VIRY.CZ

Dobry vecer,opakovane dostavam nevyzadane e-maily s prilohami typu rar,pdf,exe...,ktere muj antivir detekuje,jako nebezpecne soubory,presto jsem jeden omylem otevrela a od teto doby se muj PC vyrazne zpomalil,zamrza a heslo k me e-mailove schrance bylo zmeneno,bez meho vedomi...zde vkladam log z RSIT a prosim o kontrolu....p.s. omlouvam se za chybejici diakritiku,mam pouze nemeckou klavesnici...dekuji


Logfile of random's system information tool 1.10 (written by random/random)
Run by jana2732 at 2015-07-07 22:24:31
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 396 GB (83%) free of 477 GB
Total RAM: 4094 MB (30% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 22:25:04, on 07.07.2015
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.17840)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe
C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avpui.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files\trend micro\jana2732.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bluewin.ch/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = https://apps-guard.com/akamaiproxy.js
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: myBabylon English Toolbar - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - C:\Program Files (x86)\myBabylon_English\tbmyB1.dll (file missing)
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: ContentBlockerBrowserHelperObject - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll
O2 - BHO: VirtualKeyboardBrowserHelperObject - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll
O2 - BHO: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\OnlineBanking\online_banking_bho.dll
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\UrlAdvisor\klwtbbho.dll
O3 - Toolbar: myBabylon English Toolbar - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - C:\Program Files (x86)\myBabylon_English\tbmyB1.dll (file missing)
O4 - HKLM\..\Run: [OM2_Monitor] "C:\Program Files (x86)\OLYMPUS\OLYMPUS Master 2\FirstStart.exe" /OM
O4 - HKCU\..\Run: [OM2_Monitor] "C:\Program Files (x86)\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" -NoStart
O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETZWERKDIENST')
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Zu Anti-Banner hinzufügen - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ie_banner_deny.htm
O9 - Extra button: Virtuelle Tastatur - {0C4CC089-D306-440D-9772-464E226F6539} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Link-Untersuchung - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\UrlAdvisor\klwtbbho.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Kaspersky Anti-Virus Service (AVP) - Kaspersky Lab ZAO - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: TeamViewer 6 (TeamViewer6) - TeamViewer GmbH - C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe
O23 - Service: TomTomHOMEService - TomTom - C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 8849 bytes

======Listing Processes======



\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
"C:\Windows\system32\nvvsvc.exe"
"C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe"
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe" -r
C:\Windows\System32\svchost.exe -k utcsvc
"C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe"
C:\Windows\system32\nvvsvc.exe -session -first
"taskhost.exe"
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe"
"c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe"
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe"
"C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe"
"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe"
"C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe"
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
"C:/Program Files/NVIDIA Corporation/Display/nvtray.exe" -user_has_logged_in 1
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-ea4f37e3-4a07-4702-acb9-8cc5ed5ee444 -SystemEventPortName:HostProcess-87c614f8-6c36-4979-a180-085f3852ec28 -IoCancelEventPortName:HostProcess-6455a070-71f5-4a0b-b2b0-1786cc98b85b -NonStateChangingEventPortName:HostProcess-5e865538-82bb-4d81-80df-4c46b9b59c30 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:cf465607-af70-480f-9d4f-29eecb8fbae5 -DeviceGroupId:WpdFsGroup
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Windows\system32\GWX\GWX.exe"
"C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avpui.exe" -hidden /prefetch:1
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\System32\svchost.exe -k secsvcs
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe"
taskeng.exe {BCCB3CFD-8A3D-48F7-A19F-5EFD6DF5F4A0}
"c:\program files\windows defender\MpCmdRun.exe" SpyNetService -RestrictPrivileges -AccessKey 6747DA0A-00EB-67A5-A715-D3D37CC480A8 -Reinvoke

"C:\Users\jana2732\Downloads\RSITx64.exe"
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\Windows\system32\SearchFilterHost.exe" 0 512 516 524 65536 520
C:\Windows\system32\igfxsrvc.exe -Embedding
C:\Windows\System32\svchost.exe -k WerSvcGroup

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
3-12-18 550080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E33CF602-D945-461A-83F0-819F76A199F8}]
URL Advisor Plugin - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll [2014-02-17 996544]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F}]
Content Blocker Plugin - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll [2013-11-12 655040]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{73455575-E40C-433C-9784-C78DC7761455}]
Virtual Keyboard Plugin - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll [2014-12-17 1265448]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9E6D0D23-3D72-4A94-AE1F-2D167624E3D9}]
Safe Money Plugin - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\OnlineBanking\online_banking_bho.dll [2013-12-18 455360]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E33CF602-D945-461A-83F0-819F76A199F8}]
URL Advisor Plugin - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\UrlAdvisor\klwtbbho.dll [2014-02-17 798912]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - myBabylon English Toolbar - C:\Program Files (x86)\myBabylon_English\tbmyB1.dll []

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2009-01-13 6963232]
"Skytel"=C:\Program Files\Realtek\Audio\HDA\Skytel.exe [2009-01-13 1833504]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2009-09-23 165912]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2009-09-23 385560]
"Persistence"=C:\Windows\system32\igfxpers.exe [2009-09-23 363544]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"OM2_Monitor"=C:\Program Files (x86)\OLYMPUS\OLYMPUS Master 2\MMonitor.exe [2009-11-25 95632]
"TomTomHOME.exe"=C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [2013-08-27 248208]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-06-12 998088]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [2011-03-24 49208]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"OM2_Monitor"=C:\Program Files (x86)\OLYMPUS\OLYMPUS Master 2\FirstStart.exe [2009-11-25 54672]
""= []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2009-09-23 261120]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0
"NoDriveTypeAutoRun"=28

