Trojaner-Board
Seite 4 von 5 « Erste 23 4 5
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Unregelmässiger Computer Freeze ohne ersichtlichem Grund (https://www.trojaner-board.de/163361-unregelmaessiger-computer-freeze-ohne-ersichtlichem-grund.html)

QueenZoe 23.02.2015 20:18
Hier der Bericht.

Code:
==================================================
Dump File        : 022015-5928-01.dmp
Crash Time        : 20.02.2015 18:55:32
Bug Check String  : DRIVER_IRQL_NOT_LESS_OR_EQUAL
Bug Check Code    : 0x000000d1
Parameter 1      : 00000000`00000044
Parameter 2      : 00000000`00000002
Parameter 3      : 00000000`00000000
Parameter 4      : fffff880`041b2864
Caused By Driver  : aswSP.sys
Caused By Address : aswSP.sys+34864
File Description  :
Product Name      :
Company          :
File Version      :
Processor        : x64
Crash Address    : ntoskrnl.exe+74ec0
Stack Address 1  :
Stack Address 2  :
Stack Address 3  :
Computer Name    :
Full Path        : C:\Windows\Minidump\022015-5928-01.dmp
Processors Count  : 8
Major Version    : 15
Minor Version    : 7601
Dump File Size    : 281'688
Dump File Time    : 20.02.2015 18:56:23
==================================================

schrauber 24.02.2015 07:15
Avast deinstallieren und neu installieren.

QueenZoe 28.02.2015 18:05
Mein PC freezed immer noch und manchmal habe ich noch ein Bluescreen :/.

schrauber 01.03.2015 09:07
Dann nochmal aktuelles Log von Bluescreenview. Die oben geposteten Bluescreens kommen alle von Avast.

QueenZoe 01.03.2015 10:07
Also soll ich einen anderen Antivirus runterladen?, oder ist das dann bei allen so, da das ja mit Kaspersky angefangen hat.

Code:
==================================================
Dump File        : 022815-5850-01.dmp
Crash Time        : 28.02.2015 17:27:34
Bug Check String  :
Bug Check Code    : 0x00000124
Parameter 1      : 00000000`00000000
Parameter 2      : fffffa80`07331028
Parameter 3      : 00000000`be000000
Parameter 4      : 00000000`0100110a
Caused By Driver  : hal.dll
Caused By Address : hal.dll+12a3b
File Description  :
Product Name      :
Company          :
File Version      :
Processor        : x64
Crash Address    : ntoskrnl.exe+74ec0
Stack Address 1  :
Stack Address 2  :
Stack Address 3  :
Computer Name    :
Full Path        : C:\Windows\Minidump\022815-5850-01.dmp
Processors Count  : 8
Major Version    : 15
Minor Version    : 7601
Dump File Size    : 281'688
Dump File Time    : 28.02.2015 17:28:27
==================================================

schrauber 01.03.2015 16:12
Ich sagte nur dass die aktuellsten Bluescreens von Avast kamen. Dieser ist ein anderer:

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)


QueenZoe 01.03.2015 21:19
Addition.txt

Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 29-02-2015
Ran by Chiara at 2015-03-01 21:17:56
Running from C:\Users\Chiara\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Photoshop CS2 (HKLM-x32\...\Adobe Photoshop CS2 - {236BB7C4-4419-42FD-0407-1E257A25E34D}) (Version: 9.0 - Adobe Systems, Inc.)
APB Reloaded (HKLM-x32\...\Steam App 113400) (Version:  - Reloaded Productions)
Apple Application Support (HKLM-x32\...\{83CAF0DE-8D3B-4C37-A631-2B8F16EC3031}) (Version: 3.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{BDD99690-3541-4619-9D2A-3CDDB3E15F9E}) (Version: 8.0.5.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 10.0.2208 - AVAST Software)
Battle.net (HKLM-x32\...\Battle.net) (Version:  - Blizzard Entertainment)
Battlefield 3™ (HKLM-x32\...\{76285C16-411A-488A-BCE3-C83CB933D8CF}) (Version: 1.6.0.0 - Electronic Arts)
Battlelog Web Plugins (HKLM-x32\...\Battlelog Web Plugins) (Version: 2.4.0 - EA Digital Illusions CE AB)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.4.4954 - CDBurnerXP)
CHIP Updater (HKLM-x32\...\CHIP Updater_is1) (Version: 2.26 - Abelssoft)
Counter-Strike 1.6 (HKLM-x32\...\Counter-Strike 1.6) (Version:  - )
CrystalDiskInfo 6.3.0 (HKLM-x32\...\CrystalDiskInfo_is1) (Version: 6.3.0 - Crystal Dew World)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DayZ (HKLM-x32\...\Steam App 221100) (Version:  - Bohemia Interactive)
Die Sims™ 3 (HKLM-x32\...\{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}) (Version: 1.67.2 - Electronic Arts)
Die Sims™ 3 Einfach tierisch (HKLM-x32\...\{C12631C6-804D-4B32-B0DD-8A496462F106}) (Version: 10.0.96 - Electronic Arts)
Die Sims™ 3 Inselparadies (HKLM-x32\...\{DB21639E-FE55-432C-BCA2-0C5249E3F79E}) (Version: 19.0.101 - Electronic Arts)
Dropbox (HKU\S-1-5-21-1268736343-3887576109-2910839842-1000\...\Dropbox) (Version: 3.0.5 - Dropbox, Inc.)
Dungeon Defenders (HKLM-x32\...\Steam App 65800) (Version:  - Trendy Entertainment)
Elsword (HKLM-x32\...\Elsword_de_is1) (Version:  - )
Euro Truck Simulator 2 (HKLM-x32\...\Steam App 227300) (Version:  - SCS Software)
Fotogalerie (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Fowl Space (HKLM-x32\...\Steam App 109500) (Version:  - Pixelante Game Studios)
Free YouTube to MP3 Converter version 3.12.44.908 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.44.908 - DVDVideoSoft Ltd.)
Gameforge Live 2.0.5 (HKLM-x32\...\{9C98989A-3A15-42DA-A3B9-D20331437D67}}_is1) (Version: 2.0.5 - Gameforge)
Garry's Mod (HKLM-x32\...\Steam App 4000) (Version:  - Facepunch Studios)
GIMP 2.8.10 (HKLM\...\GIMP-2_is1) (Version: 2.8.10 - The GIMP Team)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 40.0.2214.115 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
Humanity Asset (HKLM-x32\...\Steam App 271640) (Version:  - Browny Application)
Intel(R) Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 10.0.0.1204 - Intel Corporation)
Intel(R) Network Connections 19.1.51.0 (HKLM\...\PROSetDX) (Version: 19.1.51.0 - Intel)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3960 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 13.0.3.1001 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 3.0.0.16 - Intel Corporation)
Intel® Chipsatz-Gerätesoftware (x32 Version: 10.0.14 - Intel(R) Corporation) Hidden
iTunes (HKLM\...\{2ABBBD91-91E5-4AD7-929A-FE15D1DC0576}) (Version: 12.0.1.26 - Apple Inc.)
Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games )
League of Legends (x32 Version: 3.0.1 - Riot Games ) Hidden
LightScribe System Software (HKLM-x32\...\{F132000C-1CBA-458F-BF2F-FD43D59410F9}) (Version: 1.18.27.10 - LightScribe)
LightScribe Template Labeler (HKLM-x32\...\{8A03241E-7A3C-401D-B0CE-B3096F50AE6F}) (Version: 1.18.27.10 - LightScribe)
LogMeIn Hamachi (HKLM-x32\...\LogMeIn Hamachi) (Version: 2.2.0.319 - LogMeIn, Inc.)
LogMeIn Hamachi (x32 Version: 2.2.0.319 - LogMeIn, Inc.) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office Outlook Connector (HKLM-x32\...\{95140000-007A-0407-0000-0000000FF1CE}) (Version: 14.0.5118.5000 - Microsoft Corporation)
Microsoft Office Outlook Connector (HKLM-x32\...\{95140000-007A-0409-0000-0000000FF1CE}) (Version: 14.0.5118.5000 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUSR) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1268736343-3887576109-2910839842-1000\...\OneDriveSetup.exe) (Version: 17.0.4035.0328 - Microsoft Corporation)
Microsoft Outlook Social Connector Provider for Windows Live Messenger 32-bit (HKLM-x32\...\{95140000-007D-0409-0000-0000000FF1CE}) (Version: 14.0.5120.5000 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft WSE 3.0 Runtime (HKLM-x32\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.)
Microsoft XNA Framework Redistributable 4.0 (HKLM-x32\...\{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}) (Version: 4.0.20823.0 - Microsoft Corporation)
MorphVOX Junior (HKLM-x32\...\{E6C7380F-15DD-445E-BA02-B7A180BA0A5A}) (Version: 2.8.1 - Screaming Bee)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 35.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 35.0.1 (x86 de)) (Version: 35.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 31.0 - Mozilla)
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.7.3 - Notepad++ Team)
NVIDIA PhysX (HKLM-x32\...\{8A809006-C25A-4A3A-9DAB-94659BCDB107}) (Version: 9.10.0224 - NVIDIA Corporation)
ooVoo Search App powered by Ask (HKLM-x32\...\{4F564F32-2D53-5000-76A7-A758B70C1002}) (Version: 12.16.2.2010 - APN, LLC)
Origin (HKLM-x32\...\Origin) (Version: 9.4.21.2812 - Electronic Arts, Inc.)
ORION: Dino Horde (HKLM-x32\...\Steam App 104900) (Version:  - Spiral Game Studios)
PAC-MAN Championship Edition DX+ (HKLM-x32\...\Steam App 236450) (Version:  - Mine Loader Software Co., Ltd.)
Pando Media Booster (HKLM-x32\...\{980A182F-E0A2-4A40-94C1-AE0C1235902E}) (Version: 2.6.0.7 - Pando Networks Inc.)
Pflanzen gegen Zombies™ (HKLM-x32\...\{5E6536C2-E79A-49CF-83EA-817AD81F9FC8}) (Version: 1.2.0.1093 - Electronic Arts, Inc.)
PlanetSide 2 (HKLM-x32\...\Steam App 218230) (Version:  - Sony Online Entertainment)
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.993 - Even Balance, Inc.)
Quick Memory Editor 5.5 (HKLM-x32\...\Quick Memory Editor_is1) (Version:  - softcows.com)
RaceRoom Racing Experience  (HKLM-x32\...\Steam App 211500) (Version:  - SimBin Studios AB)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7227 - Realtek Semiconductor Corp.)
Red Orchestra 2: Heroes of Stalingrad - Single Player (HKLM-x32\...\Steam App 236830) (Version:  - )
Reversion - The Escape (HKLM-x32\...\Steam App 270570) (Version:  - 3f Interactive)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Robocraft (HKLM-x32\...\Steam App 301520) (Version:  - Freejam)
S.K.I.L.L. - Special Force 2 (HKLM-x32\...\Special Force 2 Beta_is1) (Version:  - )
Sanctum (HKLM-x32\...\Steam App 91600) (Version:  - Coffee Stain Studios)
Sanctum 2 (HKLM-x32\...\Steam App 210770) (Version:  - Coffee Stain Studios)
Search App by Ask (HKLM-x32\...\{4F524A2D-5350-4500-76A7-A758B70C1801}) (Version: 12.24.1.51 - APN, LLC) <==== ATTENTION
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
Shopping App by Ask (HKLM-x32\...\{4F524A2D-5354-2D53-5045-A758B70C1801}) (Version: 12.24.1.53 - APN, LLC)
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)
Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
Sonic Radar II (HKLM\...\{203BCA8D-BC00-4DD5-85DF-2F84DB803B57}) (Version: 2.0.801 - ASUSTeKcomputer.Inc)
Spore (HKLM-x32\...\Steam App 17390) (Version:  - Maxis™)
Steam (HKLM-x32\...\Steam) (Version:  - Valve Corporation)
TeamSpeak 3 Client (HKLM-x32\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH)
Terraria (HKLM-x32\...\Steam App 105600) (Version:  - Re-Logic)
The Crew (Worldwide) (HKLM-x32\...\Uplay Install 413) (Version:  - Ubisoft)
The Sims 2: Ultimate Collection (HKLM-x32\...\{04450C18-F039-4B81-A621-70C3B0F523D5}) (Version: 1.0.0.0 - Electronic Arts)
Tweaking.com - Windows Repair (All in One) (HKLM-x32\...\Tweaking.com - Windows Repair (All in One)) (Version: 2.11.1 - Tweaking.com)
Unity Web Player (HKU\S-1-5-21-1268736343-3887576109-2910839842-1000\...\UnityWebPlayer) (Version: 4.5.4f1 - Unity Technologies ApS)
Unturned (HKLM-x32\...\Steam App 304930) (Version:  - Nelson Sexton)
Uplay (HKLM-x32\...\Uplay) (Version: 4.9 - Ubisoft)
Virtual Audio Cable 4.10 (HKLM\...\Virtual Audio Cable 4.10) (Version:  - )
Wildlife Park 2 - Diamant Edition v2.1 (HKLM-x32\...\Wildlife Park 2 - Diamant Edition_is1) (Version:  - Deep Silver)
Wildlife Park 2 (HKLM-x32\...\Steam App 304350) (Version:  - b-alive gmbh)
Wildlife Park Gold (HKLM-x32\...\{5FF50E1A-4E6D-454B-BA00-6E15D6216BFB}) (Version:  - )
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
WinRAR 5.10 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.10.0 - win.rar GmbH)
Zoo Tycoon 2 - Ultimate Collection (HKLM-x32\...\InstallShield_{9CC4840D-EF1C-406F-AF08-3C19EB1335B9}) (Version: 1.00.0000 - Microsoft Game Studios)
Zoo Tycoon 2 - Ultimate Collection (x32 Version: 1.00.0000 - Microsoft Game Studios) Hidden
Zoo Tycoon 2 Trial Version (HKLM-x32\...\Zoo Tycoon 2 Trial Version) (Version: 1.0 - Microsoft)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-1268736343-3887576109-2910839842-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Chiara\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1268736343-3887576109-2910839842-1000_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\Windows\system32\igfxEM.exe (Intel Corporation)
CustomCLSID: HKU\S-1-5-21-1268736343-3887576109-2910839842-1000_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Chiara\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1268736343-3887576109-2910839842-1000_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Chiara\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1268736343-3887576109-2910839842-1000_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32 -> C:\Users\Chiara\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1268736343-3887576109-2910839842-1000_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Chiara\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1268736343-3887576109-2910839842-1000_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Chiara\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\FileSyncApi64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1268736343-3887576109-2910839842-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Chiara\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1268736343-3887576109-2910839842-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Chiara\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1268736343-3887576109-2910839842-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Chiara\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1268736343-3887576109-2910839842-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Chiara\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1268736343-3887576109-2910839842-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Chiara\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1268736343-3887576109-2910839842-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Chiara\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1268736343-3887576109-2910839842-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Chiara\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1268736343-3887576109-2910839842-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Chiara\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

==================== Restore Points  =========================


==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2015-02-18 22:04 - 00000855 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1      localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0C1F16E8-CB37-4FDE-8B61-18DD1F52BD1D} - System32\Tasks\{F3C6D55E-9D63-48DF-B884-7BFE8149CEDE} => pcalua.exe -a E:\autorun.exe -d E:\
Task: {143D0C23-5112-428D-BDBD-BF3F545D8151} - System32\Tasks\Microsoft\Windows\TabletPC\InputPersonalization => C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe [2009-07-14] (Microsoft Corporation)
Task: {1CBEB510-4008-44C6-9C4E-490FBC7249D1} - System32\Tasks\{22D96E65-8650-42A8-A671-1AD330D89631} => pcalua.exe -a C:\Users\Chiara\Downloads\wlsetup-all_16.4.3508.0205(1).exe -d C:\Users\Chiara\Downloads
Task: {29E9FAAA-D156-447B-8A86-FC07996626AE} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-09-07] (Google Inc.)
Task: {2E209025-5453-4291-AB6D-A9C8E8C81EB8} - System32\Tasks\{2879CBD8-3138-47D1-A430-ED37161ADFED} => pcalua.exe -a E:\Sims3EP05Setup.exe -d E:\
Task: {3B6DBB04-0233-4CD2-87BC-CCE71189B559} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2015-02-28] (AVAST Software)
Task: {51C250E5-DA49-456E-9F76-6AEBD7D094E4} - System32\Tasks\{D7047EF8-AA6F-40D8-851D-05B4673CEE47} => pcalua.exe -a E:\autorun.exe -d E:\
Task: {59D27426-10E0-4A44-ADA3-6AFF127E72C0} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-04] (Adobe Systems Incorporated)
Task: {624E486E-982E-4928-943D-0054557A3091} - System32\Tasks\{B912D025-C180-4820-A28F-68479292C869} => pcalua.exe -a C:\Users\Chiara\Desktop\wlsetup-webEN.exe -d C:\Users\Chiara\Desktop
Task: {66CBA191-790F-4BA0-B132-AF2F2719D12F} - System32\Tasks\Microsoft\Microsoft Antimalware\Microsoft Antimalware Scheduled Scan => C:\Program Files\Microsoft Security Client\MpCmdRun.exe
Task: {E2F49DDA-F22C-4225-814F-3DEE3FA985CC} - System32\Tasks\Abelssoft\Updater scan => C:\Program Files (x86)\CHIP Updater\CHIPUpdater.exe
Task: {E882F6CE-0D17-462A-9F7A-E0C16C2741C2} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-09-07] (Google Inc.)
Task: {ECAA8DAE-9A17-498E-B3EC-F0715A542D00} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {F15C76DB-403A-4FB7-9F21-76C753F6B84F} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {F7F0351A-E580-4469-96DA-3DA881E9CB33} - System32\Tasks\{5AB2EF2A-A557-455F-9709-6140841F93ED} => pcalua.exe -a E:\Sims3EP05Setup.exe -d E:\
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) ==============

2014-07-30 16:54 - 2012-09-18 14:27 - 00192512 _____ () C:\Windows\System32\zlhp1020.dll
2014-07-30 16:54 - 2012-09-18 14:27 - 00065024 _____ () C:\Windows\system32\spool\PRTPROCS\x64\pphp1020.dll
2014-07-26 20:17 - 2014-01-28 04:16 - 00936728 _____ () C:\Program Files (x86)\ASUS\AXSP\1.02.00\atkexComSvc.exe
2014-08-26 22:15 - 2014-10-18 20:38 - 00076152 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2014-07-26 19:35 - 2013-08-20 10:37 - 00605496 _____ () C:\Windows\system32\audioLibVc.dll
2015-03-01 19:12 - 2015-03-01 19:12 - 00310272 _____ () C:\Users\Chiara\AppData\Roaming\.minecraft\versions\1.8-OptiFine_HD_U_A7\1.8-OptiFine_HD_U_A7-natives-15566503254992\lwjgl64.dll
2015-03-01 19:12 - 2015-03-01 19:12 - 00653832 _____ () C:\Users\Chiara\AppData\Roaming\.minecraft\versions\1.8-OptiFine_HD_U_A7\1.8-OptiFine_HD_U_A7-natives-15566503254992\avutil-ttv-51.dll
2015-03-01 19:12 - 2015-03-01 19:12 - 00361103 _____ () C:\Users\Chiara\AppData\Roaming\.minecraft\versions\1.8-OptiFine_HD_U_A7\1.8-OptiFine_HD_U_A7-natives-15566503254992\swresample-ttv-0.dll
2015-03-01 19:12 - 2015-03-01 19:12 - 00688161 _____ () C:\Users\Chiara\AppData\Roaming\.minecraft\versions\1.8-OptiFine_HD_U_A7\1.8-OptiFine_HD_U_A7-natives-15566503254992\libmp3lame-ttv.dll
2015-03-01 19:12 - 2015-03-01 19:12 - 01384960 _____ () C:\Users\Chiara\AppData\Roaming\.minecraft\versions\1.8-OptiFine_HD_U_A7\1.8-OptiFine_HD_U_A7-natives-15566503254992\twitchsdk.dll
2015-03-01 19:12 - 2015-03-01 19:12 - 00382464 _____ () C:\Users\Chiara\AppData\Roaming\.minecraft\versions\1.8-OptiFine_HD_U_A7\1.8-OptiFine_HD_U_A7-natives-15566503254992\OpenAL64.dll
2015-02-28 22:46 - 2015-02-28 22:46 - 02913792 _____ () C:\Program Files\AVAST Software\Avast\defs\15022801\algo.dll
2015-03-01 14:53 - 2015-03-01 14:53 - 02913792 _____ () C:\Program Files\AVAST Software\Avast\defs\15030100\algo.dll
2015-03-01 18:53 - 2015-03-01 18:53 - 02913792 _____ () C:\Program Files\AVAST Software\Avast\defs\15030101\algo.dll
2014-10-11 13:06 - 2014-10-11 13:06 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-10-11 13:05 - 2014-10-11 13:05 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2014-07-26 20:17 - 2015-03-01 14:53 - 00035328 _____ () C:\Program Files (x86)\ASUS\AXSP\1.02.00\PEbiosinterface32.dll
2014-07-26 20:17 - 2014-01-28 04:16 - 00104448 _____ () C:\Program Files (x86)\ASUS\AXSP\1.02.00\ATKEX.dll
2013-09-04 23:14 - 2013-09-04 23:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2015-02-28 10:36 - 2015-02-28 10:36 - 38562088 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2015-02-03 18:40 - 2015-02-03 18:40 - 03925104 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2014-03-20 10:43 - 2014-03-20 10:43 - 01241560 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
2015-02-04 20:38 - 2015-02-04 20:38 - 16852144 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll
2014-08-25 17:27 - 2014-11-11 19:47 - 00774656 _____ () D:\Steam\SDL2.dll
2015-01-23 21:04 - 2014-12-02 01:29 - 05002752 _____ () D:\Steam\v8.dll
2015-01-23 21:04 - 2014-12-02 01:29 - 01612800 _____ () D:\Steam\icui18n.dll
2015-01-23 21:04 - 2014-12-02 01:29 - 01210368 _____ () D:\Steam\icuuc.dll
2014-08-25 17:27 - 2015-02-19 00:51 - 02360000 _____ () D:\Steam\video.dll
2014-10-15 20:08 - 2014-12-01 22:31 - 02396672 _____ () D:\Steam\libavcodec-56.dll
2014-10-15 20:08 - 2014-12-01 22:31 - 00442880 _____ () D:\Steam\libavutil-54.dll
2014-10-15 20:08 - 2014-12-01 22:31 - 00479744 _____ () D:\Steam\libavformat-56.dll
2014-10-15 20:08 - 2014-12-01 22:31 - 00332800 _____ () D:\Steam\libavresample-2.dll
2014-10-15 20:08 - 2014-12-01 22:31 - 00485888 _____ () D:\Steam\libswscale-3.dll
2014-08-25 17:27 - 2015-02-19 00:51 - 00702656 _____ () D:\Steam\bin\chromehtml.DLL
2014-08-25 17:27 - 2015-01-28 02:30 - 34641288 _____ () D:\Steam\bin\libcef.dll
2014-08-25 17:27 - 2015-01-28 02:30 - 01709960 _____ () D:\Steam\bin\ffmpegsumo.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Hamachi2Svc => ""="Service"

==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1268736343-3887576109-2910839842-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Chiara\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.0.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== Accounts: =============================

Administrator (S-1-5-21-1268736343-3887576109-2910839842-500 - Administrator - Disabled)
Chiara (S-1-5-21-1268736343-3887576109-2910839842-1000 - Administrator - Enabled) => C:\Users\Chiara
Gast (S-1-5-21-1268736343-3887576109-2910839842-501 - Limited - Enabled) => C:\Users\Gast
HomeGroupUser$ (S-1-5-21-1268736343-3887576109-2910839842-1002 - Limited - Enabled)

==================== Faulty Device Manager Devices =============

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (03/01/2015 01:24:01 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm javaw.exe, Version 8.0.25.18 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 15f0

Startzeit: 01d053abd70965f9

Endzeit: 152

Anwendungspfad: C:\Users\Chiara\Downloads\runtime\jre-x64\1.8.0_25\bin\javaw.exe

Berichts-ID: 40bcd7f0-bfa9-11e4-94bf-40167ea8b169

Error: (02/28/2015 08:05:03 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm javaw.exe, Version 8.0.25.18 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1824

Startzeit: 01d0537e979ecf2d

Endzeit: 111

Anwendungspfad: C:\Users\Chiara\Downloads\runtime\jre-x64\1.8.0_25\bin\javaw.exe

Berichts-ID: b1ab5a8c-bf7c-11e4-b4a6-40167ea8b169

Error: (02/28/2015 10:36:12 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".


