystemSupport.exe

(AMD) C:\Windows\System32\atiesrxx.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgfws.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgnsa.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgemca.exe

(AVG Secure Search) C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.4.0\ToolbarUpdater.exe

() C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.4.0\loggingserver.exe

(AMD) C:\Windows\System32\atieclxx.exe

(IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe

() C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgui.exe

() C:\Program Files (x86)\AVG Web TuneUp\vprot.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Advanced Micro Devices Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\MOM.exe

(ATI Technologies Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\CCC.exe

(AVG Secure Search) C:\Program Files (x86)\AVG Web TuneUp\avgcefrend.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [Classic Start Menu] => C:\Program Files\Classic Shell\ClassicStartMenu.exe [161984 2014-04-20] (IvoSoft)

HKLM\...\Run: [CDAServer] => C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe [464608 2014-09-08] ()

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13776088 2014-12-11] (Realtek Semiconductor)

HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2015\avgui.exe [3723728 2015-03-25] (AVG Technologies CZ, s.r.o.)

HKLM-x32\...\Run: [vProt] => C:\Program Files (x86)\AVG Web TuneUp\vprot.exe [3033112 2015-03-30] ()

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [335232 2015-03-07] (Oracle Corporation)

HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2014-11-20] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [Raptr] => C:\Program Files (x86)\Raptr\raptrstub.exe [55568 2015-03-25] (Raptr, Inc)

ShellIconOverlayIdentifiers: [ShareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft)

ShellIconOverlayIdentifiers-x32: [ShareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft)
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKU\S-1-5-21-4216540600-1385818188-3882979393-1001\Software\Microsoft\Internet Explorer\Main,Start Page = https://mysearch.avg.com/?cid={B006D8D8-CF6E-4831-8A5C-55719C8BE82C}&mid=b57f61a7c8d547cda1dad16c643bc7ba-ad1491be2ce6c122f6b66faa90e70c2decf7d34c&lang=de&ds=AVG&coid=avgtbavg&cmpid=0215pit&pr=fr&d=2015-03-30 13:26:20&v=4.1.0.411&pid=wtu&sg=&sap=hp

HKU\S-1-5-21-4216540600-1385818188-3882979393-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp

SearchScopes: HKU\S-1-5-21-4216540600-1385818188-3882979393-1001 -> DefaultScope {95B7759C-8C7F-4BF1-B163-73684A933233} URL = https://mysearch.avg.com/search?cid={B006D8D8-CF6E-4831-8A5C-55719C8BE82C}&mid=b57f61a7c8d547cda1dad16c643bc7ba-ad1491be2ce6c122f6b66faa90e70c2decf7d34c&lang=de&ds=AVG&coid=avgtbavg&cmpid=0215pit&pr=fr&d=2015-03-30 13:26:20&v=4.1.0.411&pid=wtu&sg=&sap=dsp&q={searchTerms}

SearchScopes: HKU\S-1-5-21-4216540600-1385818188-3882979393-1001 -> {95B7759C-8C7F-4BF1-B163-73684A933233} URL = https://mysearch.avg.com/search?cid={B006D8D8-CF6E-4831-8A5C-55719C8BE82C}&mid=b57f61a7c8d547cda1dad16c643bc7ba-ad1491be2ce6c122f6b66faa90e70c2decf7d34c&lang=de&ds=AVG&coid=avgtbavg&cmpid=0215pit&pr=fr&d=2015-03-30 13:26:20&v=4.1.0.411&pid=wtu&sg=&sap=dsp&q={searchTerms}

BHO: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer64.dll [2014-04-20] (IvoSoft)

BHO: AVG Web TuneUp -> {95B7759C-8C7F-4BF1-B163-73684A933233} -> C:\Program Files\AVG Web TuneUp\4.1.0.411\AVG Web TuneUp.dll [2015-03-30] (AVG)

BHO: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_64.dll [2014-04-20] (IvoSoft)

BHO-x32: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer32.dll [2014-04-20] (IvoSoft)

BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\ssv.dll [2015-03-30] (Oracle Corporation)

BHO-x32: AVG Web TuneUp -> {95B7759C-8C7F-4BF1-B163-73684A933233} -> C:\Program Files (x86)\AVG Web TuneUp\4.1.0.411\AVG Web TuneUp.dll [2015-03-30] (AVG)

BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\jp2ssv.dll [2015-03-30] (Oracle Corporation)

BHO-x32: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_32.dll [2014-04-20] (IvoSoft)

Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll [2014-04-20] (IvoSoft)

Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll [2014-04-20] (IvoSoft)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
 

FireFox:

========

FF ProfilePath: C:\Users\Seufus\AppData\Roaming\Mozilla\Firefox\Profiles\wc58qiy3.default

FF Homepage: google.de

FF Plugin-x32: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin -> C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\18.4.0\\npsitesafety.dll No File

FF Plugin-x32: @java.com/DTPlugin,version=11.40.2 -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\dtplugin\npDeployJava1.dll [2015-03-30] (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=11.40.2 -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\plugin2\npjp2.dll [2015-03-30] (Oracle Corporation)
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 avgfws; C:\Program Files (x86)\AVG\AVG2015\avgfws.exe [1516968 2015-03-25] (AVG Technologies CZ, s.r.o.)

R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe [3416016 2015-03-25] (AVG Technologies CZ, s.r.o.)

R2 avgwd; C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe [309232 2015-03-25] (AVG Technologies CZ, s.r.o.)

S4 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-11-21] (Microsoft Corporation)

R2 vToolbarUpdater18.4.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.4.0\ToolbarUpdater.exe [1875480 2015-03-30] (AVG Secure Search)

S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-04] (Microsoft Corporation)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-04] (Microsoft Corporation)

R2 WtuSystemSupport; C:\Program Files (x86)\AVG Web TuneUp\WtuSystemSupport.exe [620056 2015-03-30] ()
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R0 amdkmafd; C:\Windows\System32\drivers\amdkmafd.sys [21160 2012-09-23] (Advanced Micro Devices, Inc.)

R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWB6.sys [223232 2014-06-21] (Advanced Micro Devices)

S0 Avgboota; C:\Windows\System32\DRIVERS\avgboota.sys [20496 2013-09-04] (AVG Technologies CZ, s.r.o.)

R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [153368 2014-06-18] (AVG Technologies CZ, s.r.o.)

R1 Avgfwfd; C:\Windows\system32\DRIVERS\avgfwd6a.sys [58136 2014-12-03] (AVG Technologies CZ, s.r.o.)

R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [281056 2015-03-25] (AVG Technologies CZ, s.r.o.)

R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [203544 2014-11-18] (AVG Technologies CZ, s.r.o.)

R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [243480 2014-08-28] (AVG Technologies CZ, s.r.o.)

R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [341472 2015-02-03] (AVG Technologies CZ, s.r.o.)

R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [133088 2015-02-05] (AVG Technologies CZ, s.r.o.)

R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31512 2014-06-18] (AVG Technologies CZ, s.r.o.)

R1 Avgwfpa; C:\Windows\system32\DRIVERS\avgwfpa.sys [289248 2015-03-19] (AVG Technologies CZ, s.r.o.)

S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-04] (Microsoft Corporation)
 

==================== NetSvcs (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2015-03-31 08:27 - 2015-03-31 08:27 - 00010517 _____ () C:\Users\Seufus\Desktop\FRST.txt

2015-03-31 08:26 - 2015-03-31 08:27 - 00000000 ____D () C:\FRST

2015-03-31 08:25 - 2015-03-31 08:25 - 02095616 _____ (Farbar) C:\Users\Seufus\Desktop\FRST64.exe

2015-03-31 00:58 - 2015-03-31 00:58 - 00004383 _____ () C:\Users\Seufus\Downloads\sys_log.log

2015-03-31 00:45 - 2015-03-31 00:45 - 00000000 ____D () C:\Windows\SysWOW64\RTCOM

2015-03-31 00:45 - 2015-03-31 00:45 - 00000000 ____D () C:\Program Files\Realtek

2015-03-31 00:40 - 2015-03-31 00:40 - 00000000 ___SD () C:\Windows\SysWOW64\GWX

2015-03-31 00:40 - 2015-03-31 00:40 - 00000000 ___SD () C:\Windows\system32\GWX

2015-03-31 00:40 - 2015-03-14 10:20 - 01385256 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll

2015-03-31 00:40 - 2015-03-14 10:13 - 01124352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msctf.dll

2015-03-31 00:21 - 2015-03-31 00:21 - 00000000 ____D () C:\ProgramData\ATI

2015-03-31 00:16 - 2015-03-31 00:16 - 00000000 ____D () C:\Users\Seufus\AppData\Roaming\library_dir

2015-03-31 00:16 - 2015-03-31 00:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Gaming Evolved

2015-03-31 00:15 - 2015-03-31 08:23 - 00000000 ____D () C:\Users\Seufus\AppData\Roaming\Raptr