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"wave4"=wdmaud.drv
"midi4"=wdmaud.drv
"mixer4"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2015-07-07 22:24:32 ----D---- C:\Program Files\trend micro
2015-06-10 12:01:58 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2015-06-10 12:01:58 ----A---- C:\Windows\SYSWOW64\ieetwproxystub.dll
2015-06-10 12:01:58 ----A---- C:\Windows\system32\ieetwcollector.exe
2015-06-10 12:01:57 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2015-06-10 12:01:57 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2015-06-10 12:01:57 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2015-06-10 12:01:57 ----A---- C:\Windows\SYSWOW64\MshtmlDac.dll
2015-06-10 12:01:57 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2015-06-10 12:01:57 ----A---- C:\Windows\SYSWOW64\JavaScriptCollectionAgent.dll
2015-06-10 12:01:57 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2015-06-10 12:01:57 ----A---- C:\Windows\SYSWOW64\dxtrans.dll
2015-06-10 12:01:57 ----A---- C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-06-10 12:01:57 ----A---- C:\Windows\system32\iernonce.dll
2015-06-10 12:01:57 ----A---- C:\Windows\system32\ieetwproxystub.dll
2015-06-10 12:01:57 ----A---- C:\Windows\system32\ie4uinit.exe
2015-06-10 12:01:56 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2015-06-10 12:01:55 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2015-06-10 12:01:55 ----A---- C:\Windows\SYSWOW64\jscript9diag.dll
2015-06-10 12:01:55 ----A---- C:\Windows\SYSWOW64\jscript.dll
2015-06-10 12:01:55 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2015-06-10 12:01:55 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2015-06-10 12:01:55 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2015-06-10 12:01:55 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll
2015-06-10 12:01:55 ----A---- C:\Windows\SYSWOW64\dxtmsft.dll
2015-06-10 12:01:55 ----A---- C:\Windows\system32\urlmon.dll
2015-06-10 12:01:55 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe
2015-06-10 12:01:55 ----A---- C:\Windows\system32\ieetwcollectorres.dll
2015-06-10 12:01:55 ----A---- C:\Windows\system32\iedkcs32.dll
2015-06-10 12:01:55 ----A---- C:\Windows\system32\dxtrans.dll
2015-06-10 12:01:54 ----A---- C:\Windows\SYSWOW64\ieui.dll
2015-06-10 12:01:54 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2015-06-10 12:01:54 ----A---- C:\Windows\system32\msfeeds.dll
2015-06-10 12:01:53 ----A---- C:\Windows\system32\iesetup.dll
2015-06-10 12:01:53 ----A---- C:\Windows\system32\iertutil.dll
2015-06-10 12:01:53 ----A---- C:\Windows\system32\ieapfltr.dll
2015-06-10 12:01:52 ----A---- C:\Windows\SYSWOW64\wininet.dll
2015-06-10 12:01:52 ----A---- C:\Windows\SYSWOW64\msrating.dll
2015-06-10 12:01:52 ----A---- C:\Windows\SYSWOW64\mshtmlmedia.dll
2015-06-10 12:01:52 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2015-06-10 12:01:52 ----A---- C:\Windows\system32\vbscript.dll
2015-06-10 12:01:52 ----A---- C:\Windows\system32\jsproxy.dll
2015-06-10 12:01:52 ----A---- C:\Windows\system32\ieUnatt.exe
2015-06-10 12:01:51 ----A---- C:\Windows\system32\ieui.dll
2015-06-10 12:01:51 ----A---- C:\Windows\system32\ieframe.dll
2015-06-10 12:01:51 ----A---- C:\Windows\system32\dxtmsft.dll
2015-06-10 12:01:50 ----A---- C:\Windows\system32\mshtmlmedia.dll
2015-06-10 12:01:50 ----A---- C:\Windows\system32\mshtmled.dll
2015-06-10 12:01:50 ----A---- C:\Windows\system32\jscript9diag.dll
2015-06-10 12:01:50 ----A---- C:\Windows\system32\jscript.dll
2015-06-10 12:01:49 ----A---- C:\Windows\system32\wininet.dll
2015-06-10 12:01:49 ----A---- C:\Windows\system32\jscript9.dll
2015-06-10 12:01:48 ----A---- C:\Windows\system32\msrating.dll
2015-06-10 12:01:48 ----A---- C:\Windows\system32\MshtmlDac.dll
2015-06-10 12:01:48 ----A---- C:\Windows\system32\mshtml.dll
2015-06-10 12:01:15 ----A---- C:\Windows\system32\wmp.dll
2015-06-10 12:01:14 ----A---- C:\Windows\SYSWOW64\wmp.dll
2015-06-10 12:01:14 ----A---- C:\Windows\system32\spwmp.dll
2015-06-10 12:01:13 ----A---- C:\Windows\SYSWOW64\wmploc.DLL
2015-06-10 12:01:13 ----A---- C:\Windows\SYSWOW64\spwmp.dll
2015-06-10 12:01:13 ----A---- C:\Windows\SYSWOW64\dxmasf.dll
2015-06-10 12:01:13 ----A---- C:\Windows\system32\wmploc.DLL
2015-06-10 12:01:13 ----A---- C:\Windows\system32\dxmasf.dll
2015-06-10 12:01:11 ----A---- C:\Windows\system32\invagent.dll
2015-06-10 12:01:11 ----A---- C:\Windows\system32\generaltel.dll
2015-06-10 12:01:11 ----A---- C:\Windows\system32\appraiser.dll
2015-06-10 12:01:11 ----A---- C:\Windows\system32\aeinv.dll
2015-06-10 12:01:10 ----A---- C:\Windows\system32\devinv.dll
2015-06-10 12:01:10 ----A---- C:\Windows\system32\aepic.dll
2015-06-10 12:01:10 ----A---- C:\Windows\system32\aepdu.dll
2015-06-10 12:01:10 ----A---- C:\Windows\system32\acmigration.dll
2015-06-10 11:56:35 ----A---- C:\Windows\system32\diagtrack.dll
2015-06-10 11:56:34 ----A---- C:\Windows\system32\kerberos.dll
2015-06-10 11:56:33 ----A---- C:\Windows\SYSWOW64\kerberos.dll
2015-06-10 11:56:33 ----A---- C:\Windows\system32\KernelBase.dll
2015-06-10 11:56:32 ----A---- C:\Windows\system32\lsasrv.dll
2015-06-10 11:56:32 ----A---- C:\Windows\system32\kernel32.dll
2015-06-10 11:56:31 ----A---- C:\Windows\SYSWOW64\advapi32.dll
2015-06-10 11:56:31 ----A---- C:\Windows\system32\advapi32.dll
2015-06-10 11:56:30 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2015-06-10 11:56:30 ----A---- C:\Windows\system32\ntoskrnl.exe
2015-06-10 11:56:29 ----A---- C:\Windows\system32\ntdll.dll
2015-06-10 11:56:28 ----A---- C:\Windows\system32\wow64.dll
2015-06-10 11:56:28 ----A---- C:\Windows\system32\drivers\ksecpkg.sys
2015-06-10 11:56:27 ----A---- C:\Windows\SYSWOW64\tracerpt.exe
2015-06-10 11:56:27 ----A---- C:\Windows\system32\winsrv.dll
2015-06-10 11:56:27 ----A---- C:\Windows\system32\tracerpt.exe
2015-06-10 11:56:27 ----A---- C:\Windows\system32\srcore.dll
2015-06-10 11:56:27 ----A---- C:\Windows\system32\rstrui.exe
2015-06-10 11:56:27 ----A---- C:\Windows\system32\conhost.exe
2015-06-10 11:56:26 ----A---- C:\Windows\SYSWOW64\schannel.dll
2015-06-10 11:56:26 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2015-06-10 11:56:26 ----A---- C:\Windows\SYSWOW64\ntdll.dll
2015-06-10 11:56:26 ----A---- C:\Windows\SYSWOW64\msv1_0.dll
2015-06-10 11:56:26 ----A---- C:\Windows\system32\schannel.dll
2015-06-10 11:56:25 ----A---- C:\Windows\system32\wdigest.dll
2015-06-10 11:56:25 ----A---- C:\Windows\system32\tdh.dll
2015-06-10 11:56:25 ----A---- C:\Windows\system32\sechost.dll
2015-06-10 11:56:25 ----A---- C:\Windows\system32\msv1_0.dll
2015-06-10 11:56:25 ----A---- C:\Windows\system32\drivers\ksecdd.sys
2015-06-10 11:56:24 ----A---- C:\Windows\SYSWOW64\tdh.dll
2015-06-10 11:56:24 ----A---- C:\Windows\SYSWOW64\ncrypt.dll
2015-06-10 11:56:24 ----A---- C:\Windows\SYSWOW64\logman.exe
2015-06-10 11:56:24 ----A---- C:\Windows\system32\TSpkg.dll
2015-06-10 11:56:24 ----A---- C:\Windows\system32\sspicli.dll
2015-06-10 11:56:24 ----A---- C:\Windows\system32\ncrypt.dll
2015-06-10 11:56:24 ----A---- C:\Windows\system32\logman.exe
2015-06-10 11:56:23 ----A---- C:\Windows\SYSWOW64\wdigest.dll
2015-06-10 11:56:23 ----A---- C:\Windows\SYSWOW64\TSpkg.dll
2015-06-10 11:56:23 ----A---- C:\Windows\SYSWOW64\setup16.exe
2015-06-10 11:56:23 ----A---- C:\Windows\SYSWOW64\sechost.dll
2015-06-10 11:56:23 ----A---- C:\Windows\system32\smss.exe
2015-06-10 11:56:23 ----A---- C:\Windows\system32\lsass.exe
2015-06-10 11:56:22 ----A---- C:\Windows\SYSWOW64\typeperf.exe
2015-06-10 11:56:22 ----A---- C:\Windows\SYSWOW64\srclient.dll
2015-06-10 11:56:22 ----A---- C:\Windows\SYSWOW64\relog.exe
2015-06-10 11:56:22 ----A---- C:\Windows\SYSWOW64\diskperf.exe
2015-06-10 11:56:22 ----A---- C:\Windows\SYSWOW64\auditpol.exe
2015-06-10 11:56:22 ----A---- C:\Windows\system32\typeperf.exe
2015-06-10 11:56:22 ----A---- C:\Windows\system32\srclient.dll
2015-06-10 11:56:22 ----A---- C:\Windows\system32\relog.exe
2015-06-10 11:56:22 ----A---- C:\Windows\system32\diskperf.exe
2015-06-10 11:56:22 ----A---- C:\Windows\system32\csrsrv.dll
2015-06-10 11:56:22 ----A---- C:\Windows\system32\auditpol.exe
2015-06-10 11:56:21 ----A---- C:\Windows\SYSWOW64\sspicli.dll
2015-06-10 11:56:21 ----A---- C:\Windows\SYSWOW64\secur32.dll
2015-06-10 11:56:21 ----A---- C:\Windows\SYSWOW64\ntvdm64.dll
2015-06-10 11:56:21 ----A---- C:\Windows\SYSWOW64\KernelBase.dll
2015-06-10 11:56:21 ----A---- C:\Windows\SYSWOW64\credssp.dll
2015-06-10 11:56:21 ----A---- C:\Windows\system32\wow64win.dll
2015-06-10 11:56:21 ----A---- C:\Windows\system32\wow64cpu.dll
2015-06-10 11:56:21 ----A---- C:\Windows\system32\sspisrv.dll
2015-06-10 11:56:21 ----A---- C:\Windows\system32\secur32.dll
2015-06-10 11:56:21 ----A---- C:\Windows\system32\ntvdm64.dll
2015-06-10 11:56:21 ----A---- C:\Windows\system32\credssp.dll
2015-06-10 11:56:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-06-10 11:56:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-06-10 11:56:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-string-l1-1-0.dll
2015-06-10 11:56:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-06-10 11:56:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-06-10 11:56:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-06-10 11:56:20 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-06-10 11:56:20 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-06-10 11:56:20 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-06-10 11:56:20 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-06-10 11:56:20 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-06-10 11:56:20 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-06-10 11:56:20 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-06-10 11:56:20 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-06-10 11:56:20 ----A---- C:\Windows\SYSWOW64\wow32.dll
2015-06-10 11:56:20 ----A---- C:\Windows\SYSWOW64\kernel32.dll
2015-06-10 11:56:19 ----AH---- C:\Windows\SYSWOW64\api-ms-win-security-base-l1-1-0.dll
2015-06-10 11:56:19 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-util-l1-1-0.dll
2015-06-10 11:56:19 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-06-10 11:56:19 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-06-10 11:56:19 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-06-10 11:56:19 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-06-10 11:56:19 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-06-10 11:56:19 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-06-10 11:56:19 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-06-10 11:56:19 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-io-l1-1-0.dll
2015-06-10 11:56:19 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-06-10 11:56:19 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-06-10 11:56:19 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-06-10 11:56:19 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-file-l1-1-0.dll
2015-06-10 11:56:19 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-06-10 11:56:19 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-06-10 11:56:19 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-06-10 11:56:19 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-06-10 11:56:19 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-06-10 11:56:19 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-06-10 11:56:19 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-06-10 11:56:19 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-06-10 11:56:19 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-06-10 11:56:19 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-06-10 11:56:19 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-06-10 11:56:19 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-06-10 11:56:19 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-06-10 11:56:19 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-06-10 11:56:19 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-06-10 11:56:19 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-06-10 11:56:19 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-06-10 11:56:19 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-06-10 11:56:19 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-06-10 11:56:19 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-06-10 11:56:19 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-06-10 11:56:19 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-06-10 11:56:19 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-06-10 11:56:18 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-06-10 11:56:18 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-06-10 11:56:18 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-console-l1-1-0.dll
2015-06-10 11:56:18 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-06-10 11:56:18 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-06-10 11:56:18 ----A---- C:\Windows\SYSWOW64\user.exe
2015-06-10 11:56:18 ----A---- C:\Windows\SYSWOW64\instnm.exe
2015-06-10 11:56:18 ----A---- C:\Windows\SYSWOW64\apisetschema.dll
2015-06-10 11:56:18 ----A---- C:\Windows\system32\apisetschema.dll
2015-06-10 11:56:17 ----A---- C:\Windows\SYSWOW64\msobjs.dll
2015-06-10 11:56:17 ----A---- C:\Windows\SYSWOW64\msaudite.dll
2015-06-10 11:56:17 ----A---- C:\Windows\SYSWOW64\adtschema.dll
2015-06-10 11:56:17 ----A---- C:\Windows\system32\UtcResources.dll
2015-06-10 11:56:17 ----A---- C:\Windows\system32\msobjs.dll
2015-06-10 11:56:17 ----A---- C:\Windows\system32\msaudite.dll
2015-06-10 11:56:17 ----A---- C:\Windows\system32\adtschema.dll
2015-06-10 11:55:57 ----A---- C:\Windows\SYSWOW64\comctl32.dll
2015-06-10 11:55:57 ----A---- C:\Windows\system32\comctl32.dll
2015-06-10 11:55:55 ----A---- C:\Windows\system32\win32k.sys
2015-06-10 11:55:51 ----A---- C:\Windows\system32\drivers\stream.sys

