Hallo,

ich habe seit genau 3 Tagen nach einiger Zeit einen Bluescreen. Nun möche ich Vireninfektionen wenn möglich ausschließen, deshalb mal folgende Scanns:

gmer Log:
GMER Logfile:
GMER Logfile:

GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-07-23 21:36:45
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk1\DR1 -> \Device\Ide\IAAStorageDevice-3 M4-CT064 rev.0009 59,63GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Admin\AppData\Local\Temp\awtorpod.sys

OTL Log



---- User code sections - GMER 2.1 ----

.text   C:\Program Files (x86)\OpenVPN Technologies\OpenVPN Client\core\capiws.exe[1632] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 69   0000000075b01465 2 bytes [B0, 75]
.text   C:\Program Files (x86)\OpenVPN Technologies\OpenVPN Client\core\capiws.exe[1632] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 155  0000000075b014bb 2 bytes [B0, 75]
.text   ...                                                                                                                                        * 2
.text   D:\Program Files (x86)\Skype\Phone\Skype.exe[3016] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                 0000000075b01465 2 bytes [B0, 75]
.text   D:\Program Files (x86)\Skype\Phone\Skype.exe[3016] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                0000000075b014bb 2 bytes [B0, 75]
.text   ...                                                                                                                                        * 2
.text   D:\Program Files (x86)\Skype\Phone\Skype.exe[1772] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                 0000000075b01465 2 bytes [B0, 75]
.text   D:\Program Files (x86)\Skype\Phone\Skype.exe[1772] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                0000000075b014bb 2 bytes [B0, 75]
.text   ...                                                                                                                                        * 2
.text   C:\Users\Admin\Desktop\tools\Defogger.exe[2928] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                    0000000075b01465 2 bytes [B0, 75]
.text   C:\Users\Admin\Desktop\tools\Defogger.exe[2928] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                   0000000075b014bb 2 bytes [B0, 75]
.text   ...                                                                                                                                        * 2

---- Threads - GMER 2.1 ----

Thread  C:\Windows\System32\svchost.exe [768:2624]                                                                                                 000007fef2ce9688

---- Disk sectors - GMER 2.1 ----

Disk    \Device\Harddisk1\DR1                                                                                                                      unknown MBR code

---- EOF - GMER 2.1 ----
         

--- --- ---

--- --- ---[/CODE]

OTL:
OTL Logfile:

OTL logfile created on: 20.07.2013 17:38:19 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Admin\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
9,99 Gb Total Physical Memory | 6,77 Gb Available Physical Memory | 67,73% Memory free
10,99 Gb Paging File | 7,63 Gb Available in Paging File | 69,42% Paging File free
Paging file location(s): c:\pagefile.sys 1024 1024 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 59,62 Gb Total Space | 12,08 Gb Free Space | 20,26% Space Free | Partition Type: NTFS
Drive D: | 781,25 Gb Total Space | 609,55 Gb Free Space | 78,02% Space Free | Partition Type: NTFS
Drive E: | 616,01 Gb Total Space | 595,13 Gb Free Space | 96,61% Space Free | Partition Type: NTFS
Drive R: | 1021,97 Mb Total Space | 1021,95 Mb Free Space | 100,00% Space Free | Partition Type: FAT32
 