2015-03-31 00:15 - 2015-03-31 00:16 - 00000000 ____D () C:\Program Files (x86)\Raptr

2015-03-31 00:15 - 2015-03-31 00:15 - 00053736 _____ () C:\Windows\SysWOW64\CCCInstall_201503310015448800.log

2015-03-31 00:15 - 2015-03-31 00:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center

2015-03-31 00:15 - 2015-03-31 00:15 - 00000000 ____D () C:\ProgramData\AMD

2015-03-31 00:15 - 2015-03-31 00:15 - 00000000 ____D () C:\Program Files\Common Files\ATI Technologies

2015-03-31 00:15 - 2015-03-31 00:15 - 00000000 ____D () C:\Program Files (x86)\AMD AVT

2015-03-31 00:15 - 2015-03-31 00:15 - 00000000 ____D () C:\Program Files (x86)\AMD

2015-03-31 00:14 - 2015-03-31 00:14 - 00059972 _____ () C:\Windows\SysWOW64\CCCInstall_201503310014271907.log

2015-03-31 00:06 - 2015-03-31 00:06 - 00000000 ____D () C:\Users\Seufus\Documents\Scan

2015-03-31 00:05 - 2015-03-31 00:05 - 00000000 ____D () C:\ProgramData\boost_interprocess

2015-03-30 23:54 - 2015-03-31 00:05 - 00000000 ____D () C:\Users\Seufus\AppData\Roaming\Samsung

2015-03-30 23:54 - 2015-03-30 23:58 - 00000000 ____D () C:\ProgramData\Samsung

2015-03-30 23:54 - 2015-03-30 23:54 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung Printers

2015-03-30 23:54 - 2015-03-30 23:54 - 00000000 ____D () C:\Program Files\Common Files\Common Desktop Agent

2015-03-30 23:54 - 2015-03-30 23:54 - 00000000 ____D () C:\Program Files (x86)\Samsung

2015-03-30 23:45 - 2015-03-30 23:45 - 00001816 ____R () C:\Users\Seufus\Desktop\BitLocker-Wiederherstellungsschlüssel 68A02BD9-F3BE-40D3-90C1-5A956EE3534D.txt

2015-03-30 23:37 - 2015-03-30 23:37 - 00008704 ___SH () C:\Users\Blau\Desktop\Thumbs.db

2015-03-30 23:35 - 2015-03-30 23:35 - 00003598 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-4216540600-1385818188-3882979393-1006

2015-03-30 23:35 - 2015-03-30 23:35 - 00000000 ____D () C:\Windows\system32\appmgmt

2015-03-30 23:32 - 2015-03-30 23:32 - 00000000 ____D () C:\Users\Blau\Desktop\Neuer Ordner (4)

2015-03-30 23:32 - 2015-03-30 23:32 - 00000000 ____D () C:\Users\Blau\Desktop\Ethnic & Oriental Lounge Vol.1 (Relaxation Mystic Chill Out)

2015-03-30 23:32 - 2015-03-30 23:32 - 00000000 ____D () C:\Users\Blau\Desktop\Der kleine Pinz CD 1

2015-03-30 23:31 - 2015-03-30 23:31 - 00000000 ____D () C:\Users\Blau\Desktop\Joaquín Sabina

2015-03-30 23:31 - 2015-03-30 23:31 - 00000000 ____D () C:\Users\Blau\Desktop\jkhkj

2015-03-30 23:23 - 2015-03-30 23:23 - 00000000 ____D () C:\Users\Blau\AppData\Roaming\Mozilla

2015-03-30 23:23 - 2015-03-30 23:23 - 00000000 ____D () C:\Users\Blau\AppData\Local\Mozilla

2015-03-30 23:22 - 2015-03-30 23:39 - 00000000 ____D () C:\Users\Blau\AppData\Roaming\ClassicShell

2015-03-30 23:21 - 2015-03-30 23:22 - 00000000 ____D () C:\Users\Blau\AppData\Local\Packages

2015-03-30 23:21 - 2015-03-30 23:22 - 00000000 ____D () C:\Users\Blau\AppData\Local\AVG Web TuneUp

2015-03-30 23:21 - 2015-03-30 23:21 - 00001454 _____ () C:\Users\Blau\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

2015-03-30 23:21 - 2015-03-30 23:21 - 00000020 ___SH () C:\Users\Blau\ntuser.ini

2015-03-30 23:21 - 2015-03-30 23:21 - 00000000 _SHDL () C:\Users\Blau\Vorlagen

2015-03-30 23:21 - 2015-03-30 23:21 - 00000000 _SHDL () C:\Users\Blau\Startmenü

2015-03-30 23:21 - 2015-03-30 23:21 - 00000000 _SHDL () C:\Users\Blau\Netzwerkumgebung

2015-03-30 23:21 - 2015-03-30 23:21 - 00000000 _SHDL () C:\Users\Blau\Lokale Einstellungen

2015-03-30 23:21 - 2015-03-30 23:21 - 00000000 _SHDL () C:\Users\Blau\Eigene Dateien

2015-03-30 23:21 - 2015-03-30 23:21 - 00000000 _SHDL () C:\Users\Blau\Druckumgebung

2015-03-30 23:21 - 2015-03-30 23:21 - 00000000 _SHDL () C:\Users\Blau\Documents\Eigene Musik

2015-03-30 23:21 - 2015-03-30 23:21 - 00000000 _SHDL () C:\Users\Blau\Documents\Eigene Bilder

2015-03-30 23:21 - 2015-03-30 23:21 - 00000000 _SHDL () C:\Users\Blau\AppData\Roaming\Microsoft\Windows\Start Menu\Programme

2015-03-30 23:21 - 2015-03-30 23:21 - 00000000 _SHDL () C:\Users\Blau\AppData\Local\Verlauf

2015-03-30 23:21 - 2015-03-30 23:21 - 00000000 _SHDL () C:\Users\Blau\AppData\Local\Anwendungsdaten

2015-03-30 23:21 - 2015-03-30 23:21 - 00000000 _SHDL () C:\Users\Blau\Anwendungsdaten

2015-03-30 23:21 - 2015-03-30 23:21 - 00000000 ____D () C:\Users\Blau\AppData\Roaming\AVG2015

2015-03-30 23:21 - 2015-03-30 23:21 - 00000000 ____D () C:\Users\Blau\AppData\Roaming\ATI

2015-03-30 23:21 - 2015-03-30 23:21 - 00000000 ____D () C:\Users\Blau\AppData\Roaming\Adobe

2015-03-30 23:21 - 2015-03-30 23:21 - 00000000 ____D () C:\Users\Blau\AppData\Local\VirtualStore

2015-03-30 23:21 - 2015-03-30 23:21 - 00000000 ____D () C:\Users\Blau\AppData\Local\Avg2015

2015-03-30 23:21 - 2015-03-30 23:21 - 00000000 ____D () C:\Users\Blau\AppData\Local\ATI

2015-03-30 23:21 - 2015-03-30 23:21 - 00000000 ____D () C:\Users\Blau

2015-03-30 23:21 - 2015-03-10 00:19 - 00000000 ___RD () C:\Users\Blau\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools

2015-03-30 23:21 - 2014-11-21 17:14 - 00000000 ___RD () C:\Users\Blau\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories

2015-03-30 23:21 - 2014-11-21 17:14 - 00000000 ___RD () C:\Users\Blau\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility

2015-03-30 23:21 - 2014-11-21 09:48 - 00000369 _____ () C:\Users\Blau\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pictures.lnk

2015-03-30 23:21 - 2014-11-21 09:48 - 00000369 _____ () C:\Users\Blau\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Documents.lnk

2015-03-30 23:21 - 2013-08-22 17:36 - 00000000 ____D () C:\Users\Blau\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance

2015-03-30 22:48 - 2015-03-30 22:48 - 00002710 _____ () C:\Users\Seufus\Desktop\sys_log.log

2015-03-30 22:25 - 2015-03-30 12:40 - 00000000 ____D () C:\Windows\Panther

2015-03-30 21:13 - 2015-03-30 22:13 - 00000000 ____D () C:\Users\Gast\AppData\Roaming\Winamp

2015-03-30 21:09 - 2015-03-30 21:11 - 00000000 ____D () C:\Users\Seufus\AppData\Roaming\Winamp

2015-03-30 21:09 - 2015-03-30 21:10 - 00000000 ____D () C:\Program Files (x86)\Winamp

2015-03-30 21:09 - 2009-09-04 17:29 - 01892184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_42.dll

2015-03-30 21:09 - 2006-09-28 16:05 - 02414360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_31.dll

2015-03-30 17:06 - 2015-03-30 17:06 - 00000000 ____D () C:\Users\Gast\AppData\Roaming\Mozilla

2015-03-30 17:06 - 2015-03-30 17:06 - 00000000 ____D () C:\Users\Gast\AppData\Local\Mozilla

2015-03-30 17:05 - 2015-03-30 17:06 - 00000000 ____D () C:\Users\Seufus\Desktop\jkhkj