Details:
AddLegacyDriverFiles: Unable to back up image of binary khztvfdj.

System Error:
Das System kann die angegebene Datei nicht finden.
.

Error: (02/27/2015 11:43:40 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm javaw.exe, Version 8.0.25.18 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1b08

Startzeit: 01d052b899fcf299

Endzeit: 149

Anwendungspfad: C:\Users\Chiara\Downloads\runtime\jre-x64\1.8.0_25\bin\javaw.exe

Berichts-ID: 10f47e65-bed2-11e4-b73a-40167ea8b169

Error: (02/26/2015 08:46:58 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 998

Error: (02/26/2015 08:46:58 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 998

Error: (02/26/2015 08:46:58 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (02/26/2015 08:16:43 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 1014

Error: (02/26/2015 08:16:43 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 1014

Error: (02/26/2015 08:16:43 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second


System errors:
=============
Error: (03/01/2015 02:53:12 PM) (Source: BugCheck) (EventID: 1001) (User: )
Description: 0x00000124 (0x0000000000000000, 0xfffffa8006f01028, 0x00000000be000000, 0x000000000100110a)C:\Windows\MEMORY.DMP030115-5678-01

Error: (03/01/2015 02:53:11 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎01.‎03.‎2015 um 14:51:49 unerwartet heruntergefahren.

Error: (03/01/2015 11:51:18 AM) (Source: bowser) (EventID: 8003) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "VLADIK-PC",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{29ED322B-9937-40E9-9540-F7691F5412AA}-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.

Error: (02/28/2015 06:46:38 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎28.‎02.‎2015 um 18:45:08 unerwartet heruntergefahren.

Error: (02/28/2015 06:04:11 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎28.‎02.‎2015 um 18:03:23 unerwartet heruntergefahren.

Error: (02/28/2015 05:28:28 PM) (Source: BugCheck) (EventID: 1001) (User: )
Description: 0x00000124 (0x0000000000000000, 0xfffffa8007331028, 0x00000000be000000, 0x000000000100110a)C:\Windows\MEMORY.DMP022815-5850-01

Error: (02/28/2015 05:28:27 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎28.‎02.‎2015 um 17:27:19 unerwartet heruntergefahren.

Error: (02/28/2015 01:28:45 PM) (Source: volsnap) (EventID: 36) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.

Error: (02/28/2015 10:54:05 AM) (Source: bowser) (EventID: 8003) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "VLADIK-PC",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{29ED322B-9937-40E9-9540-F7691F5412AA}-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.

Error: (02/28/2015 08:02:18 AM) (Source: DCOM) (EventID: 10016) (User: BLUESTAR)
Description: AnwendungsspezifischLokalAktivierung{8BC3F05E-D86B-11D0-A075-00C04FB68820}{8BC3F05E-D86B-11D0-A075-00C04FB68820}BLUESTARGastS-1-5-21-1268736343-3887576109-2910839842-501LocalHost (unter Verwendung von LRPC)


Microsoft Office Sessions:
=========================
Error: (03/01/2015 01:24:01 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: javaw.exe8.0.25.1815f001d053abd70965f9152C:\Users\Chiara\Downloads\runtime\jre-x64\1.8.0_25\bin\javaw.exe40bcd7f0-bfa9-11e4-94bf-40167ea8b169

Error: (02/28/2015 08:05:03 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: javaw.exe8.0.25.18182401d0537e979ecf2d111C:\Users\Chiara\Downloads\runtime\jre-x64\1.8.0_25\bin\javaw.exeb1ab5a8c-bf7c-11e4-b4a6-40167ea8b169

Error: (02/28/2015 10:36:12 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description:
Details:
AddLegacyDriverFiles: Unable to back up image of binary khztvfdj.

System Error:
Das System kann die angegebene Datei nicht finden.

Error: (02/27/2015 11:43:40 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: javaw.exe8.0.25.181b0801d052b899fcf299149C:\Users\Chiara\Downloads\runtime\jre-x64\1.8.0_25\bin\javaw.exe10f47e65-bed2-11e4-b73a-40167ea8b169

Error: (02/26/2015 08:46:58 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 998

Error: (02/26/2015 08:46:58 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 998

Error: (02/26/2015 08:46:58 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (02/26/2015 08:16:43 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 1014

Error: (02/26/2015 08:16:43 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 1014

Error: (02/26/2015 08:16:43 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second


CodeIntegrity Errors:
===================================
  Date: 2015-01-30 22:28:35.015
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-01-30 22:28:34.938
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-01-30 22:28:34.861
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-01-30 22:28:34.784
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-01-18 13:18:54.859
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-01-18 13:18:54.858
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-01-18 13:17:33.206
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-01-18 13:17:33.203
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-01-18 09:44:59.224
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-01-18 09:44:59.223
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info ===========================

Processor: Intel(R) Core(TM) i7-4790K CPU @ 4.00GHz
Percentage of memory in use: 62%
Total physical RAM: 7876.96 MB
Available physical RAM: 2954.83 MB
Total Pagefile: 15752.11 MB
Available Pagefile: 9859.07 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: (System) (Fixed) (Total:111.69 GB) (Free:5.71 GB) NTFS
Drive d: (Daten) (Fixed) (Total:1862.89 GB) (Free:1644.99 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 111.8 GB) (Disk ID: 1930675A)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=111.7 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: 00000000)

Partition: GPT Partition Type.

==================== End Of Log
============================
FRST.txt


FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-02-2015
Ran by Chiara (administrator) on BLUESTAR on 01-03-2015 21:17:43
Running from C:\Users\Chiara\Downloads
Loaded Profiles: Chiara (Available profiles: Chiara & Gast)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(APN LLC.) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
() C:\Program Files (x86)\ASUS\AXSP\1.02.00\atkexComSvc.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(LogMeIn Inc.) D:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
(LogMeIn, Inc.) D:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(APN) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(LogMeIn Inc.) D:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(LogMeIn, Inc.) D:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe
(Oracle Corporation) C:\Users\Chiara\Downloads\runtime\jre-x64\1.8.0_25\bin\java.exe
(Oracle Corporation) C:\Users\Chiara\Downloads\runtime\jre-x64\1.8.0_25\bin\javaw.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_305.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_305.exe
(Valve Corporation) D:\Steam\Steam.exe
(Valve Corporation) D:\Steam\bin\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Valve Corporation) D:\Steam\bin\steamwebhelper.exe
(Valve Corporation) D:\Steam\bin\steamwebhelper.exe
(Valve Corporation) D:\Steam\bin\steamwebhelper.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2014-04-11] (Intel Corporation)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7572696 2014-04-17] (Realtek Semiconductor)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848 2014-02-21] (Intel Corporation)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.)
HKLM-x32\...\Run: [ApnTBMon] => C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1934744 2015-01-31] (APN)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [508800 2014-12-17] (Oracle Corporation)
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] => D:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [3978600 2015-02-17] (LogMeIn Inc.)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5227112 2015-02-28] (AVAST Software)
HKU\S-1-5-21-1268736343-3887576109-2910839842-1000\...\Run: [Speech Recognition] => C:\Windows\Speech\Common\sapisvr.exe [44544 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-21-1268736343-3887576109-2910839842-1000\...\Run: [EADM] => C:\Program Files (x86)\Origin\Origin.exe [3631448 2015-02-27] (Electronic Arts)
HKU\S-1-5-21-1268736343-3887576109-2910839842-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [30879328 2014-12-11] (Skype Technologies S.A.)
Startup: C:\Users\Chiara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk
ShortcutTarget: Adobe Gamma.lnk -> C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\.DEFAULT\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-1268736343-3887576109-2910839842-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:49174;https=127.0.0.1:49174
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=56626&homepage=about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/?trackid=sp-006
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = https://www.google.com/search?trackid=sp-006&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-1268736343-3887576109-2910839842-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-1268736343-3887576109-2910839842-1000\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/?trackid=sp-006
SearchScopes: HKLM-x32 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = https://www.google.com/search?trackid=sp-006&q={searchTerms}
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1268736343-3887576109-2910839842-1000 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = https://www.google.com/search?trackid=sp-006&q={searchTerms}
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: No Name -> {9030D464-4C02-4ABF-8ECC-5164760863C6} ->  No File
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll (Oracle Corporation)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} -  No File
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\wblsi6v6.default-1408827089247
FF Homepage: hxxp://www.search.ask.com/?tpid=ORJ-ST-SPE&o=APN11464&pf=V7&trgb=FF&p2=%5EBEA%5EOSJ000%5EYY%5ECH&gct=hp&apn_ptnrs=BEA&apn_dtid=%5EOSJ000%5EYY%5ECH&apn_dbr=ff_35.0.1.5500&apn_uid=CFFB9BD3-36CC-4E25-B3AF-350A80C85E92&itbv=12.24.1.53&doi=2015-02-11&psv=&pt=tb
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @esn/npbattlelog,version=2.4.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.4.0\npbattlelog.dll (EA Digital Illusions CE AB)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MIF5BA~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKU\S-1-5-21-1268736343-3887576109-2910839842-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Chiara\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF SearchPlugin: C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\wblsi6v6.default-1408827089247\searchplugins\ask-search.xml
FF SearchPlugin: C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\wblsi6v6.default-1408827089247\searchplugins\google-images.xml
FF SearchPlugin: C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\wblsi6v6.default-1408827089247\searchplugins\google-maps.xml
FF Extension: amptrakeepacom - C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\wblsi6v6.default-1408827089247\Extensions\amptra@keepa.com [2014-09-08]
FF Extension: Web Helper Lite - C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\wblsi6v6.default-1408827089247\Extensions\{53ecb410-cb6c-474d-8ce2-8f9e2c15a4a7} [2014-10-09]
FF Extension: Cliqz Beta - C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\wblsi6v6.default-1408827089247\Extensions\cliqz@cliqz.com.xpi [2014-10-07]
FF Extension: MEGA - C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\wblsi6v6.default-1408827089247\Extensions\firefox@mega.co.nz.xpi [2014-11-02]
FF Extension: Search App by Ask - C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\wblsi6v6.default-1408827089247\Extensions\toolbar_ORJ-SPE@apn.ask.com.xpi [2015-01-31]
FF Extension: Shopping App by Ask - C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\wblsi6v6.default-1408827089247\Extensions\toolbar_ORJ-ST-SPE@apn.ask.com.xpi [2015-01-31]
FF Extension: ooVoo Search App powered by Ask - C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\wblsi6v6.default-1408827089247\Extensions\toolbar_OVO2-SP@apn.ask.com.xpi [2014-09-11]
FF Extension: Search App - C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\wblsi6v6.default-1408827089247\Extensions\{1d33817b-02d7-4cfa-a618-2d2fe2f6add4}.xpi [2014-12-23]
FF Extension: mpeg4 shield - C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\wblsi6v6.default-1408827089247\Extensions\{3d69b985-bc93-4bb9-9a0a-e16269028e65}.xpi [2014-10-10]
FF Extension: {9b0ceae4-a807-4940-a439-ad70def3437d} - C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\wblsi6v6.default-1408827089247\Extensions\{9b0ceae4-a807-4940-a439-ad70def3437d}.xpi [2014-10-05]
FF Extension: Adblock Plus - C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\wblsi6v6.default-1408827089247\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-08-23]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-02-28]
FF HKU\S-1-5-21-1268736343-3887576109-2910839842-1000\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff
FF HKU\S-1-5-21-1268736343-3887576109-2910839842-1000\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\wblsi6v6.default-1408827089247\extensions\cliqz@cliqz.com