Computer Name: ADMIN-PC | User Name: Admin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2013.07.20 17:38:03 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Admin\Downloads\OTL.exe
PRC - [2013.07.14 20:40:01 | 000,567,880 | ---- | M] () -- C:\Program Files (x86)\puush\puush.exe
PRC - [2013.05.20 11:56:08 | 000,440,992 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Windows Phone\WindowsPhone.exe
PRC - [2013.04.17 14:28:38 | 000,917,400 | ---- | M] (Mozilla Corporation) -- D:\Program Files (x86)\Mozilla Firefox\firefox.exe
PRC - [2012.07.09 01:40:10 | 000,104,912 | ---- | M] (Microsoft Corporation) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PRC - [2010.08.12 17:45:00 | 000,024,064 | ---- | M] () -- C:\Program Files (x86)\OpenVPN Technologies\OpenVPN Client\core\capiws.exe
PRC - [2005.11.14 16:24:00 | 000,121,064 | ---- | M] (Macrovision Corporation) -- C:\Program Files (x86)\Realtek\Audio\Drivers\HDADrv\Setup.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2013.07.20 16:06:54 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\c8ea295fd4dce110b32c3c4f0e3807b2\System.Runtime.Remoting.ni.dll
MOD - [2013.07.20 16:06:37 | 012,436,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\178644ab40108f3becd8b91049a254c3\System.Windows.Forms.ni.dll
MOD - [2013.07.20 16:06:32 | 001,593,344 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\bfa7a95284aec941f4b03bae0debe07c\System.Drawing.ni.dll
MOD - [2013.07.20 16:06:29 | 005,464,064 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\32066405eb9ab14056b2af3115d2a6de\System.Xml.ni.dll
MOD - [2013.07.20 16:06:26 | 000,978,432 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\9e24b9ffd816c0c90efc4d3fc9fd745f\System.Configuration.ni.dll
MOD - [2013.07.20 16:06:16 | 007,989,760 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\187c13e8967097d2ed1e5f123e7d890a\System.ni.dll
MOD - [2013.07.20 16:06:12 | 011,499,520 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9a6c1b7af18b4d5a91dc7f8d6617522f\mscorlib.ni.dll
MOD - [2013.07.20 15:00:49 | 018,545,152 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\4bb52b02b721bb5f8739eab898723751\PresentationFramework.ni.dll
MOD - [2013.07.20 15:00:40 | 010,926,592 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\aa489a04fe509025c1baeb8a3a8185f4\PresentationCore.ni.dll
MOD - [2013.07.20 15:00:40 | 007,566,336 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\38a0a29884a7c5bb50d9114ceb6866c5\System.Xml.ni.dll
MOD - [2013.07.20 15:00:36 | 006,998,016 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\ed2841e8c3c99feb0d04e4ea5ca0a152\System.Core.ni.dll
MOD - [2013.07.20 15:00:36 | 001,880,576 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\c5f14d8d1109365283a352a54f0a10cf\System.Xaml.ni.dll
MOD - [2013.07.20 15:00:34 | 003,910,144 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\eee141c3bb48eaa1a0379fb82b3c4298\WindowsBase.ni.dll
MOD - [2013.07.20 15:00:34 | 001,156,608 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\389618567077f42c6247fed59cd7f87a\System.Management.ni.dll
MOD - [2013.07.20 15:00:33 | 000,964,096 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\e4ffebb0f0a92f5e8caaacb697537040\System.Configuration.ni.dll
MOD - [2013.07.20 15:00:32 | 009,937,408 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System\0c7fff6c73e859736f1f84b20f6b0b0a\System.ni.dll
MOD - [2013.07.20 15:00:32 | 000,462,336 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio1c9175f8#\7bddc53dc2d50b327afaa798cb47c5b8\PresentationFramework.Aero.ni.dll
MOD - [2013.07.20 15:00:27 | 016,547,328 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\aa3538b86646ec3401d133b7f9bc8465\mscorlib.ni.dll
MOD - [2013.07.14 20:40:01 | 000,567,880 | ---- | M] () -- C:\Program Files (x86)\puush\puush.exe
MOD - [2013.04.21 21:44:32 | 000,087,952 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2013.04.21 21:44:04 | 001,242,952 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2013.04.17 14:28:37 | 002,402,200 | ---- | M] () -- D:\Program Files (x86)\Mozilla Firefox\mozjs.dll
MOD - [2013.01.20 03:03:39 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - [2013.03.29 03:34:18 | 000,241,152 | ---- | M] (AMD) [Disabled | Stopped] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2009.07.14 03:38:59 | 000,019,456 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\CISVC.EXE -- (CISVC)
SRV - [2013.06.21 09:53:36 | 000,162,408 | R--- | M] (Skype Technologies) [Auto | Stopped] -- D:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2013.05.17 16:47:46 | 000,024,576 | ---- | M] (Realtek Semiconductor.) [Auto | Running] -- C:\Program Files (x86)\Realtek\Audio\SetupAfterRebootService.exe -- (SetupARService)
SRV - [2013.01.24 20:15:10 | 000,045,056 | ---- | M] () [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\BattlEye\BEService.exe -- (BEService)