2015-03-30 17:05 - 2015-03-30 17:05 - 00000000 ____D () C:\Users\Seufus\Desktop\Neuer Ordner (4)

2015-03-30 17:05 - 2015-03-30 17:05 - 00000000 ____D () C:\Users\Seufus\Desktop\Joaquín Sabina

2015-03-30 17:05 - 2015-03-30 17:05 - 00000000 ____D () C:\Users\Seufus\Desktop\Ethnic & Oriental Lounge Vol.1 (Relaxation Mystic Chill Out)

2015-03-30 17:05 - 2015-03-30 17:05 - 00000000 ____D () C:\Users\Seufus\Desktop\Der kleine Pinz CD 1

2015-03-30 17:04 - 2015-03-30 22:40 - 00000000 ____D () C:\Users\Gast\AppData\Roaming\ClassicShell

2015-03-30 17:03 - 2015-03-30 17:03 - 00001450 _____ () C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

2015-03-30 17:03 - 2015-03-30 17:03 - 00000020 ___SH () C:\Users\Gast\ntuser.ini

2015-03-30 17:03 - 2015-03-30 17:03 - 00000000 _SHDL () C:\Users\Gast\Vorlagen

2015-03-30 17:03 - 2015-03-30 17:03 - 00000000 _SHDL () C:\Users\Gast\Startmenü

2015-03-30 17:03 - 2015-03-30 17:03 - 00000000 _SHDL () C:\Users\Gast\Netzwerkumgebung

2015-03-30 17:03 - 2015-03-30 17:03 - 00000000 _SHDL () C:\Users\Gast\Lokale Einstellungen

2015-03-30 17:03 - 2015-03-30 17:03 - 00000000 _SHDL () C:\Users\Gast\Eigene Dateien

2015-03-30 17:03 - 2015-03-30 17:03 - 00000000 _SHDL () C:\Users\Gast\Druckumgebung

2015-03-30 17:03 - 2015-03-30 17:03 - 00000000 _SHDL () C:\Users\Gast\Documents\Eigene Musik

2015-03-30 17:03 - 2015-03-30 17:03 - 00000000 _SHDL () C:\Users\Gast\Documents\Eigene Bilder

2015-03-30 17:03 - 2015-03-30 17:03 - 00000000 _SHDL () C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programme

2015-03-30 17:03 - 2015-03-30 17:03 - 00000000 _SHDL () C:\Users\Gast\AppData\Local\Verlauf

2015-03-30 17:03 - 2015-03-30 17:03 - 00000000 _SHDL () C:\Users\Gast\AppData\Local\Anwendungsdaten

2015-03-30 17:03 - 2015-03-30 17:03 - 00000000 _SHDL () C:\Users\Gast\Anwendungsdaten

2015-03-30 17:03 - 2015-03-30 17:03 - 00000000 ____D () C:\Users\Gast\AppData\Roaming\AVG2015

2015-03-30 17:03 - 2015-03-30 17:03 - 00000000 ____D () C:\Users\Gast\AppData\Roaming\ATI

2015-03-30 17:03 - 2015-03-30 17:03 - 00000000 ____D () C:\Users\Gast\AppData\Roaming\Adobe

2015-03-30 17:03 - 2015-03-30 17:03 - 00000000 ____D () C:\Users\Gast\AppData\Local\VirtualStore

2015-03-30 17:03 - 2015-03-30 17:03 - 00000000 ____D () C:\Users\Gast\AppData\Local\Packages

2015-03-30 17:03 - 2015-03-30 17:03 - 00000000 ____D () C:\Users\Gast\AppData\Local\Avg2015

2015-03-30 17:03 - 2015-03-30 17:03 - 00000000 ____D () C:\Users\Gast\AppData\Local\AVG Web TuneUp

2015-03-30 17:03 - 2015-03-30 17:03 - 00000000 ____D () C:\Users\Gast\AppData\Local\ATI

2015-03-30 17:03 - 2015-03-30 17:03 - 00000000 ____D () C:\Users\Gast

2015-03-30 17:03 - 2015-03-10 00:19 - 00000000 ___RD () C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools

2015-03-30 17:03 - 2014-11-21 17:14 - 00000000 ___RD () C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories

2015-03-30 17:03 - 2014-11-21 17:14 - 00000000 ___RD () C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility

2015-03-30 17:03 - 2014-11-21 09:48 - 00000369 _____ () C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pictures.lnk

2015-03-30 17:03 - 2014-11-21 09:48 - 00000369 _____ () C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Documents.lnk

2015-03-30 17:03 - 2013-08-22 17:36 - 00000000 ____D () C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance

2015-03-30 16:34 - 2015-03-30 16:34 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2015-03-30 16:34 - 2015-03-30 16:34 - 00000000 ____D () C:\ProgramData\Sun

2015-03-30 16:34 - 2015-03-30 16:34 - 00000000 ____D () C:\ProgramData\Oracle

2015-03-30 16:34 - 2015-03-30 16:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java

2015-03-30 16:34 - 2015-03-30 16:34 - 00000000 ____D () C:\Program Files (x86)\Java

2015-03-30 16:29 - 2015-03-30 16:29 - 00001175 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

2015-03-30 16:29 - 2015-03-30 16:29 - 00000000 ____D () C:\Users\Seufus\AppData\Roaming\Mozilla

2015-03-30 16:29 - 2015-03-30 16:29 - 00000000 ____D () C:\Users\Seufus\AppData\Local\Mozilla

2015-03-30 16:29 - 2015-03-30 16:29 - 00000000 ____D () C:\ProgramData\Mozilla

2015-03-30 16:29 - 2015-03-30 16:29 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

2015-03-30 16:29 - 2015-03-30 16:29 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2015-03-30 16:18 - 2015-03-30 16:18 - 00000000 ____D () C:\Users\Gast\Desktop\Neuer Ordner (4)

2015-03-30 16:17 - 2015-03-30 16:17 - 00000000 ____D () C:\Users\Gast\Desktop\Joaquín Sabina

2015-03-30 16:13 - 2015-03-30 16:13 - 00000000 ____D () C:\Users\Gast\Desktop\jkhkj

2015-03-30 16:12 - 2015-03-30 16:12 - 00000000 ____D () C:\Users\Gast\Desktop\Ethnic & Oriental Lounge Vol.1 (Relaxation Mystic Chill Out)

2015-03-30 16:11 - 2015-03-30 16:11 - 00000000 ____D () C:\Users\Gast\Desktop\Der kleine Pinz CD 1

2015-03-30 16:09 - 2015-03-30 16:09 - 00040448 ___SH () C:\Users\Seufus\Desktop\Thumbs.db

2015-03-30 16:02 - 2015-03-30 16:02 - 00001933 _____ () C:\Users\Seufus\Desktop\aswMBR.txt

2015-03-30 16:02 - 2015-03-30 16:02 - 00000512 _____ () C:\Users\Seufus\Desktop\MBR.dat

2015-03-30 15:55 - 2015-03-30 15:55 - 05198336 _____ (AVAST Software) C:\Users\Seufus\Downloads\aswMBR.exe

2015-03-30 13:43 - 2015-03-30 13:43 - 00000000 ____D () C:\Users\Seufus\AppData\Local\Intel

2015-03-30 13:43 - 2015-03-30 13:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel Driver Update Utility

2015-03-30 13:43 - 2015-03-30 13:43 - 00000000 ____D () C:\Program Files (x86)\Intel Driver Update Utility

2015-03-30 13:39 - 2015-03-30 13:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavalys

2015-03-30 13:39 - 2015-03-30 13:39 - 00000000 ____D () C:\Program Files (x86)\Lavalys

2015-03-30 13:26 - 2015-03-30 13:26 - 00000000 ____D () C:\Users\Seufus\AppData\Local\AVG Web TuneUp

2015-03-30 13:26 - 2015-03-30 13:26 - 00000000 ____D () C:\ProgramData\AVG Web TuneUp

2015-03-30 13:26 - 2015-03-30 13:26 - 00000000 ____D () C:\ProgramData\AVG Security Toolbar

2015-03-30 13:26 - 2015-03-30 13:26 - 00000000 ____D () C:\ProgramData\AVG Secure Search

2015-03-30 13:26 - 2015-03-30 13:26 - 00000000 ____D () C:\Program Files\AVG Web TuneUp

2015-03-30 13:26 - 2015-03-30 13:26 - 00000000 ____D () C:\Program Files (x86)\AVG Web TuneUp

2015-03-30 13:19 - 2015-03-30 13:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG

2015-03-30 13:19 - 2015-03-30 13:19 - 00000000 ___HD () C:\$AVG

2015-03-30 13:19 - 2015-03-30 13:19 - 00000000 ____D () C:\Users\Seufus\AppData\Roaming\TuneUp Software

2015-03-30 13:19 - 2015-03-30 13:19 - 00000000 ____D () C:\Users\Seufus\AppData\Roaming\AVG2015