======List of files/folders modified in the last 1 month======

2015-07-07 22:25:00 ----D---- C:\Windows\Temp
2015-07-07 22:24:32 ----RD---- C:\Program Files
2015-07-07 22:08:50 ----D---- C:\ProgramData\Kaspersky Lab
2015-07-07 22:08:40 ----D---- C:\Windows\system32\config
2015-07-07 22:08:23 ----SHD---- C:\System Volume Information
2015-07-07 22:08:19 ----D---- C:\ProgramData\NVIDIA
2015-07-07 22:03:53 ----D---- C:\Windows\system32\NDF
2015-07-07 06:57:46 ----D---- C:\Windows
2015-07-06 22:41:47 ----D---- C:\Windows\debug
2015-07-06 22:39:07 ----D---- C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-07-06 22:38:58 ----D---- C:\Windows\system32\drivers
2015-07-06 21:40:17 ----D---- C:\Windows\Tasks
2015-07-06 21:40:17 ----D---- C:\Windows\system32\wfp
2015-07-06 21:40:16 ----D---- C:\Windows\system32\wbem
2015-07-06 21:39:24 ----SD---- C:\Windows\system32\GWX
2015-07-06 21:39:24 ----D---- C:\Windows\system32\Tasks
2015-07-06 21:39:24 ----D---- C:\Windows\system32\DriverStore
2015-07-06 21:39:24 ----D---- C:\Windows\system32\catroot2
2015-07-06 21:39:24 ----D---- C:\Windows\System32
2015-07-06 21:39:17 ----D---- C:\Windows\registration
2015-06-23 23:05:18 ----D---- C:\Windows\SysWOW64
2015-06-23 23:05:06 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe
2015-06-23 20:13:31 ----SHD---- C:\Windows\Installer
2015-06-23 20:13:30 ----D---- C:\Config.Msi
2015-06-23 13:30:20 ----N---- C:\Windows\system32\MpSigStub.exe
2015-06-11 15:00:46 ----SD---- C:\Users\jana2732\AppData\Roaming\Microsoft
2015-06-10 21:14:25 ----A---- C:\Windows\system32\PerfStringBackup.INI
2015-06-10 21:14:05 ----D---- C:\Windows\inf
2015-06-10 21:07:27 ----D---- C:\Windows\winsxs
2015-06-10 21:04:16 ----SD---- C:\Windows\system32\CompatTel
2015-06-10 21:04:16 ----D---- C:\Program Files\Windows Media Player
2015-06-10 21:04:16 ----D---- C:\Program Files (x86)\Windows Media Player
2015-06-10 21:04:15 ----D---- C:\Windows\system32\appraiser
2015-06-10 21:04:15 ----D---- C:\Windows\AppPatch
2015-06-10 21:04:14 ----D---- C:\Windows\SYSWOW64\de-DE
2015-06-10 21:04:13 ----D---- C:\Windows\system32\de-DE
2015-06-10 21:04:09 ----D---- C:\Program Files\Internet Explorer
2015-06-10 21:04:08 ----D---- C:\Windows\SYSWOW64\en-US
2015-06-10 21:04:06 ----D---- C:\Windows\system32\en-US
2015-06-10 21:04:06 ----D---- C:\Windows\PolicyDefinitions
2015-06-10 21:04:05 ----D---- C:\Program Files (x86)\Internet Explorer
2015-06-10 12:56:47 ----D---- C:\ProgramData\Microsoft Help
2015-06-10 12:54:37 ----D---- C:\Windows\system32\MRT
2015-06-10 12:50:21 ----A---- C:\Windows\system32\MRT.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 kl1;kl1; C:\Windows\system32\DRIVERS\kl1.sys [2013-11-12 458336]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 213888]
R1 KLIF;Kaspersky Lab Driver; C:\Windows\system32\DRIVERS\klif.sys [2014-03-20 625248]
R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter; C:\Windows\system32\DRIVERS\klim6.sys [2013-11-12 29792]
R1 klpd;klpd; C:\Windows\system32\DRIVERS\klpd.sys [2013-04-12 15456]
R1 kltdi;kltdi; C:\Windows\system32\DRIVERS\kltdi.sys [2013-05-14 55904]
R1 kneps;kneps; C:\Windows\system32\DRIVERS\kneps.sys [2013-12-18 178272]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2009-01-13 1683104]
R3 klkbdflt;Kaspersky Lab KLKBDFLT; C:\Windows\system32\DRIVERS\klkbdflt.sys [2014-02-17 29280]
R3 klmouflt;Kaspersky Lab KLMOUFLT; C:\Windows\system32\DRIVERS\klmouflt.sys [2013-11-12 29280]
R3 MBAMProtector;MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys [2015-06-18 25816]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\Windows\system32\drivers\nvhda64v.sys [2011-03-04 174184]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt64win7.sys [2009-03-01 187392]
S1 SASDIFSV;SASDIFSV; \??\C:\Users\jana2732\AppData\Local\Temp\SAS_SelfExtract\SASDIFSV64.SYS []
S1 SASKUTIL;SASKUTIL; \??\C:\Users\jana2732\AppData\Local\Temp\SAS_SelfExtract\SASKUTIL64.SYS []
S3 e1express;Intel(R) PRO/1000 PCI Express-Netzwerkverbindungstreiber; C:\Windows\system32\DRIVERS\e1e6032e.sys [2009-06-10 278016]
S3 gdrv;gdrv; \??\C:\Windows\gdrv.sys [2009-10-06 24104]
S3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd64.sys [2009-09-23 6180832]
S3 MBAMWebAccessControl;MBAMWebAccessControl; \??\C:\Windows\system32\drivers\mwac.sys [2015-06-18 63704]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
S3 upperdev;upperdev; C:\Windows\system32\DRIVERS\usbser_lowerfltx64.sys []
S3 usbscan;USB-Scannertreiber; C:\Windows\system32\DRIVERS\usbscan.sys [2013-07-03 42496]
S3 WinUsb;WinUsb; C:\Windows\system32\drivers\WinUsb.sys [2010-11-20 41984]
S4 klflt;klflt; C:\Windows\system32\DRIVERS\klflt.sys [2014-03-20 115296]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2015-06-12 82112]
R2 AVP;Kaspersky Anti-Virus Service; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe [2013-11-12 214512]
R2 DiagTrack;@%SystemRoot%\system32\UtcResources.dll,-3001; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 MDM;Machine Debug Manager; C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe [2006-10-26 335872]
R2 NVSvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2013-01-18 884512]
R2 SQLWriter;SQL Server VSS Writer; c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe [2008-11-25 153952]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service; C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2013-01-18 383264]
R2 TeamViewer6;TeamViewer 6; C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2011-11-03 2358656]
R2 TomTomHOMEService;TomTomHOMEService; C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe [2013-08-27 93072]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2013-09-11 105144]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2013-09-11 124088]
S2 MBAMService;MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [2015-06-18 1133880]
S2 nvUpdatusService;NVIDIA Update Service Daemon; C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [2013-02-26 1260320]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-06-23 268464]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2015-05-22 114688]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2014-06-28 129976]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2011-07-20 440696]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-05-22 1255736]
S4 aspnet_state;ASP.NET State Service; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2013-09-11 51808]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]

-----------------EOF-----------------

Zdravim

Log neni cely, nicmene havet tam vidim.


Stahnete AdwCleaner https://toolslib.net/downloads/finish/1/ a ulozte ho na plochu.
Ukoncete vsechny programy, jinak to AdwCleaner udela za vas.
Kliknete na nej pravym mysidlem a levym na Spustit jako spravce.
Kliknete na Scan a pockejte, az kontrola dobehne.
Pak kliknete na Cleaning
Program zacne pracovat (muze dojit k restartu pc) a vyplivne log (pripadne bude zde C:\AdwCleaner\AdwCleaner [S?].txt ). Ten mi sem zkopirujte.

Dobry vecer ,diky za bleskovou reakci , log je bohuzel, diky memu operacnimu systemu v nemcine



# AdwCleaner v4.207 - Bericht erstellt 08/07/2015 um 00:20:57
# Aktualisiert 21/06/2015 von Xplode
# Datenbank : 2015-06-21.1 [Lokal]
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (x64)
# Benutzername : jana2732 - JANA2732-STEG
# Gestarted von : C:\Users\jana2732\Desktop\adwcleaner_4.207.exe
# Option : Suchlauf

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Datei Gefunden : C:\Program Files (x86)\Mozilla Firefox\searchplugins\Search_Results.xml
Ordner Gefunden : C:\Program Files (x86)\Babylon
Ordner Gefunden : C:\Program Files (x86)\BearShare Applications
Ordner Gefunden : C:\Program Files (x86)\Search Results Toolbar
Ordner Gefunden : C:\Program Files (x86)\Uniblue
Ordner Gefunden : C:\Program Files (x86)\WinZip Driver Updater
Ordner Gefunden : C:\Users\jana2732\AppData\Local\eSupport.com
Ordner Gefunden : C:\Users\jana2732\AppData\Local\PackageAware
Ordner Gefunden : C:\Users\jana2732\AppData\Local\torch
Ordner Gefunden : C:\Users\jana2732\AppData\LocalLow\Conduit
Ordner Gefunden : C:\Users\jana2732\AppData\Roaming\Uniblue

***** [ Geplante Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Daten Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyServer] - :
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\Conduit
Schlüssel Gefunden : HKCU\Software\Babylon
Schlüssel Gefunden : [x64] HKCU\Software\Babylon
Schlüssel Gefunden : HKLM\SOFTWARE\Babylon
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{AD79BAD6-9504-4F09-ACEC-7B319584A4C1}
Schlüssel Gefunden : HKLM\SOFTWARE\Conduit
Wert Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [DefaultConnectionSettings]
Wert Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [SavedLegacySettings]

***** [ Internetbrowser ] *****

-\\ Internet Explorer v11.0.9600.17840


-\\ Mozilla Firefox v12.0 (de)


-\\ Google Chrome v


*************************

AdwCleaner[R0].txt - [2078 Bytes] - [08/07/2015 00:20:57]

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [2137 Bytes] ##########




# AdwCleaner v4.207 - Bericht erstellt 08/07/2015 um 00:24:07
# Aktualisiert 21/06/2015 von Xplode
# Datenbank : 2015-06-21.1 [Lokal]
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (x64)
# Benutzername : jana2732 - JANA2732-STEG
# Gestarted von : C:\Users\jana2732\Desktop\adwcleaner_4.207.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\Program Files (x86)\Babylon
Ordner Gelöscht : C:\Program Files (x86)\BearShare Applications
Ordner Gelöscht : C:\Program Files (x86)\Search Results Toolbar
Ordner Gelöscht : C:\Program Files (x86)\Uniblue
Ordner Gelöscht : C:\Program Files (x86)\WinZip Driver Updater
Ordner Gelöscht : C:\Users\jana2732\AppData\Local\eSupport.com
Ordner Gelöscht : C:\Users\jana2732\AppData\Local\PackageAware
Ordner Gelöscht : C:\Users\jana2732\AppData\Local\torch
Ordner Gelöscht : C:\Users\jana2732\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\jana2732\AppData\Roaming\Uniblue
Datei Gelöscht : C:\Program Files (x86)\Mozilla Firefox\searchplugins\Search_Results.xml

***** [ Geplante Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{AD79BAD6-9504-4F09-ACEC-7B319584A4C1}
Schlüssel Gelöscht : HKCU\Software\Babylon
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Conduit
Schlüssel Gelöscht : HKLM\SOFTWARE\Babylon
Schlüssel Gelöscht : HKLM\SOFTWARE\Conduit
Daten Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyServer] - :

***** [ Internetbrowser ] *****

-\\ Internet Explorer v11.0.9600.17840


-\\ Mozilla Firefox v12.0 (de)


-\\ Google Chrome v


*************************

AdwCleaner[R0].txt - [2220 Bytes] - [08/07/2015 00:20:57]
AdwCleaner[S0].txt - [1876 Bytes] - [08/07/2015 00:24:07]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1935 Bytes] ##########

To nevadi, s nemcinou si poradim


Udelejte novou kontrolu s MBAM. Test nastavte podle tohoto navodu (cili Vlastni sken vsech disku) http://forum.viry.cz/viewtopic.php?f=29&t=144868 a dejte sem vysledky. Predem nic nemazte, miva obcas falesne detekce

scan jeste bezi, log vlozim zitra, dekuji mockrat a dobrou noc

Jasan, ja uz byl taky v risi snu

Pokud nedate log do 12:00 (to odchazim do prace), budu tu pak az vecer kolem 22:00.
Jestli MBAM neco najde a nebude vam tam prekazet, nezavirejte ho, jen minimalizujte na listu. Jinak byste musela sken zopakovat, aby sly nalezy odstranit.