SRV - [2013.01.24 14:30:21 | 000,541,608 | ---- | M] (Valve Corporation) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2012.07.09 01:40:10 | 000,104,912 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.08.12 17:45:00 | 000,024,064 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\OpenVPN Technologies\OpenVPN Client\core\capiws.exe -- (OpenVPNAccessClient)
SRV - [2010.02.19 14:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2010.01.09 22:34:24 | 004,925,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2004.06.14 01:00:00 | 000,057,344 | ---- | M] (brother Industries Ltd) [On_Demand | Stopped] -- C:\Windows\SysWOW64\brsvc01a.exe -- (Brother XP spl Service)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2013.06.30 20:23:41 | 000,231,376 | ---- | M] (TrueCrypt Foundation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\truecrypt.sys -- (truecrypt)
DRV:64bit: - [2013.04.12 11:41:28 | 000,131,856 | ---- | M] (Oracle Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VBoxNetAdp.sys -- (VBoxNetAdp)
DRV:64bit: - [2013.03.29 04:35:02 | 011,658,752 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)
DRV:64bit: - [2013.03.29 03:09:44 | 000,581,120 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2013.03.01 03:49:12 | 000,036,600 | ---- | M] (Riverbed Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\npf.sys -- (NPF)
DRV:64bit: - [2013.02.22 03:53:00 | 000,042,184 | ---- | M] (Anchorfree Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\taphss6.sys -- (taphss6)
DRV:64bit: - [2013.01.20 03:03:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2013.01.17 22:15:12 | 000,066,800 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGSHidFilt.Sys -- (LGSHidFilt)
DRV:64bit: - [2012.11.29 12:50:06 | 000,073,552 | ---- | M] (Dataram, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RAMDiskVE.sys -- (RAMDiskVE)
DRV:64bit: - [2012.09.21 21:04:24 | 000,024,608 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lvbflt64.sys -- (CompFilter64)
DRV:64bit: - [2012.09.21 21:04:22 | 004,763,680 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lvuvc64.sys -- (LVUVC64)
DRV:64bit: - [2012.09.21 21:04:22 | 000,351,520 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lvrs64.sys -- (LVRS64)
DRV:64bit: - [2012.09.17 16:05:26 | 000,123,704 | ---- | M] (JMicron Technology Corp.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\jraid.sys -- (JRAID)
DRV:64bit: - [2012.08.21 14:01:20 | 000,033,240 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2012.06.05 13:45:16 | 000,237,968 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RtHDMIVX.sys -- (RTHDMIAzAudService)
DRV:64bit: - [2012.05.30 13:42:10 | 000,569,152 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2012.02.02 11:43:02 | 000,509,104 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\e1k62x64.sys -- (e1kexpress)
DRV:64bit: - [2011.11.03 03:01:00 | 000,056,208 | ---- | M] (Rovi Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)
DRV:64bit: - [2011.04.11 22:01:00 | 000,341,832 | ---- | M] (Logitech) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ladfGSRamd64.sys -- (LADF_RenderOnly)
DRV:64bit: - [2011.04.11 22:00:18 | 000,410,184 | ---- | M] (Logitech) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ladfGSCamd64.sys -- (LADF_CaptureOnly)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.21 05:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.21 05:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.21 05:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2010.08.03 16:25:30 | 000,030,720 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tapoas.sys -- (tapoas)
DRV:64bit: - [2009.11.24 03:38:00 | 000,016,008 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LGVirHid.sys -- (LGVirHid)
DRV:64bit: - [2009.11.24 03:37:50 | 000,022,408 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGBusEnum.sys -- (LGBusEnum)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.03.18 16:35:42 | 000,033,856 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hamachi.sys -- (hamachi)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = B4 36 B4 5F B1 F6 CD 01  [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..extensions.enabledAddons: %7Bf36c6cd1-da73-491d-b290-8fc9115bfa55%7D:2.2.1
FF - prefs.js..extensions.enabledAddons: firefox%40mega.co.nz:1.0.3
FF - prefs.js..extensions.enabledAddons: ich%40maltegoetz.de:1.5.1
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:17.0.5
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\adobe.com/AdobeAAMDetect: C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: E:\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.17.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\3.0.40818.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@ngm.nexoneu.com/NxGame: C:\ProgramData\NexonEU\NGM\npNxGameeu.dll (Nexon)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\adobe.com/AdobeAAMDetect: C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF - HKCU\Software\MozillaPlugins\amazon.com/AmazonMP3DownloaderPlugin: C:\Users\Admin\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll (Amazon.com, Inc.)
 