2015-03-30 13:19 - 2015-03-30 13:19 - 00000000 ____D () C:\ProgramData\AVG2015

2015-03-30 13:19 - 2015-03-30 13:19 - 00000000 ____D () C:\Program Files (x86)\AVG

2015-03-30 13:18 - 2015-03-30 13:19 - 00000000 ____D () C:\Users\Seufus\AppData\Local\Avg2015

2015-03-30 13:17 - 2015-03-31 08:25 - 00000000 ____D () C:\ProgramData\MFAData

2015-03-30 13:17 - 2015-03-30 13:17 - 00000000 ____D () C:\Users\Seufus\AppData\Local\MFAData

2015-03-30 13:17 - 2015-03-30 13:17 - 00000000 ____D () C:\Users\Seufus\AppData\Local\Avg2014

2015-03-30 13:10 - 2015-03-31 08:24 - 00000000 ____D () C:\Users\Seufus\AppData\Roaming\ClassicShell

2015-03-30 13:10 - 2015-03-30 13:10 - 00000000 ____D () C:\ProgramData\ClassicShell

2015-03-30 13:09 - 2015-03-30 13:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Classic Shell

2015-03-30 13:09 - 2015-03-30 13:09 - 00000000 ____D () C:\Program Files\Classic Shell

2015-03-30 13:07 - 2015-03-30 13:07 - 00000000 __SHD () C:\Users\Seufus\AppData\Local\EmieUserList

2015-03-30 13:07 - 2015-03-30 13:07 - 00000000 __SHD () C:\Users\Seufus\AppData\Local\EmieSiteList

2015-03-30 13:07 - 2015-03-30 13:07 - 00000000 __SHD () C:\Users\Seufus\AppData\Local\EmieBrowserModeList

2015-03-30 13:07 - 2015-03-30 13:07 - 00000000 ____D () C:\Users\Seufus\AppData\Roaming\Macromedia

2015-03-30 13:04 - 2015-03-31 00:53 - 00003598 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-4216540600-1385818188-3882979393-1001

2015-03-30 12:59 - 2015-03-30 12:59 - 00001454 _____ () C:\Users\Seufus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

2015-03-30 12:59 - 2015-03-30 12:59 - 00000000 ____D () C:\Users\Seufus\AppData\Roaming\ATI

2015-03-30 12:59 - 2015-03-30 12:59 - 00000000 ____D () C:\Users\Seufus\AppData\Roaming\Adobe

2015-03-30 12:59 - 2015-03-30 12:59 - 00000000 ____D () C:\Users\Seufus\AppData\Local\ATI

2015-03-30 12:44 - 2015-03-30 12:44 - 00000000 ____D () C:\Users\Seufus\AppData\Local\VirtualStore

2015-03-30 12:41 - 2015-03-31 00:14 - 00000000 ____D () C:\Program Files (x86)\ATI Technologies

2015-03-30 12:41 - 2015-03-30 13:43 - 00000000 ____D () C:\ProgramData\Package Cache

2015-03-30 12:41 - 2015-03-30 12:41 - 00060817 _____ () C:\Windows\SysWOW64\CCCInstall_201503301241485866.log

2015-03-30 12:40 - 2015-03-31 00:14 - 00000000 ____D () C:\Program Files\AMD

2015-03-30 12:40 - 2015-03-31 00:12 - 00000000 ____D () C:\AMD

2015-03-30 12:40 - 2015-03-30 16:16 - 00000000 ____D () C:\Users\Seufus\AppData\Local\Packages

2015-03-30 12:40 - 2015-03-30 12:40 - 00000000 _____ () C:\Windows\ativpsrm.bin

2015-03-30 12:36 - 2015-03-30 12:59 - 00000000 ____D () C:\Users\Seufus

2015-03-30 12:36 - 2015-03-30 12:36 - 00000020 ___SH () C:\Users\Seufus\ntuser.ini

2015-03-30 12:36 - 2015-03-30 12:36 - 00000000 _SHDL () C:\Users\Seufus\Vorlagen

2015-03-30 12:36 - 2015-03-30 12:36 - 00000000 _SHDL () C:\Users\Seufus\Startmenü

2015-03-30 12:36 - 2015-03-30 12:36 - 00000000 _SHDL () C:\Users\Seufus\Netzwerkumgebung

2015-03-30 12:36 - 2015-03-30 12:36 - 00000000 _SHDL () C:\Users\Seufus\Lokale Einstellungen

2015-03-30 12:36 - 2015-03-30 12:36 - 00000000 _SHDL () C:\Users\Seufus\Eigene Dateien

2015-03-30 12:36 - 2015-03-30 12:36 - 00000000 _SHDL () C:\Users\Seufus\Druckumgebung

2015-03-30 12:36 - 2015-03-30 12:36 - 00000000 _SHDL () C:\Users\Seufus\Documents\Eigene Musik

2015-03-30 12:36 - 2015-03-30 12:36 - 00000000 _SHDL () C:\Users\Seufus\Documents\Eigene Bilder

2015-03-30 12:36 - 2015-03-30 12:36 - 00000000 _SHDL () C:\Users\Seufus\AppData\Roaming\Microsoft\Windows\Start Menu\Programme

2015-03-30 12:36 - 2015-03-30 12:36 - 00000000 _SHDL () C:\Users\Seufus\AppData\Local\Verlauf

2015-03-30 12:36 - 2015-03-30 12:36 - 00000000 _SHDL () C:\Users\Seufus\AppData\Local\Anwendungsdaten

2015-03-30 12:36 - 2015-03-30 12:36 - 00000000 _SHDL () C:\Users\Seufus\Anwendungsdaten

2015-03-30 12:36 - 2015-03-10 00:19 - 00000000 ___RD () C:\Users\Seufus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools

2015-03-30 12:36 - 2014-11-21 17:14 - 00000000 ___RD () C:\Users\Seufus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories

2015-03-30 12:36 - 2014-11-21 17:14 - 00000000 ___RD () C:\Users\Seufus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility

2015-03-30 12:36 - 2014-11-21 09:48 - 00000369 _____ () C:\Users\Seufus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pictures.lnk

2015-03-30 12:36 - 2014-11-21 09:48 - 00000369 _____ () C:\Users\Seufus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Documents.lnk

2015-03-30 12:36 - 2013-08-22 17:36 - 00000000 ____D () C:\Users\Seufus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance

2015-03-30 12:34 - 2015-03-31 00:04 - 00000000 ____D () C:\Program Files\KMSpico

2015-03-30 12:34 - 2015-03-30 12:34 - 00004608 _____ () C:\Windows\SECOH-QAD.exe

2015-03-30 12:34 - 2015-03-30 12:34 - 00003584 _____ () C:\Windows\SECOH-QAD.dll

2015-03-30 12:34 - 2010-12-06 04:16 - 00090112 _____ (Vestris Inc.) C:\Windows\system32\Vestris.ResourceLib.dll

2015-03-30 12:32 - 2015-03-31 08:22 - 01127967 _____ () C:\Windows\WindowsUpdate.log

2015-03-30 12:32 - 2015-03-30 12:32 - 00000000 ____D () C:\Windows\CSC

2015-03-30 12:29 - 2015-03-30 12:29 - 00000000 _SHDL () C:\Users\Public\Documents\Eigene Musik

2015-03-30 12:29 - 2015-03-30 12:29 - 00000000 _SHDL () C:\Users\Public\Documents\Eigene Bilder

2015-03-30 12:29 - 2015-03-30 12:29 - 00000000 _SHDL () C:\Users\Default\Vorlagen

2015-03-30 12:29 - 2015-03-30 12:29 - 00000000 _SHDL () C:\Users\Default\Startmenü

2015-03-30 12:29 - 2015-03-30 12:29 - 00000000 _SHDL () C:\Users\Default\Netzwerkumgebung

2015-03-30 12:29 - 2015-03-30 12:29 - 00000000 _SHDL () C:\Users\Default\Lokale Einstellungen

2015-03-30 12:29 - 2015-03-30 12:29 - 00000000 _SHDL () C:\Users\Default\Eigene Dateien

2015-03-30 12:29 - 2015-03-30 12:29 - 00000000 _SHDL () C:\Users\Default\Druckumgebung

2015-03-30 12:29 - 2015-03-30 12:29 - 00000000 _SHDL () C:\Users\Default\Documents\Eigene Musik

2015-03-30 12:29 - 2015-03-30 12:29 - 00000000 _SHDL () C:\Users\Default\Documents\Eigene Bilder

2015-03-30 12:29 - 2015-03-30 12:29 - 00000000 _SHDL () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programme

2015-03-30 12:29 - 2015-03-30 12:29 - 00000000 _SHDL () C:\Users\Default\AppData\Local\Verlauf

2015-03-30 12:29 - 2015-03-30 12:29 - 00000000 _SHDL () C:\Users\Default\AppData\Local\Anwendungsdaten

2015-03-30 12:29 - 2015-03-30 12:29 - 00000000 _SHDL () C:\Users\Default\Anwendungsdaten