Chrome:
=======
CHR HomePage: Default -> hxxp://Vosteran.com/?f=1&a=vst_ggbc_14_47_ff&cd=2XzuyEtN2Y1L1QzuyB0AyBzytCzyyEzytCzztAtC0AtB0EtCtN0D0Tzu0StCtDyDyBtN1L2XzutAtFyCtFtBtFtDtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2SyB0EtC0DzytAtDyEtG0FyDtC0CtGtDyCtCyBtG0DzzzyyBtGyB0Dzy0CtCyE0B0A0EtCtAtC2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCyDyE0D0CzytDzytG0D0ByDtCtGyE0BtCtCtGzytA0DzytG0D0EyEtD0ByByB0AyBtC0D0E2Q&cr=423194433&ir=
CHR StartupUrls: Default -> "https://www.google.com/?trackid=sp-006"
CHR DefaultSearchURL: Default -> https://www.google.de/search?q={searchTerms}?trackid=sp-006
CHR DefaultSuggestURL: Default -> https://www.google.com/complete/search?client=chrome&q={searchTerms}
CHR Profile: C:\Users\Chiara\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\Chiara\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-09-14]
CHR Extension: (Google Docs) - C:\Users\Chiara\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-09-14]
CHR Extension: (Google Drive) - C:\Users\Chiara\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-09-14]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Chiara\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-07]
CHR Extension: (YouTube) - C:\Users\Chiara\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-07-26]
CHR Extension: (Google Search) - C:\Users\Chiara\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-07-26]
CHR Extension: (Google Sheets) - C:\Users\Chiara\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-09-14]
CHR Extension: (Avira Browser Safety) - C:\Users\Chiara\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2014-09-08]
CHR Extension: (Skype Click to Call) - C:\Users\Chiara\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2014-07-31]
CHR Extension: (Google Wallet) - C:\Users\Chiara\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-07-26]
CHR Extension: (Amazon) - C:\Users\Chiara\AppData\Local\Google\Chrome\User Data\Default\Extensions\ocbnpbkmjpgbdcgiflkgkpnkinifpgpj [2014-10-05]
CHR Extension: (Disable AntiAdblock) - C:\Users\Chiara\AppData\Local\Google\Chrome\User Data\Default\Extensions\oimhabmdhenmcaligiilhadkdliolpah [2014-07-31]
CHR Extension: (Gmail) - C:\Users\Chiara\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-07-26]
CHR HKLM\...\Chrome\Extension: [Äÿ] - No Path Or update_url value
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-02-28]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [ocbnpbkmjpgbdcgiflkgkpnkinifpgpj] - C:\Users\Chiara\ChromeExtensions\ocbnpbkmjpgbdcgiflkgkpnkinifpgpj\amazon-icon-2.crx [2014-10-04]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [72704 2014-11-16] (Adobe Systems) [File not signed]
R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [177560 2015-01-31] (APN LLC.)
R2 asComSvc; C:\Program Files (x86)\ASUS\AXSP\1.02.00\atkexComSvc.exe [936728 2014-01-28] ()
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2015-02-28] (AVAST Software)
R2 Hamachi2Svc; D:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe [2490216 2015-02-17] (LogMeIn Inc.)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [16232 2014-04-11] (Intel Corporation)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-03] (Macrovision Corporation) [File not signed]
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [329104 2014-10-03] (Intel Corporation)
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [887232 2014-01-31] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [154584 2014-03-20] (Intel Corporation)
R2 LightScribeService; C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2013-01-16] (Hewlett-Packard Company) [File not signed]
S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [1910640 2015-02-27] (Electronic Arts)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76152 2014-10-18] ()
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [15232 2014-01-28] ()
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2015-02-28] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [87912 2015-02-28] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2015-02-28] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2015-02-28] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1050432 2015-02-28] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [436624 2015-02-28] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [116728 2015-02-28] (AVAST Software)
S3 aswTap; C:\Windows\System32\DRIVERS\aswTap.sys [44640 2015-01-18] (The OpenVPN Project)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [267632 2015-02-28] ()
R3 e1dexpress; C:\Windows\System32\DRIVERS\e1d62x64.sys [487704 2014-03-14] (Intel Corporation)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28008 2014-04-11] (Intel Corporation)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [118272 2014-03-20] (Intel Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-01 14:53 - 2015-03-01 14:53 - 00281688 _____ () C:\Windows\Minidump\030115-5678-01.dmp
2015-03-01 10:05 - 2015-03-01 10:05 - 00001812 _____ () C:\Users\Chiara\Desktop\Bluescreenview3.txt
2015-02-28 17:28 - 2015-02-28 17:28 - 00281688 _____ () C:\Windows\Minidump\022815-5850-01.dmp
2015-02-28 10:37 - 2015-02-28 10:37 - 00000000 ____D () C:\Users\Chiara\AppData\Roaming\AVAST Software
2015-02-28 10:36 - 2015-03-01 20:59 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2015-02-28 10:36 - 2015-02-28 10:36 - 01050432 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys
2015-02-28 10:36 - 2015-02-28 10:36 - 00436624 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2015-02-28 10:36 - 2015-02-28 10:36 - 00364512 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2015-02-28 10:36 - 2015-02-28 10:36 - 00267632 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2015-02-28 10:36 - 2015-02-28 10:36 - 00116728 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2015-02-28 10:36 - 2015-02-28 10:36 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2015-02-28 10:36 - 2015-02-28 10:36 - 00087912 _____ (AVAST Software) C:\Windows\system32\Drivers\aswmonflt.sys
2015-02-28 10:36 - 2015-02-28 10:36 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2015-02-28 10:36 - 2015-02-28 10:36 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2015-02-28 10:36 - 2015-02-28 10:36 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2015-02-28 10:36 - 2015-02-28 10:36 - 00001930 _____ () C:\Users\Public\Desktop\Avast Free Antivirus.lnk
2015-02-28 10:36 - 2015-02-28 10:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2015-02-28 10:36 - 2015-02-28 10:36 - 00000000 ____D () C:\Program Files\AVAST Software
2015-02-28 10:35 - 2015-02-28 10:35 - 132469808 _____ (AVAST Software) C:\Users\Chiara\Downloads\avast_free_antivirus_setup(1).exe
2015-02-28 08:01 - 2015-02-28 08:01 - 00000000 ____D () C:\Users\Gast\AppData\Roaming\Apple Computer
2015-02-25 22:42 - 2015-01-09 00:44 - 00419936 _____ () C:\Windows\SysWOW64\locale.nls
2015-02-25 22:42 - 2015-01-09 00:43 - 00419936 _____ () C:\Windows\system32\locale.nls
2015-02-25 20:49 - 2015-01-09 04:14 - 00950272 _____ (Microsoft Corporation) C:\Windows\system32\perftrack.dll
2015-02-25 20:49 - 2015-01-09 04:14 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\wdi.dll
2015-02-25 20:49 - 2015-01-09 04:14 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\powertracker.dll
2015-02-25 20:49 - 2015-01-09 03:48 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdi.dll
2015-02-24 19:42 - 2015-02-24 19:42 - 00000634 _____ () C:\Users\Public\Desktop\Battle.net.lnk
2015-02-24 19:42 - 2015-02-24 19:42 - 00000000 ____D () C:\Users\Chiara\AppData\Roaming\Battle.net
2015-02-24 19:42 - 2015-02-24 19:42 - 00000000 ____D () C:\Users\Chiara\AppData\Local\Blizzard Entertainment
2015-02-24 19:42 - 2015-02-24 19:42 - 00000000 ____D () C:\Users\Chiara\AppData\Local\Battle.net
2015-02-24 19:42 - 2015-02-24 19:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battle.net
2015-02-24 19:42 - 2015-02-24 19:42 - 00000000 ____D () C:\ProgramData\Blizzard Entertainment
2015-02-24 19:41 - 2015-02-24 19:41 - 03057720 _____ (Blizzard Entertainment) C:\Users\Chiara\Downloads\Hearthstone-Setup-deDE.exe
2015-02-24 19:41 - 2015-02-24 19:41 - 00000000 ____D () C:\ProgramData\Battle.net
2015-02-20 18:56 - 2015-02-20 18:56 - 00281688 _____ () C:\Windows\Minidump\022015-5928-01.dmp
2015-02-19 18:57 - 2015-02-19 18:57 - 00000000 ____D () C:\Users\Chiara\AppData\Local\Steam
2015-02-18 21:38 - 2015-02-18 21:38 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-BLUESTAR-Windows-7-Home-Premium-(64-bit).dat
2015-02-18 21:38 - 2015-02-18 21:38 - 00000000 ____D () C:\RegBackup
2015-02-18 21:28 - 2015-02-18 21:28 - 00002169 _____ () C:\Users\Chiara\Desktop\Tweaking.com - Windows Repair (All in One).lnk
2015-02-18 21:28 - 2015-02-18 21:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tweaking.com
2015-02-18 21:28 - 2015-02-18 21:28 - 00000000 ____D () C:\Program Files (x86)\Tweaking.com
2015-02-18 21:27 - 2015-02-18 21:27 - 11852704 _____ () C:\Users\Chiara\Downloads\tweaking.com_windows_repair_aio_setup.exe
2015-02-18 21:25 - 2015-02-18 21:25 - 00281688 _____ () C:\Windows\Minidump\021815-6302-01.dmp
2015-02-18 20:17 - 2015-02-18 20:17 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2015-02-18 18:42 - 2015-02-18 18:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
2015-02-14 22:33 - 2015-02-14 22:33 - 00281664 _____ () C:\Windows\Minidump\021415-10545-01.dmp
2015-02-13 10:27 - 2015-02-13 10:27 - 00049682 _____ () C:\Users\Chiara\Downloads\SystemLook.txt
2015-02-13 10:26 - 2015-02-13 10:26 - 00165376 _____ () C:\Users\Chiara\Downloads\SystemLook_x64.exe
2015-02-12 09:32 - 2015-01-23 05:42 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-02-12 09:32 - 2015-01-23 05:41 - 06041600 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-02-12 09:32 - 2015-01-23 04:43 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-02-12 09:32 - 2015-01-23 04:17 - 04300800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-02-12 00:08 - 2015-02-12 10:01 - 00000000 ____D () C:\Users\Chiara\Desktop\Zoes alt
2015-02-11 10:34 - 2015-02-11 10:34 - 00000000 ____D () C:\Users\Chiara\Downloads\runtime
2015-02-11 10:34 - 2015-02-11 10:34 - 00000000 ____D () C:\Users\Chiara\Downloads\game
2015-02-11 10:33 - 2015-02-11 10:33 - 01294088 _____ (Mojang) C:\Users\Chiara\Downloads\Minecraft(2).exe
2015-02-11 10:29 - 2015-02-11 10:29 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-02-11 10:29 - 2015-02-11 10:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-02-11 10:29 - 2015-02-11 10:29 - 00000000 ____D () C:\Program Files (x86)\Java
2015-02-11 10:27 - 2015-02-11 10:27 - 00000000 ____D () C:\Users\Chiara\AppData\Local\AskPartnerNetwork
2015-02-11 10:27 - 2015-02-11 10:27 - 00000000 ____D () C:\ProgramData\AskPartnerNetwork
2015-02-11 10:27 - 2015-02-11 10:27 - 00000000 ____D () C:\ProgramData\APN
2015-02-11 10:27 - 2015-02-11 10:27 - 00000000 ____D () C:\Program Files (x86)\AskPartnerNetwork
2015-02-11 10:24 - 2015-02-11 10:24 - 00639912 _____ (Oracle Corporation) C:\Users\Chiara\Downloads\jxpiinstall.exe
2015-02-11 09:50 - 2015-02-11 09:50 - 00000000 ____D () C:\Users\Chiara\AppData\Local\IsolatedStorage
2015-02-11 09:39 - 2015-02-11 09:48 - 00000000 ____D () C:\ProgramData\Screaming Bee
2015-02-11 09:38 - 2015-02-11 09:38 - 01198368 _____ () C:\Users\Chiara\Downloads\MorphVOX Pro - CHIP-Installer.exe
2015-02-11 09:38 - 2015-02-04 04:16 - 00894976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-02-11 09:38 - 2015-02-04 04:16 - 00762368 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-02-11 09:38 - 2015-02-04 04:16 - 00609280 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-02-11 09:38 - 2015-02-04 04:16 - 00414720 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-02-11 09:38 - 2015-02-04 04:16 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-02-11 09:38 - 2015-02-04 04:16 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-02-11 09:38 - 2015-02-04 04:13 - 01098752 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-02-11 09:38 - 2015-01-28 00:36 - 01239720 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2015-02-11 09:38 - 2015-01-14 06:47 - 00389808 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-02-11 09:38 - 2015-01-14 06:09 - 00342712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-02-11 09:38 - 2015-01-12 04:09 - 25056256 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-02-11 09:38 - 2015-01-12 04:05 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-02-11 09:38 - 2015-01-12 04:05 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-02-11 09:38 - 2015-01-12 03:49 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-02-11 09:38 - 2015-01-12 03:48 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-02-11 09:38 - 2015-01-12 03:48 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-02-11 09:38 - 2015-01-12 03:48 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-02-11 09:38 - 2015-01-12 03:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-02-11 09:38 - 2015-01-12 03:40 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-02-11 09:38 - 2015-01-12 03:39 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-02-11 09:38 - 2015-01-12 03:36 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-02-11 09:38 - 2015-01-12 03:34 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-02-11 09:38 - 2015-01-12 03:34 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-02-11 09:38 - 2015-01-12 03:25 - 19740160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-02-11 09:38 - 2015-01-12 03:25 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-02-11 09:38 - 2015-01-12 03:21 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-02-11 09:38 - 2015-01-12 03:21 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-02-11 09:38 - 2015-01-12 03:13 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-02-11 09:38 - 2015-01-12 03:08 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-02-11 09:38 - 2015-01-12 03:08 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-02-11 09:38 - 2015-01-12 03:07 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-02-11 09:38 - 2015-01-12 03:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-02-11 09:38 - 2015-01-12 03:07 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-02-11 09:38 - 2015-01-12 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-02-11 09:38 - 2015-01-12 03:04 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-02-11 09:38 - 2015-01-12 03:02 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-02-11 09:38 - 2015-01-12 03:00 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-02-11 09:38 - 2015-01-12 02:59 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-02-11 09:38 - 2015-01-12 02:57 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-02-11 09:38 - 2015-01-12 02:55 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-02-11 09:38 - 2015-01-12 02:48 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-02-11 09:38 - 2015-01-12 02:48 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-02-11 09:38 - 2015-01-12 02:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-02-11 09:38 - 2015-01-12 02:46 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-02-11 09:38 - 2015-01-12 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-02-11 09:38 - 2015-01-12 02:43 - 14401024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-02-11 09:38 - 2015-01-12 02:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-02-11 09:38 - 2015-01-12 02:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-02-11 09:38 - 2015-01-12 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-02-11 09:38 - 2015-01-12 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-02-11 09:38 - 2015-01-12 02:27 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-02-11 09:38 - 2015-01-12 02:23 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-02-11 09:38 - 2015-01-12 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-02-11 09:38 - 2015-01-12 02:22 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-02-11 09:38 - 2015-01-12 02:14 - 12829184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-02-11 09:38 - 2015-01-12 02:14 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-02-11 09:38 - 2015-01-12 02:02 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-02-11 09:38 - 2015-01-12 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-02-11 09:38 - 2015-01-12 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-02-11 09:38 - 2015-01-12 01:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-02-11 09:38 - 2015-01-10 07:48 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-02-11 09:38 - 2015-01-10 07:48 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-02-11 09:38 - 2015-01-10 07:48 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-02-11 09:38 - 2015-01-10 07:48 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-02-11 09:38 - 2015-01-10 07:48 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-02-11 09:38 - 2015-01-10 07:48 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-02-11 09:38 - 2015-01-10 07:48 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-02-11 09:38 - 2015-01-10 07:27 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-02-11 09:38 - 2015-01-10 07:27 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-02-11 09:38 - 2015-01-10 07:27 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-02-11 09:38 - 2015-01-10 07:27 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-02-11 09:38 - 2015-01-10 07:27 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-02-11 09:38 - 2015-01-10 07:27 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-02-11 09:38 - 2015-01-10 07:27 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-02-11 09:37 - 2015-01-15 09:14 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-02-11 09:37 - 2015-01-15 09:14 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-02-11 09:37 - 2015-01-15 09:09 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-02-11 09:37 - 2015-01-15 09:09 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-02-11 09:37 - 2015-01-15 09:09 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-02-11 09:37 - 2015-01-15 09:09 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-02-11 09:37 - 2015-01-15 09:09 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-02-11 09:37 - 2015-01-15 09:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-02-11 09:37 - 2015-01-15 09:06 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-02-11 09:37 - 2015-01-15 09:06 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-02-11 09:37 - 2015-01-15 09:04 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-02-11 09:37 - 2015-01-15 08:42 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-02-11 09:37 - 2015-01-15 08:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-02-11 09:37 - 2015-01-15 08:41 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-02-11 09:37 - 2015-01-15 08:39 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-02-11 09:37 - 2015-01-15 08:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-02-11 09:37 - 2015-01-15 08:37 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-02-11 09:37 - 2015-01-15 05:22 - 00458824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-02-11 09:37 - 2015-01-14 07:09 - 05554112 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-02-11 09:37 - 2015-01-14 07:05 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-02-11 09:37 - 2015-01-14 07:05 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-02-11 09:37 - 2015-01-14 07:04 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-02-11 09:37 - 2015-01-14 06:44 - 03972544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-02-11 09:37 - 2015-01-14 06:44 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-02-11 09:37 - 2015-01-14 06:41 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-02-11 09:37 - 2015-01-13 04:10 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-02-11 09:37 - 2015-01-13 03:49 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-02-11 09:37 - 2015-01-09 03:03 - 03201536 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-02-11 09:37 - 2014-12-12 06:31 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-02-11 09:37 - 2014-12-12 06:07 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2015-02-11 09:37 - 2014-12-08 04:09 - 00406528 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2015-02-11 09:37 - 2014-12-08 03:46 - 00308224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll
2015-02-11 09:37 - 2014-11-26 04:53 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2015-02-11 09:37 - 2014-11-26 04:32 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2015-02-11 09:37 - 2014-07-07 03:07 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2015-02-11 09:37 - 2014-07-07 03:06 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2015-02-11 09:37 - 2014-07-07 02:40 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2015-02-11 09:37 - 2014-07-07 02:40 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2015-02-10 21:58 - 2015-02-11 09:50 - 00000000 ____D () C:\Users\Chiara\AppData\Roaming\Screaming Bee
2015-02-10 21:57 - 2015-02-11 10:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Screaming Bee
2015-02-10 21:57 - 2015-02-11 10:21 - 00000000 ____D () C:\Program Files (x86)\Screaming Bee
2015-02-10 21:57 - 2015-02-10 21:57 - 00002270 _____ () C:\Users\Chiara\Desktop\MorphVOX Junior.lnk
2015-02-10 21:57 - 2015-02-10 21:57 - 00000000 ____D () C:\Users\Chiara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Screaming Bee
2015-02-10 21:56 - 2015-02-10 21:56 - 02970992 _____ () C:\Users\Chiara\Downloads\MorphVOXJunior_Install-1.exe
2015-02-10 17:46 - 2015-02-10 17:46 - 00281664 _____ () C:\Windows\Minidump\021015-12760-01.dmp
2015-02-10 13:46 - 2015-03-01 14:53 - 00000000 ____D () C:\Windows\Minidump
2015-02-10 13:46 - 2015-02-10 13:46 - 00281664 _____ () C:\Windows\Minidump\021015-9968-01.dmp
2015-02-10 11:24 - 2015-02-10 11:24 - 00001196 _____ () C:\Users\Chiara\Desktop\CrystalDiskInfo.lnk
2015-02-10 11:24 - 2015-02-10 11:24 - 00000000 ____D () C:\Users\Chiara\AppData\Roaming\OpenCandy
2015-02-10 11:24 - 2015-02-10 11:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CrystalDiskInfo
2015-02-10 11:24 - 2015-02-10 11:24 - 00000000 ____D () C:\Program Files (x86)\CrystalDiskInfo
2015-02-10 11:23 - 2015-02-10 11:23 - 03014272 _____ (Crystal Dew World ) C:\Users\Chiara\Downloads\CrystalDiskInfo6_3_0-en.exe
2015-02-08 19:53 - 2015-02-08 19:53 - 00526371 _____ () C:\Users\Chiara\Desktop\openhardwaremonitor-v0.6.0-beta.zip
2015-02-08 09:38 - 2015-02-08 09:38 - 01188194 _____ () C:\Users\Chiara\Downloads\ProcessExplorer.zip
2015-02-05 19:45 - 2015-02-05 19:48 - 00067892 _____ () C:\Users\Chiara\Downloads\bluescreenview_v1.55.zip
2015-02-03 18:40 - 2015-02-03 18:40 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-02-02 22:10 - 2015-02-02 22:10 - 00852573 _____ () C:\Users\Chiara\Downloads\SecurityCheck.exe
2015-02-02 21:19 - 2015-02-02 21:19 - 02347384 _____ (ESET) C:\Users\Chiara\Downloads\esetsmartinstaller_deu.exe
2015-02-02 21:11 - 2015-02-02 21:11 - 00011853 _____ () C:\Users\Chiara\AppData\Local\recently-used.xbel
2015-01-31 22:07 - 2015-03-01 21:16 - 00000000 ____D () C:\Users\Chiara\Downloads\FRST-OlderVersion
2015-01-31 22:04 - 2015-01-31 22:04 - 01707939 _____ (Thisisu) C:\Users\Chiara\Downloads\JRT.exe
2015-01-31 22:01 - 2015-01-31 22:02 - 00000000 ____D () C:\AdwCleaner
2015-01-31 22:00 - 2015-01-31 22:00 - 02194432 _____ () C:\Users\Chiara\Downloads\AdwCleaner_4.109.exe
2015-01-31 21:50 - 2015-01-31 21:52 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-01-31 21:50 - 2015-01-31 21:50 - 00000618 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-01-31 21:50 - 2015-01-31 21:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-01-31 21:50 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-01-31 21:50 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-01-31 21:50 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-01-31 21:48 - 2015-01-31 21:48 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Chiara\Downloads\mbam-setup-2.0.4.1028.exe
2015-01-31 11:20 - 2015-01-31 11:20 - 01770497 _____ () C:\Users\Chiara\Documents\Pferd Mystisch.xcf
2015-01-30 22:30 - 2015-01-30 22:30 - 00039626 _____ () C:\ComboFix.txt
2015-01-30 22:25 - 2015-01-30 22:25 - 05611408 ____R (Swearware) C:\Users\Chiara\Downloads\ComboFix.exe
2015-01-30 22:25 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-01-30 22:25 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-01-30 22:25 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-01-30 22:25 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-01-30 22:25 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-01-30 22:25 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2015-01-30 22:25 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2015-01-30 22:25 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2015-01-30 22:19 - 2015-01-30 22:30 - 00000000 ____D () C:\Qoobox
2015-01-30 22:04 - 2015-01-30 22:04 - 00000610 _____ () C:\Users\Chiara\Desktop\Revo Uninstaller.lnk
2015-01-30 22:03 - 2015-01-30 22:03 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Chiara\Downloads\revosetup95.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-01 21:17 - 2014-10-06 12:27 - 00000000 ____D () C:\Users\Chiara\AppData\Local\LogMeIn Hamachi
2015-03-01 21:17 - 2014-09-17 17:50 - 00000000 ____D () C:\FRST
2015-03-01 21:17 - 2014-09-16 17:42 - 00022793 _____ () C:\Users\Chiara\Downloads\FRST.txt
2015-03-01 21:16 - 2014-09-16 17:41 - 02092544 _____ (Farbar) C:\Users\Chiara\Downloads\FRST64.exe
2015-03-01 21:15 - 2014-07-31 21:34 - 00000000 ____D () C:\Users\Chiara\AppData\Roaming\.minecraft
2015-03-01 20:55 - 2014-07-31 21:39 - 00000000 ____D () C:\Users\Chiara\AppData\Roaming\Skype
2015-03-01 20:38 - 2014-08-13 10:30 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-03-01 20:20 - 2014-09-07 12:57 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-03-01 19:55 - 2014-07-26 18:30 - 01938421 _____ () C:\Windows\WindowsUpdate.log
2015-03-01 19:25 - 2014-08-02 13:55 - 00000000 ____D () C:\Users\Chiara\AppData\Roaming\TS3Client
2015-03-01 19:20 - 2014-09-07 12:57 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-03-01 14:58 - 2009-07-14 05:45 - 00023088 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-03-01 14:58 - 2009-07-14 05:45 - 00023088 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-03-01 14:57 - 2009-07-14 18:58 - 00686552 _____ () C:\Windows\system32\perfh007.dat
2015-03-01 14:57 - 2009-07-14 18:58 - 00145882 _____ () C:\Windows\system32\perfc007.dat
2015-03-01 14:57 - 2009-07-14 06:13 - 01623866 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-03-01 14:55 - 2014-07-26 19:39 - 00006462 _____ () C:\Windows\SysWOW64\Gms.log
2015-03-01 14:53 - 2014-08-01 13:15 - 00000000 ____D () C:\ProgramData\Origin
2015-03-01 14:53 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-03-01 14:53 - 2009-07-14 05:51 - 00062105 _____ () C:\Windows\setupact.log
2015-02-28 17:28 - 2014-07-26 18:58 - 02440906 _____ () C:\Windows\PFRO.log
2015-02-28 10:36 - 2014-09-07 12:56 - 00000000 ____D () C:\ProgramData\AVAST Software
2015-02-28 08:02 - 2014-11-26 15:42 - 00111336 _____ () C:\Users\Gast\AppData\Local\GDIPFONTCACHEV1.DAT
2015-02-28 08:01 - 2014-11-26 15:41 - 00000000 ____D () C:\Users\Gast\AppData\Local\LogMeIn Hamachi
2015-02-27 19:07 - 2014-08-26 21:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Origin
2015-02-27 19:07 - 2014-08-26 21:52 - 00000000 ____D () C:\Program Files (x86)\Origin
2015-02-26 18:43 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\tracing
2015-02-25 19:38 - 2015-01-14 18:04 - 00000000 ____D () C:\Users\Chiara\AppData\Local\osu!
2015-02-23 20:36 - 2014-08-26 22:18 - 00347464 _____ () C:\Windows\SysWOW64\PnkBstrB.xtr
2015-02-23 20:36 - 2014-08-26 22:15 - 00347464 _____ () C:\Windows\SysWOW64\PnkBstrB.exe
2015-02-23 20:10 - 2014-08-01 16:03 - 00347464 _____ () C:\Windows\SysWOW64\PnkBstrB.ex0
2015-02-22 13:05 - 2014-08-13 10:55 - 00000000 ____D () C:\Users\Chiara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2015-02-20 19:22 - 2014-09-07 12:57 - 00002239 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-02-18 22:09 - 2014-07-26 19:47 - 00111336 _____ () C:\Users\Chiara\AppData\Local\GDIPFONTCACHEV1.DAT
2015-02-18 22:07 - 2009-07-14 06:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-02-18 22:07 - 2009-07-14 05:45 - 00413480 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-02-18 22:04 - 2009-07-14 03:34 - 00000616 _____ () C:\Windows\win.ini
2015-02-18 21:54 - 2009-07-14 03:34 - 00000855 _____ () C:\Windows\system32\Drivers\etc\hosts_bak_832
2015-02-18 21:43 - 2009-07-14 03:34 - 00000855 _____ () C:\Windows\system32\Drivers\etc\hosts_bak_79
2015-02-16 16:20 - 2014-11-02 13:46 - 00033856 ____H (LogMeIn, Inc.) C:\Windows\system32\hamachi.sys
2015-02-15 19:33 - 2014-12-20 21:26 - 00000000 ____D () C:\Users\Chiara\AppData\Roaming\Apple Computer
2015-02-14 11:43 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2015-02-12 09:26 - 2014-12-12 18:54 - 00000000 ____D () C:\Windows\system32\appraiser
2015-02-12 09:26 - 2014-07-26 21:17 - 00000000 ___SD () C:\Windows\system32\CompatTel
2015-02-12 00:46 - 2014-10-11 09:31 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-02-12 00:46 - 2014-07-26 21:01 - 00000000 ____D () C:\Windows\system32\MRT
2015-02-12 00:44 - 2014-07-26 21:01 - 116773704 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-02-11 17:26 - 2014-08-01 16:22 - 00000000 ____D () C:\Users\Chiara\Downloads\Gameforge Live
2015-02-11 10:31 - 2014-07-26 22:25 - 00000000 ____D () C:\ProgramData\Oracle
2015-02-11 10:24 - 2014-09-01 13:46 - 00000000 ____D () C:\Program Files\Java
2015-02-11 10:21 - 2014-07-26 18:56 - 00000000 ____D () C:\ProgramData\Package Cache
2015-02-08 14:33 - 2014-08-01 12:28 - 00000000 ____D () C:\Users\Chiara\.gimp-2.8
2015-02-06 19:15 - 2014-09-07 12:57 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-02-06 19:15 - 2014-09-07 12:57 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-02-05 18:59 - 2014-12-20 21:25 - 00000000 ____D () C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
2015-02-04 20:38 - 2014-08-13 10:30 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-02-04 20:38 - 2014-08-13 10:30 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-02-04 20:38 - 2014-08-13 10:30 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-02-03 18:43 - 2014-08-13 10:42 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-02-02 21:11 - 2014-08-01 12:29 - 00000000 ____D () C:\Users\Chiara\AppData\Local\gtk-2.0
2015-01-31 22:02 - 2014-10-03 18:16 - 00000000 ____D () C:\Users\Chiara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\GoodGameEmpire
2015-01-31 21:59 - 2014-08-02 17:14 - 00000000 ____D () C:\Windows\de
2015-01-30 22:29 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2015-01-30 22:29 - 2009-07-14 03:34 - 00000027 _____ () C:\Windows\system32\Drivers\etc\hosts_bak_601
2015-01-30 22:11 - 2014-07-26 18:30 - 00000000 ____D () C:\Users\Chiara

==================== Files in the root of some directories =======

2014-10-04 19:34 - 2013-03-07 12:48 - 0036864 _____ (Microsoft Corporation) C:\Program Files (x86)\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll
2014-10-04 19:34 - 2013-03-10 05:38 - 0084736 _____ (Microsoft Corporation) C:\Program Files (x86)\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll
2014-10-04 19:34 - 2006-10-03 17:26 - 0037063 _____ () C:\Program Files (x86)\Office Word 2003 Look.dotx
2014-11-23 16:41 - 2014-12-09 18:41 - 0000162 _____ () C:\Users\Chiara\AppData\Roaming\WB.CFG
2014-11-25 19:41 - 2014-12-02 18:41 - 0000002 _____ () C:\Users\Chiara\AppData\Local\DSI.DAT
2015-02-02 21:11 - 2015-02-02 21:11 - 0011853 _____ () C:\Users\Chiara\AppData\Local\recently-used.xbel

Some content of TEMP:
====================
C:\Users\Chiara\AppData\Local\Temp\APNSetup.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-24 21:18

==================== End Of Log ============================
--- --- ---

schrauber 02.03.2015 12:24
Search App by Ask deinstallieren.


Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.


Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


und ein frisches FRST log bitte.