64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\PROGRAM FILES\ESET\ESET NOD32 ANTIVIRUS\MOZILLA THUNDERBIRD
64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\bdThunderbird@bitdefender.com: C:\PROGRAM FILES\BITDEFENDER\BITDEFENDER\BDTBEXT [2013.07.04 11:51:54 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}: C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.5\extensions\\Components: D:\Program Files (x86)\Mozilla Firefox\components [2013.07.20 14:53:58 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.5\extensions\\Plugins: D:\Program Files (x86)\Mozilla Firefox\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\bdThunderbird@bitdefender.com: C:\Program Files\Bitdefender\Bitdefender\bdtbext [2013.07.04 11:51:54 | 000,000,000 | ---D | M]
 
[2013.06.28 19:38:32 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\Extensions
[2013.06.28 19:38:32 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\Extensions\net.openvpn.client
[2013.07.01 14:55:39 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\9oid3g3q.default\extensions
[2013.04.16 18:20:59 | 000,000,000 | ---D | M] (Flashblock) -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\9oid3g3q.default\extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a}
[2013.06.30 00:24:30 | 000,000,000 | ---D | M] (ProxTube - Unblock YouTube) -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\9oid3g3q.default\extensions\ich@maltegoetz.de
[2013.03.23 19:37:42 | 000,004,366 | ---- | M] () (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\9oid3g3q.default\extensions\firefox@mega.co.nz.xpi
[2013.05.08 21:20:33 | 000,870,680 | ---- | M] () (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\9oid3g3q.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2013.02.26 17:38:45 | 000,745,166 | ---- | M] () (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\9oid3g3q.default\extensions\{f36c6cd1-da73-491d-b290-8fc9115bfa55}.xpi
[2013.03.21 21:17:50 | 000,001,050 | ---- | M] () -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\9oid3g3q.default\searchplugins\11-suche.xml
[2013.03.21 21:17:50 | 000,002,418 | ---- | M] () -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\9oid3g3q.default\searchplugins\englische-ergebnisse.xml
[2013.03.21 21:17:50 | 000,010,701 | ---- | M] () -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\9oid3g3q.default\searchplugins\gmx-suche.xml
[2013.03.21 21:17:50 | 000,002,432 | ---- | M] () -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\9oid3g3q.default\searchplugins\lastminute.xml
[2013.03.21 21:17:50 | 000,005,682 | ---- | M] () -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\9oid3g3q.default\searchplugins\webde-suche.xml
 