2015-03-30 12:29 - 2015-03-30 12:29 - 00000000 _SHDL () C:\Users\Default User\Documents\Eigene Musik

2015-03-30 12:29 - 2015-03-30 12:29 - 00000000 _SHDL () C:\Users\Default User\Documents\Eigene Bilder

2015-03-30 12:29 - 2015-03-30 12:29 - 00000000 _SHDL () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programme

2015-03-30 12:29 - 2015-03-30 12:29 - 00000000 _SHDL () C:\Users\Default User\AppData\Local\Verlauf

2015-03-30 12:29 - 2015-03-30 12:29 - 00000000 _SHDL () C:\Users\Default User\AppData\Local\Anwendungsdaten

2015-03-30 12:29 - 2015-03-30 12:29 - 00000000 _SHDL () C:\Programme

2015-03-30 12:29 - 2015-03-30 12:29 - 00000000 _SHDL () C:\ProgramData\Vorlagen

2015-03-30 12:29 - 2015-03-30 12:29 - 00000000 _SHDL () C:\ProgramData\Startmenü

2015-03-30 12:29 - 2015-03-30 12:29 - 00000000 _SHDL () C:\ProgramData\Microsoft\Windows\Start Menu\Programme

2015-03-30 12:29 - 2015-03-30 12:29 - 00000000 _SHDL () C:\ProgramData\Dokumente

2015-03-30 12:29 - 2015-03-30 12:29 - 00000000 _SHDL () C:\ProgramData\Anwendungsdaten

2015-03-30 12:29 - 2015-03-30 12:29 - 00000000 _SHDL () C:\Program Files\Gemeinsame Dateien

2015-03-30 12:29 - 2015-03-30 12:29 - 00000000 _SHDL () C:\Dokumente und Einstellungen

2015-03-30 12:28 - 2015-03-30 12:28 - 00000000 __SHD () C:\Recovery

2015-03-30 12:27 - 2015-03-30 12:27 - 00002326 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-4216540600-1385818188-3882979393-500

2015-03-25 11:21 - 2015-03-25 11:21 - 00281056 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgidsdrivera.sys

2015-03-19 16:05 - 2015-03-19 16:05 - 00289248 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgwfpa.sys

2015-03-11 19:46 - 2015-03-11 19:46 - 00002326 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3926316494-2145053832-294120142-500

2015-03-11 16:52 - 2015-03-31 08:23 - 00003758 _____ () C:\Windows\System32\Tasks\AutoKMS

2015-03-11 16:52 - 2015-03-11 16:52 - 00000000 ____D () C:\ProgramData\Microsoft Toolkit

2015-03-11 13:36 - 2015-03-11 13:36 - 00002326 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2539250862-3510011041-2209991536-500

2015-03-11 13:35 - 2015-03-30 12:26 - 00001644 _____ () C:\Windows\PFRO.log

2015-03-10 00:48 - 2015-03-31 00:47 - 00019010 _____ () C:\Windows\setupact.log

2015-03-10 00:48 - 2015-03-10 00:48 - 00000000 _____ () C:\Windows\setuperr.log

2015-03-10 00:46 - 2015-03-30 12:28 - 00002832 _____ () C:\Windows\DtcInstall.log

2015-03-10 00:11 - 2015-03-06 04:53 - 00430080 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll

2015-03-10 00:11 - 2015-03-06 04:33 - 00358912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll

2015-03-10 00:11 - 2015-02-26 01:26 - 04178944 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2015-03-10 00:11 - 2015-02-21 03:16 - 25021440 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2015-03-10 00:11 - 2015-02-20 05:03 - 00358912 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll

2015-03-10 00:11 - 2015-02-20 04:58 - 00044032 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll

2015-03-10 00:11 - 2015-02-20 04:20 - 00301056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll

2015-03-10 00:11 - 2015-02-20 04:15 - 00035840 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll

2015-03-10 00:11 - 2015-02-12 19:40 - 22291584 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll

2015-03-10 00:11 - 2015-02-12 19:34 - 19731824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll

2015-03-10 00:11 - 2015-01-31 01:20 - 00203264 _____ (Microsoft Corporation) C:\Windows\system32\ubpm.dll

2015-03-10 00:11 - 2015-01-29 20:45 - 01763352 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll

2015-03-10 00:11 - 2015-01-29 20:34 - 01488040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll

2015-03-10 00:11 - 2015-01-28 17:41 - 07472960 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2015-03-10 00:11 - 2015-01-28 17:41 - 01733440 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll

2015-03-10 00:11 - 2015-01-28 17:41 - 01498360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll

2015-03-10 00:11 - 2015-01-28 03:31 - 00402432 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll

2015-03-10 00:11 - 2015-01-28 03:11 - 00357376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll

2015-03-10 00:11 - 2015-01-27 06:22 - 00131584 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll

2015-03-10 00:11 - 2015-01-27 04:11 - 03547648 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll

2015-03-10 00:10 - 2015-02-21 02:41 - 12827648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2015-03-10 00:10 - 2015-02-21 02:27 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2015-03-10 00:10 - 2015-02-21 02:27 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll

2015-03-10 00:10 - 2015-02-21 02:25 - 19720192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2015-03-10 00:10 - 2015-02-21 01:58 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2015-03-10 00:10 - 2015-02-21 01:32 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2015-03-10 00:10 - 2015-02-20 04:49 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2015-03-10 00:10 - 2015-02-20 04:48 - 02886144 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2015-03-10 00:10 - 2015-02-20 04:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2015-03-10 00:10 - 2015-02-20 04:35 - 00816128 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2015-03-10 00:10 - 2015-02-20 04:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2015-03-10 00:10 - 2015-02-20 04:32 - 06035456 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2015-03-10 00:10 - 2015-02-20 04:09 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2015-03-10 00:10 - 2015-02-20 04:07 - 00145408 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll

2015-03-10 00:10 - 2015-02-20 04:06 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll

2015-03-10 00:10 - 2015-02-20 04:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2015-03-10 00:10 - 2015-02-20 04:03 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2015-03-10 00:10 - 2015-02-20 03:59 - 01032704 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll

2015-03-10 00:10 - 2015-02-20 03:56 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2015-03-10 00:10 - 2015-02-20 03:52 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll

2015-03-10 00:10 - 2015-02-20 03:49 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2015-03-10 00:10 - 2015-02-20 03:49 - 00374272 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2015-03-10 00:10 - 2015-02-20 03:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2015-03-10 00:10 - 2015-02-20 03:43 - 14398976 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2015-03-10 00:10 - 2015-02-20 03:30 - 04300288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2015-03-10 00:10 - 2015-02-20 03:30 - 00880128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll

2015-03-10 00:10 - 2015-02-20 03:29 - 02865152 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll

2015-03-10 00:10 - 2015-02-20 03:28 - 02358784 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2015-03-10 00:10 - 2015-02-20 03:26 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll

2015-03-10 00:10 - 2015-02-20 03:24 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2015-03-10 00:10 - 2015-02-20 03:24 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2015-03-10 00:10 - 2015-02-20 03:16 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2015-03-10 00:10 - 2015-02-20 03:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2015-03-10 00:10 - 2015-02-20 03:01 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2015-03-10 00:10 - 2015-02-20 02:57 - 01311232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2015-03-10 00:10 - 2015-02-20 02:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2015-03-10 00:09 - 2015-02-08 01:57 - 01090048 _____ (Microsoft Corporation) C:\Windows\system32\MrmCoreR.dll

2015-03-10 00:09 - 2015-02-08 01:49 - 00791040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MrmCoreR.dll

2015-03-10 00:09 - 2015-02-07 01:09 - 00396419 _____ () C:\Windows\system32\ApnDatabase.xml

2015-03-10 00:09 - 2015-02-06 03:28 - 02257408 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll

2015-03-10 00:09 - 2015-02-06 03:08 - 01943040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll

2015-03-10 00:09 - 2015-02-05 22:24 - 01113920 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys

2015-03-10 00:09 - 2015-02-04 01:58 - 00264000 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdFilter.sys

2015-03-10 00:09 - 2015-02-04 01:58 - 00114496 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdNisDrv.sys

2015-03-10 00:09 - 2015-02-04 01:58 - 00044024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdBoot.sys

2015-03-10 00:09 - 2015-02-03 02:03 - 03551744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_47.dll

2015-03-10 00:09 - 2015-02-03 02:02 - 04298240 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_47.dll

2015-03-10 00:09 - 2015-02-03 01:53 - 00014848 _____ (Microsoft Corporation) C:\Windows\system32\winshfhc.dll

2015-03-10 00:09 - 2015-02-03 01:53 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winshfhc.dll

2015-03-10 00:09 - 2015-01-30 05:01 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidbth.sys

2015-03-10 00:09 - 2015-01-30 04:03 - 01488896 _____ (Microsoft Corporation) C:\Windows\system32\mfc42u.dll