QueenZoe 03.03.2015 21:48
mbam.txt

Code:
Malwarebytes Anti-Malware
www.malwarebytes.org

Suchlauf Datum: 03.03.2015
Suchlauf-Zeit: 21:13:15
Logdatei: mbam.txt
Administrator: Ja

Version: 2.00.4.1028
Malware Datenbank: v2015.03.03.06
Rootkit Datenbank: v2015.02.25.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: Chiara

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 435571
Verstrichene Zeit: 4 Min, 32 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente erkannt)

Module: 0
(Keine schädliche Elemente erkannt)

Registrierungsschlüssel: 0
(Keine schädliche Elemente erkannt)

Registrierungswerte: 0
(Keine schädliche Elemente erkannt)

Registrierungsdaten: 0
(Keine schädliche Elemente erkannt)

Ordner: 2
PUP.Optional.OpenCandy, C:\Users\Chiara\AppData\Roaming\OpenCandy, In Quarantäne, [8e941f22b2d8a98d7a7ca4bfd42fd22e],
PUP.Optional.OpenCandy, C:\Users\Chiara\AppData\Roaming\OpenCandy\5F04FCA5A0EE4518928BCACBA072D59B, In Quarantäne, [8e941f22b2d8a98d7a7ca4bfd42fd22e],

Dateien: 4
PUP.Optional.Ask.A, C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\wblsi6v6.default-1408827089247\extensions\toolbar_ORJ-SPE@apn.ask.com.xpi, In Quarantäne, [1d053b06f496a5916ba6724d47bc748c],
PUP.Optional.OpenCandy, C:\Users\Chiara\AppData\Roaming\OpenCandy\5F04FCA5A0EE4518928BCACBA072D59B\pcmechanicpmROE_p1v1.exe, In Quarantäne, [8e941f22b2d8a98d7a7ca4bfd42fd22e],
PUP.Optional.ASK.A, C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\wblsi6v6.default-1408827089247\prefs.js, Gut: (), Schlecht: (user_pref("browser.startup.homepage", "hxxp://www.search.ask.com/?tpid=ORJ-ST-SPE&o=APN11464&pf=V7&trgb=FF&p2=Ersetzt,[df4391b0eb9fd660fb125eb822e4a55b]EBEAErsetzt,[df4391b0eb9fd660fb125eb822e4a55b]EOSJ000Ersetzt,[df4391b0eb9fd660fb125eb822e4a55b]EYYErsetzt,[df4391b0eb9fd660fb125eb822e4a55b]ECH&gct=hp&apn_ptnrs=BEA&apn_dtid=Ersetzt,[df4391b0eb9fd660fb125eb822e4a55b]EOSJ000Ersetzt,[df4391b0eb9fd660fb125eb822e4a55b]EYYErsetzt,[df4391b0eb9fd660fb125eb822e4a55b]ECH&apn_dbr=ff_35.0.1.5500&apn_uid=CFFB9BD3-36CC-4E25-B3AF-350A80C85E92&itbv=12.24.1.53&doi=2015-02-11&psv=&pt=tb");), Ersetzt,[df4391b0eb9fd660fb125eb822e4a55b]
PUP.Optional.ASK.A, C:\Users\Gast\AppData\Roaming\Mozilla\Firefox\Profiles\oh9p8drw.default\prefs.js, Gut: (), Schlecht: (user_pref("browser.startup.homepage", "hxxp://www.search.ask.com/?tpid=ORJ-ST-SPE&o=APN11464&pf=V7&trgb=FF&p2=Ersetzt,[67bb81c0335751e5f9145db91ee8c63a]EBEAErsetzt,[67bb81c0335751e5f9145db91ee8c63a]EOSJ000Ersetzt,[67bb81c0335751e5f9145db91ee8c63a]EYYErsetzt,[67bb81c0335751e5f9145db91ee8c63a]ECH&gct=hp&apn_ptnrs=BEA&apn_dtid=Ersetzt,[67bb81c0335751e5f9145db91ee8c63a]EOSJ000Ersetzt,[67bb81c0335751e5f9145db91ee8c63a]EYYErsetzt,[67bb81c0335751e5f9145db91ee8c63a]ECH&apn_dbr=ff_35.0.1.5500&apn_uid=CFFB9BD3-36CC-4E25-B3AF-350A80C85E92&itbv=12.24.1.53&doi=2015-02-11&psv=&pt=tb");), Ersetzt,[67bb81c0335751e5f9145db91ee8c63a]

Physische Sektoren: 0
(Keine schädliche Elemente erkannt)


(end)
AdwCleaner.txt

Code:
# AdwCleaner v4.111 - Bericht erstellt 03/03/2015 um 21:31:57
# Aktualisiert 18/02/2015 von Xplode
# Datenbank : 2015-03-02.3 [Server]
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (x64)
# Benutzername : Chiara - BLUESTAR
# Gestarted von : C:\Users\Chiara\Downloads\AdwCleaner_4.111.exe
# Option : Löschen

***** [ Dienste ] *****

Dienst Gelöscht : APNMCP

***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\apn
Ordner Gelöscht : C:\ProgramData\AskPartnerNetwork
Ordner Gelöscht : C:\Program Files (x86)\AskPartnerNetwork
Ordner Gelöscht : C:\Users\Chiara\AppData\Local\Temp\apn
Ordner Gelöscht : C:\Users\Chiara\AppData\Local\AskPartnerNetwork
Datei Gelöscht : C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\wblsi6v6.default-1408827089247\searchplugins\ask-search.xml
Datei Gelöscht : C:\Users\Gast\AppData\Roaming\Mozilla\Firefox\Profiles\oh9p8drw.default\searchplugins\ask-search.xml

***** [ Geplante Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnTbMon]
Schlüssel Gelöscht : HKCU\Software\AskPartnerNetwork
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKLM\SOFTWARE\AskPartnerNetwork
Schlüssel Gelöscht : HKLM\SOFTWARE\Uniblue
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4F524A2D-5354-2D53-5045-A758B70C1801}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\7AB5857A57A0687786597A857BFFFFFF

***** [ Internetbrowser ] *****

-\\ Internet Explorer v11.0.9600.17631


-\\ Mozilla Firefox v35.0.1 (x86 de)

[wblsi6v6.default-1408827089247\prefs.js] - Zeile Gelöscht : user_pref("browser.startup.homepage", "hxxp://www.search.ask.com/?tpid=ORJ-ST-SPE&o=APN11464&pf=V7&trgb=FF&p2=%5EBEA%5EOSJ000%5EYY%5ECH&gct=hp&apn_ptnrs=BEA&apn_dtid=%5EOSJ000%5EYY%5ECH&apn_dbr=ff_35.[...]
[wblsi6v6.default-1408827089247\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar_ORJ-SPE@apn.ask.com.install-event-fired", true);
[wblsi6v6.default-1408827089247\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar_ORJ-ST-SPE@apn.ask.com.install-event-fired", true);
[wblsi6v6.default-1408827089247\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar_OVO2-SP@apn.ask.com.install-event-fired", true);
[wblsi6v6.default-1408827089247\prefs.js] - Zeile Gelöscht : user_pref("extensions.xpiState", "{\"app-profile\":{\"amptra@keepa.com\":{\"d\":\"C:\\\\Users\\\\Chiara\\\\AppData\\\\Roaming\\\\Mozilla\\\\Firefox\\\\Profiles\\\\wblsi6v6.default-1408827089247\\\\ext[...]

-\\ Google Chrome v40.0.2214.115


-\\ Comodo Dragon v


*************************

AdwCleaner[R0].txt - [13097 Bytes] - [31/01/2015 22:01:04]
AdwCleaner[R1].txt - [3077 Bytes] - [03/03/2015 21:27:05]
AdwCleaner[S0].txt - [15071 Bytes] - [31/01/2015 22:02:28]
AdwCleaner[S1].txt - [2934 Bytes] - [03/03/2015 21:31:57]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [2993  Bytes] ##########
JRT.txt

Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.3 (03.01.2015:1)
OS: Windows 7 Home Premium x64
Ran by Chiara on 03.03.2015 at 21:41:38.48
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ FireFox

Successfully deleted the following from C:\Users\Chiara\AppData\Roaming\mozilla\firefox\profiles\wblsi6v6.default-1408827089247\prefs.js

user_pref("extensions.xpiState", "{\"app-profile\":{\"amptra@keepa.com\":{\"d\":\"C:\\\\Users\\\\Chiara\\\\AppData\\\\Roaming\\\\Mozilla\\\\Firefox\\\\Profiles\\\\wblsi6v6.def
Emptied folder: C:\Users\Chiara\AppData\Roaming\mozilla\firefox\profiles\wblsi6v6.default-1408827089247\minidumps [4 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 03.03.2015 at 21:43:27.21
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST.txt


FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-02-2015
Ran by Chiara (administrator) on BLUESTAR on 03-03-2015 21:44:50
Running from C:\Users\Chiara\Downloads
Loaded Profiles: Chiara (Available profiles: Chiara & Gast)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
() C:\Program Files (x86)\ASUS\AXSP\1.02.00\atkexComSvc.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(LogMeIn Inc.) D:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
(LogMeIn, Inc.) D:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(LogMeIn Inc.) D:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(LogMeIn, Inc.) D:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Oracle Corporation) C:\Users\Chiara\Downloads\runtime\jre-x64\1.8.0_25\bin\java.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Oracle Corporation) C:\Users\Chiara\Downloads\runtime\jre-x64\1.8.0_25\bin\javaw.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2014-04-11] (Intel Corporation)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7572696 2014-04-17] (Realtek Semiconductor)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848 2014-02-21] (Intel Corporation)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [508800 2014-12-17] (Oracle Corporation)
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] => D:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [3978600 2015-02-17] (LogMeIn Inc.)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5227112 2015-02-28] (AVAST Software)
HKU\S-1-5-21-1268736343-3887576109-2910839842-1000\...\Run: [Speech Recognition] => C:\Windows\Speech\Common\sapisvr.exe [44544 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-21-1268736343-3887576109-2910839842-1000\...\Run: [EADM] => C:\Program Files (x86)\Origin\Origin.exe [3631448 2015-02-27] (Electronic Arts)
HKU\S-1-5-21-1268736343-3887576109-2910839842-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [30879328 2014-12-11] (Skype Technologies S.A.)
Startup: C:\Users\Chiara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk
ShortcutTarget: Adobe Gamma.lnk -> C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\.DEFAULT\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-1268736343-3887576109-2910839842-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:49174;https=127.0.0.1:49174
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=56626&homepage=about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/?trackid=sp-006
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = https://www.google.com/search?trackid=sp-006&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-1268736343-3887576109-2910839842-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-1268736343-3887576109-2910839842-1000\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/?trackid=sp-006
SearchScopes: HKLM-x32 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = https://www.google.com/search?trackid=sp-006&q={searchTerms}
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1268736343-3887576109-2910839842-1000 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = https://www.google.com/search?trackid=sp-006&q={searchTerms}
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: No Name -> {9030D464-4C02-4ABF-8ECC-5164760863C6} ->  No File
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll (Oracle Corporation)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} -  No File
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\wblsi6v6.default-1408827089247
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @esn/npbattlelog,version=2.4.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.4.0\npbattlelog.dll (EA Digital Illusions CE AB)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MIF5BA~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKU\S-1-5-21-1268736343-3887576109-2910839842-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Chiara\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF SearchPlugin: C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\wblsi6v6.default-1408827089247\searchplugins\google-images.xml
FF SearchPlugin: C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\wblsi6v6.default-1408827089247\searchplugins\google-maps.xml
FF Extension: amptrakeepacom - C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\wblsi6v6.default-1408827089247\Extensions\amptra@keepa.com [2014-09-08]
FF Extension: Web Helper Lite - C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\wblsi6v6.default-1408827089247\Extensions\{53ecb410-cb6c-474d-8ce2-8f9e2c15a4a7} [2014-10-09]
FF Extension: Cliqz Beta - C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\wblsi6v6.default-1408827089247\Extensions\cliqz@cliqz.com.xpi [2014-10-07]
FF Extension: MEGA - C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\wblsi6v6.default-1408827089247\Extensions\firefox@mega.co.nz.xpi [2014-11-02]
FF Extension: Shopping App by Ask - C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\wblsi6v6.default-1408827089247\Extensions\toolbar_ORJ-ST-SPE@apn.ask.com.xpi [2015-01-31]
FF Extension: ooVoo Search App powered by Ask - C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\wblsi6v6.default-1408827089247\Extensions\toolbar_OVO2-SP@apn.ask.com.xpi [2014-09-11]
FF Extension: Search App - C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\wblsi6v6.default-1408827089247\Extensions\{1d33817b-02d7-4cfa-a618-2d2fe2f6add4}.xpi [2014-12-23]
FF Extension: mpeg4 shield - C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\wblsi6v6.default-1408827089247\Extensions\{3d69b985-bc93-4bb9-9a0a-e16269028e65}.xpi [2014-10-10]
FF Extension: {9b0ceae4-a807-4940-a439-ad70def3437d} - C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\wblsi6v6.default-1408827089247\Extensions\{9b0ceae4-a807-4940-a439-ad70def3437d}.xpi [2014-10-05]
FF Extension: Adblock Plus - C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\wblsi6v6.default-1408827089247\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-08-23]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-02-28]
FF HKU\S-1-5-21-1268736343-3887576109-2910839842-1000\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff
FF HKU\S-1-5-21-1268736343-3887576109-2910839842-1000\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\wblsi6v6.default-1408827089247\extensions\cliqz@cliqz.com

Chrome:
=======
CHR HomePage: Default -> hxxp://Vosteran.com/?f=1&a=vst_ggbc_14_47_ff&cd=2XzuyEtN2Y1L1QzuyB0AyBzytCzyyEzytCzztAtC0AtB0EtCtN0D0Tzu0StCtDyDyBtN1L2XzutAtFyCtFtBtFtDtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2SyB0EtC0DzytAtDyEtG0FyDtC0CtGtDyCtCyBtG0DzzzyyBtGyB0Dzy0CtCyE0B0A0EtCtAtC2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCyDyE0D0CzytDzytG0D0ByDtCtGyE0BtCtCtGzytA0DzytG0D0EyEtD0ByByB0AyBtC0D0E2Q&cr=423194433&ir=
CHR StartupUrls: Default -> "https://www.google.com/?trackid=sp-006"
CHR DefaultSearchURL: Default -> https://www.google.de/search?q={searchTerms}?trackid=sp-006
CHR DefaultSuggestURL: Default -> https://www.google.com/complete/search?client=chrome&q={searchTerms}
CHR Profile: C:\Users\Chiara\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\Chiara\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-09-14]
CHR Extension: (Google Docs) - C:\Users\Chiara\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-09-14]
CHR Extension: (Google Drive) - C:\Users\Chiara\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-09-14]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Chiara\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-07]
CHR Extension: (YouTube) - C:\Users\Chiara\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-07-26]
CHR Extension: (Google Search) - C:\Users\Chiara\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-07-26]
CHR Extension: (Google Sheets) - C:\Users\Chiara\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-09-14]
CHR Extension: (Avira Browser Safety) - C:\Users\Chiara\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2014-09-08]
CHR Extension: (Skype Click to Call) - C:\Users\Chiara\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2014-07-31]
CHR Extension: (Google Wallet) - C:\Users\Chiara\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-07-26]
CHR Extension: (Amazon) - C:\Users\Chiara\AppData\Local\Google\Chrome\User Data\Default\Extensions\ocbnpbkmjpgbdcgiflkgkpnkinifpgpj [2014-10-05]
CHR Extension: (Disable AntiAdblock) - C:\Users\Chiara\AppData\Local\Google\Chrome\User Data\Default\Extensions\oimhabmdhenmcaligiilhadkdliolpah [2014-07-31]
CHR Extension: (Gmail) - C:\Users\Chiara\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-07-26]
CHR HKLM\...\Chrome\Extension: [Äÿ] - No Path Or update_url value
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-02-28]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [ocbnpbkmjpgbdcgiflkgkpnkinifpgpj] - C:\Users\Chiara\ChromeExtensions\ocbnpbkmjpgbdcgiflkgkpnkinifpgpj\amazon-icon-2.crx [2014-10-04]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [72704 2014-11-16] (Adobe Systems) [File not signed]
R2 asComSvc; C:\Program Files (x86)\ASUS\AXSP\1.02.00\atkexComSvc.exe [936728 2014-01-28] ()
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2015-02-28] (AVAST Software)
R2 Hamachi2Svc; D:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe [2490216 2015-02-17] (LogMeIn Inc.)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [16232 2014-04-11] (Intel Corporation)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-03] (Macrovision Corporation) [File not signed]
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [329104 2014-10-03] (Intel Corporation)
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [887232 2014-01-31] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [154584 2014-03-20] (Intel Corporation)
R2 LightScribeService; C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2013-01-16] (Hewlett-Packard Company) [File not signed]
S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [1910640 2015-02-27] (Electronic Arts)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76152 2014-10-18] ()
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [15232 2014-01-28] ()
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2015-02-28] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [87912 2015-02-28] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2015-02-28] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2015-02-28] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1050432 2015-02-28] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [436624 2015-02-28] (AVAST Software)
S2 aswStm; C:\Windows\system32\drivers\aswStm.sys [116728 2015-02-28] (AVAST Software)
S3 aswTap; C:\Windows\System32\DRIVERS\aswTap.sys [44640 2015-01-18] (The OpenVPN Project)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [267632 2015-02-28] ()
R3 e1dexpress; C:\Windows\System32\DRIVERS\e1d62x64.sys [487704 2014-03-14] (Intel Corporation)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28008 2014-04-11] (Intel Corporation)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [118272 2014-03-20] (Intel Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-03 21:43 - 2015-03-03 21:43 - 00001089 _____ () C:\Users\Chiara\Desktop\JRT.txt
2015-03-03 21:41 - 2015-03-03 21:41 - 01388333 _____ (Thisisu) C:\Users\Chiara\Downloads\JRT(1).exe
2015-03-03 21:26 - 2015-03-03 21:26 - 02126848 _____ () C:\Users\Chiara\Downloads\AdwCleaner_4.111.exe
2015-03-03 21:25 - 2015-03-03 21:25 - 00003295 _____ () C:\Users\Chiara\Desktop\mbam.txt
2015-03-01 14:53 - 2015-03-01 14:53 - 00281688 _____ () C:\Windows\Minidump\030115-5678-01.dmp
2015-03-01 10:05 - 2015-03-01 10:05 - 00001812 _____ () C:\Users\Chiara\Desktop\Bluescreenview3.txt
2015-02-28 17:28 - 2015-02-28 17:28 - 00281688 _____ () C:\Windows\Minidump\022815-5850-01.dmp
2015-02-28 10:37 - 2015-02-28 10:37 - 00000000 ____D () C:\Users\Chiara\AppData\Roaming\AVAST Software
2015-02-28 10:36 - 2015-03-03 21:34 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2015-02-28 10:36 - 2015-02-28 10:36 - 01050432 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys
2015-02-28 10:36 - 2015-02-28 10:36 - 00436624 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2015-02-28 10:36 - 2015-02-28 10:36 - 00364512 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2015-02-28 10:36 - 2015-02-28 10:36 - 00267632 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2015-02-28 10:36 - 2015-02-28 10:36 - 00116728 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2015-02-28 10:36 - 2015-02-28 10:36 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2015-02-28 10:36 - 2015-02-28 10:36 - 00087912 _____ (AVAST Software) C:\Windows\system32\Drivers\aswmonflt.sys
2015-02-28 10:36 - 2015-02-28 10:36 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2015-02-28 10:36 - 2015-02-28 10:36 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2015-02-28 10:36 - 2015-02-28 10:36 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2015-02-28 10:36 - 2015-02-28 10:36 - 00001930 _____ () C:\Users\Public\Desktop\Avast Free Antivirus.lnk
2015-02-28 10:36 - 2015-02-28 10:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2015-02-28 10:36 - 2015-02-28 10:36 - 00000000 ____D () C:\Program Files\AVAST Software
2015-02-28 10:35 - 2015-02-28 10:35 - 132469808 _____ (AVAST Software) C:\Users\Chiara\Downloads\avast_free_antivirus_setup(1).exe
2015-02-28 08:01 - 2015-02-28 08:01 - 00000000 ____D () C:\Users\Gast\AppData\Roaming\Apple Computer
2015-02-25 22:42 - 2015-01-09 00:44 - 00419936 _____ () C:\Windows\SysWOW64\locale.nls
2015-02-25 22:42 - 2015-01-09 00:43 - 00419936 _____ () C:\Windows\system32\locale.nls
2015-02-25 20:49 - 2015-01-09 04:14 - 00950272 _____ (Microsoft Corporation) C:\Windows\system32\perftrack.dll
2015-02-25 20:49 - 2015-01-09 04:14 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\wdi.dll
2015-02-25 20:49 - 2015-01-09 04:14 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\powertracker.dll
2015-02-25 20:49 - 2015-01-09 03:48 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdi.dll
2015-02-24 19:42 - 2015-02-24 19:42 - 00000634 _____ () C:\Users\Public\Desktop\Battle.net.lnk
2015-02-24 19:42 - 2015-02-24 19:42 - 00000000 ____D () C:\Users\Chiara\AppData\Roaming\Battle.net
2015-02-24 19:42 - 2015-02-24 19:42 - 00000000 ____D () C:\Users\Chiara\AppData\Local\Blizzard Entertainment
2015-02-24 19:42 - 2015-02-24 19:42 - 00000000 ____D () C:\Users\Chiara\AppData\Local\Battle.net
2015-02-24 19:42 - 2015-02-24 19:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battle.net
2015-02-24 19:42 - 2015-02-24 19:42 - 00000000 ____D () C:\ProgramData\Blizzard Entertainment
2015-02-24 19:41 - 2015-02-24 19:41 - 03057720 _____ (Blizzard Entertainment) C:\Users\Chiara\Downloads\Hearthstone-Setup-deDE.exe
2015-02-24 19:41 - 2015-02-24 19:41 - 00000000 ____D () C:\ProgramData\Battle.net
2015-02-20 18:56 - 2015-02-20 18:56 - 00281688 _____ () C:\Windows\Minidump\022015-5928-01.dmp
2015-02-19 18:57 - 2015-02-19 18:57 - 00000000 ____D () C:\Users\Chiara\AppData\Local\Steam
2015-02-18 21:38 - 2015-02-18 21:38 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-BLUESTAR-Windows-7-Home-Premium-(64-bit).dat
2015-02-18 21:38 - 2015-02-18 21:38 - 00000000 ____D () C:\RegBackup
2015-02-18 21:28 - 2015-02-18 21:28 - 00002169 _____ () C:\Users\Chiara\Desktop\Tweaking.com - Windows Repair (All in One).lnk
2015-02-18 21:28 - 2015-02-18 21:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tweaking.com
2015-02-18 21:28 - 2015-02-18 21:28 - 00000000 ____D () C:\Program Files (x86)\Tweaking.com
2015-02-18 21:27 - 2015-02-18 21:27 - 11852704 _____ () C:\Users\Chiara\Downloads\tweaking.com_windows_repair_aio_setup.exe
2015-02-18 21:25 - 2015-02-18 21:25 - 00281688 _____ () C:\Windows\Minidump\021815-6302-01.dmp
2015-02-18 20:17 - 2015-02-18 20:17 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2015-02-18 18:42 - 2015-02-18 18:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
2015-02-14 22:33 - 2015-02-14 22:33 - 00281664 _____ () C:\Windows\Minidump\021415-10545-01.dmp
2015-02-13 10:27 - 2015-02-13 10:27 - 00049682 _____ () C:\Users\Chiara\Downloads\SystemLook.txt
2015-02-13 10:26 - 2015-02-13 10:26 - 00165376 _____ () C:\Users\Chiara\Downloads\SystemLook_x64.exe
2015-02-12 09:32 - 2015-01-23 05:42 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-02-12 09:32 - 2015-01-23 05:41 - 06041600 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-02-12 09:32 - 2015-01-23 04:43 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-02-12 09:32 - 2015-01-23 04:17 - 04300800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-02-12 00:08 - 2015-02-12 10:01 - 00000000 ____D () C:\Users\Chiara\Desktop\Zoes alt
2015-02-11 10:34 - 2015-02-11 10:34 - 00000000 ____D () C:\Users\Chiara\Downloads\runtime
2015-02-11 10:34 - 2015-02-11 10:34 - 00000000 ____D () C:\Users\Chiara\Downloads\game
2015-02-11 10:33 - 2015-02-11 10:33 - 01294088 _____ (Mojang) C:\Users\Chiara\Downloads\Minecraft(2).exe
2015-02-11 10:29 - 2015-02-11 10:29 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-02-11 10:29 - 2015-02-11 10:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-02-11 10:29 - 2015-02-11 10:29 - 00000000 ____D () C:\Program Files (x86)\Java
2015-02-11 10:24 - 2015-02-11 10:24 - 00639912 _____ (Oracle Corporation) C:\Users\Chiara\Downloads\jxpiinstall.exe
2015-02-11 09:50 - 2015-02-11 09:50 - 00000000 ____D () C:\Users\Chiara\AppData\Local\IsolatedStorage
2015-02-11 09:39 - 2015-02-11 09:48 - 00000000 ____D () C:\ProgramData\Screaming Bee
2015-02-11 09:38 - 2015-02-11 09:38 - 01198368 _____ () C:\Users\Chiara\Downloads\MorphVOX Pro - CHIP-Installer.exe
2015-02-11 09:38 - 2015-02-04 04:16 - 00894976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-02-11 09:38 - 2015-02-04 04:16 - 00762368 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-02-11 09:38 - 2015-02-04 04:16 - 00609280 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-02-11 09:38 - 2015-02-04 04:16 - 00414720 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-02-11 09:38 - 2015-02-04 04:16 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-02-11 09:38 - 2015-02-04 04:16 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-02-11 09:38 - 2015-02-04 04:13 - 01098752 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-02-11 09:38 - 2015-01-28 00:36 - 01239720 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2015-02-11 09:38 - 2015-01-14 06:47 - 00389808 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-02-11 09:38 - 2015-01-14 06:09 - 00342712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-02-11 09:38 - 2015-01-12 04:09 - 25056256 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-02-11 09:38 - 2015-01-12 04:05 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-02-11 09:38 - 2015-01-12 04:05 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-02-11 09:38 - 2015-01-12 03:49 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-02-11 09:38 - 2015-01-12 03:48 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-02-11 09:38 - 2015-01-12 03:48 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-02-11 09:38 - 2015-01-12 03:48 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-02-11 09:38 - 2015-01-12 03:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-02-11 09:38 - 2015-01-12 03:40 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-02-11 09:38 - 2015-01-12 03:39 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-02-11 09:38 - 2015-01-12 03:36 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-02-11 09:38 - 2015-01-12 03:34 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-02-11 09:38 - 2015-01-12 03:34 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-02-11 09:38 - 2015-01-12 03:25 - 19740160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-02-11 09:38 - 2015-01-12 03:25 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-02-11 09:38 - 2015-01-12 03:21 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-02-11 09:38 - 2015-01-12 03:21 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-02-11 09:38 - 2015-01-12 03:13 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-02-11 09:38 - 2015-01-12 03:08 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-02-11 09:38 - 2015-01-12 03:08 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-02-11 09:38 - 2015-01-12 03:07 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-02-11 09:38 - 2015-01-12 03:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-02-11 09:38 - 2015-01-12 03:07 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-02-11 09:38 - 2015-01-12 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-02-11 09:38 - 2015-01-12 03:04 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-02-11 09:38 - 2015-01-12 03:02 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-02-11 09:38 - 2015-01-12 03:00 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-02-11 09:38 - 2015-01-12 02:59 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-02-11 09:38 - 2015-01-12 02:57 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-02-11 09:38 - 2015-01-12 02:55 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-02-11 09:38 - 2015-01-12 02:48 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-02-11 09:38 - 2015-01-12 02:48 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-02-11 09:38 - 2015-01-12 02:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-02-11 09:38 - 2015-01-12 02:46 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-02-11 09:38 - 2015-01-12 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-02-11 09:38 - 2015-01-12 02:43 - 14401024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-02-11 09:38 - 2015-01-12 02:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-02-11 09:38 - 2015-01-12 02:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-02-11 09:38 - 2015-01-12 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-02-11 09:38 - 2015-01-12 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-02-11 09:38 - 2015-01-12 02:27 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-02-11 09:38 - 2015-01-12 02:23 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-02-11 09:38 - 2015-01-12 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-02-11 09:38 - 2015-01-12 02:22 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-02-11 09:38 - 2015-01-12 02:14 - 12829184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-02-11 09:38 - 2015-01-12 02:14 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-02-11 09:38 - 2015-01-12 02:02 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-02-11 09:38 - 2015-01-12 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-02-11 09:38 - 2015-01-12 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-02-11 09:38 - 2015-01-12 01:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-02-11 09:38 - 2015-01-10 07:48 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-02-11 09:38 - 2015-01-10 07:48 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-02-11 09:38 - 2015-01-10 07:48 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-02-11 09:38 - 2015-01-10 07:48 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-02-11 09:38 - 2015-01-10 07:48 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-02-11 09:38 - 2015-01-10 07:48 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-02-11 09:38 - 2015-01-10 07:48 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-02-11 09:38 - 2015-01-10 07:27 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-02-11 09:38 - 2015-01-10 07:27 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-02-11 09:38 - 2015-01-10 07:27 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-02-11 09:38 - 2015-01-10 07:27 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-02-11 09:38 - 2015-01-10 07:27 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-02-11 09:38 - 2015-01-10 07:27 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-02-11 09:38 - 2015-01-10 07:27 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-02-11 09:37 - 2015-01-15 09:14 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-02-11 09:37 - 2015-01-15 09:14 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-02-11 09:37 - 2015-01-15 09:09 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-02-11 09:37 - 2015-01-15 09:09 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-02-11 09:37 - 2015-01-15 09:09 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-02-11 09:37 - 2015-01-15 09:09 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-02-11 09:37 - 2015-01-15 09:09 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-02-11 09:37 - 2015-01-15 09:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-02-11 09:37 - 2015-01-15 09:06 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-02-11 09:37 - 2015-01-15 09:06 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-02-11 09:37 - 2015-01-15 09:04 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-02-11 09:37 - 2015-01-15 08:42 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-02-11 09:37 - 2015-01-15 08:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-02-11 09:37 - 2015-01-15 08:41 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-02-11 09:37 - 2015-01-15 08:39 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-02-11 09:37 - 2015-01-15 08:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-02-11 09:37 - 2015-01-15 08:37 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-02-11 09:37 - 2015-01-15 05:22 - 00458824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-02-11 09:37 - 2015-01-14 07:09 - 05554112 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-02-11 09:37 - 2015-01-14 07:05 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-02-11 09:37 - 2015-01-14 07:05 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-02-11 09:37 - 2015-01-14 07:04 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-02-11 09:37 - 2015-01-14 06:44 - 03972544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-02-11 09:37 - 2015-01-14 06:44 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-02-11 09:37 - 2015-01-14 06:41 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-02-11 09:37 - 2015-01-13 04:10 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-02-11 09:37 - 2015-01-13 03:49 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-02-11 09:37 - 2015-01-09 03:03 - 03201536 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-02-11 09:37 - 2014-12-12 06:31 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-02-11 09:37 - 2014-12-12 06:07 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2015-02-11 09:37 - 2014-12-08 04:09 - 00406528 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2015-02-11 09:37 - 2014-12-08 03:46 - 00308224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll
2015-02-11 09:37 - 2014-11-26 04:53 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2015-02-11 09:37 - 2014-11-26 04:32 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2015-02-11 09:37 - 2014-07-07 03:07 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2015-02-11 09:37 - 2014-07-07 03:06 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2015-02-11 09:37 - 2014-07-07 02:40 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2015-02-11 09:37 - 2014-07-07 02:40 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2015-02-10 21:58 - 2015-02-11 09:50 - 00000000 ____D () C:\Users\Chiara\AppData\Roaming\Screaming Bee
2015-02-10 21:57 - 2015-02-11 10:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Screaming Bee
2015-02-10 21:57 - 2015-02-11 10:21 - 00000000 ____D () C:\Program Files (x86)\Screaming Bee
2015-02-10 21:57 - 2015-02-10 21:57 - 00002270 _____ () C:\Users\Chiara\Desktop\MorphVOX Junior.lnk
2015-02-10 21:57 - 2015-02-10 21:57 - 00000000 ____D () C:\Users\Chiara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Screaming Bee
2015-02-10 21:56 - 2015-02-10 21:56 - 02970992 _____ () C:\Users\Chiara\Downloads\MorphVOXJunior_Install-1.exe
2015-02-10 17:46 - 2015-02-10 17:46 - 00281664 _____ () C:\Windows\Minidump\021015-12760-01.dmp
2015-02-10 13:46 - 2015-03-01 14:53 - 00000000 ____D () C:\Windows\Minidump
2015-02-10 13:46 - 2015-02-10 13:46 - 00281664 _____ () C:\Windows\Minidump\021015-9968-01.dmp
2015-02-10 11:24 - 2015-02-10 11:24 - 00001196 _____ () C:\Users\Chiara\Desktop\CrystalDiskInfo.lnk
2015-02-10 11:24 - 2015-02-10 11:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CrystalDiskInfo
2015-02-10 11:24 - 2015-02-10 11:24 - 00000000 ____D () C:\Program Files (x86)\CrystalDiskInfo
2015-02-10 11:23 - 2015-02-10 11:23 - 03014272 _____ (Crystal Dew World ) C:\Users\Chiara\Downloads\CrystalDiskInfo6_3_0-en.exe
2015-02-08 19:53 - 2015-02-08 19:53 - 00526371 _____ () C:\Users\Chiara\Desktop\openhardwaremonitor-v0.6.0-beta.zip
2015-02-08 09:38 - 2015-02-08 09:38 - 01188194 _____ () C:\Users\Chiara\Downloads\ProcessExplorer.zip
2015-02-05 19:45 - 2015-02-05 19:48 - 00067892 _____ () C:\Users\Chiara\Downloads\bluescreenview_v1.55.zip
2015-02-03 18:40 - 2015-02-03 18:40 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-02-02 22:10 - 2015-02-02 22:10 - 00852573 _____ () C:\Users\Chiara\Downloads\SecurityCheck.exe
2015-02-02 21:19 - 2015-02-02 21:19 - 02347384 _____ (ESET) C:\Users\Chiara\Downloads\esetsmartinstaller_deu.exe
2015-02-02 21:11 - 2015-02-02 21:11 - 00011853 _____ () C:\Users\Chiara\AppData\Local\recently-used.xbel