Dobry vecer, vkladam log z MBAM, ktery mi pred chvili dokoncil kontrolu, drive jsem nemela bohuzel cas , nicmene dnes uz unavou nevydrzim u pc...pro dnesek se loucim, dekuji za vasi podporu a preji dobrou noc



Malwarebytes Anti-Malware
www.malwarebytes.org

Datum skenování: 08.07.2015
Cas skenování: 20:43
Protokol: mbam scan.txt
Správce: Ano

Verze: 2.1.8.1057
Databáze malwaru: v2015.07.08.06
Databáze rootkitu: v2015.07.07.01
Licence: Bezplatná verze
Ochrana proti malwaru: Vypnuto
Ochrana proti škodlivým webovým stránkám: Vypnuto
Ochrana programu: Vypnuto

OS: Windows 7 Service Pack 1
CPU: x64
Souborový systém: NTFS
Uživatel: jana2732

Typ skenu: Vlastní sken
Výsledek: Dokonceno
Prohledaných objektu: 549195
Uplynulý cas: 2 hod, 25 min, 4 sek

Pamet: Zapnuto
Po spuštení: Zapnuto
Souborový systém: Zapnuto
Archivy: Zapnuto
Rootkity: Zapnuto
Heuristika: Zapnuto
PUP: Zapnuto
PUM: Zapnuto

Procesy: 0
(Nenalezeny žádné škodlivé položky)

Moduly: 0
(Nenalezeny žádné škodlivé položky)

Klíce registru: 0
(Nenalezeny žádné škodlivé položky)

Hodnoty registru: 0
(Nenalezeny žádné škodlivé položky)

Data registru: 0
(Nenalezeny žádné škodlivé položky)

Složky: 0
(Nenalezeny žádné škodlivé položky)

Soubory: 0
(Nenalezeny žádné škodlivé položky)

Fyzické sektory: 0
(Nenalezeny žádné škodlivé položky)


(end)

MBAM muzete odinstalovat.

Dejte novy log z RSIT

a k tomu

Dejte logy podle tohoto navodu http://forum.viry.cz/viewtopic.php?f=13&t=133100 - vypnete na chvili antivir, je mozne, ze to bude blokovat jako skodnou, ale pouzivame to porad, jedna se o falesny poplach

Dobry vecer.
Ospravedlnujem sa vam, ze odpisujem az tak neskoro. Bola som na dovolenke a casovo som sa k tomu nedostala.
S mojim priatelom mame pripojene obe pocitace na jednej internetovej sieti. Dnes mal problem pripojit sa na Internet a dostal od poskytovatela internetu oznamenie, v ktorom stalo, ze v nasej sieti je jeden z pocitacou infikovany virusom alebo malwarem, ktory rozsiruje aj do ostatnych pocitacou. Mohli by ste prosim skontrolovat log od môjho priatela na tomto tematu, alebo je nutne zalozit nove?

Nizsie vam posielam svoj log s RSIT...s malickym oneskorenim , dalsie logy poslem zajtra
Dakujem vam za vas obetovany cas.
S pozdravom
Jana


Logfile of random's system information tool 1.10 (written by random/random)
Run by jana2732 at 2015-07-31 21:53:37
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 394 GB (83%) free of 477 GB
Total RAM: 4094 MB (16% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 21:53:44, on 31.07.2015
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.17910)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe
C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avpui.exe
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
C:\Program Files\trend micro\jana2732.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bluewin.ch/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = https://apps-guard.com/akamaiproxy.js
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: myBabylon English Toolbar - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - C:\Program Files (x86)\myBabylon_English\tbmyB1.dll (file missing)
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: ContentBlockerBrowserHelperObject - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll
O2 - BHO: VirtualKeyboardBrowserHelperObject - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll
O2 - BHO: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\OnlineBanking\online_banking_bho.dll
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\UrlAdvisor\klwtbbho.dll
O3 - Toolbar: myBabylon English Toolbar - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - C:\Program Files (x86)\myBabylon_English\tbmyB1.dll (file missing)
O4 - HKLM\..\Run: [OM2_Monitor] "C:\Program Files (x86)\OLYMPUS\OLYMPUS Master 2\FirstStart.exe" /OM
O4 - HKCU\..\Run: [OM2_Monitor] "C:\Program Files (x86)\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" -NoStart
O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETZWERKDIENST')
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Zu Anti-Banner hinzufügen - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ie_banner_deny.htm
O9 - Extra button: Virtuelle Tastatur - {0C4CC089-D306-440D-9772-464E226F6539} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Link-Untersuchung - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\UrlAdvisor\klwtbbho.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Kaspersky Anti-Virus Service (AVP) - Kaspersky Lab ZAO - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: TeamViewer 6 (TeamViewer6) - TeamViewer GmbH - C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe
O23 - Service: TomTomHOMEService - TomTom - C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 8793 bytes

======Listing Processes======



\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
"C:\Windows\system32\nvvsvc.exe"
"C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe"
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe"
C:\Windows\system32\nvvsvc.exe -session -first
"C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe" -r
C:\Windows\System32\svchost.exe -k utcsvc
"C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe"
"c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe"
"taskhost.exe"
"C:\Windows\system32\Dwm.exe"
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe"
"C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe"
C:\Windows\Explorer.EXE
"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe"
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-73ebabb6-7adc-4313-bb57-0f9213961db0 -SystemEventPortName:HostProcess-2bfe7964-f719-484a-8c5f-cbe6ba81e694 -IoCancelEventPortName:HostProcess-3bccb206-fc6c-40c2-9025-c343fd74df7b -NonStateChangingEventPortName:HostProcess-d2a65805-8986-43a6-b4dd-f6164217eef3 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:0ee62187-e615-4415-93f8-437b1f5c556a -DeviceGroupId:WpdFsGroup
C:\Windows\servicing\TrustedInstaller.exe
"C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe"
"C:/Program Files/NVIDIA Corporation/Display/nvtray.exe" -user_has_logged_in 1
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Windows\system32\GWX\GWX.exe"
"C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avpui.exe" -hidden /prefetch:1
C:\Windows\System32\svchost.exe -k secsvcs
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

"C:\Program Files\Windows NT\Accessories\WORDPAD.EXE" "C:\rsit\info.txt"
"C:\Program Files\Internet Explorer\iexplore.exe"
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3236 CREDAT:1316105 /prefetch:2
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1013351676-1538886928-1562305135-10016_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1013351676-1538886928-1562305135-10016 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
"C:\Windows\system32\SearchFilterHost.exe" 0 512 516 524 65536 520
"C:\Users\jana2732\Desktop\RSITx64.exe"
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe7_ Global\UsGthrCtrlFltPipeMssGthrPipe7 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exeARE
\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9E6D0D23-3D72-4A94-AE1F-2D167624E3D9}]
Safe Money Plugin - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll [2013-12-18 550080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E33CF602-D945-461A-83F0-819F76A199F8}]
URL Advisor Plugin - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll [2014-02-17 996544]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-09-23 60568]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F}]
Content Blocker Plugin - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll [2013-11-12 655040]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{73455575-E40C-433C-9784-C78DC7761455}]
Virtual Keyboard Plugin - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll [2014-12-17 1265448]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9E6D0D23-3D72-4A94-AE1F-2D167624E3D9}]
Safe Money Plugin - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\OnlineBanking\online_banking_bho.dll [2013-12-18 455360]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E33CF602-D945-461A-83F0-819F76A199F8}]
URL Advisor Plugin - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\UrlAdvisor\klwtbbho.dll [2014-02-17 798912]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - myBabylon English Toolbar - C:\Program Files (x86)\myBabylon_English\tbmyB1.dll []

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2009-01-13 6963232]
"Skytel"=C:\Program Files\Realtek\Audio\HDA\Skytel.exe [2009-01-13 1833504]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2009-09-23 165912]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2009-09-23 385560]
"Persistence"=C:\Windows\system32\igfxpers.exe [2009-09-23 363544]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"OM2_Monitor"=C:\Program Files (x86)\OLYMPUS\OLYMPUS Master 2\MMonitor.exe [2009-11-25 95632]
"TomTomHOME.exe"=C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [2013-08-27 248208]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-07-07 998104]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [2011-03-24 49208]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"OM2_Monitor"=C:\Program Files (x86)\OLYMPUS\OLYMPUS Master 2\FirstStart.exe [2009-11-25 54672]
""= []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2009-09-23 261120]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0
"NoDriveTypeAutoRun"=28