2015-03-10 00:09 - 2015-01-30 04:03 - 01464832 _____ (Microsoft Corporation) C:\Windows\system32\mfc42.dll

2015-03-10 00:09 - 2015-01-30 03:44 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc42u.dll

2015-03-10 00:09 - 2015-01-30 03:42 - 01204224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc42.dll

2015-03-10 00:09 - 2015-01-30 03:29 - 00035840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\atlthunk.dll

2015-03-10 00:09 - 2015-01-29 03:04 - 01091072 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll

2015-03-10 00:09 - 2015-01-29 03:04 - 00864256 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll

2015-03-10 00:09 - 2015-01-29 02:59 - 02773504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll

2015-03-10 00:09 - 2015-01-29 02:49 - 02459136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll

2015-03-10 00:09 - 2015-01-28 01:47 - 02501368 _____ (Microsoft Corporation) C:\Windows\explorer.exe

2015-03-10 00:09 - 2015-01-28 01:41 - 02207488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe

2015-03-10 00:08 - 2015-01-31 01:42 - 03097600 _____ (Microsoft Corporation) C:\Windows\system32\msftedit.dll

2015-03-10 00:08 - 2015-01-31 01:29 - 02484224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msftedit.dll

2015-03-10 00:08 - 2015-01-30 04:02 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\eappgnui.dll

2015-03-10 00:08 - 2015-01-30 03:40 - 00091648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\eappgnui.dll

2015-03-10 00:08 - 2015-01-30 03:37 - 00331776 _____ (Microsoft Corporation) C:\Windows\system32\eapp3hst.dll

2015-03-10 00:08 - 2015-01-30 03:24 - 00339456 _____ (Microsoft Corporation) C:\Windows\system32\eapphost.dll

2015-03-10 00:08 - 2015-01-30 03:24 - 00250880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\eapp3hst.dll

2015-03-10 00:08 - 2015-01-30 03:16 - 00266752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\eapphost.dll

2015-03-10 00:08 - 2015-01-30 03:08 - 00346112 _____ (Microsoft Corporation) C:\Windows\system32\eappcfg.dll

2015-03-10 00:08 - 2015-01-30 03:06 - 00278016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\eappcfg.dll

2015-03-10 00:08 - 2015-01-29 03:58 - 00347136 _____ (Microsoft Corporation) C:\Windows\system32\photowiz.dll

2015-03-10 00:08 - 2015-01-29 03:29 - 00290816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\photowiz.dll

2015-03-10 00:08 - 2015-01-29 03:11 - 00274944 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll

2015-03-10 00:08 - 2015-01-29 03:00 - 00210944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll

2015-03-10 00:08 - 2015-01-29 02:55 - 00971776 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll

2015-03-10 00:08 - 2015-01-29 02:50 - 00811008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll

2015-03-10 00:08 - 2015-01-28 04:24 - 00075264 _____ (Microsoft Corporation) C:\Windows\system32\StorageContextHandler.dll

2015-03-10 00:08 - 2015-01-28 03:47 - 00060928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\StorageContextHandler.dll

2015-03-10 00:08 - 2015-01-27 05:44 - 00933888 _____ (Microsoft Corporation) C:\Windows\system32\calc.exe

2015-03-10 00:08 - 2015-01-24 03:51 - 00816128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\calc.exe

2015-03-10 00:08 - 2015-01-23 09:17 - 00723072 _____ (Microsoft Corporation) C:\Windows\system32\SHCore.dll

2015-03-10 00:08 - 2015-01-23 07:02 - 00560392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SHCore.dll

2015-03-10 00:08 - 2014-12-11 07:36 - 00046456 _____ (Microsoft Corporation) C:\Windows\system32\LockScreenContentServer.exe

2015-03-09 23:42 - 2014-12-13 23:28 - 00513488 _____ () C:\Windows\SysWOW64\locale.nls

2015-03-09 23:42 - 2014-12-13 23:28 - 00513488 _____ () C:\Windows\system32\locale.nls

2015-03-09 23:25 - 2015-03-09 23:25 - 00000000 _SHDL () C:\Users\Public\Documents\Mes vidéos

2015-03-09 23:25 - 2015-03-09 23:25 - 00000000 _SHDL () C:\Users\Public\Documents\Mes images

2015-03-09 23:25 - 2015-03-09 23:25 - 00000000 _SHDL () C:\Users\Public\Documents\Ma musique

2015-03-09 23:25 - 2015-03-09 23:25 - 00000000 _SHDL () C:\Users\Default\Voisinage réseau

2015-03-09 23:25 - 2015-03-09 23:25 - 00000000 _SHDL () C:\Users\Default\Voisinage d'impression

2015-03-09 23:25 - 2015-03-09 23:25 - 00000000 _SHDL () C:\Users\Default\Modèles

2015-03-09 23:25 - 2015-03-09 23:25 - 00000000 _SHDL () C:\Users\Default\Menu Démarrer

2015-03-09 23:25 - 2015-03-09 23:25 - 00000000 _SHDL () C:\Users\Default\Documents\Mes vidéos

2015-03-09 23:25 - 2015-03-09 23:25 - 00000000 _SHDL () C:\Users\Default\Documents\Mes images

2015-03-09 23:25 - 2015-03-09 23:25 - 00000000 _SHDL () C:\Users\Default\Documents\Ma musique

2015-03-09 23:25 - 2015-03-09 23:25 - 00000000 _SHDL () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programmes

2015-03-09 23:25 - 2015-03-09 23:25 - 00000000 _SHDL () C:\Users\Default\AppData\Local\Historique

2015-03-09 23:25 - 2015-03-09 23:25 - 00000000 _SHDL () C:\Users\Default User\Documents\Mes vidéos

2015-03-09 23:25 - 2015-03-09 23:25 - 00000000 _SHDL () C:\Users\Default User\Documents\Mes images

2015-03-09 23:25 - 2015-03-09 23:25 - 00000000 _SHDL () C:\Users\Default User\Documents\Ma musique

2015-03-09 23:25 - 2015-03-09 23:25 - 00000000 _SHDL () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programmes

2015-03-09 23:25 - 2015-03-09 23:25 - 00000000 _SHDL () C:\Users\Default User\AppData\Local\Historique

2015-03-09 23:25 - 2015-03-09 23:25 - 00000000 _SHDL () C:\ProgramData\Modèles

2015-03-09 23:25 - 2015-03-09 23:25 - 00000000 _SHDL () C:\ProgramData\Microsoft\Windows\Start Menu\Programmes

2015-03-09 23:25 - 2015-03-09 23:25 - 00000000 _SHDL () C:\ProgramData\Menu Démarrer

2015-03-09 23:25 - 2015-03-09 23:25 - 00000000 _SHDL () C:\ProgramData\Bureau

2015-03-09 23:25 - 2015-03-09 23:25 - 00000000 _SHDL () C:\Program Files\Fichiers communs

2015-03-09 23:19 - 2015-03-09 23:19 - 00002324 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-906833649-1322662672-2572310967-500

2015-03-09 21:16 - 2015-03-31 00:52 - 00764776 _____ () C:\Windows\system32\perfh00C.dat

2015-03-09 21:16 - 2015-03-31 00:52 - 00150868 _____ () C:\Windows\system32\perfc00C.dat

2015-03-09 21:16 - 2015-03-09 21:16 - 00350772 _____ () C:\Windows\system32\perfi00C.dat

2015-03-09 21:16 - 2015-03-09 21:16 - 00040528 _____ () C:\Windows\system32\perfd00C.dat

2015-03-09 21:16 - 2015-03-09 21:16 - 00000000 ____D () C:\Windows\SysWOW64\fr

2015-03-09 21:16 - 2015-03-09 21:16 - 00000000 ____D () C:\Windows\system32\fr

2015-03-09 21:11 - 2015-03-31 00:52 - 00763552 _____ () C:\Windows\system32\perfh00A.dat

2015-03-09 21:11 - 2015-03-31 00:52 - 00158234 _____ () C:\Windows\system32\perfc00A.dat

2015-03-09 21:11 - 2015-03-09 21:11 - 00346516 _____ () C:\Windows\system32\perfi00A.dat

2015-03-09 21:11 - 2015-03-09 21:11 - 00043804 _____ () C:\Windows\system32\perfd00A.dat

2015-03-09 21:11 - 2015-03-09 21:11 - 00000000 ____D () C:\Windows\SysWOW64\es

2015-03-09 21:11 - 2015-03-09 21:11 - 00000000 ____D () C:\Windows\system32\es

2015-03-09 21:06 - 2015-03-31 00:52 - 00726688 _____ () C:\Windows\system32\perfh007.dat

2015-03-09 21:06 - 2015-03-31 00:52 - 00151380 _____ () C:\Windows\system32\perfc007.dat

2015-03-09 21:06 - 2015-03-09 21:06 - 00305634 _____ () C:\Windows\system32\perfi007.dat