O1 HOSTS File: ([2013.03.12 15:36:43 | 000,002,213 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 crl.verisign.net
O1 - Hosts: 127.0.0.1 CRL.VERISIGN.NET.*
O1 - Hosts: 127.0.0.1 ood.opsource.net
O1 - Hosts: 20 more lines...
O2:64bit: - BHO: (no name) - AutorunsDisabled - No CLSID value found.
O2 - BHO: (no name) - AutorunsDisabled - No CLSID value found.
O4:64bit: - HKLM..\Run: [Bdagent] "D:\BITDefender\Bitdefender\Bitdefender\bdagent.exe" File not found
O4:64bit: - HKLM..\Run: [InstallerLauncher] C:\Program Files\Common Files\Bitdefender\SetupInformation\{6F57816A-791A-4159-A75F-CFD0C7EA4FBF}\setuplauncher.exe (Bitdefender)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [bdruninstaller] C:\Program Files\Common Files\Bitdefender\SetupInformation\downloader\setuplauncher.exe (Bitdefender)
O4 - HKCU..\Run: [AdobeBridge]  File not found
O4 - HKCU..\Run: [puush] C:\Program Files (x86)\puush\puush.exe ()
O4 - Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled [2013.04.17 14:23:39 | 000,000,000 | -H-D | M]
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: An OneNote s&enden - res://D:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found
O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://D:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: An OneNote s&enden - res://D:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://D:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found
O9 - Extra 'Tools' menuitem : Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - Reg Error: Key error. File not found
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{60BAFB0B-1C79-455B-9316-2F103D59F3C8}: DhcpNameServer = 8.8.8.8 8.8.4.4
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A8475590-02B5-439B-9AAB-A5C3D2796428}: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\Z\Shell - "" = AutoRun
O33 - MountPoints2\Z\Shell\AutoRun\command - "" = Z:\install.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.07.20 15:59:37 | 000,000,000 | ---D | C] -- C:\Program Files\Bitdefender
[2013.07.20 15:44:47 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Bitdefender
[2013.07.20 15:41:40 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\QuickScan
[2013.07.20 15:40:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Bitdefender
[2013.07.20 15:39:18 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Bitdefender
[2013.07.20 15:39:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Bitdefender
[2013.07.20 15:02:59 | 000,000,000 | -H-D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled
[2013.07.20 15:00:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013.07.20 15:00:26 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2013.07.20 15:00:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2013.07.19 21:32:16 | 000,000,000 | ---D | C] -- C:\Users\Admin\Desktop\WBB Plugins
[2013.07.19 21:22:49 | 000,000,000 | ---D | C] -- C:\Users\Admin\Desktop\Board
[2013.07.18 13:58:39 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\gtk-2.0
[2013.07.18 13:57:05 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\.purple
[2013.07.18 13:56:53 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\pidgin-otr
[2013.07.18 13:56:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\pidgin-otr
[2013.07.18 13:46:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2013.07.18 13:46:21 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2013.07.18 13:46:20 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2013.07.18 13:46:20 | 000,000,000 | ---D | C] -- C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
[2013.07.18 13:45:50 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Apple
[2013.07.18 13:45:44 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour
[2013.07.18 13:45:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Bonjour
[2013.07.17 18:34:20 | 000,000,000 | ---D | C] -- C:\Users\Admin\Desktop\Neues Textdokument (1)
[2013.07.17 12:15:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinPcap
[2013.07.14 00:42:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Apple Software Update
[2013.07.13 13:27:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Phone
[2013.07.13 13:27:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Windows Phone
[2013.07.12 13:54:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Windows Media Player
[2013.07.11 16:14:16 | 000,000,000 | ---D | C] -- C:\Users\Admin\Desktop\Bilder
[2013.07.05 13:58:53 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Amazon
[2013.07.05 13:58:31 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\Program Files
[2013.07.03 18:35:10 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Bitcoin
[2013.06.30 20:29:34 | 000,000,000 | ---D | C] -- C:\ProgramData\TrueCrypt
[2013.06.30 20:24:01 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\TrueCrypt
[2013.06.30 20:23:41 | 000,231,376 | ---- | C] (TrueCrypt Foundation) -- C:\Windows\SysNative\drivers\truecrypt.sys
[2013.06.30 20:23:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TrueCrypt
[2013.06.30 20:23:34 | 000,000,000 | ---D | C] -- C:\Program Files\TrueCrypt
[2013.06.28 19:38:30 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\OpenVPN Technologies
[2013.06.28 19:38:30 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\OpenVPN Technologies
[2013.06.28 19:38:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenVPN Client
[2013.06.28 19:37:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\OpenVPN Technologies
[2013.03.12 13:25:26 | 001,542,752 | ---- | C] (Lenovo Group Limited                                        ) -- C:\Users\Admin\AppData\Local\cs01383264.exe
 