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"wave4"=wdmaud.drv
"midi4"=wdmaud.drv
"mixer4"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2015-07-30 10:48:45 ----D---- C:\Program Files\Common Files\AV
2015-07-28 21:44:12 ----A---- C:\Windows\system32\invagent.dll
2015-07-28 21:44:12 ----A---- C:\Windows\system32\generaltel.dll
2015-07-28 21:44:12 ----A---- C:\Windows\system32\devinv.dll
2015-07-28 21:44:12 ----A---- C:\Windows\system32\appraiser.dll
2015-07-28 21:44:12 ----A---- C:\Windows\system32\aeinv.dll
2015-07-28 21:44:12 ----A---- C:\Windows\system32\acmigration.dll
2015-07-28 21:44:11 ----A---- C:\Windows\system32\CompatTelRunner.exe
2015-07-28 21:44:11 ----A---- C:\Windows\system32\aepdu.dll
2015-07-21 07:07:30 ----A---- C:\Windows\SYSWOW64\lpk.dll
2015-07-21 07:07:30 ----A---- C:\Windows\SYSWOW64\fontsub.dll
2015-07-21 07:07:30 ----A---- C:\Windows\SYSWOW64\dciman32.dll
2015-07-21 07:07:30 ----A---- C:\Windows\SYSWOW64\atmlib.dll
2015-07-21 07:07:30 ----A---- C:\Windows\SYSWOW64\atmfd.dll
2015-07-21 07:07:30 ----A---- C:\Windows\system32\lpk.dll
2015-07-21 07:07:30 ----A---- C:\Windows\system32\fontsub.dll
2015-07-21 07:07:30 ----A---- C:\Windows\system32\dciman32.dll
2015-07-21 07:07:30 ----A---- C:\Windows\system32\atmlib.dll
2015-07-21 07:07:30 ----A---- C:\Windows\system32\atmfd.dll
2015-07-14 23:51:44 ----A---- C:\Windows\SYSWOW64\cewmdm.dll
2015-07-14 23:51:44 ----A---- C:\Windows\system32\cewmdm.dll
2015-07-14 23:51:39 ----A---- C:\Windows\SYSWOW64\wuwebv.dll
2015-07-14 23:51:39 ----A---- C:\Windows\SYSWOW64\wups.dll
2015-07-14 23:51:39 ----A---- C:\Windows\SYSWOW64\wudriver.dll
2015-07-14 23:51:39 ----A---- C:\Windows\SYSWOW64\wuapp.exe
2015-07-14 23:51:39 ----A---- C:\Windows\SYSWOW64\wuapi.dll
2015-07-14 23:51:39 ----A---- C:\Windows\system32\wuwebv.dll
2015-07-14 23:51:39 ----A---- C:\Windows\system32\wups2.dll
2015-07-14 23:51:39 ----A---- C:\Windows\system32\wups.dll
2015-07-14 23:51:39 ----A---- C:\Windows\system32\wudriver.dll
2015-07-14 23:51:39 ----A---- C:\Windows\system32\wucltux.dll
2015-07-14 23:51:39 ----A---- C:\Windows\system32\wuauclt.exe
2015-07-14 23:51:39 ----A---- C:\Windows\system32\wuapp.exe
2015-07-14 23:51:39 ----A---- C:\Windows\system32\wuapi.dll
2015-07-14 23:51:39 ----A---- C:\Windows\system32\wu.upgrade.ps.dll
2015-07-14 23:51:39 ----A---- C:\Windows\system32\WinSetupUI.dll
2015-07-14 23:51:38 ----A---- C:\Windows\system32\wuaueng.dll
2015-07-14 23:51:18 ----A---- C:\Windows\system32\win32k.sys
2015-07-14 23:51:13 ----A---- C:\Windows\SYSWOW64\gdi32.dll
2015-07-14 23:51:13 ----A---- C:\Windows\system32\gdi32.dll
2015-07-14 23:51:00 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2015-07-14 23:51:00 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2015-07-14 23:51:00 ----A---- C:\Windows\SYSWOW64\ieetwproxystub.dll
2015-07-14 23:51:00 ----A---- C:\Windows\system32\ieetwproxystub.dll
2015-07-14 23:51:00 ----A---- C:\Windows\system32\ieetwcollector.exe
2015-07-14 23:50:59 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2015-07-14 23:50:59 ----A---- C:\Windows\SYSWOW64\MshtmlDac.dll
2015-07-14 23:50:59 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2015-07-14 23:50:59 ----A---- C:\Windows\SYSWOW64\JavaScriptCollectionAgent.dll
2015-07-14 23:50:59 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2015-07-14 23:50:59 ----A---- C:\Windows\SYSWOW64\dxtrans.dll
2015-07-14 23:50:59 ----A---- C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-07-14 23:50:59 ----A---- C:\Windows\system32\iernonce.dll
2015-07-14 23:50:59 ----A---- C:\Windows\system32\ie4uinit.exe
2015-07-14 23:50:57 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2015-07-14 23:50:57 ----A---- C:\Windows\SYSWOW64\jscript.dll
2015-07-14 23:50:57 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2015-07-14 23:50:57 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2015-07-14 23:50:57 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll
2015-07-14 23:50:57 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe
2015-07-14 23:50:57 ----A---- C:\Windows\system32\ieetwcollectorres.dll
2015-07-14 23:50:57 ----A---- C:\Windows\system32\iedkcs32.dll
2015-07-14 23:50:56 ----A---- C:\Windows\SYSWOW64\dxtmsft.dll
2015-07-14 23:50:56 ----A---- C:\Windows\system32\msfeeds.dll
2015-07-14 23:50:56 ----A---- C:\Windows\system32\dxtrans.dll
2015-07-14 23:50:55 ----A---- C:\Windows\system32\iesetup.dll
2015-07-14 23:50:55 ----A---- C:\Windows\system32\ieapfltr.dll
2015-07-14 23:50:54 ----A---- C:\Windows\SYSWOW64\mshtmlmedia.dll
2015-07-14 23:50:54 ----A---- C:\Windows\system32\vbscript.dll
2015-07-14 23:50:53 ----A---- C:\Windows\SYSWOW64\wininet.dll
2015-07-14 23:50:53 ----A---- C:\Windows\SYSWOW64\msrating.dll
2015-07-14 23:50:53 ----A---- C:\Windows\system32\jsproxy.dll
2015-07-14 23:50:53 ----A---- C:\Windows\system32\ieUnatt.exe
2015-07-14 23:50:52 ----A---- C:\Windows\system32\dxtmsft.dll
2015-07-14 23:50:51 ----A---- C:\Windows\system32\mshtmlmedia.dll
2015-07-14 23:50:51 ----A---- C:\Windows\system32\mshtmled.dll
2015-07-14 23:50:51 ----A---- C:\Windows\system32\jscript.dll
2015-07-14 23:50:50 ----A---- C:\Windows\system32\wininet.dll
2015-07-14 23:50:47 ----A---- C:\Windows\system32\msrating.dll
2015-07-14 23:50:47 ----A---- C:\Windows\system32\MshtmlDac.dll
2015-07-14 23:50:41 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2015-07-14 23:50:41 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2015-07-14 23:50:40 ----A---- C:\Windows\SYSWOW64\ieui.dll
2015-07-14 23:50:40 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2015-07-14 23:50:39 ----A---- C:\Windows\system32\urlmon.dll
2015-07-14 23:50:39 ----A---- C:\Windows\system32\ieui.dll
2015-07-14 23:50:39 ----A---- C:\Windows\system32\ieframe.dll
2015-07-14 23:50:38 ----A---- C:\Windows\system32\mshtml.dll
2015-07-14 23:50:37 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2015-07-14 23:50:37 ----A---- C:\Windows\system32\iertutil.dll
2015-07-14 23:50:35 ----A---- C:\Windows\system32\jscript9diag.dll
2015-07-14 23:50:35 ----A---- C:\Windows\system32\jscript9.dll
2015-07-14 23:50:34 ----A---- C:\Windows\SYSWOW64\jscript9diag.dll
2015-07-14 23:50:34 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2015-07-14 23:50:28 ----A---- C:\Windows\SYSWOW64\ole32.dll
2015-07-14 23:50:28 ----A---- C:\Windows\system32\ole32.dll
2015-07-14 23:50:21 ----A---- C:\Windows\SYSWOW64\cryptsvc.dll
2015-07-14 23:50:21 ----A---- C:\Windows\SYSWOW64\crypt32.dll
2015-07-14 23:50:21 ----A---- C:\Windows\system32\cryptsvc.dll
2015-07-14 23:50:21 ----A---- C:\Windows\system32\crypt32.dll
2015-07-14 23:50:20 ----A---- C:\Windows\SYSWOW64\wintrust.dll
2015-07-14 23:50:20 ----A---- C:\Windows\SYSWOW64\cryptnet.dll
2015-07-14 23:50:20 ----A---- C:\Windows\system32\wintrust.dll
2015-07-14 23:50:20 ----A---- C:\Windows\system32\cryptnet.dll
2015-07-14 23:49:22 ----A---- C:\Windows\system32\rpcrt4.dll
2015-07-14 23:49:22 ----A---- C:\Windows\system32\kerberos.dll
2015-07-14 23:49:21 ----A---- C:\Windows\SYSWOW64\rpcrt4.dll
2015-07-14 23:49:21 ----A---- C:\Windows\SYSWOW64\msv1_0.dll
2015-07-14 23:49:21 ----A---- C:\Windows\SYSWOW64\kerberos.dll
2015-07-14 23:49:21 ----A---- C:\Windows\system32\msv1_0.dll
2015-07-14 23:49:21 ----A---- C:\Windows\system32\lsasrv.dll
2015-07-14 23:49:21 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2015-07-14 23:49:21 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2015-07-14 23:49:21 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2015-07-14 23:49:21 ----A---- C:\Windows\system32\drivers\ksecpkg.sys
2015-07-14 23:49:20 ----A---- C:\Windows\system32\drivers\ksecdd.sys
2015-07-14 23:49:20 ----A---- C:\Windows\system32\cryptbase.dll
2015-07-14 23:49:19 ----A---- C:\Windows\SYSWOW64\TSpkg.dll
2015-07-14 23:49:19 ----A---- C:\Windows\SYSWOW64\schannel.dll
2015-07-14 23:49:19 ----A---- C:\Windows\SYSWOW64\ncrypt.dll
2015-07-14 23:49:19 ----A---- C:\Windows\SYSWOW64\cryptbase.dll
2015-07-14 23:49:19 ----A---- C:\Windows\system32\wdigest.dll
2015-07-14 23:49:19 ----A---- C:\Windows\system32\schannel.dll
2015-07-14 23:49:16 ----A---- C:\Windows\system32\TSpkg.dll
2015-07-14 23:49:16 ----A---- C:\Windows\system32\sspicli.dll
2015-07-14 23:49:16 ----A---- C:\Windows\system32\ncrypt.dll
2015-07-14 23:49:15 ----A---- C:\Windows\SYSWOW64\wdigest.dll
2015-07-14 23:49:15 ----A---- C:\Windows\SYSWOW64\auditpol.exe
2015-07-14 23:49:15 ----A---- C:\Windows\system32\sspisrv.dll
2015-07-14 23:49:15 ----A---- C:\Windows\system32\lsass.exe
2015-07-14 23:49:15 ----A---- C:\Windows\system32\credssp.dll
2015-07-14 23:49:15 ----A---- C:\Windows\system32\auditpol.exe
2015-07-14 23:49:14 ----A---- C:\Windows\SYSWOW64\sspicli.dll
2015-07-14 23:49:14 ----A---- C:\Windows\SYSWOW64\secur32.dll
2015-07-14 23:49:14 ----A---- C:\Windows\SYSWOW64\credssp.dll
2015-07-14 23:49:14 ----A---- C:\Windows\system32\secur32.dll
2015-07-14 23:49:13 ----A---- C:\Windows\SYSWOW64\msaudite.dll
2015-07-14 23:49:13 ----A---- C:\Windows\SYSWOW64\adtschema.dll
2015-07-14 23:49:13 ----A---- C:\Windows\system32\msaudite.dll
2015-07-14 23:49:13 ----A---- C:\Windows\system32\adtschema.dll
2015-07-14 23:49:09 ----A---- C:\Windows\SYSWOW64\msobjs.dll
2015-07-14 23:49:09 ----A---- C:\Windows\system32\msobjs.dll
2015-07-14 23:47:10 ----A---- C:\Windows\SYSWOW64\FlashPlayerInstaller.exe
2015-07-14 23:46:34 ----A---- C:\Windows\SYSWOW64\msi.dll
2015-07-14 23:46:34 ----A---- C:\Windows\system32\msi.dll
2015-07-14 23:46:34 ----A---- C:\Windows\system32\authui.dll
2015-07-14 23:46:33 ----A---- C:\Windows\SYSWOW64\msihnd.dll
2015-07-14 23:46:33 ----A---- C:\Windows\SYSWOW64\msiexec.exe
2015-07-14 23:46:33 ----A---- C:\Windows\SYSWOW64\authui.dll
2015-07-14 23:46:33 ----A---- C:\Windows\system32\msihnd.dll
2015-07-14 23:46:33 ----A---- C:\Windows\system32\msiexec.exe
2015-07-14 23:46:33 ----A---- C:\Windows\system32\consent.exe
2015-07-14 23:46:32 ----A---- C:\Windows\SYSWOW64\msimsg.dll
2015-07-14 23:46:32 ----A---- C:\Windows\system32\msimsg.dll
2015-07-14 23:46:32 ----A---- C:\Windows\system32\appinfo.dll
2015-07-08 00:20:07 ----D---- C:\AdwCleaner
2015-07-07 22:24:32 ----D---- C:\Program Files\trend micro