2015-03-09 21:06 - 2015-03-09 21:06 - 00040390 _____ () C:\Windows\system32\perfd007.dat

2015-03-09 21:06 - 2015-03-09 21:06 - 00000000 ____D () C:\Windows\SysWOW64\de

2015-03-09 21:06 - 2015-03-09 21:06 - 00000000 ____D () C:\Windows\system32\de
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2015-03-31 00:52 - 2014-11-21 09:38 - 03523776 _____ () C:\Windows\system32\PerfStringBackup.INI

2015-03-31 00:47 - 2013-08-22 16:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2015-03-31 00:46 - 2013-08-22 15:25 - 00262144 ___SH () C:\Windows\system32\config\BBI

2015-03-31 00:40 - 2013-08-22 17:20 - 00000000 ____D () C:\Windows\CbsTemp

2015-03-31 00:25 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\sru

2015-03-30 23:27 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\AppReadiness

2015-03-30 22:25 - 2013-08-22 17:36 - 00262144 _____ () C:\Windows\system32\config\BCD-Template

2015-03-30 13:21 - 2013-08-22 15:25 - 00262144 ___SH () C:\Windows\system32\config\ELAM

2015-03-30 13:19 - 2013-08-22 17:36 - 00000000 ___HD () C:\Windows\ELAMBKUP

2015-03-30 12:59 - 2013-08-22 16:45 - 00000000 ____D () C:\Windows\Setup

2015-03-30 12:40 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\restore

2015-03-30 12:29 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\rescache

2015-03-30 12:29 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\Windows NT

2015-03-30 12:29 - 2013-08-22 15:36 - 00000000 __RHD () C:\Users\Default

2015-03-30 12:28 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\Recovery

2015-03-11 19:50 - 2013-08-22 15:36 - 00000000 ____D () C:\Windows\system32\Sysprep

2015-03-10 00:22 - 2013-08-22 16:44 - 00338752 _____ () C:\Windows\system32\FNTCACHE.DAT

2015-03-10 00:19 - 2013-08-22 17:36 - 00000000 ___RD () C:\Windows\ToastData

2015-03-10 00:19 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools

2015-03-10 00:19 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools

2015-03-10 00:19 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\WinStore

2015-03-10 00:19 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\PolicyDefinitions

2015-03-10 00:19 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\Windows Defender

2015-03-10 00:19 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files (x86)\Windows Defender

2015-03-10 00:12 - 2013-08-22 17:36 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories

2015-03-09 23:45 - 2015-02-16 00:30 - 00000000 ____D () C:\Windows\system32\MRT

2015-03-09 23:44 - 2015-02-16 00:30 - 122905848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2015-03-09 21:16 - 2014-11-21 09:18 - 00000000 ____D () C:\Program Files\Windows Journal

2015-03-09 21:16 - 2014-11-21 08:54 - 00000000 ____D () C:\Windows\SysWOW64\winrm

2015-03-09 21:16 - 2014-11-21 08:54 - 00000000 ____D () C:\Windows\SysWOW64\WCN

2015-03-09 21:16 - 2014-11-21 08:54 - 00000000 ____D () C:\Windows\SysWOW64\slmgr

2015-03-09 21:16 - 2014-11-21 08:54 - 00000000 ____D () C:\Windows\SysWOW64\Printing_Admin_Scripts

2015-03-09 21:16 - 2014-11-21 08:54 - 00000000 ____D () C:\Windows\system32\winrm

2015-03-09 21:16 - 2014-11-21 08:54 - 00000000 ____D () C:\Windows\system32\WCN

2015-03-09 21:16 - 2014-11-21 08:54 - 00000000 ____D () C:\Windows\system32\slmgr

2015-03-09 21:16 - 2014-11-21 08:54 - 00000000 ____D () C:\Windows\system32\Printing_Admin_Scripts

2015-03-09 21:16 - 2013-08-22 17:36 - 00000000 ___SD () C:\Windows\system32\dsc

2015-03-09 21:16 - 2013-08-22 17:36 - 00000000 ___RD () C:\Windows\ImmersiveControlPanel

2015-03-09 21:16 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\SysWOW64\Com

2015-03-09 21:16 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\SystemResetPlatform

2015-03-09 21:16 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\migwiz

2015-03-09 21:16 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\Com

2015-03-09 21:16 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\IME

2015-03-09 21:16 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\Help

2015-03-09 21:16 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\FileManager

2015-03-09 21:16 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\Windows Photo Viewer

2015-03-09 21:16 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\Common Files\System

2015-03-09 21:16 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files (x86)\Windows Photo Viewer

2015-03-09 21:16 - 2013-08-22 15:36 - 00000000 ____D () C:\Windows\SysWOW64\oobe

2015-03-09 21:16 - 2013-08-22 15:36 - 00000000 ____D () C:\Windows\SysWOW64\Dism

2015-03-09 21:16 - 2013-08-22 15:36 - 00000000 ____D () C:\Windows\system32\oobe

2015-03-09 21:16 - 2013-08-22 15:36 - 00000000 ____D () C:\Windows\system32\Dism

2015-03-09 21:16 - 2013-08-22 15:36 - 00000000 ____D () C:\Windows\servicing

2015-03-04 23:24 - 2015-02-16 00:42 - 00792032 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2015-03-04 23:24 - 2015-02-16 00:42 - 00178144 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2015-03-03 15:17 - 2015-02-16 00:35 - 00295552 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
 

Some content of TEMP:

====================

C:\Users\Seufus\AppData\Local\Temp\raptrpatch.exe

C:\Users\Seufus\AppData\Local\Temp\raptr_stub.exe
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2015-02-15 23:48
 

==================== End Of Log ============================

--- --- ---

--- --- ---

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-03-2015

Ran by Seufus at 2015-03-31 08:27:56

Running from C:\Users\Seufus\Desktop

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

(If an entry is included in the fixlist, it will be removed.)
 

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AV: AVG Internet Security 2015 (Enabled - Up to date) {4D41356F-32AD-7C42-C820-63775EE4F413}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: AVG Internet Security 2015 (Enabled - Up to date) {F620D48B-1497-73CC-F290-58052563BEAE}

FW: AVG Internet Security 2015 (Enabled) {757AB44A-78C2-7D1A-E37F-CA42A037B368}
 

==================== Installed Programs ======================
 

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 

AMD Catalyst Install Manager (HKLM\...\{F2A7CE36-57BF-5C86-952D-90DBF3746D82}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.)

AVG 2015 (HKLM\...\AVG) (Version: 2015.0.5863 - AVG Technologies)

AVG 2015 (Version: 15.0.4321 - AVG Technologies) Hidden

AVG 2015 (Version: 15.0.5863 - AVG Technologies) Hidden

AVG Web TuneUp (HKLM-x32\...\AVG Web TuneUp) (Version: 4.1.0.411 - AVG Technologies)

Catalyst Control Center (HKLM-x32\...\WUCCCApp) (Version: 1.00.0000 - AMD)

Classic Shell (HKLM\...\{840C85B7-D3D6-4143-9AF9-DAE80FD54CFC}) (Version: 4.1.0 - IvoSoft)

Common Desktop Agent (Version: 1.62.0 - OEM) Hidden

EVEREST Home Edition v2.20 (HKLM-x32\...\EVEREST Home Edition_is1) (Version: 2.20 - Lavalys Inc)

Intel(R) Driver Update Utility 2.0 (x32 Version: 2.0.0.29 - Intel) Hidden

Intel® Driver Update Utility (HKLM-x32\...\{8409c4f7-2340-4933-a304-5d37db4fb48b}) (Version: 2.0.0.29 - Intel)

Java 8 Update 40 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218040F0}) (Version: 8.0.400 - Oracle Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)

Mozilla Firefox 36.0.4 (x86 de) (HKLM-x32\...\Mozilla Firefox 36.0.4 (x86 de)) (Version: 36.0.4 - Mozilla)

Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 36.0.4 - Mozilla)

Raptr (HKLM-x32\...\Raptr) (Version:  - )

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7404 - Realtek Semiconductor Corp.)

Samsung Easy Document Creator (HKLM-x32\...\Samsung Easy Document Creator) (Version: 1.06.50 (16.12.2014) - Samsung Electronics Co., Ltd.)

Samsung Easy Printer Manager (HKLM-x32\...\Samsung Easy Printer Manager) (Version: 1.05.75.00(19.01.2015) - Samsung Electronics Co., Ltd.)