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-03 21:44 - 2014-09-17 17:50 - 00000000 ____D () C:\FRST
2015-03-03 21:44 - 2014-09-16 17:42 - 00021346 _____ () C:\Users\Chiara\Downloads\FRST.txt
2015-03-03 21:44 - 2014-07-31 21:39 - 00000000 ____D () C:\Users\Chiara\AppData\Roaming\Skype
2015-03-03 21:44 - 2014-07-31 21:34 - 00000000 ____D () C:\Users\Chiara\AppData\Roaming\.minecraft
2015-03-03 21:38 - 2014-08-13 10:30 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-03-03 21:37 - 2009-07-14 05:45 - 00023088 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-03-03 21:37 - 2009-07-14 05:45 - 00023088 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-03-03 21:36 - 2009-07-14 18:58 - 00686552 _____ () C:\Windows\system32\perfh007.dat
2015-03-03 21:36 - 2009-07-14 18:58 - 00145882 _____ () C:\Windows\system32\perfc007.dat
2015-03-03 21:36 - 2009-07-14 06:13 - 01623866 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-03-03 21:34 - 2014-07-26 19:39 - 00006462 _____ () C:\Windows\SysWOW64\Gms.log
2015-03-03 21:32 - 2014-10-06 12:27 - 00000000 ____D () C:\Users\Chiara\AppData\Local\LogMeIn Hamachi
2015-03-03 21:32 - 2014-09-07 12:57 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-03-03 21:32 - 2014-08-01 13:15 - 00000000 ____D () C:\ProgramData\Origin
2015-03-03 21:32 - 2014-07-26 18:58 - 02442608 _____ () C:\Windows\PFRO.log
2015-03-03 21:32 - 2014-07-26 18:30 - 02051934 _____ () C:\Windows\WindowsUpdate.log
2015-03-03 21:32 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-03-03 21:32 - 2009-07-14 05:51 - 00062329 _____ () C:\Windows\setupact.log
2015-03-03 21:31 - 2015-01-31 22:01 - 00000000 ____D () C:\AdwCleaner
2015-03-03 21:24 - 2015-01-31 21:50 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-03-03 21:20 - 2014-09-07 12:57 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-03-03 21:18 - 2014-08-02 17:14 - 00000000 ____D () C:\Windows\en
2015-03-03 20:55 - 2014-08-02 13:55 - 00000000 ____D () C:\Users\Chiara\AppData\Roaming\TS3Client
2015-03-01 21:18 - 2014-09-16 17:42 - 00039279 _____ () C:\Users\Chiara\Downloads\Addition.txt
2015-03-01 21:16 - 2015-01-31 22:07 - 00000000 ____D () C:\Users\Chiara\Downloads\FRST-OlderVersion
2015-03-01 21:16 - 2014-09-16 17:41 - 02092544 _____ (Farbar) C:\Users\Chiara\Downloads\FRST64.exe
2015-02-28 10:36 - 2014-09-07 12:56 - 00000000 ____D () C:\ProgramData\AVAST Software
2015-02-28 08:02 - 2014-11-26 15:42 - 00111336 _____ () C:\Users\Gast\AppData\Local\GDIPFONTCACHEV1.DAT
2015-02-28 08:01 - 2014-11-26 15:41 - 00000000 ____D () C:\Users\Gast\AppData\Local\LogMeIn Hamachi
2015-02-27 19:07 - 2014-08-26 21:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Origin
2015-02-27 19:07 - 2014-08-26 21:52 - 00000000 ____D () C:\Program Files (x86)\Origin
2015-02-26 18:43 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\tracing
2015-02-25 19:38 - 2015-01-14 18:04 - 00000000 ____D () C:\Users\Chiara\AppData\Local\osu!
2015-02-23 20:36 - 2014-08-26 22:18 - 00347464 _____ () C:\Windows\SysWOW64\PnkBstrB.xtr
2015-02-23 20:36 - 2014-08-26 22:15 - 00347464 _____ () C:\Windows\SysWOW64\PnkBstrB.exe
2015-02-23 20:10 - 2014-08-01 16:03 - 00347464 _____ () C:\Windows\SysWOW64\PnkBstrB.ex0
2015-02-22 13:05 - 2014-08-13 10:55 - 00000000 ____D () C:\Users\Chiara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2015-02-20 19:22 - 2014-09-07 12:57 - 00002239 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-02-18 22:09 - 2014-07-26 19:47 - 00111336 _____ () C:\Users\Chiara\AppData\Local\GDIPFONTCACHEV1.DAT
2015-02-18 22:07 - 2009-07-14 06:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-02-18 22:07 - 2009-07-14 05:45 - 00413480 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-02-18 22:04 - 2009-07-14 03:34 - 00000616 _____ () C:\Windows\win.ini
2015-02-18 21:54 - 2009-07-14 03:34 - 00000855 _____ () C:\Windows\system32\Drivers\etc\hosts_bak_832
2015-02-18 21:43 - 2009-07-14 03:34 - 00000855 _____ () C:\Windows\system32\Drivers\etc\hosts_bak_79
2015-02-16 16:20 - 2014-11-02 13:46 - 00033856 ____H (LogMeIn, Inc.) C:\Windows\system32\hamachi.sys
2015-02-15 19:33 - 2014-12-20 21:26 - 00000000 ____D () C:\Users\Chiara\AppData\Roaming\Apple Computer
2015-02-14 11:43 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2015-02-12 09:26 - 2014-12-12 18:54 - 00000000 ____D () C:\Windows\system32\appraiser
2015-02-12 09:26 - 2014-07-26 21:17 - 00000000 ___SD () C:\Windows\system32\CompatTel
2015-02-12 00:46 - 2014-10-11 09:31 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-02-12 00:46 - 2014-07-26 21:01 - 00000000 ____D () C:\Windows\system32\MRT
2015-02-12 00:44 - 2014-07-26 21:01 - 116773704 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-02-11 17:26 - 2014-08-01 16:22 - 00000000 ____D () C:\Users\Chiara\Downloads\Gameforge Live
2015-02-11 10:31 - 2014-07-26 22:25 - 00000000 ____D () C:\ProgramData\Oracle
2015-02-11 10:24 - 2014-09-01 13:46 - 00000000 ____D () C:\Program Files\Java
2015-02-11 10:21 - 2014-07-26 18:56 - 00000000 ____D () C:\ProgramData\Package Cache
2015-02-08 14:33 - 2014-08-01 12:28 - 00000000 ____D () C:\Users\Chiara\.gimp-2.8
2015-02-06 19:15 - 2014-09-07 12:57 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-02-06 19:15 - 2014-09-07 12:57 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-02-05 18:59 - 2014-12-20 21:25 - 00000000 ____D () C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
2015-02-04 20:38 - 2014-08-13 10:30 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-02-04 20:38 - 2014-08-13 10:30 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-02-04 20:38 - 2014-08-13 10:30 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-02-03 18:43 - 2014-08-13 10:42 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-02-02 21:11 - 2014-08-01 12:29 - 00000000 ____D () C:\Users\Chiara\AppData\Local\gtk-2.0

==================== Files in the root of some directories =======

2014-10-04 19:34 - 2013-03-07 12:48 - 0036864 _____ (Microsoft Corporation) C:\Program Files (x86)\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll
2014-10-04 19:34 - 2013-03-10 05:38 - 0084736 _____ (Microsoft Corporation) C:\Program Files (x86)\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll
2014-10-04 19:34 - 2006-10-03 17:26 - 0037063 _____ () C:\Program Files (x86)\Office Word 2003 Look.dotx
2014-11-23 16:41 - 2014-12-09 18:41 - 0000162 _____ () C:\Users\Chiara\AppData\Roaming\WB.CFG
2014-11-25 19:41 - 2014-12-02 18:41 - 0000002 _____ () C:\Users\Chiara\AppData\Local\DSI.DAT
2015-02-02 21:11 - 2015-02-02 21:11 - 0011853 _____ () C:\Users\Chiara\AppData\Local\recently-used.xbel

Some content of TEMP:
====================
C:\Users\Chiara\AppData\Local\Temp\APNSetup.exe
C:\Users\Chiara\AppData\Local\Temp\Quarantine.exe
C:\Users\Chiara\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-24 21:18

==================== End Of Log ============================
--- --- ---

schrauber 04.03.2015 08:52

ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

QueenZoe 04.03.2015 22:15
ESET log

Code:
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=690387873974944a861784aa0851377a
# engine=22755
# end=stopped
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-03-04 08:09:38
# local_time=2015-03-04 09:09:38 (+0100, Mitteleuropäische Zeit)
# country="Switzerland"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='avast! Antivirus'
# compatibility_mode=783 16777213 71 94 362475 387234 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 11564 177129628 0 0
# scanned=46060
# found=2
# cleaned=0
# scan_time=166
sh=6408D61C9809E743126596AF762ABA61C67626F2 ft=1 fh=11b2d7f1750c67b8 vn="Win32/Adware.DsiLoad.A Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Chiara\AppData\Local\dsisetup32736342.exe.vir"
sh=6408D61C9809E743126596AF762ABA61C67626F2 ft=1 fh=11b2d7f1750c67b8 vn="Win32/Adware.DsiLoad.A Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Chiara\AppData\Local\dsisetup4201572.exe.vir"
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=690387873974944a861784aa0851377a
# engine=22755
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-03-04 08:54:53
# local_time=2015-03-04 09:54:53 (+0100, Mitteleuropäische Zeit)
# country="Switzerland"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='avast! Antivirus'
# compatibility_mode=783 16777213 71 94 365190 389949 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 14279 177132343 0 0
# scanned=420669
# found=6
# cleaned=6
# scan_time=2600
sh=6408D61C9809E743126596AF762ABA61C67626F2 ft=1 fh=11b2d7f1750c67b8 vn="Win32/Adware.DsiLoad.A Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Qoobox\Quarantine\C\Users\Chiara\AppData\Local\dsisetup32736342.exe.vir"
sh=6408D61C9809E743126596AF762ABA61C67626F2 ft=1 fh=11b2d7f1750c67b8 vn="Win32/Adware.DsiLoad.A Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Qoobox\Quarantine\C\Users\Chiara\AppData\Local\dsisetup4201572.exe.vir"
sh=555DF40180DE40368CC0594D8E9C35F692A68857 ft=1 fh=fef808299896d418 vn="Win32/UniBlue.C evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Chiara\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\10SFF43J\pcmechanicpm-standalone-setup[1].exe"
sh=61445CF141ED133F87389743CD88AB1CCB9E3772 ft=1 fh=7907f7fc610451a2 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Chiara\AppData\Local\Temp\DMR\dmr_72.exe"
sh=555DF40180DE40368CC0594D8E9C35F692A68857 ft=1 fh=fef808299896d418 vn="Win32/UniBlue.C evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Chiara\AppData\Local\Temp\is-0BDS0.tmp\pm-standalone-setup.exe"
sh=3D7368B74ECB0B54D65AF5276FAAA44C4000BEEE ft=1 fh=0532a6dbf87874d1 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Chiara\Downloads\MorphVOX Pro - CHIP-Installer.exe"
checkup.txt

Code:
Results of screen317's Security Check version 0.99.95 
 Windows 7 Service Pack 1 x64 (UAC is enabled) 
 Internet Explorer 11 
``````````````Antivirus/Firewall Check:``````````````
avast! Antivirus 
 Antivirus up to date! 
`````````Anti-malware/Other Utilities Check:`````````
 Java 8 Update 31 
 Java version 32-bit out of Date!
  Java 64-bit 8 Update 31 
 Adobe Flash Player 16.0.0.305 
 Mozilla Firefox (35.0.1)
 Google Chrome (40.0.2214.111)
 Google Chrome (40.0.2214.115)
 Google Chrome (update.dll..)
````````Process Check: objlist.exe by Laurent```````` 
 ESET ESET Online Scanner OnlineScannerApp.exe 
 AVAST Software Avast AvastSvc.exe 
 AVAST Software Avast avastui.exe 
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C: 
````````````````````End of Log``````````````````````
FRST.txt


FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-02-2015
Ran by Chiara (administrator) on BLUESTAR on 04-03-2015 22:11:18
Running from C:\Users\Chiara\Downloads
Loaded Profiles: Chiara (Available profiles: Chiara & Gast)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
() C:\Program Files (x86)\ASUS\AXSP\1.02.00\atkexComSvc.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(LogMeIn Inc.) D:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
(LogMeIn, Inc.) D:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(LogMeIn Inc.) D:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(LogMeIn, Inc.) D:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Oracle Corporation) C:\Users\Chiara\Downloads\runtime\jre-x64\1.8.0_25\bin\java.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Oracle Corporation) C:\Users\Chiara\Downloads\runtime\jre-x64\1.8.0_25\bin\javaw.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe
(TeamSpeak Systems GmbH) C:\Program Files (x86)\TeamSpeak 3 Client\ts3client_win32.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_305.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_305.exe
() C:\Users\Chiara\Downloads\SecurityCheck.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2014-04-11] (Intel Corporation)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7572696 2014-04-17] (Realtek Semiconductor)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848 2014-02-21] (Intel Corporation)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [508800 2014-12-17] (Oracle Corporation)
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] => D:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [3978600 2015-02-17] (LogMeIn Inc.)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5227112 2015-02-28] (AVAST Software)
HKU\S-1-5-21-1268736343-3887576109-2910839842-1000\...\Run: [Speech Recognition] => C:\Windows\Speech\Common\sapisvr.exe [44544 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-21-1268736343-3887576109-2910839842-1000\...\Run: [EADM] => C:\Program Files (x86)\Origin\Origin.exe [3631448 2015-02-27] (Electronic Arts)
HKU\S-1-5-21-1268736343-3887576109-2910839842-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [30879328 2014-12-11] (Skype Technologies S.A.)
Startup: C:\Users\Chiara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk
ShortcutTarget: Adobe Gamma.lnk -> C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\.DEFAULT\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-1268736343-3887576109-2910839842-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:49174;https=127.0.0.1:49174
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=56626&homepage=about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/?trackid=sp-006
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = https://www.google.com/search?trackid=sp-006&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-1268736343-3887576109-2910839842-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-1268736343-3887576109-2910839842-1000\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/?trackid=sp-006
SearchScopes: HKLM-x32 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = https://www.google.com/search?trackid=sp-006&q={searchTerms}
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1268736343-3887576109-2910839842-1000 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = https://www.google.com/search?trackid=sp-006&q={searchTerms}
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: No Name -> {9030D464-4C02-4ABF-8ECC-5164760863C6} ->  No File
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll (Oracle Corporation)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} -  No File
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\wblsi6v6.default-1408827089247
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @esn/npbattlelog,version=2.4.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.4.0\npbattlelog.dll (EA Digital Illusions CE AB)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MIF5BA~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKU\S-1-5-21-1268736343-3887576109-2910839842-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Chiara\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF SearchPlugin: C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\wblsi6v6.default-1408827089247\searchplugins\google-images.xml
FF SearchPlugin: C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\wblsi6v6.default-1408827089247\searchplugins\google-maps.xml
FF Extension: amptrakeepacom - C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\wblsi6v6.default-1408827089247\Extensions\amptra@keepa.com [2014-09-08]
FF Extension: Web Helper Lite - C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\wblsi6v6.default-1408827089247\Extensions\{53ecb410-cb6c-474d-8ce2-8f9e2c15a4a7} [2014-10-09]
FF Extension: Cliqz Beta - C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\wblsi6v6.default-1408827089247\Extensions\cliqz@cliqz.com.xpi [2014-10-07]
FF Extension: MEGA - C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\wblsi6v6.default-1408827089247\Extensions\firefox@mega.co.nz.xpi [2014-11-02]
FF Extension: Shopping App by Ask - C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\wblsi6v6.default-1408827089247\Extensions\toolbar_ORJ-ST-SPE@apn.ask.com.xpi [2015-01-31]
FF Extension: ooVoo Search App powered by Ask - C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\wblsi6v6.default-1408827089247\Extensions\toolbar_OVO2-SP@apn.ask.com.xpi [2014-09-11]
FF Extension: Search App - C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\wblsi6v6.default-1408827089247\Extensions\{1d33817b-02d7-4cfa-a618-2d2fe2f6add4}.xpi [2014-12-23]
FF Extension: mpeg4 shield - C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\wblsi6v6.default-1408827089247\Extensions\{3d69b985-bc93-4bb9-9a0a-e16269028e65}.xpi [2014-10-10]
FF Extension: {9b0ceae4-a807-4940-a439-ad70def3437d} - C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\wblsi6v6.default-1408827089247\Extensions\{9b0ceae4-a807-4940-a439-ad70def3437d}.xpi [2014-10-05]
FF Extension: Adblock Plus - C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\wblsi6v6.default-1408827089247\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-08-23]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-02-28]
FF HKU\S-1-5-21-1268736343-3887576109-2910839842-1000\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff
FF HKU\S-1-5-21-1268736343-3887576109-2910839842-1000\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\wblsi6v6.default-1408827089247\extensions\cliqz@cliqz.com

Chrome:
=======
CHR HomePage: Default -> hxxp://Vosteran.com/?f=1&a=vst_ggbc_14_47_ff&cd=2XzuyEtN2Y1L1QzuyB0AyBzytCzyyEzytCzztAtC0AtB0EtCtN0D0Tzu0StCtDyDyBtN1L2XzutAtFyCtFtBtFtDtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2SyB0EtC0DzytAtDyEtG0FyDtC0CtGtDyCtCyBtG0DzzzyyBtGyB0Dzy0CtCyE0B0A0EtCtAtC2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCyDyE0D0CzytDzytG0D0ByDtCtGyE0BtCtCtGzytA0DzytG0D0EyEtD0ByByB0AyBtC0D0E2Q&cr=423194433&ir=
CHR StartupUrls: Default -> "https://www.google.com/?trackid=sp-006"
CHR DefaultSearchURL: Default -> https://www.google.de/search?q={searchTerms}?trackid=sp-006
CHR DefaultSuggestURL: Default -> https://www.google.com/complete/search?client=chrome&q={searchTerms}
CHR Profile: C:\Users\Chiara\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\Chiara\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-09-14]
CHR Extension: (Google Docs) - C:\Users\Chiara\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-09-14]
CHR Extension: (Google Drive) - C:\Users\Chiara\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-09-14]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Chiara\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-07]
CHR Extension: (YouTube) - C:\Users\Chiara\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-07-26]
CHR Extension: (Google Search) - C:\Users\Chiara\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-07-26]
CHR Extension: (Google Sheets) - C:\Users\Chiara\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-09-14]
CHR Extension: (Avira Browser Safety) - C:\Users\Chiara\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2014-09-08]
CHR Extension: (Skype Click to Call) - C:\Users\Chiara\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2014-07-31]
CHR Extension: (Google Wallet) - C:\Users\Chiara\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-07-26]
CHR Extension: (Amazon) - C:\Users\Chiara\AppData\Local\Google\Chrome\User Data\Default\Extensions\ocbnpbkmjpgbdcgiflkgkpnkinifpgpj [2014-10-05]
CHR Extension: (Disable AntiAdblock) - C:\Users\Chiara\AppData\Local\Google\Chrome\User Data\Default\Extensions\oimhabmdhenmcaligiilhadkdliolpah [2014-07-31]
CHR Extension: (Gmail) - C:\Users\Chiara\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-07-26]
CHR HKLM\...\Chrome\Extension: [Äÿ] - No Path Or update_url value
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-02-28]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [ocbnpbkmjpgbdcgiflkgkpnkinifpgpj] - C:\Users\Chiara\ChromeExtensions\ocbnpbkmjpgbdcgiflkgkpnkinifpgpj\amazon-icon-2.crx [2014-10-04]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [72704 2014-11-16] (Adobe Systems) [File not signed]
R2 asComSvc; C:\Program Files (x86)\ASUS\AXSP\1.02.00\atkexComSvc.exe [936728 2014-01-28] ()
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2015-02-28] (AVAST Software)
R2 Hamachi2Svc; D:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe [2490216 2015-02-17] (LogMeIn Inc.)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [16232 2014-04-11] (Intel Corporation)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-03] (Macrovision Corporation) [File not signed]
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [329104 2014-10-03] (Intel Corporation)
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [887232 2014-01-31] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [154584 2014-03-20] (Intel Corporation)
R2 LightScribeService; C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2013-01-16] (Hewlett-Packard Company) [File not signed]
S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [1910640 2015-02-27] (Electronic Arts)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76152 2014-10-18] ()
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [15232 2014-01-28] ()
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2015-02-28] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [87912 2015-02-28] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2015-02-28] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2015-02-28] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1050432 2015-02-28] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [436624 2015-02-28] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [116728 2015-02-28] (AVAST Software)
S3 aswTap; C:\Windows\System32\DRIVERS\aswTap.sys [44640 2015-01-18] (The OpenVPN Project)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [267632 2015-02-28] ()
R3 e1dexpress; C:\Windows\System32\DRIVERS\e1d62x64.sys [487704 2014-03-14] (Intel Corporation)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28008 2014-04-11] (Intel Corporation)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [118272 2014-03-20] (Intel Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-04 22:07 - 2015-03-04 22:07 - 00852594 _____ () C:\Users\Chiara\Downloads\SecurityCheck(1).exe
2015-03-04 21:05 - 2015-03-04 21:05 - 02347384 _____ (ESET) C:\Users\Chiara\Downloads\esetsmartinstaller_deu(1).exe
2015-03-04 21:05 - 2015-03-04 21:05 - 00000000 ____D () C:\Program Files (x86)\ESET
2015-03-03 21:43 - 2015-03-03 21:43 - 00001089 _____ () C:\Users\Chiara\Desktop\JRT.txt
2015-03-03 21:41 - 2015-03-03 21:41 - 01388333 _____ (Thisisu) C:\Users\Chiara\Downloads\JRT(1).exe
2015-03-03 21:26 - 2015-03-03 21:26 - 02126848 _____ () C:\Users\Chiara\Downloads\AdwCleaner_4.111.exe
2015-03-03 21:25 - 2015-03-03 21:25 - 00003295 _____ () C:\Users\Chiara\Desktop\mbam.txt
2015-03-01 14:53 - 2015-03-01 14:53 - 00281688 _____ () C:\Windows\Minidump\030115-5678-01.dmp
2015-03-01 10:05 - 2015-03-01 10:05 - 00001812 _____ () C:\Users\Chiara\Desktop\Bluescreenview3.txt
2015-02-28 17:28 - 2015-02-28 17:28 - 00281688 _____ () C:\Windows\Minidump\022815-5850-01.dmp
2015-02-28 10:37 - 2015-02-28 10:37 - 00000000 ____D () C:\Users\Chiara\AppData\Roaming\AVAST Software
2015-02-28 10:36 - 2015-03-04 21:54 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2015-02-28 10:36 - 2015-02-28 10:36 - 01050432 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys
2015-02-28 10:36 - 2015-02-28 10:36 - 00436624 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2015-02-28 10:36 - 2015-02-28 10:36 - 00364512 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2015-02-28 10:36 - 2015-02-28 10:36 - 00267632 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2015-02-28 10:36 - 2015-02-28 10:36 - 00116728 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2015-02-28 10:36 - 2015-02-28 10:36 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2015-02-28 10:36 - 2015-02-28 10:36 - 00087912 _____ (AVAST Software) C:\Windows\system32\Drivers\aswmonflt.sys
2015-02-28 10:36 - 2015-02-28 10:36 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2015-02-28 10:36 - 2015-02-28 10:36 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2015-02-28 10:36 - 2015-02-28 10:36 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2015-02-28 10:36 - 2015-02-28 10:36 - 00001930 _____ () C:\Users\Public\Desktop\Avast Free Antivirus.lnk
2015-02-28 10:36 - 2015-02-28 10:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2015-02-28 10:36 - 2015-02-28 10:36 - 00000000 ____D () C:\Program Files\AVAST Software
2015-02-28 10:35 - 2015-02-28 10:35 - 132469808 _____ (AVAST Software) C:\Users\Chiara\Downloads\avast_free_antivirus_setup(1).exe
2015-02-28 08:01 - 2015-02-28 08:01 - 00000000 ____D () C:\Users\Gast\AppData\Roaming\Apple Computer
2015-02-25 22:42 - 2015-01-09 00:44 - 00419936 _____ () C:\Windows\SysWOW64\locale.nls
2015-02-25 22:42 - 2015-01-09 00:43 - 00419936 _____ () C:\Windows\system32\locale.nls
2015-02-25 20:49 - 2015-01-09 04:14 - 00950272 _____ (Microsoft Corporation) C:\Windows\system32\perftrack.dll
2015-02-25 20:49 - 2015-01-09 04:14 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\wdi.dll
2015-02-25 20:49 - 2015-01-09 04:14 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\powertracker.dll
2015-02-25 20:49 - 2015-01-09 03:48 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdi.dll
2015-02-24 19:42 - 2015-02-24 19:42 - 00000634 _____ () C:\Users\Public\Desktop\Battle.net.lnk
2015-02-24 19:42 - 2015-02-24 19:42 - 00000000 ____D () C:\Users\Chiara\AppData\Roaming\Battle.net
2015-02-24 19:42 - 2015-02-24 19:42 - 00000000 ____D () C:\Users\Chiara\AppData\Local\Blizzard Entertainment
2015-02-24 19:42 - 2015-02-24 19:42 - 00000000 ____D () C:\Users\Chiara\AppData\Local\Battle.net
2015-02-24 19:42 - 2015-02-24 19:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battle.net
2015-02-24 19:42 - 2015-02-24 19:42 - 00000000 ____D () C:\ProgramData\Blizzard Entertainment
2015-02-24 19:41 - 2015-02-24 19:41 - 03057720 _____ (Blizzard Entertainment) C:\Users\Chiara\Downloads\Hearthstone-Setup-deDE.exe
2015-02-24 19:41 - 2015-02-24 19:41 - 00000000 ____D () C:\ProgramData\Battle.net
2015-02-20 18:56 - 2015-02-20 18:56 - 00281688 _____ () C:\Windows\Minidump\022015-5928-01.dmp
2015-02-19 18:57 - 2015-02-19 18:57 - 00000000 ____D () C:\Users\Chiara\AppData\Local\Steam
2015-02-18 21:38 - 2015-02-18 21:38 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-BLUESTAR-Windows-7-Home-Premium-(64-bit).dat
2015-02-18 21:38 - 2015-02-18 21:38 - 00000000 ____D () C:\RegBackup
2015-02-18 21:28 - 2015-02-18 21:28 - 00002169 _____ () C:\Users\Chiara\Desktop\Tweaking.com - Windows Repair (All in One).lnk
2015-02-18 21:28 - 2015-02-18 21:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tweaking.com
2015-02-18 21:28 - 2015-02-18 21:28 - 00000000 ____D () C:\Program Files (x86)\Tweaking.com
2015-02-18 21:27 - 2015-02-18 21:27 - 11852704 _____ () C:\Users\Chiara\Downloads\tweaking.com_windows_repair_aio_setup.exe
2015-02-18 21:25 - 2015-02-18 21:25 - 00281688 _____ () C:\Windows\Minidump\021815-6302-01.dmp
2015-02-18 20:17 - 2015-02-18 20:17 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2015-02-18 18:42 - 2015-02-18 18:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
2015-02-14 22:33 - 2015-02-14 22:33 - 00281664 _____ () C:\Windows\Minidump\021415-10545-01.dmp
2015-02-13 10:27 - 2015-02-13 10:27 - 00049682 _____ () C:\Users\Chiara\Downloads\SystemLook.txt
2015-02-13 10:26 - 2015-02-13 10:26 - 00165376 _____ () C:\Users\Chiara\Downloads\SystemLook_x64.exe
2015-02-12 09:32 - 2015-01-23 05:42 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-02-12 09:32 - 2015-01-23 05:41 - 06041600 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-02-12 09:32 - 2015-01-23 04:43 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-02-12 09:32 - 2015-01-23 04:17 - 04300800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-02-12 00:08 - 2015-02-12 10:01 - 00000000 ____D () C:\Users\Chiara\Desktop\Zoes alt
2015-02-11 10:34 - 2015-02-11 10:34 - 00000000 ____D () C:\Users\Chiara\Downloads\runtime
2015-02-11 10:34 - 2015-02-11 10:34 - 00000000 ____D () C:\Users\Chiara\Downloads\game
2015-02-11 10:33 - 2015-02-11 10:33 - 01294088 _____ (Mojang) C:\Users\Chiara\Downloads\Minecraft(2).exe
2015-02-11 10:29 - 2015-02-11 10:29 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-02-11 10:29 - 2015-02-11 10:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-02-11 10:29 - 2015-02-11 10:29 - 00000000 ____D () C:\Program Files (x86)\Java
2015-02-11 10:24 - 2015-02-11 10:24 - 00639912 _____ (Oracle Corporation) C:\Users\Chiara\Downloads\jxpiinstall.exe
2015-02-11 09:50 - 2015-02-11 09:50 - 00000000 ____D () C:\Users\Chiara\AppData\Local\IsolatedStorage
2015-02-11 09:39 - 2015-02-11 09:48 - 00000000 ____D () C:\ProgramData\Screaming Bee
2015-02-11 09:38 - 2015-02-04 04:16 - 00894976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-02-11 09:38 - 2015-02-04 04:16 - 00762368 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-02-11 09:38 - 2015-02-04 04:16 - 00609280 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-02-11 09:38 - 2015-02-04 04:16 - 00414720 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-02-11 09:38 - 2015-02-04 04:16 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-02-11 09:38 - 2015-02-04 04:16 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-02-11 09:38 - 2015-02-04 04:13 - 01098752 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-02-11 09:38 - 2015-01-28 00:36 - 01239720 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2015-02-11 09:38 - 2015-01-14 06:47 - 00389808 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-02-11 09:38 - 2015-01-14 06:09 - 00342712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-02-11 09:38 - 2015-01-12 04:09 - 25056256 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-02-11 09:38 - 2015-01-12 04:05 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-02-11 09:38 - 2015-01-12 04:05 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-02-11 09:38 - 2015-01-12 03:49 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-02-11 09:38 - 2015-01-12 03:48 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-02-11 09:38 - 2015-01-12 03:48 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-02-11 09:38 - 2015-01-12 03:48 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-02-11 09:38 - 2015-01-12 03:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-02-11 09:38 - 2015-01-12 03:40 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-02-11 09:38 - 2015-01-12 03:39 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-02-11 09:38 - 2015-01-12 03:36 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-02-11 09:38 - 2015-01-12 03:34 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-02-11 09:38 - 2015-01-12 03:34 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-02-11 09:38 - 2015-01-12 03:25 - 19740160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-02-11 09:38 - 2015-01-12 03:25 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-02-11 09:38 - 2015-01-12 03:21 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-02-11 09:38 - 2015-01-12 03:21 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-02-11 09:38 - 2015-01-12 03:13 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-02-11 09:38 - 2015-01-12 03:08 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-02-11 09:38 - 2015-01-12 03:08 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-02-11 09:38 - 2015-01-12 03:07 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-02-11 09:38 - 2015-01-12 03:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-02-11 09:38 - 2015-01-12 03:07 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-02-11 09:38 - 2015-01-12 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-02-11 09:38 - 2015-01-12 03:04 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-02-11 09:38 - 2015-01-12 03:02 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-02-11 09:38 - 2015-01-12 03:00 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-02-11 09:38 - 2015-01-12 02:59 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-02-11 09:38 - 2015-01-12 02:57 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-02-11 09:38 - 2015-01-12 02:55 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-02-11 09:38 - 2015-01-12 02:48 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-02-11 09:38 - 2015-01-12 02:48 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-02-11 09:38 - 2015-01-12 02:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-02-11 09:38 - 2015-01-12 02:46 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-02-11 09:38 - 2015-01-12 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-02-11 09:38 - 2015-01-12 02:43 - 14401024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-02-11 09:38 - 2015-01-12 02:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-02-11 09:38 - 2015-01-12 02:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-02-11 09:38 - 2015-01-12 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-02-11 09:38 - 2015-01-12 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-02-11 09:38 - 2015-01-12 02:27 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-02-11 09:38 - 2015-01-12 02:23 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-02-11 09:38 - 2015-01-12 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-02-11 09:38 - 2015-01-12 02:22 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-02-11 09:38 - 2015-01-12 02:14 - 12829184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-02-11 09:38 - 2015-01-12 02:14 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-02-11 09:38 - 2015-01-12 02:02 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-02-11 09:38 - 2015-01-12 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-02-11 09:38 - 2015-01-12 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-02-11 09:38 - 2015-01-12 01:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-02-11 09:38 - 2015-01-10 07:48 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-02-11 09:38 - 2015-01-10 07:48 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-02-11 09:38 - 2015-01-10 07:48 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-02-11 09:38 - 2015-01-10 07:48 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-02-11 09:38 - 2015-01-10 07:48 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-02-11 09:38 - 2015-01-10 07:48 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-02-11 09:38 - 2015-01-10 07:48 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-02-11 09:38 - 2015-01-10 07:27 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-02-11 09:38 - 2015-01-10 07:27 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-02-11 09:38 - 2015-01-10 07:27 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-02-11 09:38 - 2015-01-10 07:27 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-02-11 09:38 - 2015-01-10 07:27 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-02-11 09:38 - 2015-01-10 07:27 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-02-11 09:38 - 2015-01-10 07:27 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-02-11 09:37 - 2015-01-15 09:14 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-02-11 09:37 - 2015-01-15 09:14 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-02-11 09:37 - 2015-01-15 09:09 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-02-11 09:37 - 2015-01-15 09:09 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-02-11 09:37 - 2015-01-15 09:09 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-02-11 09:37 - 2015-01-15 09:09 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-02-11 09:37 - 2015-01-15 09:09 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-02-11 09:37 - 2015-01-15 09:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-02-11 09:37 - 2015-01-15 09:06 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-02-11 09:37 - 2015-01-15 09:06 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-02-11 09:37 - 2015-01-15 09:04 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-02-11 09:37 - 2015-01-15 08:42 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-02-11 09:37 - 2015-01-15 08:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-02-11 09:37 - 2015-01-15 08:41 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-02-11 09:37 - 2015-01-15 08:39 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-02-11 09:37 - 2015-01-15 08:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-02-11 09:37 - 2015-01-15 08:37 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-02-11 09:37 - 2015-01-15 05:22 - 00458824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-02-11 09:37 - 2015-01-14 07:09 - 05554112 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-02-11 09:37 - 2015-01-14 07:05 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-02-11 09:37 - 2015-01-14 07:05 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-02-11 09:37 - 2015-01-14 07:04 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-02-11 09:37 - 2015-01-14 06:44 - 03972544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-02-11 09:37 - 2015-01-14 06:44 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-02-11 09:37 - 2015-01-14 06:41 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-02-11 09:37 - 2015-01-13 04:10 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-02-11 09:37 - 2015-01-13 03:49 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-02-11 09:37 - 2015-01-09 03:03 - 03201536 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-02-11 09:37 - 2014-12-12 06:31 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-02-11 09:37 - 2014-12-12 06:07 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2015-02-11 09:37 - 2014-12-08 04:09 - 00406528 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2015-02-11 09:37 - 2014-12-08 03:46 - 00308224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll
2015-02-11 09:37 - 2014-11-26 04:53 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2015-02-11 09:37 - 2014-11-26 04:32 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2015-02-11 09:37 - 2014-07-07 03:07 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2015-02-11 09:37 - 2014-07-07 03:06 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2015-02-11 09:37 - 2014-07-07 02:40 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2015-02-11 09:37 - 2014-07-07 02:40 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2015-02-10 21:58 - 2015-02-11 09:50 - 00000000 ____D () C:\Users\Chiara\AppData\Roaming\Screaming Bee
2015-02-10 21:57 - 2015-02-11 10:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Screaming Bee
2015-02-10 21:57 - 2015-02-11 10:21 - 00000000 ____D () C:\Program Files (x86)\Screaming Bee
2015-02-10 21:57 - 2015-02-10 21:57 - 00002270 _____ () C:\Users\Chiara\Desktop\MorphVOX Junior.lnk
2015-02-10 21:57 - 2015-02-10 21:57 - 00000000 ____D () C:\Users\Chiara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Screaming Bee
2015-02-10 21:56 - 2015-02-10 21:56 - 02970992 _____ () C:\Users\Chiara\Downloads\MorphVOXJunior_Install-1.exe
2015-02-10 17:46 - 2015-02-10 17:46 - 00281664 _____ () C:\Windows\Minidump\021015-12760-01.dmp
2015-02-10 13:46 - 2015-03-01 14:53 - 00000000 ____D () C:\Windows\Minidump
2015-02-10 13:46 - 2015-02-10 13:46 - 00281664 _____ () C:\Windows\Minidump\021015-9968-01.dmp
2015-02-10 11:24 - 2015-02-10 11:24 - 00001196 _____ () C:\Users\Chiara\Desktop\CrystalDiskInfo.lnk
2015-02-10 11:24 - 2015-02-10 11:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CrystalDiskInfo
2015-02-10 11:24 - 2015-02-10 11:24 - 00000000 ____D () C:\Program Files (x86)\CrystalDiskInfo
2015-02-10 11:23 - 2015-02-10 11:23 - 03014272 _____ (Crystal Dew World ) C:\Users\Chiara\Downloads\CrystalDiskInfo6_3_0-en.exe
2015-02-08 19:53 - 2015-02-08 19:53 - 00526371 _____ () C:\Users\Chiara\Desktop\openhardwaremonitor-v0.6.0-beta.zip
2015-02-08 09:38 - 2015-02-08 09:38 - 01188194 _____ () C:\Users\Chiara\Downloads\ProcessExplorer.zip
2015-02-05 19:45 - 2015-02-05 19:48 - 00067892 _____ () C:\Users\Chiara\Downloads\bluescreenview_v1.55.zip
2015-02-03 18:40 - 2015-02-03 18:40 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-02-02 22:10 - 2015-02-02 22:10 - 00852573 _____ () C:\Users\Chiara\Downloads\SecurityCheck.exe
2015-02-02 21:19 - 2015-02-02 21:19 - 02347384 _____ (ESET) C:\Users\Chiara\Downloads\esetsmartinstaller_deu.exe
2015-02-02 21:11 - 2015-02-02 21:11 - 00011853 _____ () C:\Users\Chiara\AppData\Local\recently-used.xbel