======List of files/folders modified in the last 1 month======

2015-07-31 21:53:42 ----D---- C:\Windows\Temp
2015-07-31 21:48:11 ----D---- C:\rsit
2015-07-31 21:41:02 ----D---- C:\Windows\debug
2015-07-31 21:41:01 ----D---- C:\Windows
2015-07-31 21:25:19 ----D---- C:\ProgramData\Kaspersky Lab
2015-07-31 21:25:06 ----D---- C:\Windows\system32\config
2015-07-31 21:24:48 ----SHD---- C:\System Volume Information
2015-07-31 21:24:44 ----D---- C:\ProgramData\NVIDIA
2015-07-31 21:24:38 ----RD---- C:\Program Files (x86)
2015-07-31 21:22:57 ----D---- C:\Windows\system32\drivers
2015-07-30 10:48:45 ----D---- C:\Program Files\Common Files
2015-07-30 00:01:15 ----SHD---- C:\Windows\Installer
2015-07-30 00:01:15 ----D---- C:\Config.Msi
2015-07-29 00:42:11 ----SD---- C:\Windows\system32\CompatTel
2015-07-29 00:42:09 ----D---- C:\Windows\System32
2015-07-28 21:41:47 ----D---- C:\Windows\winsxs
2015-07-28 21:41:08 ----D---- C:\Windows\SoftwareDistribution
2015-07-25 10:29:06 ----SD---- C:\Windows\system32\GWX
2015-07-21 12:22:20 ----D---- C:\Windows\SysWOW64
2015-07-17 11:33:33 ----SD---- C:\Windows\SYSWOW64\GWX
2015-07-15 11:27:55 ----D---- C:\Windows\SYSWOW64\de-DE
2015-07-15 11:27:55 ----D---- C:\Windows\system32\de-DE
2015-07-15 11:27:55 ----D---- C:\Windows\PolicyDefinitions
2015-07-15 11:27:54 ----D---- C:\Program Files (x86)\Internet Explorer
2015-07-15 11:27:53 ----D---- C:\Windows\SYSWOW64\en-US
2015-07-15 11:27:53 ----D---- C:\Windows\system32\en-US
2015-07-15 11:27:53 ----D---- C:\Program Files\Internet Explorer
2015-07-15 11:27:47 ----D---- C:\Windows\system32\wbem
2015-07-15 11:27:47 ----D---- C:\Windows\system32\appraiser
2015-07-15 11:27:47 ----D---- C:\Windows\AppPatch
2015-07-15 11:19:15 ----D---- C:\Windows\system32\Tasks
2015-07-15 00:05:18 ----D---- C:\ProgramData\Microsoft Help
2015-07-14 23:56:44 ----D---- C:\Windows\system32\MRT
2015-07-14 23:48:29 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe
2015-07-14 23:41:39 ----D---- C:\Windows\system32\catroot2
2015-07-14 18:19:53 ----D---- C:\Windows\Tasks
2015-07-14 18:19:53 ----D---- C:\Windows\system32\wfp
2015-07-14 18:19:53 ----D---- C:\Windows\system32\DriverStore
2015-07-14 18:19:41 ----D---- C:\Windows\registration
2015-07-07 22:24:32 ----RD---- C:\Program Files
2015-07-07 22:03:53 ----D---- C:\Windows\system32\NDF
2015-07-03 08:43:04 ----A---- C:\Windows\system32\MRT.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 kl1;kl1; C:\Windows\system32\DRIVERS\kl1.sys [2013-11-12 458336]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 213888]
R1 KLIF;Kaspersky Lab Driver; C:\Windows\system32\DRIVERS\klif.sys [2014-03-20 625248]
R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter; C:\Windows\system32\DRIVERS\klim6.sys [2013-11-12 29792]
R1 klpd;klpd; C:\Windows\system32\DRIVERS\klpd.sys [2013-04-12 15456]
R1 kltdi;kltdi; C:\Windows\system32\DRIVERS\kltdi.sys [2013-05-14 55904]
R1 kneps;kneps; C:\Windows\system32\DRIVERS\kneps.sys [2013-12-18 178272]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2009-01-13 1683104]
R3 klkbdflt;Kaspersky Lab KLKBDFLT; C:\Windows\system32\DRIVERS\klkbdflt.sys [2014-02-17 29280]
R3 klmouflt;Kaspersky Lab KLMOUFLT; C:\Windows\system32\DRIVERS\klmouflt.sys [2013-11-12 29280]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\Windows\system32\drivers\nvhda64v.sys [2011-03-04 174184]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt64win7.sys [2009-03-01 187392]
S1 SASDIFSV;SASDIFSV; \??\C:\Users\jana2732\AppData\Local\Temp\SAS_SelfExtract\SASDIFSV64.SYS []
S1 SASKUTIL;SASKUTIL; \??\C:\Users\jana2732\AppData\Local\Temp\SAS_SelfExtract\SASKUTIL64.SYS []
S3 e1express;Intel(R) PRO/1000 PCI Express-Netzwerkverbindungstreiber; C:\Windows\system32\DRIVERS\e1e6032e.sys [2009-06-10 278016]
S3 gdrv;gdrv; \??\C:\Windows\gdrv.sys [2009-10-06 24104]
S3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd64.sys [2009-09-23 6180832]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
S3 upperdev;upperdev; C:\Windows\system32\DRIVERS\usbser_lowerfltx64.sys []
S3 usbscan;USB-Scannertreiber; C:\Windows\system32\DRIVERS\usbscan.sys [2013-07-03 42496]
S3 WinUsb;WinUsb; C:\Windows\system32\drivers\WinUsb.sys [2010-11-20 41984]
S4 klflt;klflt; C:\Windows\system32\DRIVERS\klflt.sys [2014-03-20 115296]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2015-07-07 82128]
R2 AVP;Kaspersky Anti-Virus Service; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe [2013-11-12 214512]
R2 DiagTrack;@%SystemRoot%\system32\UtcResources.dll,-3001; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 MDM;Machine Debug Manager; C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe [2006-10-26 335872]
R2 NVSvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2013-01-18 884512]
R2 SQLWriter;SQL Server VSS Writer; c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe [2008-11-25 153952]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service; C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2013-01-18 383264]
R2 TeamViewer6;TeamViewer 6; C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2011-11-03 2358656]
R2 TomTomHOMEService;TomTomHOMEService; C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe [2013-08-27 93072]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2013-09-11 105144]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2013-09-11 124088]
S2 nvUpdatusService;NVIDIA Update Service Daemon; C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [2013-02-26 1260320]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-07-14 268976]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2015-06-20 114688]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2014-06-28 129976]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2011-07-20 440696]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-05-22 1255736]
S4 aspnet_state;ASP.NET State Service; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2013-09-11 51808]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]

-----------------EOF-----------------




Tu je log z FRST a v prilohe Addition.txt v archive rar.


Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:30-07-2015
durchgeführt von jana2732 (Administrator) auf JANA2732-STEG (31-07-2015 23:34:34)
Gestartet von C:\Users\jana2732\Desktop
Geladene Profile: jana2732 (Verfügbare Profile: jana2732 & UpdatusUser)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: IE)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\VS7DEBUG\mdm.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avpui.exe
(Microsoft Corporation) C:\Program Files\Windows NT\Accessories\wordpad.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(forum.viry.cz) C:\Users\jana2732\Desktop\FRSTLauncher.exe


==================== Registry (Nicht auf der Ausnahmeliste) ==================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [6963232 2009-01-13] (Realtek Semiconductor)
HKLM\...\Run: [Skytel] => C:\Program Files\Realtek\Audio\HDA\Skytel.exe [1833504 2009-01-13] (Realtek Semiconductor Corp.)
HKLM-x32\...\Run: [OM2_Monitor] => C:\Program Files (x86)\OLYMPUS\OLYMPUS Master 2\FirstStart.exe [54672 2009-11-25] (OLYMPUS IMAGING CORP.)
HKLM-x32\...\Run: [] => [X]
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-1013351676-1538886928-1562305135-1001\...\Run: [OM2_Monitor] => C:\Program Files (x86)\OLYMPUS\OLYMPUS Master 2\MMonitor.exe [95632 2009-11-25] (OLYMPUS IMAGING CORP.)
HKU\S-1-5-21-1013351676-1538886928-1562305135-1001\...\Run: [TomTomHOME.exe] => C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248208 2013-08-27] (TomTom)

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt..)

AutoConfigURL: [S-1-5-21-1013351676-1538886928-1562305135-1001] => https://apps-guard.com/akamaiproxy.js
HKU\S-1-5-21-1013351676-1538886928-1562305135-1001\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bluewin.ch/
HKU\S-1-5-21-1013351676-1538886928-1562305135-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://ch.msn.com/default.aspx
URLSearchHook: HKLM-x32 - myBabylon English Toolbar - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - C:\Program Files (x86)\myBabylon_English\tbmyB1.dll Keine Datei
URLSearchHook: HKU\S-1-5-21-1013351676-1538886928-1562305135-1001 - myBabylon English Toolbar - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - C:\Program Files (x86)\myBabylon_English\tbmyB1.dll Keine Datei
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll [2013-11-12] (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll [2014-12-17] (Kaspersky Lab ZAO)
BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll [2013-12-18] (Kaspersky Lab ZAO)
BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll [2014-02-17] (Kaspersky Lab ZAO)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-09-23] (Adobe Systems Incorporated)
BHO-x32: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll [2013-11-12] (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll [2014-12-17] (Kaspersky Lab ZAO)
BHO-x32: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\OnlineBanking\online_banking_bho.dll [2013-12-18] (Kaspersky Lab ZAO)
BHO-x32: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\UrlAdvisor\klwtbbho.dll [2014-02-17] (Kaspersky Lab ZAO)
Toolbar: HKLM-x32 - myBabylon English Toolbar - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - C:\Program Files (x86)\myBabylon_English\tbmyB1.dll Keine Datei
Toolbar: HKU\S-1-5-21-1013351676-1538886928-1562305135-1001 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - Keine Datei
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/s ... wflash.cab
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{CDE7220C-EDB2-481D-AEDA-955A416D7E54}: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\jana2732\AppData\Roaming\Mozilla\Firefox\Profiles\s0no0se6.default
FF NetworkProxy: "autoconfig_url", "https://apps-guard.com/akamaiproxy.js"
FF NetworkProxy: "type", 2
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2013-01-18] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2013-01-18] (NVIDIA Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-06-29] (Adobe Systems Inc.)
FF Extension: Search-Results Toolbar - C:\Users\jana2732\AppData\Roaming\Mozilla\Firefox\Profiles\s0no0se6.default\Extensions\{15a0413e-9f45-4d45-9a75-2c20b15b5b51} [2013-05-24]
FF HKLM-x32\...\Firefox\Extensions: [url_advisor@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com [2013-11-12]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com [2013-11-12]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: Dangerous Websites Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com [2013-11-12]
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com
FF Extension: Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com [2013-11-12]
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com
FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com [2013-11-12]