Samsung Scan Process Machine (x32 Version: 1.03.05.22 - Samsung Electronics Co., Ltd.) Hidden

SNS Upload for Easy Document Creator (HKLM-x32\...\{B6B5F07C-88D5-49D3-A1A7-A6D4BC37DCCC}) (Version: 1.0.0 - Samsung Electronics Co.,Ltd)

Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)

Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)

Winamp (HKLM-x32\...\Winamp) (Version: 5.666  - Nullsoft, Inc)
 

==================== Custom CLSID (selected items): ==========================
 

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
 
 

==================== Restore Points  =========================
 

30-03-2015 12:40:58 Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727
 

==================== Hosts content: ==========================
 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 

2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
 

==================== Scheduled Tasks (whitelisted) =============
 

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
 

Task: {4BF5163A-A246-4088-9436-16C532F1CAE8} - System32\Tasks\AutoKMS => C:\Windows\AutoKMS\AutoKMS.exe [2015-03-11] ()

Task: {4FBF1401-161F-43D7-8C93-C04C07B203CD} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-24] (Microsoft Corporation)

Task: {5DA91D73-C245-4A19-89BF-73D03CF22759} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxcontent => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-24] (Microsoft Corporation)

Task: {9830635D-9B86-4BD0-B68C-43123FAB7144} - System32\Tasks\Microsoft\Windows\Setup\gwx\runappraiser => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-24] (Microsoft Corporation)

Task: {C00834C8-CF82-483C-93A4-271CDF36FBC4} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-03-24] (Microsoft Corporation)

Task: {DE34A060-BF2B-43BC-B181-B3E08AEE5E7F} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2015-03-09] (Microsoft Corporation)
 

==================== Loaded Modules (whitelisted) ==============
 

2015-03-30 13:26 - 2015-03-30 13:26 - 00620056 ____N () C:\Program Files (x86)\AVG Web TuneUp\WtuSystemSupport.exe

2015-02-20 08:01 - 2015-02-20 08:01 - 00022528 _____ () C:\Windows\System32\us001lm.dll

2015-03-30 13:26 - 2015-03-30 13:26 - 00159768 _____ () C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.4.0\loggingserver.exe

2014-09-08 13:39 - 2014-09-08 13:39 - 00464608 _____ () C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe

2014-09-08 13:38 - 2014-09-08 13:38 - 00051200 _____ () C:\Program Files\Common Files\Common Desktop Agent\CDASrvPS.dll

2015-03-30 13:26 - 2015-03-30 13:26 - 03033112 _____ () C:\Program Files (x86)\AVG Web TuneUp\vprot.exe

2015-03-30 13:26 - 2015-03-30 13:26 - 00519704 _____ () C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.4.0\log4cplusU.dll

2015-03-30 13:26 - 2015-03-30 13:26 - 01711128 _____ () C:\Program Files (x86)\AVG Web TuneUp\TBAPI.dll

2015-03-30 13:26 - 2015-03-30 13:26 - 40630296 _____ () C:\Program Files (x86)\AVG Web TuneUp\libcef.dll
 

==================== Alternate Data Streams (whitelisted) =========
 

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
 
 

==================== Safe Mode (whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
 

==================== EXE Association (whitelisted) ===============
 

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
 
 

==================== Other Areas ============================
 

(Currently there is no automatic fix for this section.)
 

HKU\S-1-5-21-4216540600-1385818188-3882979393-1001\Control Panel\Desktop\\Wallpaper -> C:\Windows\web\wallpaper\Windows\img0.jpg

DNS Servers: 192.168.2.1
 

==================== MSCONFIG/TASK MANAGER disabled items ==
 

(Currently there is no automatic fix for this section.)
 
 

==================== Accounts: =============================
 

Administrator (S-1-5-21-4216540600-1385818188-3882979393-500 - Administrator - Disabled)

Blau (S-1-5-21-4216540600-1385818188-3882979393-1006 - Limited - Enabled) => C:\Users\Blau

Gast (S-1-5-21-4216540600-1385818188-3882979393-501 - Limited - Disabled) => C:\Users\Gast

HomeGroupUser$ (S-1-5-21-4216540600-1385818188-3882979393-1004 - Limited - Enabled)

Seufus (S-1-5-21-4216540600-1385818188-3882979393-1001 - Administrator - Enabled) => C:\Users\Seufus
 

==================== Faulty Device Manager Devices =============
 
 

==================== Event log errors: =========================
 

Application errors:

==================
 

Error: (03/31/2015 00:14:08 AM) (Source: Microsoft-Windows-RestartManager) (EventID: 10006) (User: Bratrolli)

Description: Die Anwendung oder der Dienst "Catalyst Control Center: Monitoring program" konnte nicht heruntergefahren werden.
 

Error: (03/31/2015 00:14:08 AM) (Source: Microsoft-Windows-RestartManager) (EventID: 10006) (User: Bratrolli)

Description: Die Anwendung oder der Dienst "Catalyst Control Center: Host application" konnte nicht heruntergefahren werden.
 

Error: (03/30/2015 11:54:54 PM) (Source: SideBySide) (EventID: 33) (User: )

Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"1".

Die abhängige Assemblierung "Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"" konnte nicht gefunden werden.

Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
 

Error: (03/30/2015 11:54:54 PM) (Source: SideBySide) (EventID: 33) (User: )

Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"1".

Die abhängige Assemblierung "Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"" konnte nicht gefunden werden.

Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
 
 

System errors:

=============

Error: (03/31/2015 08:23:30 AM) (Source: DCOM) (EventID: 10016) (User: Bratrolli)

Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}BratrolliSeufusS-1-5-21-4216540600-1385818188-3882979393-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
 

Error: (03/31/2015 08:23:30 AM) (Source: DCOM) (EventID: 10016) (User: Bratrolli)

Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}BratrolliSeufusS-1-5-21-4216540600-1385818188-3882979393-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
 

Error: (03/31/2015 08:23:30 AM) (Source: DCOM) (EventID: 10016) (User: Bratrolli)

Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}BratrolliSeufusS-1-5-21-4216540600-1385818188-3882979393-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
 

Error: (03/31/2015 08:23:30 AM) (Source: DCOM) (EventID: 10016) (User: Bratrolli)

Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}BratrolliSeufusS-1-5-21-4216540600-1385818188-3882979393-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
 

Error: (03/31/2015 08:23:30 AM) (Source: DCOM) (EventID: 10016) (User: Bratrolli)

Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}BratrolliSeufusS-1-5-21-4216540600-1385818188-3882979393-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
 

Error: (03/31/2015 08:23:30 AM) (Source: DCOM) (EventID: 10016) (User: Bratrolli)

Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}BratrolliSeufusS-1-5-21-4216540600-1385818188-3882979393-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
 

Error: (03/31/2015 08:23:30 AM) (Source: DCOM) (EventID: 10016) (User: Bratrolli)

Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}BratrolliSeufusS-1-5-21-4216540600-1385818188-3882979393-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
 

Error: (03/31/2015 08:23:30 AM) (Source: DCOM) (EventID: 10016) (User: Bratrolli)

Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}BratrolliSeufusS-1-5-21-4216540600-1385818188-3882979393-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
 

Error: (03/31/2015 08:23:30 AM) (Source: DCOM) (EventID: 10016) (User: Bratrolli)

Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}BratrolliSeufusS-1-5-21-4216540600-1385818188-3882979393-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
 

Error: (03/31/2015 08:23:30 AM) (Source: DCOM) (EventID: 10016) (User: Bratrolli)

Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}BratrolliSeufusS-1-5-21-4216540600-1385818188-3882979393-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
 
 

Microsoft Office Sessions:

=========================
 

Error: (03/31/2015 00:14:08 AM) (Source: Microsoft-Windows-RestartManager) (EventID: 10006) (User: Bratrolli)

Description: 1C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exeCatalyst Control Center: Monitoring program0211762280
 

Error: (03/31/2015 00:14:08 AM) (Source: Microsoft-Windows-RestartManager) (EventID: 10006) (User: Bratrolli)

Description: 1C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exeCatalyst Control Center: Host application021174840
 

Error: (03/30/2015 11:54:54 PM) (Source: SideBySide) (EventID: 33) (User: )

Description: Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"C:\Program Files (x86)\Samsung\Easy Document Creator\x64\EDCAddin.dll
 

Error: (03/30/2015 11:54:54 PM) (Source: SideBySide) (EventID: 33) (User: )

Description: Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"C:\Program Files (x86)\Samsung\Easy Document Creator\x64\EDCAddin.dll
 
 
 
 

CodeIntegrity Errors:

===================================

  Date: 2015-03-30 13:39:15.204

  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Users\Seufus\AppData\Local\Temp\EverestDriver.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 

  Date: 2015-03-30 13:39:15.078

  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files (x86)\Lavalys\EVEREST Home Edition\kerneld.amd64 because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
 

==================== Memory info =========================== 
 

Processor: Intel(R) Core(TM) i3-2120 CPU @ 3.30GHz

Percentage of memory in use: 15%

Total physical RAM: 8157.18 MB

Available physical RAM: 6914.1 MB

Total Pagefile: 10077.18 MB

Available Pagefile: 8378.77 MB

Total Virtual: 131072 MB

Available Virtual: 131071.8 MB
 

==================== Drives ================================
 

Drive c: () (Fixed) (Total:1817.44 GB) (Free:1767.75 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (Size: 2794.5 GB) (Disk ID: AECC925E)
 

Partition: GPT Partition Type.
 

==================== End Of Log ============================

Gruss Gammel.