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-04 22:11 - 2014-09-17 17:50 - 00000000 ____D () C:\FRST
2015-03-04 22:11 - 2014-09-16 17:42 - 00021759 _____ () C:\Users\Chiara\Downloads\FRST.txt
2015-03-04 21:53 - 2014-07-31 21:39 - 00000000 ____D () C:\Users\Chiara\AppData\Roaming\Skype
2015-03-04 21:50 - 2014-07-26 18:30 - 02082098 _____ () C:\Windows\WindowsUpdate.log
2015-03-04 21:38 - 2014-08-13 10:30 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-03-04 21:20 - 2014-09-07 12:57 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-03-04 21:15 - 2009-07-14 05:45 - 00023088 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-03-04 21:15 - 2009-07-14 05:45 - 00023088 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-03-04 20:52 - 2014-07-31 21:34 - 00000000 ____D () C:\Users\Chiara\AppData\Roaming\.minecraft
2015-03-04 20:34 - 2014-10-06 12:27 - 00000000 ____D () C:\Users\Chiara\AppData\Local\LogMeIn Hamachi
2015-03-04 19:25 - 2014-08-02 13:55 - 00000000 ____D () C:\Users\Chiara\AppData\Roaming\TS3Client
2015-03-04 19:20 - 2014-09-07 12:57 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-03-04 18:51 - 2014-08-01 13:15 - 00000000 ____D () C:\ProgramData\Origin
2015-03-04 18:49 - 2009-07-14 18:58 - 00686552 _____ () C:\Windows\system32\perfh007.dat
2015-03-04 18:49 - 2009-07-14 18:58 - 00145882 _____ () C:\Windows\system32\perfc007.dat
2015-03-04 18:49 - 2009-07-14 06:13 - 01623866 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-03-04 18:46 - 2014-07-26 19:39 - 00006462 _____ () C:\Windows\SysWOW64\Gms.log
2015-03-04 18:44 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-03-04 18:44 - 2009-07-14 05:51 - 00062385 _____ () C:\Windows\setupact.log
2015-03-03 21:32 - 2014-07-26 18:58 - 02442608 _____ () C:\Windows\PFRO.log
2015-03-03 21:31 - 2015-01-31 22:01 - 00000000 ____D () C:\AdwCleaner
2015-03-03 21:24 - 2015-01-31 21:50 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-03-03 21:18 - 2014-08-02 17:14 - 00000000 ____D () C:\Windows\en
2015-03-01 21:18 - 2014-09-16 17:42 - 00039279 _____ () C:\Users\Chiara\Downloads\Addition.txt
2015-03-01 21:16 - 2015-01-31 22:07 - 00000000 ____D () C:\Users\Chiara\Downloads\FRST-OlderVersion
2015-03-01 21:16 - 2014-09-16 17:41 - 02092544 _____ (Farbar) C:\Users\Chiara\Downloads\FRST64.exe
2015-02-28 10:36 - 2014-09-07 12:56 - 00000000 ____D () C:\ProgramData\AVAST Software
2015-02-28 08:02 - 2014-11-26 15:42 - 00111336 _____ () C:\Users\Gast\AppData\Local\GDIPFONTCACHEV1.DAT
2015-02-28 08:01 - 2014-11-26 15:41 - 00000000 ____D () C:\Users\Gast\AppData\Local\LogMeIn Hamachi
2015-02-27 19:07 - 2014-08-26 21:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Origin
2015-02-27 19:07 - 2014-08-26 21:52 - 00000000 ____D () C:\Program Files (x86)\Origin
2015-02-26 18:43 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\tracing
2015-02-25 19:38 - 2015-01-14 18:04 - 00000000 ____D () C:\Users\Chiara\AppData\Local\osu!
2015-02-23 20:36 - 2014-08-26 22:18 - 00347464 _____ () C:\Windows\SysWOW64\PnkBstrB.xtr
2015-02-23 20:36 - 2014-08-26 22:15 - 00347464 _____ () C:\Windows\SysWOW64\PnkBstrB.exe
2015-02-23 20:10 - 2014-08-01 16:03 - 00347464 _____ () C:\Windows\SysWOW64\PnkBstrB.ex0
2015-02-22 13:05 - 2014-08-13 10:55 - 00000000 ____D () C:\Users\Chiara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2015-02-20 19:22 - 2014-09-07 12:57 - 00002239 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-02-18 22:09 - 2014-07-26 19:47 - 00111336 _____ () C:\Users\Chiara\AppData\Local\GDIPFONTCACHEV1.DAT
2015-02-18 22:07 - 2009-07-14 06:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-02-18 22:07 - 2009-07-14 05:45 - 00413480 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-02-18 22:04 - 2009-07-14 03:34 - 00000616 _____ () C:\Windows\win.ini
2015-02-18 21:54 - 2009-07-14 03:34 - 00000855 _____ () C:\Windows\system32\Drivers\etc\hosts_bak_832
2015-02-18 21:43 - 2009-07-14 03:34 - 00000855 _____ () C:\Windows\system32\Drivers\etc\hosts_bak_79
2015-02-16 16:20 - 2014-11-02 13:46 - 00033856 ____H (LogMeIn, Inc.) C:\Windows\system32\hamachi.sys
2015-02-15 19:33 - 2014-12-20 21:26 - 00000000 ____D () C:\Users\Chiara\AppData\Roaming\Apple Computer
2015-02-14 11:43 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2015-02-12 09:26 - 2014-12-12 18:54 - 00000000 ____D () C:\Windows\system32\appraiser
2015-02-12 09:26 - 2014-07-26 21:17 - 00000000 ___SD () C:\Windows\system32\CompatTel
2015-02-12 00:46 - 2014-10-11 09:31 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-02-12 00:46 - 2014-07-26 21:01 - 00000000 ____D () C:\Windows\system32\MRT
2015-02-12 00:44 - 2014-07-26 21:01 - 116773704 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-02-11 17:26 - 2014-08-01 16:22 - 00000000 ____D () C:\Users\Chiara\Downloads\Gameforge Live
2015-02-11 10:31 - 2014-07-26 22:25 - 00000000 ____D () C:\ProgramData\Oracle
2015-02-11 10:24 - 2014-09-01 13:46 - 00000000 ____D () C:\Program Files\Java
2015-02-11 10:21 - 2014-07-26 18:56 - 00000000 ____D () C:\ProgramData\Package Cache
2015-02-08 14:33 - 2014-08-01 12:28 - 00000000 ____D () C:\Users\Chiara\.gimp-2.8
2015-02-06 19:15 - 2014-09-07 12:57 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-02-06 19:15 - 2014-09-07 12:57 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-02-05 18:59 - 2014-12-20 21:25 - 00000000 ____D () C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
2015-02-04 20:38 - 2014-08-13 10:30 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-02-04 20:38 - 2014-08-13 10:30 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-02-04 20:38 - 2014-08-13 10:30 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-02-03 18:43 - 2014-08-13 10:42 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-02-02 21:11 - 2014-08-01 12:29 - 00000000 ____D () C:\Users\Chiara\AppData\Local\gtk-2.0

==================== Files in the root of some directories =======

2014-10-04 19:34 - 2013-03-07 12:48 - 0036864 _____ (Microsoft Corporation) C:\Program Files (x86)\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll
2014-10-04 19:34 - 2013-03-10 05:38 - 0084736 _____ (Microsoft Corporation) C:\Program Files (x86)\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll
2014-10-04 19:34 - 2006-10-03 17:26 - 0037063 _____ () C:\Program Files (x86)\Office Word 2003 Look.dotx
2014-11-23 16:41 - 2014-12-09 18:41 - 0000162 _____ () C:\Users\Chiara\AppData\Roaming\WB.CFG
2014-11-25 19:41 - 2014-12-02 18:41 - 0000002 _____ () C:\Users\Chiara\AppData\Local\DSI.DAT
2015-02-02 21:11 - 2015-02-02 21:11 - 0011853 _____ () C:\Users\Chiara\AppData\Local\recently-used.xbel

Some content of TEMP:
====================
C:\Users\Chiara\AppData\Local\Temp\APNSetup.exe
C:\Users\Chiara\AppData\Local\Temp\Quarantine.exe
C:\Users\Chiara\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-24 21:18

==================== End Of Log ============================
--- --- ---


Ich melde mich in ein paar Tagen wieder, dann weiss ich sicher ob die Frezee und Bluescreens weg sind. :)

schrauber 05.03.2015 07:28
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
C:\Users\Chiara\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\10SFF43J\pcmechanicpm-standalone-setup[1].exe

C:\Users\Chiara\AppData\Local\Temp\DMR\dmr_72.exe

C:\Users\Chiara\AppData\Local\Temp\is-0BDS0.tmp\pm-standalone-setup.exe

C:\Users\Chiara\Downloads\MorphVOX Pro - CHIP-Installer.exe
HKU\.DEFAULT\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-1268736343-3887576109-2910839842-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:49174;https=127.0.0.1:49174
Emptytemp:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.



Frisches FRST log bitte. Und ja, teste mal.

QueenZoe 05.03.2015 19:17
Fixlog.txt

Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 29-02-2015
Ran by Chiara at 2015-03-05 18:50:53 Run:5
Running from C:\Users\Chiara\Downloads
Loaded Profiles: Chiara (Available profiles: Chiara & Gast)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
C:\Users\Chiara\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\10SFF43J\pcmechanicpm-standalone-setup[1].exe

C:\Users\Chiara\AppData\Local\Temp\DMR\dmr_72.exe

C:\Users\Chiara\AppData\Local\Temp\is-0BDS0.tmp\pm-standalone-setup.exe

C:\Users\Chiara\Downloads\MorphVOX Pro - CHIP-Installer.exe
HKU\.DEFAULT\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-1268736343-3887576109-2910839842-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:49174;https=127.0.0.1:49174
Emptytemp:
       
*****************

"C:\Users\Chiara\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\10SFF43J\pcmechanicpm-standalone-setup[1].exe" => File/Directory not found.
"C:\Users\Chiara\AppData\Local\Temp\DMR\dmr_72.exe" => File/Directory not found.
"C:\Users\Chiara\AppData\Local\Temp\is-0BDS0.tmp\pm-standalone-setup.exe" => File/Directory not found.
"C:\Users\Chiara\Downloads\MorphVOX Pro - CHIP-Installer.exe" => File/Directory not found.
"HKU\.DEFAULT\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.
"HKU\S-1-5-21-1268736343-3887576109-2910839842-1000\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable => value deleted successfully.
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => value deleted successfully.
EmptyTemp: => Removed 630.6 MB temporary data.


The system needed a reboot.

==== End of Fixlog 18:51:05 ====
FRST.txt


FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-02-2015
Ran by Chiara (administrator) on BLUESTAR on 05-03-2015 19:00:43
Running from C:\Users\Chiara\Downloads
Loaded Profiles: Chiara (Available profiles: Chiara & Gast)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
() C:\Program Files (x86)\ASUS\AXSP\1.02.00\atkexComSvc.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(LogMeIn Inc.) D:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
(LogMeIn, Inc.) D:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(LogMeIn Inc.) D:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(LogMeIn, Inc.) D:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Oracle Corporation) C:\Users\Chiara\Downloads\runtime\jre-x64\1.8.0_25\bin\java.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Oracle Corporation) C:\Users\Chiara\Downloads\runtime\jre-x64\1.8.0_25\bin\javaw.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\CompatTel\QueryAppBlock.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2014-04-11] (Intel Corporation)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7572696 2014-04-17] (Realtek Semiconductor)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848 2014-02-21] (Intel Corporation)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [508800 2014-12-17] (Oracle Corporation)
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] => D:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [3978600 2015-02-17] (LogMeIn Inc.)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5227112 2015-02-28] (AVAST Software)
HKU\S-1-5-21-1268736343-3887576109-2910839842-1000\...\Run: [Speech Recognition] => C:\Windows\Speech\Common\sapisvr.exe [44544 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-21-1268736343-3887576109-2910839842-1000\...\Run: [EADM] => C:\Program Files (x86)\Origin\Origin.exe [3631448 2015-02-27] (Electronic Arts)
HKU\S-1-5-21-1268736343-3887576109-2910839842-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [30879328 2014-12-11] (Skype Technologies S.A.)
Startup: C:\Users\Chiara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk
ShortcutTarget: Adobe Gamma.lnk -> C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:49174;https=127.0.0.1:49174
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=56626&homepage=about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/?trackid=sp-006
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = https://www.google.com/search?trackid=sp-006&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-1268736343-3887576109-2910839842-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-1268736343-3887576109-2910839842-1000\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/?trackid=sp-006
SearchScopes: HKLM-x32 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = https://www.google.com/search?trackid=sp-006&q={searchTerms}
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1268736343-3887576109-2910839842-1000 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = https://www.google.com/search?trackid=sp-006&q={searchTerms}
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: No Name -> {9030D464-4C02-4ABF-8ECC-5164760863C6} ->  No File
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll (Oracle Corporation)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} -  No File
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\wblsi6v6.default-1408827089247
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @esn/npbattlelog,version=2.4.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.4.0\npbattlelog.dll (EA Digital Illusions CE AB)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MIF5BA~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKU\S-1-5-21-1268736343-3887576109-2910839842-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Chiara\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF SearchPlugin: C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\wblsi6v6.default-1408827089247\searchplugins\google-images.xml
FF SearchPlugin: C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\wblsi6v6.default-1408827089247\searchplugins\google-maps.xml
FF Extension: amptrakeepacom - C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\wblsi6v6.default-1408827089247\Extensions\amptra@keepa.com [2014-09-08]
FF Extension: Web Helper Lite - C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\wblsi6v6.default-1408827089247\Extensions\{53ecb410-cb6c-474d-8ce2-8f9e2c15a4a7} [2014-10-09]
FF Extension: Cliqz Beta - C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\wblsi6v6.default-1408827089247\Extensions\cliqz@cliqz.com.xpi [2014-10-07]
FF Extension: MEGA - C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\wblsi6v6.default-1408827089247\Extensions\firefox@mega.co.nz.xpi [2014-11-02]
FF Extension: Shopping App by Ask - C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\wblsi6v6.default-1408827089247\Extensions\toolbar_ORJ-ST-SPE@apn.ask.com.xpi [2015-01-31]
FF Extension: ooVoo Search App powered by Ask - C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\wblsi6v6.default-1408827089247\Extensions\toolbar_OVO2-SP@apn.ask.com.xpi [2014-09-11]
FF Extension: Search App - C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\wblsi6v6.default-1408827089247\Extensions\{1d33817b-02d7-4cfa-a618-2d2fe2f6add4}.xpi [2014-12-23]
FF Extension: mpeg4 shield - C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\wblsi6v6.default-1408827089247\Extensions\{3d69b985-bc93-4bb9-9a0a-e16269028e65}.xpi [2014-10-10]
FF Extension: {9b0ceae4-a807-4940-a439-ad70def3437d} - C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\wblsi6v6.default-1408827089247\Extensions\{9b0ceae4-a807-4940-a439-ad70def3437d}.xpi [2014-10-05]
FF Extension: Adblock Plus - C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\wblsi6v6.default-1408827089247\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-08-23]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-02-28]
FF HKU\S-1-5-21-1268736343-3887576109-2910839842-1000\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff
FF HKU\S-1-5-21-1268736343-3887576109-2910839842-1000\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\Chiara\AppData\Roaming\Mozilla\Firefox\Profiles\wblsi6v6.default-1408827089247\extensions\cliqz@cliqz.com