Chrome:
=======
CHR Profile: C:\Users\jana2732\AppData\Local\Google\Chrome\User Data\Default
CHR HKLM\...\Chrome\Extension: [blbkdnmdcafmfhinpmnlhhddbepgkeaa] - https://chrome.google.com/webstore/deta ... ddbepgkeaa
CHR HKLM-x32\...\Chrome\Extension: [blbkdnmdcafmfhinpmnlhhddbepgkeaa] - https://chrome.google.com/webstore/deta ... ddbepgkeaa
CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\urladvisor.crx [2013-06-28]
CHR HKLM-x32\...\Chrome\Extension: [hakdifolhalapjijoafobooafbilfakh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\online_banking_chrome.crx [2013-06-28]
CHR HKLM-x32\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\content_blocker_chrome.crx [2013-06-28]
CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\virtkbd.crx [2013-06-28]
CHR HKLM-x32\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\ab.crx [2013-06-28]

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe [214512 2013-11-12] (Kaspersky Lab ZAO)
R2 MDM; C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe [335872 2006-10-26] (Microsoft Corporation) [Datei ist nicht signiert]
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [458336 2013-11-12] (Kaspersky Lab ZAO)
S4 klflt; C:\Windows\System32\DRIVERS\klflt.sys [115296 2014-03-20] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [625248 2014-03-20] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [29792 2013-11-12] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29280 2014-02-17] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-11-12] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55904 2013-05-14] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178272 2013-12-18] (Kaspersky Lab ZAO)
S1 SASDIFSV; \??\C:\Users\jana2732\AppData\Local\Temp\SAS_SelfExtract\SASDIFSV64.SYS [X]
S1 SASKUTIL; \??\C:\Users\jana2732\AppData\Local\Temp\SAS_SelfExtract\SASKUTIL64.SYS [X]
S3 upperdev; system32\DRIVERS\usbser_lowerfltx64.sys [X]

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat: Erstellte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2015-07-31 23:34 - 2015-07-31 23:35 - 00013630 _____ C:\Users\jana2732\Desktop\FRST.txt
2015-07-31 23:34 - 2015-07-31 23:34 - 00000000 ____D C:\FRST
2015-07-31 23:23 - 2015-07-31 23:23 - 02168832 _____ (Farbar) C:\Users\jana2732\Desktop\FRST64.exe
2015-07-31 23:22 - 2015-07-31 23:22 - 00112640 _____ (forum.viry.cz) C:\Users\jana2732\Downloads\FRSTLauncher.exe
2015-07-31 23:22 - 2015-07-31 23:22 - 00112640 _____ (forum.viry.cz) C:\Users\jana2732\Desktop\FRSTLauncher.exe
2015-07-30 10:48 - 2015-07-30 10:48 - 00000000 ____D C:\Program Files\Common Files\AV
2015-07-28 21:44 - 2015-07-25 20:07 - 00017856 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2015-07-28 21:44 - 2015-07-25 20:04 - 00765440 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-07-28 21:44 - 2015-07-25 20:04 - 00726528 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-07-28 21:44 - 2015-07-25 20:03 - 01085440 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-07-28 21:44 - 2015-07-25 20:03 - 00433664 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-07-28 21:44 - 2015-07-25 20:03 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-07-28 21:44 - 2015-07-25 20:03 - 00067584 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-07-28 21:44 - 2015-07-25 19:55 - 01145856 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-07-21 07:07 - 2015-07-15 05:19 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2015-07-21 07:07 - 2015-07-15 05:19 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-07-21 07:07 - 2015-07-15 05:19 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2015-07-21 07:07 - 2015-07-15 05:19 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2015-07-21 07:07 - 2015-07-15 04:55 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2015-07-21 07:07 - 2015-07-15 04:55 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-07-21 07:07 - 2015-07-15 04:55 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2015-07-21 07:07 - 2015-07-15 04:54 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2015-07-21 07:07 - 2015-07-15 03:59 - 00372224 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-07-21 07:07 - 2015-07-15 03:52 - 00299008 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-07-14 23:51 - 2015-07-09 19:58 - 03154944 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-07-14 23:51 - 2015-07-09 19:58 - 02603008 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-07-14 23:51 - 2015-07-09 19:58 - 00696320 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-07-14 23:51 - 2015-07-09 19:58 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-07-14 23:51 - 2015-07-09 19:58 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-07-14 23:51 - 2015-07-09 19:58 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-07-14 23:51 - 2015-07-09 19:58 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-07-14 23:51 - 2015-07-09 19:58 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-07-14 23:51 - 2015-07-09 19:58 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-07-14 23:51 - 2015-07-09 19:58 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-07-14 23:51 - 2015-07-09 19:58 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2015-07-14 23:51 - 2015-07-09 19:43 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2015-07-14 23:51 - 2015-07-09 19:43 - 00173056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2015-07-14 23:51 - 2015-07-09 19:43 - 00093184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2015-07-14 23:51 - 2015-07-09 19:43 - 00030208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2015-07-14 23:51 - 2015-07-09 19:42 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2015-07-14 23:51 - 2015-06-25 10:57 - 03207168 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-07-14 23:51 - 2015-06-20 21:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-07-14 23:51 - 2015-06-20 21:34 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-07-14 23:51 - 2015-06-19 20:24 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-07-14 23:51 - 2015-06-19 20:16 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-07-14 23:51 - 2015-06-19 19:52 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-07-14 23:51 - 2015-06-17 19:47 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2015-07-14 23:51 - 2015-06-17 19:37 - 00312320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2015-07-14 23:51 - 2015-06-02 02:07 - 00254976 _____ (Microsoft Corporation) C:\Windows\system32\cewmdm.dll
2015-07-14 23:51 - 2015-06-02 01:47 - 00210432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cewmdm.dll
2015-07-14 23:50 - 2015-07-04 20:07 - 02087424 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2015-07-14 23:50 - 2015-07-04 19:48 - 01414656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2015-07-14 23:50 - 2015-07-02 23:21 - 19877376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-07-14 23:50 - 2015-07-02 23:08 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-07-14 23:50 - 2015-07-02 22:50 - 02279424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-07-14 23:50 - 2015-07-02 22:49 - 25193984 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-07-14 23:50 - 2015-07-02 22:46 - 00479232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-07-14 23:50 - 2015-07-02 22:40 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-07-14 23:50 - 2015-07-02 22:23 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-07-14 23:50 - 2015-07-02 22:19 - 12855296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-07-14 23:50 - 2015-07-02 22:12 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-07-14 23:50 - 2015-07-02 21:55 - 01310720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-07-14 23:50 - 2015-07-02 21:20 - 14453248 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-07-14 23:50 - 2015-07-02 20:59 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-07-14 23:50 - 2015-06-27 04:47 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-07-14 23:50 - 2015-06-27 04:43 - 05923840 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-07-14 23:50 - 2015-06-27 03:58 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-07-14 23:50 - 2015-06-27 03:39 - 04520448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-07-14 23:50 - 2015-06-25 20:09 - 00389832 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-07-14 23:50 - 2015-06-25 19:43 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-07-14 23:50 - 2015-06-20 22:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-07-14 23:50 - 2015-06-20 21:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-07-14 23:50 - 2015-06-20 21:49 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-07-14 23:50 - 2015-06-20 21:49 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-07-14 23:50 - 2015-06-20 21:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-07-14 23:50 - 2015-06-20 21:40 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-07-14 23:50 - 2015-06-20 21:39 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-07-14 23:50 - 2015-06-20 21:34 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-07-14 23:50 - 2015-06-20 21:34 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-07-14 23:50 - 2015-06-20 21:25 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-07-14 23:50 - 2015-06-20 21:21 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-07-14 23:50 - 2015-06-20 21:13 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-07-14 23:50 - 2015-06-20 21:08 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-07-14 23:50 - 2015-06-20 21:07 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-07-14 23:50 - 2015-06-20 21:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-07-14 23:50 - 2015-06-20 20:48 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-07-14 23:50 - 2015-06-20 20:48 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-07-14 23:50 - 2015-06-20 20:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-07-14 23:50 - 2015-06-20 20:46 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-07-14 23:50 - 2015-06-20 20:26 - 02427392 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-07-14 23:50 - 2015-06-20 20:02 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-07-14 23:50 - 2015-06-19 20:25 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-07-14 23:50 - 2015-06-19 20:25 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-07-14 23:50 - 2015-06-19 20:24 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-07-14 23:50 - 2015-06-19 20:23 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-07-14 23:50 - 2015-06-19 20:17 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-07-14 23:50 - 2015-06-19 20:13 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-07-14 23:50 - 2015-06-19 20:13 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-07-14 23:50 - 2015-06-19 20:03 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-07-14 23:50 - 2015-06-19 19:57 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-07-14 23:50 - 2015-06-19 19:53 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-07-14 23:50 - 2015-06-19 19:51 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-07-14 23:50 - 2015-06-19 19:40 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-07-14 23:50 - 2015-06-19 19:40 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-07-14 23:50 - 2015-06-19 19:39 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-07-14 23:50 - 2015-06-19 19:15 - 01951232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-07-14 23:50 - 2015-06-19 19:11 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-07-14 23:50 - 2015-04-27 21:23 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-07-14 23:50 - 2015-04-27 21:23 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2015-07-14 23:50 - 2015-04-27 21:23 - 00188416 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2015-07-14 23:50 - 2015-04-27 21:23 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2015-07-14 23:50 - 2015-04-27 21:05 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2015-07-14 23:50 - 2015-04-27 21:04 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2015-07-14 23:50 - 2015-04-27 21:04 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2015-07-14 23:50 - 2015-04-27 21:04 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2015-07-14 23:49 - 2015-07-01 22:56 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-07-14 23:49 - 2015-07-01 22:56 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-07-14 23:49 - 2015-07-01 22:49 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-07-14 23:49 - 2015-07-01 22:49 - 01216512 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2015-07-14 23:49 - 2015-07-01 22:49 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-07-14 23:49 - 2015-07-01 22:49 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-07-14 23:49 - 2015-07-01 22:49 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-07-14 23:49 - 2015-07-01 22:49 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-07-14 23:49 - 2015-07-01 22:49 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-07-14 23:49 - 2015-07-01 22:49 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-07-14 23:49 - 2015-07-01 22:49 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-07-14 23:49 - 2015-07-01 22:49 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-07-14 23:49 - 2015-07-01 22:49 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-07-14 23:49 - 2015-07-01 22:48 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2015-07-14 23:49 - 2015-07-01 22:48 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-07-14 23:49 - 2015-07-01 22:47 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-07-14 23:49 - 2015-07-01 22:47 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-07-14 23:49 - 2015-07-01 22:43 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-07-14 23:49 - 2015-07-01 22:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-07-14 23:49 - 2015-07-01 22:39 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-07-14 23:49 - 2015-07-01 22:30 - 00552960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-07-14 23:49 - 2015-07-01 22:30 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-07-14 23:49 - 2015-07-01 22:30 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-07-14 23:49 - 2015-07-01 22:30 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-07-14 23:49 - 2015-07-01 22:30 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-07-14 23:49 - 2015-07-01 22:30 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-07-14 23:49 - 2015-07-01 22:30 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2015-07-14 23:49 - 2015-07-01 22:30 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-07-14 23:49 - 2015-07-01 22:30 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-07-14 23:49 - 2015-07-01 22:29 - 00665088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2015-07-14 23:49 - 2015-07-01 22:29 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-07-14 23:49 - 2015-07-01 22:29 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-07-14 23:49 - 2015-07-01 22:27 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-07-14 23:49 - 2015-07-01 22:26 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-07-14 23:49 - 2015-07-01 22:24 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-07-14 23:49 - 2015-07-01 21:27 - 00159232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2015-07-14 23:49 - 2015-07-01 21:26 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2015-07-14 23:49 - 2015-07-01 21:26 - 00129024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2015-07-14 23:47 - 2015-07-14 23:47 - 18009776 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2015-07-14 23:46 - 2015-06-15 23:50 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2015-07-14 23:46 - 2015-06-15 23:45 - 03242496 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2015-07-14 23:46 - 2015-06-15 23:45 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2015-07-14 23:46 - 2015-06-15 23:45 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2015-07-14 23:46 - 2015-06-15 23:45 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2015-07-14 23:46 - 2015-06-15 23:44 - 00128000 _____ (Microsoft Corporation) C:\Windows\system32\msiexec.exe
2015-07-14 23:46 - 2015-06-15 23:43 - 02364416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2015-07-14 23:46 - 2015-06-15 23:43 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2015-07-14 23:46 - 2015-06-15 23:43 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2015-07-14 23:46 - 2015-06-15 23:42 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msiexec.exe
2015-07-14 23:46 - 2015-06-15 23:42 - 00025088 _____ (Microsoft Corporation) C:\Windows\system32\msimsg.dll
2015-07-14 23:46 - 2015-06-15 23:37 - 00025088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msimsg.dll
2015-07-08 23:39 - 2015-07-08 23:39 - 00001165 _____ C:\Users\jana2732\Desktop\mbam scan.txt
2015-07-08 00:27 - 2015-07-08 00:27 - 00002015 _____ C:\Users\jana2732\Desktop\Neues Textdokument (2).txt
2015-07-08 00:20 - 2015-07-08 00:24 - 00000000 ____D C:\AdwCleaner
2015-07-08 00:15 - 2015-07-08 00:15 - 02244096 _____ C:\Users\jana2732\Desktop\adwcleaner_4.207.exe
2015-07-07 23:59 - 2015-07-07 23:59 - 00000404 _____ C:\Users\jana2732\Desktop\Neues Textdokument.txt
2015-07-07 22:25 - 2015-07-07 22:26 - 00026901 _____ C:\Users\jana2732\Desktop\info.txt
2015-07-07 22:24 - 2015-07-31 21:53 - 00000000 ____D C:\Program Files\trend micro
2015-07-07 22:22 - 2015-07-07 22:22 - 01222144 _____ C:\Users\jana2732\Desktop\RSITx64.exe