========== Files - Modified Within 30 Days ==========
 
[2013.07.20 17:38:54 | 000,021,664 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.07.20 17:38:54 | 000,021,664 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.07.20 17:37:44 | 001,636,058 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013.07.20 17:37:44 | 000,705,126 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2013.07.20 17:37:44 | 000,658,940 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013.07.20 17:37:44 | 000,151,418 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2013.07.20 17:37:44 | 000,123,512 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013.07.20 17:31:51 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.07.20 16:22:22 | 000,168,982 | ---- | M] () -- C:\ProgramData\1374329013.bdinstall.bin
[2013.07.20 16:02:26 | 000,057,414 | ---- | M] () -- C:\ProgramData\1374328942.bdinstall.bin
[2013.07.20 16:02:04 | 000,173,843 | ---- | M] () -- C:\ProgramData\1374328896.bdinstall.bin
[2013.07.20 16:01:41 | 000,057,149 | ---- | M] () -- C:\ProgramData\1374328899.bdinstall.bin
[2013.07.20 16:00:32 | 000,169,617 | ---- | M] () -- C:\ProgramData\1374328814.bdinstall.bin
[2013.07.20 15:59:55 | 000,283,948 | ---- | M] () -- C:\ProgramData\1374328733.bdinstall.bin
[2013.07.20 15:58:23 | 005,095,072 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013.07.20 15:46:43 | 000,131,047 | ---- | M] () -- C:\ProgramData\1374327580.3848.bin
[2013.07.20 15:46:43 | 000,115,503 | ---- | M] () -- C:\ProgramData\1374327580.3660.bin
[2013.07.20 15:46:07 | 000,021,541 | ---- | M] () -- C:\ProgramData\1374327580.1772.bin
[2013.07.20 15:46:05 | 000,115,484 | ---- | M] () -- C:\ProgramData\1374327580.3984.bin
[2013.07.20 15:44:47 | 000,016,869 | ---- | M] () -- C:\ProgramData\1374327580.1608.bin
[2013.07.20 15:44:47 | 000,001,699 | ---- | M] () -- C:\ProgramData\1374327580.844.bin
[2013.07.20 15:41:49 | 000,001,451 | ---- | M] () -- C:\ProgramData\1374327580.1636.bin
[2013.07.20 15:41:43 | 000,001,090 | ---- | M] () -- C:\ProgramData\1374327580.3576.bin
[2013.07.20 15:41:39 | 000,001,089 | ---- | M] () -- C:\ProgramData\1374327580.944.bin
[2013.07.20 15:40:51 | 000,008,922 | ---- | M] () -- C:\ProgramData\1374327580.2532.bin
[2013.07.20 15:40:17 | 000,015,990 | ---- | M] () -- C:\ProgramData\1374327580.4016.bin
[2013.07.20 15:40:09 | 000,002,969 | ---- | M] () -- C:\ProgramData\1374327580.2640.bin
[2013.07.20 15:00:27 | 000,001,115 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2013.07.20 12:04:52 | 000,574,468 | ---- | M] () -- C:\Users\Admin\Documents\IMG_20072013_120223.png
[2013.07.20 12:02:28 | 000,782,500 | ---- | M] () -- C:\Users\Admin\Documents\IMG_20072013_120038.png
[2013.07.20 02:04:36 | 000,002,036 | -H-- | M] () -- C:\Users\Admin\Documents\Default.rdp
[2013.07.19 23:55:22 | 000,106,101 | ---- | M] () -- C:\Users\Admin\Documents\Schnappschuss von mir 15.png
[2013.07.19 21:04:53 | 000,584,335 | ---- | M] () -- C:\Users\Admin\Documents\air-style.tgz
[2013.07.18 17:08:32 | 000,000,218 | ---- | M] () -- C:\Users\Admin\.recently-used.xbel
[2013.07.18 13:46:37 | 000,001,445 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2013.07.17 18:38:43 | 000,010,752 | ---- | M] () -- C:\Users\Admin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2013.07.14 16:20:43 | 027,686,480 | ---- | M] () -- C:\Users\Admin\ts3_recording_13_07_14_16_18_17.wav
[2013.07.12 17:42:44 | 074,106,320 | ---- | M] () -- C:\Users\Admin\ts3_recording_13_07_12_17_36_16.wav
[2013.07.11 16:25:28 | 001,936,122 | ---- | M] () -- C:\Users\Admin\Desktop\hi.png
[2013.07.11 16:25:25 | 000,000,132 | ---- | M] () -- C:\Users\Admin\AppData\Roaming\Adobe CS6-PNG-Format - Voreinstellungen
[2013.07.10 20:13:46 | 192,999,621 | ---- | M] () -- C:\Users\Admin\Documents\Bilder.zip
[2013.07.03 19:11:36 | 000,055,291 | ---- | M] () -- C:\Users\Admin\Documents\Unbenannt.png
[2013.07.02 22:20:50 | 000,004,142 | ---- | M] () -- C:\Users\Admin\Documents\Xertonia.ovpn
[2013.07.01 22:21:49 | 001,835,008 | ---- | M] () -- C:\Users\Admin\Documents\TrueCrypt Rescue Disk.iso
[2013.06.30 20:23:41 | 000,231,376 | ---- | M] (TrueCrypt Foundation) -- C:\Windows\SysNative\drivers\truecrypt.sys
[2013.06.30 20:23:41 | 000,000,881 | ---- | M] () -- C:\Users\Public\Desktop\TrueCrypt.lnk
[2013.06.30 13:03:11 | 000,641,048 | ---- | M] () -- C:\Users\Admin\Documents\Unbenannt1.PNG
[2013.06.29 21:14:30 | 001,362,472 | ---- | M] () -- C:\Users\Admin\Documents\adsdasfs.rar
[2013.06.28 19:38:12 | 000,001,376 | ---- | M] () -- C:\Users\Public\Desktop\OpenVPN Client.lnk
[2013.06.24 18:16:51 | 000,465,195 | ---- | M] () -- C:\Users\Admin\Documents\pack.rar
[2013.06.23 21:54:24 | 000,849,986 | ---- | M] () -- C:\Users\Admin\Documents\disconnected.bmp
[2013.06.22 15:52:22 | 000,293,591 | ---- | M] () -- C:\Users\Admin\Documents\magnet.png
 