Chrome:
=======
CHR HomePage: Default -> hxxp://Vosteran.com/?f=1&a=vst_ggbc_14_47_ff&cd=2XzuyEtN2Y1L1QzuyB0AyBzytCzyyEzytCzztAtC0AtB0EtCtN0D0Tzu0StCtDyDyBtN1L2XzutAtFyCtFtBtFtDtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2SyB0EtC0DzytAtDyEtG0FyDtC0CtGtDyCtCyBtG0DzzzyyBtGyB0Dzy0CtCyE0B0A0EtCtAtC2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCyDyE0D0CzytDzytG0D0ByDtCtGyE0BtCtCtGzytA0DzytG0D0EyEtD0ByByB0AyBtC0D0E2Q&cr=423194433&ir=
CHR StartupUrls: Default -> "https://www.google.com/?trackid=sp-006"
CHR DefaultSearchURL: Default -> https://www.google.de/search?q={searchTerms}?trackid=sp-006
CHR DefaultSuggestURL: Default -> https://www.google.com/complete/search?client=chrome&q={searchTerms}
CHR Profile: C:\Users\Chiara\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\Chiara\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-09-14]
CHR Extension: (Google Docs) - C:\Users\Chiara\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-09-14]
CHR Extension: (Google Drive) - C:\Users\Chiara\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-09-14]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Chiara\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-07]
CHR Extension: (YouTube) - C:\Users\Chiara\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-07-26]
CHR Extension: (Google Search) - C:\Users\Chiara\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-07-26]
CHR Extension: (Google Sheets) - C:\Users\Chiara\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-09-14]
CHR Extension: (Avira Browser Safety) - C:\Users\Chiara\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2014-09-08]
CHR Extension: (Skype Click to Call) - C:\Users\Chiara\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2014-07-31]
CHR Extension: (Google Wallet) - C:\Users\Chiara\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-07-26]
CHR Extension: (Amazon) - C:\Users\Chiara\AppData\Local\Google\Chrome\User Data\Default\Extensions\ocbnpbkmjpgbdcgiflkgkpnkinifpgpj [2014-10-05]
CHR Extension: (Disable AntiAdblock) - C:\Users\Chiara\AppData\Local\Google\Chrome\User Data\Default\Extensions\oimhabmdhenmcaligiilhadkdliolpah [2014-07-31]
CHR Extension: (Gmail) - C:\Users\Chiara\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-07-26]
CHR HKLM\...\Chrome\Extension: [Äÿ] - No Path Or update_url value
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChromeSp.crx [2015-02-28]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-02-28]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [ocbnpbkmjpgbdcgiflkgkpnkinifpgpj] - C:\Users\Chiara\ChromeExtensions\ocbnpbkmjpgbdcgiflkgkpnkinifpgpj\amazon-icon-2.crx [2014-10-04]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [72704 2014-11-16] (Adobe Systems) [File not signed]
R2 asComSvc; C:\Program Files (x86)\ASUS\AXSP\1.02.00\atkexComSvc.exe [936728 2014-01-28] ()
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2015-02-28] (AVAST Software)
R2 Hamachi2Svc; D:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe [2490216 2015-02-17] (LogMeIn Inc.)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [16232 2014-04-11] (Intel Corporation)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-03] (Macrovision Corporation) [File not signed]
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [329104 2014-10-03] (Intel Corporation)
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [887232 2014-01-31] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [154584 2014-03-20] (Intel Corporation)
R2 LightScribeService; C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2013-01-16] (Hewlett-Packard Company) [File not signed]
S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [1910640 2015-02-27] (Electronic Arts)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76152 2014-10-18] ()
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [15232 2014-01-28] ()
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2015-02-28] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [87912 2015-02-28] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2015-02-28] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2015-02-28] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1050432 2015-02-28] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [436624 2015-02-28] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [116728 2015-02-28] (AVAST Software)
S3 aswTap; C:\Windows\System32\DRIVERS\aswTap.sys [44640 2015-01-18] (The OpenVPN Project)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [267632 2015-02-28] ()
R3 e1dexpress; C:\Windows\System32\DRIVERS\e1d62x64.sys [487704 2014-03-14] (Intel Corporation)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28008 2014-04-11] (Intel Corporation)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [118272 2014-03-20] (Intel Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-05 18:49 - 2015-03-05 18:49 - 00000715 _____ () C:\Users\Chiara\Downloads\Fix.txt
2015-03-04 22:07 - 2015-03-04 22:07 - 00852594 _____ () C:\Users\Chiara\Downloads\SecurityCheck(1).exe
2015-03-04 21:05 - 2015-03-04 21:05 - 02347384 _____ (ESET) C:\Users\Chiara\Downloads\esetsmartinstaller_deu(1).exe
2015-03-04 21:05 - 2015-03-04 21:05 - 00000000 ____D () C:\Program Files (x86)\ESET
2015-03-03 21:41 - 2015-03-03 21:41 - 01388333 _____ (Thisisu) C:\Users\Chiara\Downloads\JRT(1).exe
2015-03-03 21:26 - 2015-03-03 21:26 - 02126848 _____ () C:\Users\Chiara\Downloads\AdwCleaner_4.111.exe
2015-03-01 14:53 - 2015-03-01 14:53 - 00281688 _____ () C:\Windows\Minidump\030115-5678-01.dmp
2015-02-28 17:28 - 2015-02-28 17:28 - 00281688 _____ () C:\Windows\Minidump\022815-5850-01.dmp
2015-02-28 10:37 - 2015-02-28 10:37 - 00000000 ____D () C:\Users\Chiara\AppData\Roaming\AVAST Software
2015-02-28 10:36 - 2015-03-05 18:55 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2015-02-28 10:36 - 2015-02-28 10:36 - 01050432 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys
2015-02-28 10:36 - 2015-02-28 10:36 - 00436624 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2015-02-28 10:36 - 2015-02-28 10:36 - 00364512 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2015-02-28 10:36 - 2015-02-28 10:36 - 00267632 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2015-02-28 10:36 - 2015-02-28 10:36 - 00116728 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2015-02-28 10:36 - 2015-02-28 10:36 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2015-02-28 10:36 - 2015-02-28 10:36 - 00087912 _____ (AVAST Software) C:\Windows\system32\Drivers\aswmonflt.sys
2015-02-28 10:36 - 2015-02-28 10:36 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2015-02-28 10:36 - 2015-02-28 10:36 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2015-02-28 10:36 - 2015-02-28 10:36 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2015-02-28 10:36 - 2015-02-28 10:36 - 00001930 _____ () C:\Users\Public\Desktop\Avast Free Antivirus.lnk
2015-02-28 10:36 - 2015-02-28 10:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2015-02-28 10:36 - 2015-02-28 10:36 - 00000000 ____D () C:\Program Files\AVAST Software
2015-02-28 10:35 - 2015-02-28 10:35 - 132469808 _____ (AVAST Software) C:\Users\Chiara\Downloads\avast_free_antivirus_setup(1).exe
2015-02-28 08:01 - 2015-02-28 08:01 - 00000000 ____D () C:\Users\Gast\AppData\Roaming\Apple Computer
2015-02-25 22:42 - 2015-01-09 00:44 - 00419936 _____ () C:\Windows\SysWOW64\locale.nls
2015-02-25 22:42 - 2015-01-09 00:43 - 00419936 _____ () C:\Windows\system32\locale.nls
2015-02-25 20:49 - 2015-01-09 04:14 - 00950272 _____ (Microsoft Corporation) C:\Windows\system32\perftrack.dll
2015-02-25 20:49 - 2015-01-09 04:14 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\wdi.dll
2015-02-25 20:49 - 2015-01-09 04:14 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\powertracker.dll
2015-02-25 20:49 - 2015-01-09 03:48 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdi.dll
2015-02-24 19:42 - 2015-02-24 19:42 - 00000634 _____ () C:\Users\Public\Desktop\Battle.net.lnk
2015-02-24 19:42 - 2015-02-24 19:42 - 00000000 ____D () C:\Users\Chiara\AppData\Roaming\Battle.net
2015-02-24 19:42 - 2015-02-24 19:42 - 00000000 ____D () C:\Users\Chiara\AppData\Local\Blizzard Entertainment
2015-02-24 19:42 - 2015-02-24 19:42 - 00000000 ____D () C:\Users\Chiara\AppData\Local\Battle.net
2015-02-24 19:42 - 2015-02-24 19:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battle.net
2015-02-24 19:42 - 2015-02-24 19:42 - 00000000 ____D () C:\ProgramData\Blizzard Entertainment
2015-02-24 19:41 - 2015-02-24 19:41 - 03057720 _____ (Blizzard Entertainment) C:\Users\Chiara\Downloads\Hearthstone-Setup-deDE.exe
2015-02-24 19:41 - 2015-02-24 19:41 - 00000000 ____D () C:\ProgramData\Battle.net
2015-02-20 18:56 - 2015-02-20 18:56 - 00281688 _____ () C:\Windows\Minidump\022015-5928-01.dmp
2015-02-19 18:57 - 2015-02-19 18:57 - 00000000 ____D () C:\Users\Chiara\AppData\Local\Steam
2015-02-18 21:38 - 2015-02-18 21:38 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-BLUESTAR-Windows-7-Home-Premium-(64-bit).dat
2015-02-18 21:38 - 2015-02-18 21:38 - 00000000 ____D () C:\RegBackup
2015-02-18 21:28 - 2015-02-18 21:28 - 00002169 _____ () C:\Users\Chiara\Desktop\Tweaking.com - Windows Repair (All in One).lnk
2015-02-18 21:28 - 2015-02-18 21:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tweaking.com
2015-02-18 21:28 - 2015-02-18 21:28 - 00000000 ____D () C:\Program Files (x86)\Tweaking.com
2015-02-18 21:27 - 2015-02-18 21:27 - 11852704 _____ () C:\Users\Chiara\Downloads\tweaking.com_windows_repair_aio_setup.exe
2015-02-18 21:25 - 2015-02-18 21:25 - 00281688 _____ () C:\Windows\Minidump\021815-6302-01.dmp
2015-02-18 20:17 - 2015-02-18 20:17 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2015-02-18 18:42 - 2015-02-18 18:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
2015-02-14 22:33 - 2015-02-14 22:33 - 00281664 _____ () C:\Windows\Minidump\021415-10545-01.dmp
2015-02-13 10:27 - 2015-02-13 10:27 - 00049682 _____ () C:\Users\Chiara\Downloads\SystemLook.txt
2015-02-13 10:26 - 2015-02-13 10:26 - 00165376 _____ () C:\Users\Chiara\Downloads\SystemLook_x64.exe
2015-02-12 09:32 - 2015-01-23 05:42 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-02-12 09:32 - 2015-01-23 05:41 - 06041600 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-02-12 09:32 - 2015-01-23 04:43 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-02-12 09:32 - 2015-01-23 04:17 - 04300800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-02-12 00:08 - 2015-02-12 10:01 - 00000000 ____D () C:\Users\Chiara\Desktop\Zoes alt
2015-02-11 10:34 - 2015-02-11 10:34 - 00000000 ____D () C:\Users\Chiara\Downloads\runtime
2015-02-11 10:34 - 2015-02-11 10:34 - 00000000 ____D () C:\Users\Chiara\Downloads\game
2015-02-11 10:33 - 2015-02-11 10:33 - 01294088 _____ (Mojang) C:\Users\Chiara\Downloads\Minecraft(2).exe
2015-02-11 10:29 - 2015-02-11 10:29 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-02-11 10:29 - 2015-02-11 10:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-02-11 10:29 - 2015-02-11 10:29 - 00000000 ____D () C:\Program Files (x86)\Java
2015-02-11 10:24 - 2015-02-11 10:24 - 00639912 _____ (Oracle Corporation) C:\Users\Chiara\Downloads\jxpiinstall.exe
2015-02-11 09:50 - 2015-02-11 09:50 - 00000000 ____D () C:\Users\Chiara\AppData\Local\IsolatedStorage
2015-02-11 09:39 - 2015-02-11 09:48 - 00000000 ____D () C:\ProgramData\Screaming Bee
2015-02-11 09:38 - 2015-02-04 04:16 - 00894976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-02-11 09:38 - 2015-02-04 04:16 - 00762368 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-02-11 09:38 - 2015-02-04 04:16 - 00609280 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-02-11 09:38 - 2015-02-04 04:16 - 00414720 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-02-11 09:38 - 2015-02-04 04:16 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-02-11 09:38 - 2015-02-04 04:16 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-02-11 09:38 - 2015-02-04 04:13 - 01098752 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-02-11 09:38 - 2015-01-28 00:36 - 01239720 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2015-02-11 09:38 - 2015-01-14 06:47 - 00389808 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-02-11 09:38 - 2015-01-14 06:09 - 00342712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-02-11 09:38 - 2015-01-12 04:09 - 25056256 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-02-11 09:38 - 2015-01-12 04:05 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-02-11 09:38 - 2015-01-12 04:05 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-02-11 09:38 - 2015-01-12 03:49 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-02-11 09:38 - 2015-01-12 03:48 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-02-11 09:38 - 2015-01-12 03:48 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-02-11 09:38 - 2015-01-12 03:48 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-02-11 09:38 - 2015-01-12 03:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-02-11 09:38 - 2015-01-12 03:40 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-02-11 09:38 - 2015-01-12 03:39 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-02-11 09:38 - 2015-01-12 03:36 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-02-11 09:38 - 2015-01-12 03:34 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-02-11 09:38 - 2015-01-12 03:34 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-02-11 09:38 - 2015-01-12 03:25 - 19740160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-02-11 09:38 - 2015-01-12 03:25 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-02-11 09:38 - 2015-01-12 03:21 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-02-11 09:38 - 2015-01-12 03:21 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-02-11 09:38 - 2015-01-12 03:13 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-02-11 09:38 - 2015-01-12 03:08 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-02-11 09:38 - 2015-01-12 03:08 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-02-11 09:38 - 2015-01-12 03:07 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-02-11 09:38 - 2015-01-12 03:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-02-11 09:38 - 2015-01-12 03:07 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-02-11 09:38 - 2015-01-12 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-02-11 09:38 - 2015-01-12 03:04 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-02-11 09:38 - 2015-01-12 03:02 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-02-11 09:38 - 2015-01-12 03:00 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-02-11 09:38 - 2015-01-12 02:59 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-02-11 09:38 - 2015-01-12 02:57 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-02-11 09:38 - 2015-01-12 02:55 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-02-11 09:38 - 2015-01-12 02:48 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-02-11 09:38 - 2015-01-12 02:48 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-02-11 09:38 - 2015-01-12 02:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-02-11 09:38 - 2015-01-12 02:46 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-02-11 09:38 - 2015-01-12 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-02-11 09:38 - 2015-01-12 02:43 - 14401024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-02-11 09:38 - 2015-01-12 02:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-02-11 09:38 - 2015-01-12 02:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-02-11 09:38 - 2015-01-12 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-02-11 09:38 - 2015-01-12 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-02-11 09:38 - 2015-01-12 02:27 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-02-11 09:38 - 2015-01-12 02:23 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-02-11 09:38 - 2015-01-12 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-02-11 09:38 - 2015-01-12 02:22 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-02-11 09:38 - 2015-01-12 02:14 - 12829184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-02-11 09:38 - 2015-01-12 02:14 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-02-11 09:38 - 2015-01-12 02:02 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-02-11 09:38 - 2015-01-12 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-02-11 09:38 - 2015-01-12 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-02-11 09:38 - 2015-01-12 01:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-02-11 09:38 - 2015-01-10 07:48 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-02-11 09:38 - 2015-01-10 07:48 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-02-11 09:38 - 2015-01-10 07:48 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-02-11 09:38 - 2015-01-10 07:48 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-02-11 09:38 - 2015-01-10 07:48 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-02-11 09:38 - 2015-01-10 07:48 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-02-11 09:38 - 2015-01-10 07:48 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-02-11 09:38 - 2015-01-10 07:27 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-02-11 09:38 - 2015-01-10 07:27 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-02-11 09:38 - 2015-01-10 07:27 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-02-11 09:38 - 2015-01-10 07:27 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-02-11 09:38 - 2015-01-10 07:27 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-02-11 09:38 - 2015-01-10 07:27 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-02-11 09:38 - 2015-01-10 07:27 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-02-11 09:37 - 2015-01-15 09:14 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-02-11 09:37 - 2015-01-15 09:14 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-02-11 09:37 - 2015-01-15 09:09 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-02-11 09:37 - 2015-01-15 09:09 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-02-11 09:37 - 2015-01-15 09:09 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-02-11 09:37 - 2015-01-15 09:09 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-02-11 09:37 - 2015-01-15 09:09 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-02-11 09:37 - 2015-01-15 09:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-02-11 09:37 - 2015-01-15 09:06 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-02-11 09:37 - 2015-01-15 09:06 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-02-11 09:37 - 2015-01-15 09:04 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-02-11 09:37 - 2015-01-15 08:42 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-02-11 09:37 - 2015-01-15 08:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-02-11 09:37 - 2015-01-15 08:41 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-02-11 09:37 - 2015-01-15 08:39 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-02-11 09:37 - 2015-01-15 08:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-02-11 09:37 - 2015-01-15 08:37 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-02-11 09:37 - 2015-01-15 05:22 - 00458824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-02-11 09:37 - 2015-01-14 07:09 - 05554112 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-02-11 09:37 - 2015-01-14 07:05 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-02-11 09:37 - 2015-01-14 07:05 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-02-11 09:37 - 2015-01-14 07:04 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-02-11 09:37 - 2015-01-14 06:44 - 03972544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-02-11 09:37 - 2015-01-14 06:44 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-02-11 09:37 - 2015-01-14 06:41 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-02-11 09:37 - 2015-01-13 04:10 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-02-11 09:37 - 2015-01-13 03:49 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-02-11 09:37 - 2015-01-09 03:03 - 03201536 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-02-11 09:37 - 2014-12-12 06:31 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-02-11 09:37 - 2014-12-12 06:07 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2015-02-11 09:37 - 2014-12-08 04:09 - 00406528 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2015-02-11 09:37 - 2014-12-08 03:46 - 00308224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll
2015-02-11 09:37 - 2014-11-26 04:53 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2015-02-11 09:37 - 2014-11-26 04:32 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2015-02-11 09:37 - 2014-07-07 03:07 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2015-02-11 09:37 - 2014-07-07 03:06 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2015-02-11 09:37 - 2014-07-07 02:40 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2015-02-11 09:37 - 2014-07-07 02:40 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2015-02-10 21:58 - 2015-02-11 09:50 - 00000000 ____D () C:\Users\Chiara\AppData\Roaming\Screaming Bee
2015-02-10 21:57 - 2015-02-11 10:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Screaming Bee
2015-02-10 21:57 - 2015-02-11 10:21 - 00000000 ____D () C:\Program Files (x86)\Screaming Bee
2015-02-10 21:57 - 2015-02-10 21:57 - 00002270 _____ () C:\Users\Chiara\Desktop\MorphVOX Junior.lnk
2015-02-10 21:57 - 2015-02-10 21:57 - 00000000 ____D () C:\Users\Chiara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Screaming Bee
2015-02-10 21:56 - 2015-02-10 21:56 - 02970992 _____ () C:\Users\Chiara\Downloads\MorphVOXJunior_Install-1.exe
2015-02-10 17:46 - 2015-02-10 17:46 - 00281664 _____ () C:\Windows\Minidump\021015-12760-01.dmp
2015-02-10 13:46 - 2015-03-01 14:53 - 00000000 ____D () C:\Windows\Minidump
2015-02-10 13:46 - 2015-02-10 13:46 - 00281664 _____ () C:\Windows\Minidump\021015-9968-01.dmp
2015-02-10 11:24 - 2015-02-10 11:24 - 00001196 _____ () C:\Users\Chiara\Desktop\CrystalDiskInfo.lnk
2015-02-10 11:24 - 2015-02-10 11:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CrystalDiskInfo
2015-02-10 11:24 - 2015-02-10 11:24 - 00000000 ____D () C:\Program Files (x86)\CrystalDiskInfo
2015-02-10 11:23 - 2015-02-10 11:23 - 03014272 _____ (Crystal Dew World ) C:\Users\Chiara\Downloads\CrystalDiskInfo6_3_0-en.exe
2015-02-08 19:53 - 2015-02-08 19:53 - 00526371 _____ () C:\Users\Chiara\Desktop\openhardwaremonitor-v0.6.0-beta.zip
2015-02-08 09:38 - 2015-02-08 09:38 - 01188194 _____ () C:\Users\Chiara\Downloads\ProcessExplorer.zip
2015-02-05 19:45 - 2015-02-05 19:48 - 00067892 _____ () C:\Users\Chiara\Downloads\bluescreenview_v1.55.zip
2015-02-03 18:40 - 2015-02-03 18:40 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-05 19:00 - 2014-09-17 17:50 - 00000000 ____D () C:\FRST
2015-03-05 19:00 - 2014-09-16 17:42 - 00021386 _____ () C:\Users\Chiara\Downloads\FRST.txt
2015-03-05 18:57 - 2009-07-14 05:45 - 00023088 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-03-05 18:57 - 2009-07-14 05:45 - 00023088 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-03-05 18:56 - 2014-07-31 21:34 - 00000000 ____D () C:\Users\Chiara\AppData\Roaming\.minecraft
2015-03-05 18:56 - 2009-07-14 18:58 - 00686552 _____ () C:\Windows\system32\perfh007.dat
2015-03-05 18:56 - 2009-07-14 18:58 - 00145882 _____ () C:\Windows\system32\perfc007.dat
2015-03-05 18:56 - 2009-07-14 06:13 - 01623866 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-03-05 18:55 - 2014-07-31 21:39 - 00000000 ____D () C:\Users\Chiara\AppData\Roaming\Skype
2015-03-05 18:54 - 2014-07-26 19:39 - 00006464 _____ () C:\Windows\SysWOW64\Gms.log
2015-03-05 18:53 - 2014-10-06 12:27 - 00000000 ____D () C:\Users\Chiara\AppData\Local\LogMeIn Hamachi
2015-03-05 18:53 - 2014-09-07 12:57 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-03-05 18:53 - 2014-08-01 13:15 - 00000000 ____D () C:\ProgramData\Origin
2015-03-05 18:52 - 2014-07-26 18:58 - 02443810 _____ () C:\Windows\PFRO.log
2015-03-05 18:52 - 2014-07-26 18:30 - 01074323 _____ () C:\Windows\WindowsUpdate.log
2015-03-05 18:52 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-03-05 18:52 - 2009-07-14 05:51 - 00062497 _____ () C:\Windows\setupact.log
2015-03-04 22:57 - 2014-08-02 13:55 - 00000000 ____D () C:\Users\Chiara\AppData\Roaming\TS3Client
2015-03-04 22:38 - 2014-08-13 10:30 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-03-04 22:20 - 2014-09-07 12:57 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-03-03 21:31 - 2015-01-31 22:01 - 00000000 ____D () C:\AdwCleaner
2015-03-03 21:24 - 2015-01-31 21:50 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-03-03 21:18 - 2014-08-02 17:14 - 00000000 ____D () C:\Windows\en
2015-03-01 21:18 - 2014-09-16 17:42 - 00039279 _____ () C:\Users\Chiara\Downloads\Addition.txt
2015-03-01 21:16 - 2015-01-31 22:07 - 00000000 ____D () C:\Users\Chiara\Downloads\FRST-OlderVersion
2015-03-01 21:16 - 2014-09-16 17:41 - 02092544 _____ (Farbar) C:\Users\Chiara\Downloads\FRST64.exe
2015-02-28 10:36 - 2014-09-07 12:56 - 00000000 ____D () C:\ProgramData\AVAST Software
2015-02-28 08:02 - 2014-11-26 15:42 - 00111336 _____ () C:\Users\Gast\AppData\Local\GDIPFONTCACHEV1.DAT
2015-02-28 08:01 - 2014-11-26 15:41 - 00000000 ____D () C:\Users\Gast\AppData\Local\LogMeIn Hamachi
2015-02-27 19:07 - 2014-08-26 21:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Origin
2015-02-27 19:07 - 2014-08-26 21:52 - 00000000 ____D () C:\Program Files (x86)\Origin
2015-02-26 18:43 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\tracing
2015-02-25 19:38 - 2015-01-14 18:04 - 00000000 ____D () C:\Users\Chiara\AppData\Local\osu!
2015-02-23 20:36 - 2014-08-26 22:18 - 00347464 _____ () C:\Windows\SysWOW64\PnkBstrB.xtr
2015-02-23 20:36 - 2014-08-26 22:15 - 00347464 _____ () C:\Windows\SysWOW64\PnkBstrB.exe
2015-02-23 20:10 - 2014-08-01 16:03 - 00347464 _____ () C:\Windows\SysWOW64\PnkBstrB.ex0
2015-02-22 13:05 - 2014-08-13 10:55 - 00000000 ____D () C:\Users\Chiara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2015-02-20 19:22 - 2014-09-07 12:57 - 00002239 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-02-18 22:09 - 2014-07-26 19:47 - 00111336 _____ () C:\Users\Chiara\AppData\Local\GDIPFONTCACHEV1.DAT
2015-02-18 22:07 - 2009-07-14 06:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-02-18 22:07 - 2009-07-14 05:45 - 00413480 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-02-18 22:04 - 2009-07-14 03:34 - 00000616 _____ () C:\Windows\win.ini
2015-02-18 21:54 - 2009-07-14 03:34 - 00000855 _____ () C:\Windows\system32\Drivers\etc\hosts_bak_832
2015-02-18 21:43 - 2009-07-14 03:34 - 00000855 _____ () C:\Windows\system32\Drivers\etc\hosts_bak_79
2015-02-16 16:20 - 2014-11-02 13:46 - 00033856 ____H (LogMeIn, Inc.) C:\Windows\system32\hamachi.sys
2015-02-15 19:33 - 2014-12-20 21:26 - 00000000 ____D () C:\Users\Chiara\AppData\Roaming\Apple Computer
2015-02-14 11:43 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2015-02-12 09:26 - 2014-12-12 18:54 - 00000000 ____D () C:\Windows\system32\appraiser
2015-02-12 09:26 - 2014-07-26 21:17 - 00000000 ___SD () C:\Windows\system32\CompatTel
2015-02-12 00:46 - 2014-10-11 09:31 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-02-12 00:46 - 2014-07-26 21:01 - 00000000 ____D () C:\Windows\system32\MRT
2015-02-12 00:44 - 2014-07-26 21:01 - 116773704 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-02-11 17:26 - 2014-08-01 16:22 - 00000000 ____D () C:\Users\Chiara\Downloads\Gameforge Live
2015-02-11 10:31 - 2014-07-26 22:25 - 00000000 ____D () C:\ProgramData\Oracle
2015-02-11 10:24 - 2014-09-01 13:46 - 00000000 ____D () C:\Program Files\Java
2015-02-11 10:21 - 2014-07-26 18:56 - 00000000 ____D () C:\ProgramData\Package Cache
2015-02-08 14:33 - 2014-08-01 12:28 - 00000000 ____D () C:\Users\Chiara\.gimp-2.8
2015-02-06 19:15 - 2014-09-07 12:57 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-02-06 19:15 - 2014-09-07 12:57 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-02-05 18:59 - 2014-12-20 21:25 - 00000000 ____D () C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
2015-02-04 20:38 - 2014-08-13 10:30 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-02-04 20:38 - 2014-08-13 10:30 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-02-04 20:38 - 2014-08-13 10:30 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-02-03 18:43 - 2014-08-13 10:42 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

==================== Files in the root of some directories =======

2014-10-04 19:34 - 2013-03-07 12:48 - 0036864 _____ (Microsoft Corporation) C:\Program Files (x86)\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll
2014-10-04 19:34 - 2013-03-10 05:38 - 0084736 _____ (Microsoft Corporation) C:\Program Files (x86)\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll
2014-10-04 19:34 - 2006-10-03 17:26 - 0037063 _____ () C:\Program Files (x86)\Office Word 2003 Look.dotx
2014-11-23 16:41 - 2014-12-09 18:41 - 0000162 _____ () C:\Users\Chiara\AppData\Roaming\WB.CFG
2014-11-25 19:41 - 2014-12-02 18:41 - 0000002 _____ () C:\Users\Chiara\AppData\Local\DSI.DAT
2015-02-02 21:11 - 2015-02-02 21:11 - 0011853 _____ () C:\Users\Chiara\AppData\Local\recently-used.xbel

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-24 21:18

==================== End Of Log ============================
--- --- ---

schrauber 06.03.2015 10:41
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:49174;https=127.0.0.1:49174

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.



Kopiere den Text in der Codebox in deinen Editor (z.B. Notepad) und speichere es unter dem Namen regfix.reg (bei Dateityp bitte "alle Dateien" wählen)

Code:
Windows Registry Editor Version 5.00

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings"=-
"DefaultConnectionSettings"=-

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable"=-
"ProxyServer"=-
Starte die regfix.reg duch Doppelklick.



Nochmal frisches FRST log bitte.

QueenZoe 06.03.2015 18:58
nochmal ?


Alle Zeitangaben in WEZ +1. Es ist jetzt 11:51 Uhr.
Seite 4 von 5 « Erste 23 4 5
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2026, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30