==================== Ein Monat: Geänderte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2015-07-31 23:02 - 2009-11-12 09:23 - 01210856 _____ C:\Windows\WindowsUpdate.log
2015-07-31 23:01 - 2011-12-07 23:53 - 00000262 _____ C:\Windows\Tasks\HP Photo Creations Messager.job
2015-07-31 22:37 - 2012-08-20 16:38 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-07-31 22:14 - 2009-11-12 11:09 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2015-07-31 21:48 - 2015-05-13 18:01 - 00000000 ____D C:\rsit
2015-07-31 21:35 - 2009-07-14 06:45 - 00018736 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-07-31 21:35 - 2009-07-14 06:45 - 00018736 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-07-31 21:24 - 2012-02-22 14:45 - 00000000 ____D C:\ProgramData\NVIDIA
2015-07-31 21:24 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-07-31 19:54 - 2010-05-22 16:06 - 00003962 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{69F81C73-597A-4310-B542-0AE1A2A939D0}
2015-07-30 10:47 - 2013-11-12 00:22 - 00002341 _____ C:\Users\jana2732\Desktop\Sicherer Zahlungsverkehr.lnk
2015-07-29 00:42 - 2014-05-07 16:48 - 00000000 ___SD C:\Windows\system32\CompatTel
2015-07-25 10:29 - 2015-04-05 01:11 - 00000000 ___SD C:\Windows\system32\GWX
2015-07-21 12:22 - 2009-07-14 06:45 - 00412584 _____ C:\Windows\system32\FNTCACHE.DAT
2015-07-17 11:33 - 2015-04-05 01:11 - 00000000 ___SD C:\Windows\SysWOW64\GWX
2015-07-16 11:08 - 2009-11-17 09:55 - 00000000 ____D C:\Users\jana2732\Documents\meine Briefe
2015-07-15 11:27 - 2014-12-12 23:08 - 00000000 ____D C:\Windows\system32\appraiser
2015-07-15 11:27 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2015-07-15 11:25 - 2014-04-06 12:12 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-07-15 11:19 - 2014-12-24 19:45 - 00003886 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2015-07-15 00:05 - 2009-08-19 11:30 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-07-14 23:56 - 2013-10-23 20:40 - 00000000 ____D C:\Windows\system32\MRT
2015-07-14 23:49 - 2012-08-20 16:38 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-07-14 23:48 - 2012-08-20 16:38 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-07-14 23:48 - 2012-08-20 16:38 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-07-14 18:19 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\registration
2015-07-14 17:21 - 2009-11-12 09:23 - 00000000 ____D C:\Users\jana2732
2015-07-07 22:03 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\NDF
2015-07-03 08:43 - 2009-08-19 11:51 - 130333168 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======

2009-11-17 09:46 - 2009-11-17 09:46 - 0029791 _____ () C:\Users\jana2732\AppData\Roaming\Kommagetrennte Werte (Windows).ADR
2012-06-26 23:54 - 2012-06-26 23:55 - 0004608 _____ () C:\Users\jana2732\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2012-02-21 23:04 - 2012-02-22 15:52 - 0007609 _____ () C:\Users\jana2732\AppData\Local\Resmon.ResmonCfg
2011-11-11 15:06 - 2011-11-11 15:06 - 0017408 _____ () C:\Users\jana2732\AppData\Local\WebpageIcons.db
2011-05-04 19:11 - 2011-05-04 19:11 - 0000000 _____ () C:\Users\jana2732\AppData\Local\{A96D110E-2FFF-4715-960B-56BFFE61A381}
2014-10-19 13:05 - 2014-10-19 13:07 - 0000000 _____ () C:\Users\jana2732\AppData\Local\{C2AFE36C-1A0B-419C-A8A8-DA011DE6BF5A}
2011-12-07 23:50 - 2011-12-07 23:50 - 0000057 _____ () C:\ProgramData\Ament.ini
2015-05-11 12:07 - 2015-05-11 12:07 - 0001917 _____ () C:\ProgramData\cert523498.der
2010-04-09 23:13 - 2011-12-01 23:38 - 0000394 _____ () C:\ProgramData\hpzinstall.log

==================== Bamital & volsnap Check =================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

C:\Windows\System32\winlogon.exe => Datei ist digital signiert
C:\Windows\System32\wininit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\wininit.exe => Datei ist digital signiert
C:\Windows\explorer.exe => Datei ist digital signiert
C:\Windows\SysWOW64\explorer.exe => Datei ist digital signiert
C:\Windows\System32\svchost.exe => Datei ist digital signiert
C:\Windows\SysWOW64\svchost.exe => Datei ist digital signiert
C:\Windows\System32\services.exe => Datei ist digital signiert
C:\Windows\System32\User32.dll => Datei ist digital signiert
C:\Windows\SysWOW64\User32.dll => Datei ist digital signiert
C:\Windows\System32\userinit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\userinit.exe => Datei ist digital signiert
C:\Windows\System32\rpcss.dll => Datei ist digital signiert
C:\Windows\System32\Drivers\volsnap.sys => Datei ist digital signiert



===***===***===***=== Extract of Additional scan result of Farbar Recovery Scan Tool ===***===***===***===

==================== Drive and Memory info ===================



==================== MBR and Partition Table ==================


==================== Scheduled Tasks (whitelisted) ==================

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\HP Photo Creations Messager.job => C:\ProgramData\HP Photo Creations\MessageCheck.exe

==================== Alternate Data Streams (whitelisted) ==================


==================== Security Center ==================

AV: Kaspersky Internet Security (Disabled - Up to date) {B41C7598-35F6-4D89-7D0E-7ADE69B4047B}
AS: Kaspersky Internet Security (Disabled - Up to date) {0F7D947C-13CC-4207-47BE-41AC12334EC6}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky Internet Security (Disabled) {8C27F4BD-7F99-4CD1-5651-D3EB97674300}



===***===***===***=== Supplementary Scan createdy by FRSTLauncher ===***===***===***===
Posledni aktualizace FRSTLauncheru: 25_11_2013 (01)
Posledni aktualizace Modifikacniho skriptu: 30_09_2013 (01)


***** Velikost "Plochy" *****

Velikost slozky "C:\Users\jana2732\Desktop" je 767 MB.


***** Startup Programs *****

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [x]

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update
C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe


***** Firewall rules *****

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
DisableNotifications REG_DWORD 0x0
EnableFirewall REG_DWORD 0x1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
DisableNotifications REG_DWORD 0x0
EnableFirewall REG_DWORD 0x1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]


***** System Restore *****

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"Generalize_DisableSR"=dword:00000000


==================== End Of Log ==============================
Dakujem vam , dovidenia
Jana

Na druhy pocitac zalozte nove tema, jinak v tom bude gulas.

Jestli budete ale delat mezi jednotlivymi kroky takove pauzy a ty pocitace jsou v te dobe pouzivany, nikdy to nevycistime

Vypnete trvale Windows Defender

***** Velikost "Plochy" *****

Velikost slozky "C:\Users\jana2732\Desktop" je 767 MB.

Velikost plochy by nemela presahovat 200 - 300 MB! Brzdi to chod pc. Cili ji trosku uklidte a na plochu dejte jen zastupce. Jen pozor na obcasnou chybu, ze uzivatele maji na plose slozku, v ni dalsi a v ni dalsi a do te to schovaji. To je sice hezke, ale plochu to nezmensi, jen je to v jinem supliku



Otevrete si poznamkovy blok a zkopirujte do nej tento skript Vlevo nahore kliknete na napis Soubor
Kliknete na napis Ulozit jako...
Napiste spravne ten cerveny nazev fixlist a ulozte na plochu.
Vypnete antivir i dalsi pripadne zabezpeceni.
Spustte FRST jako spravce, kliknete na napis Fix a program vykona prikazy.
Po restartu pc by se mel objevit novy log - s nazvem fixlog, ten mi sem zase zkopirujte.





13.9. pro neaktivitu http://forum.viry.cz/viewtopic.php?f=12&t=123975