========== Files Created - No Company Name ==========
 
[2013.07.20 16:22:22 | 000,168,982 | ---- | C] () -- C:\ProgramData\1374329013.bdinstall.bin
[2013.07.20 16:02:26 | 000,057,414 | ---- | C] () -- C:\ProgramData\1374328942.bdinstall.bin
[2013.07.20 16:02:04 | 000,173,843 | ---- | C] () -- C:\ProgramData\1374328896.bdinstall.bin
[2013.07.20 16:01:41 | 000,057,149 | ---- | C] () -- C:\ProgramData\1374328899.bdinstall.bin
[2013.07.20 16:00:32 | 000,169,617 | ---- | C] () -- C:\ProgramData\1374328814.bdinstall.bin
[2013.07.20 15:59:55 | 000,283,948 | ---- | C] () -- C:\ProgramData\1374328733.bdinstall.bin
[2013.07.20 15:44:44 | 000,001,699 | ---- | C] () -- C:\ProgramData\1374327580.844.bin
[2013.07.20 15:41:40 | 000,001,451 | ---- | C] () -- C:\ProgramData\1374327580.1636.bin
[2013.07.20 15:40:17 | 000,115,484 | ---- | C] () -- C:\ProgramData\1374327580.3984.bin
[2013.07.20 15:40:17 | 000,016,869 | ---- | C] () -- C:\ProgramData\1374327580.1608.bin
[2013.07.20 15:40:17 | 000,015,990 | ---- | C] () -- C:\ProgramData\1374327580.4016.bin
[2013.07.20 15:40:17 | 000,008,922 | ---- | C] () -- C:\ProgramData\1374327580.2532.bin
[2013.07.20 15:40:17 | 000,001,090 | ---- | C] () -- C:\ProgramData\1374327580.3576.bin
[2013.07.20 15:40:17 | 000,001,089 | ---- | C] () -- C:\ProgramData\1374327580.944.bin
[2013.07.20 15:39:49 | 000,002,969 | ---- | C] () -- C:\ProgramData\1374327580.2640.bin
[2013.07.20 15:39:42 | 000,131,047 | ---- | C] () -- C:\ProgramData\1374327580.3848.bin
[2013.07.20 15:39:41 | 000,021,541 | ---- | C] () -- C:\ProgramData\1374327580.1772.bin
[2013.07.20 15:39:40 | 000,115,503 | ---- | C] () -- C:\ProgramData\1374327580.3660.bin
[2013.07.20 15:00:27 | 000,001,115 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2013.07.20 12:04:46 | 000,574,468 | ---- | C] () -- C:\Users\Admin\Documents\IMG_20072013_120223.png
[2013.07.20 12:02:10 | 000,782,500 | ---- | C] () -- C:\Users\Admin\Documents\IMG_20072013_120038.png
[2013.07.19 23:55:19 | 000,106,101 | ---- | C] () -- C:\Users\Admin\Documents\Schnappschuss von mir 15.png
[2013.07.19 21:02:56 | 000,584,335 | ---- | C] () -- C:\Users\Admin\Documents\air-style.tgz
[2013.07.18 17:08:32 | 000,000,218 | ---- | C] () -- C:\Users\Admin\.recently-used.xbel
[2013.07.18 13:56:37 | 000,000,701 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Pidgin.lnk
[2013.07.18 13:46:37 | 000,001,445 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2013.07.17 18:35:33 | 000,010,752 | ---- | C] () -- C:\Users\Admin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2013.07.17 12:14:48 | 000,001,543 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wireshark.lnk
[2013.07.14 16:18:18 | 027,686,480 | ---- | C] () -- C:\Users\Admin\ts3_recording_13_07_14_16_18_17.wav
[2013.07.14 00:42:24 | 000,002,519 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
[2013.07.12 17:36:18 | 074,106,320 | ---- | C] () -- C:\Users\Admin\ts3_recording_13_07_12_17_36_16.wav
[2013.07.12 13:54:27 | 000,001,547 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
[2013.07.11 16:25:24 | 001,936,122 | ---- | C] () -- C:\Users\Admin\Desktop\hi.png
[2013.07.10 19:45:53 | 192,999,621 | ---- | C] () -- C:\Users\Admin\Documents\Bilder.zip
[2013.07.02 22:20:49 | 000,004,142 | ---- | C] () -- C:\Users\Admin\Documents\Xertonia.ovpn
[2013.07.01 22:21:49 | 001,835,008 | ---- | C] () -- C:\Users\Admin\Documents\TrueCrypt Rescue Disk.iso
[2013.06.30 20:23:41 | 000,000,881 | ---- | C] () -- C:\Users\Public\Desktop\TrueCrypt.lnk
[2013.06.30 13:03:06 | 000,641,048 | ---- | C] () -- C:\Users\Admin\Documents\Unbenannt1.PNG
[2013.06.29 21:14:17 | 001,362,472 | ---- | C] () -- C:\Users\Admin\Documents\adsdasfs.rar
[2013.06.28 19:38:12 | 000,001,376 | ---- | C] () -- C:\Users\Public\Desktop\OpenVPN Client.lnk
[2013.06.24 18:45:18 | 005,195,636 | ---- | C] () -- C:\Users\Admin\Documents\sodii.rar
[2013.06.24 18:16:45 | 000,465,195 | ---- | C] () -- C:\Users\Admin\Documents\pack.rar
[2013.06.23 21:54:23 | 000,849,986 | ---- | C] () -- C:\Users\Admin\Documents\disconnected.bmp
[2013.06.22 15:52:16 | 000,293,591 | ---- | C] () -- C:\Users\Admin\Documents\magnet.png
[2013.06.21 15:37:04 | 000,055,291 | ---- | C] () -- C:\Users\Admin\Documents\Unbenannt.png
[2013.05.26 14:33:31 | 000,000,005 | ---- | C] () -- C:\Users\Admin\AppData\Roaming\Skype API Tool.ini
[2013.05.25 17:45:38 | 003,507,920 | ---- | C] () -- C:\Users\Admin\ts3_recording_13_05_25_17_45_37.wav
[2013.05.17 16:36:02 | 000,995,342 | ---- | C] () -- C:\Windows\SysWow64\amdocl_as32.exe
[2013.05.17 16:36:02 | 000,798,734 | ---- | C] () -- C:\Windows\SysWow64\amdocl_ld32.exe
[2013.05.17 16:16:00 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2013.05.17 16:14:53 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat
[2013.05.17 16:14:53 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat
[2013.05.17 16:14:53 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2013.04.23 20:47:07 | 000,007,620 | ---- | C] () -- C:\Users\Admin\AppData\Local\Resmon.ResmonCfg
[2013.04.22 18:42:52 | 000,151,552 | ---- | C] () -- C:\Windows\SysWow64\nvRegDev.dll
[2013.04.22 18:42:46 | 000,061,440 | ---- | C] () -- C:\Windows\SysWow64\nvPhotoshopUtil.dll
[2013.04.22 18:42:46 | 000,040,960 | ---- | C] () -- C:\Windows\SysWow64\nvISWOW64.dll
[2013.03.10 21:30:24 | 000,067,863 | ---- | C] () -- C:\Windows\SysWow64\x264vfw-uninstall.exe
[2013.03.10 15:11:17 | 000,639,488 | ---- | C] () -- C:\Windows\SysWow64\ficvdec_x86.dll
[2013.03.02 01:37:37 | 001,589,248 | ---- | C] () -- C:\Windows\SysWow64\libmysql_d.dll
[2013.03.01 03:47:36 | 000,053,299 | ---- | C] () -- C:\Windows\SysWow64\pthreadVC.dll
[2013.02.28 16:25:42 | 000,000,132 | ---- | C] () -- C:\Users\Admin\AppData\Roaming\Adobe CS6-BMP-Format - Voreinstellungen
[2013.02.17 15:55:15 | 000,000,600 | ---- | C] () -- C:\Users\Admin\AppData\Roaming\winscp.rnd
[2013.02.16 14:15:04 | 000,000,184 | ---- | C] () -- C:\Windows\AutoKMS.ini
[2013.02.02 23:17:09 | 000,000,600 | ---- | C] () -- C:\Users\Admin\AppData\Local\PUTTY.RND
[2013.01.21 21:13:45 | 000,000,132 | ---- | C] () -- C:\Users\Admin\AppData\Roaming\Adobe CS6-PNG-Format - Voreinstellungen
[2013.01.20 06:04:17 | 000,000,030 | ---- | C] () -- C:\Windows\SysWow64\brss01a.ini
[2013.01.20 06:04:16 | 000,000,462 | ---- | C] () -- C:\Windows\BRWMARK.INI
[2013.01.20 06:04:16 | 000,000,027 | ---- | C] () -- C:\Windows\BRPP2KA.INI
[2013.01.20 03:27:40 | 001,654,948 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012.09.21 21:08:36 | 010,919,784 | ---- | C] () -- C:\Windows\SysWow64\LogiDPP.dll
[2012.09.21 21:08:36 | 000,338,136 | ---- | C] () -- C:\Windows\SysWow64\DevManagerCore.dll
[2012.09.21 21:08:36 | 000,103,272 | ---- | C] () -- C:\Windows\SysWow64\LogiDPPApp.exe
 
========== ZeroAccess Check ==========
 
[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2013.02.27 07:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013.02.27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.21 05:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== LOP Check ==========
 
[2013.04.12 22:39:47 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\.minecraft
[2013.02.16 21:19:56 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\.Nitrous
[2013.07.20 02:16:34 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\.purple
[2013.07.05 13:59:23 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Amazon
[2013.07.03 18:41:34 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Bitcoin
[2013.07.20 15:44:47 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Bitdefender
[2013.04.28 17:04:38 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant
[2013.04.28 19:28:23 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\com.adobe.formscentral.FormsCentralForAcrobat
[2013.03.21 18:05:14 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\DVDVideoSoft
[2013.01.20 22:15:40 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\DVDVideoSoftIEHelpers
[2013.07.19 21:32:32 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\FileZilla
[2013.04.28 19:16:45 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\GHISLER
[2013.06.11 22:43:22 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\ICQ-Profile
[2013.06.11 22:40:58 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\ICQM
[2013.01.21 16:40:38 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Leadertech
[2013.06.03 20:41:54 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\LolClient
[2013.05.17 20:53:44 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\MAXON
[2013.02.07 18:57:47 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\netz
[2013.05.05 14:58:44 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Notepad++
[2013.06.28 19:38:30 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\OpenVPN Technologies
[2013.01.21 20:46:49 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\PDAppFlex
[2013.05.17 20:45:06 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Publish Providers
[2013.05.20 00:51:22 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\puush
[2013.07.20 15:41:40 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\QuickScan
[2013.01.24 19:51:50 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\six-zsync
[2013.05.26 00:30:30 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Sony
[2013.05.20 20:22:30 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\SplitMediaLabs
[2013.03.28 23:30:16 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\TeamViewer
[2013.07.01 22:26:57 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\TrueCrypt
[2013.01.25 00:37:31 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Wireshark
[2013.05.26 18:47:34 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\XMedia Recode
 
========== Purity Check ==========
 
 

< End of report >
         

--- --- ---
[/CODE]
Extras:OTL Logfile:

OTL Extras logfile created on: 20.07.2013 17:38:19 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Admin\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
9,99 Gb Total Physical Memory | 6,77 Gb Available Physical Memory | 67,73% Memory free
10,99 Gb Paging File | 7,63 Gb Available in Paging File | 69,42% Paging File free
Paging file location(s): c:\pagefile.sys 1024 1024 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 59,62 Gb Total Space | 12,08 Gb Free Space | 20,26% Space Free | Partition Type: NTFS
Drive D: | 781,25 Gb Total Space | 609,55 Gb Free Space | 78,02% Space Free | Partition Type: NTFS
Drive E: | 616,01 Gb Total Space | 595,13 Gb Free Space | 96,61% Space Free | Partition Type: NTFS
Drive R: | 1021,97 Mb Total Space | 1021,95 Mb Free Space | 100,00% Space Free | Partition Type: FAT32
 
Computer Name: ADMIN-PC | User Name: Admin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- D:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
http [open] -- Reg Error: Key error.
https [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Bridge] -- D:\Photoshop CS6 Extended\PS CS6\Adobe Bridge CS6 (64 Bit)\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [Browse with &IrfanView] -- "D:\Program Files (x86)\IrfanView\i_view32.exe" "%1 /thumbs" (Irfan Skiljan)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [mplayerc64.enqueue] -- "E:\Treiber\MPC-HC.1.6.5.6366.x64\MPC-HC.1.6.5.6366.x64\mpc-hc64.exe" /add "%1" (MPC-HC Team)
Directory [mplayerc64.play] -- "E:\Treiber\MPC-HC.1.6.5.6366.x64\MPC-HC.1.6.5.6366.x64\mpc-hc64.exe" "%1" (MPC-HC Team)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
http [open] -- Reg Error: Key error.
https [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Bridge] -- D:\Photoshop CS6 Extended\PS CS6\Adobe Bridge CS6 (64 Bit)\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [Browse with &IrfanView] -- "D:\Program Files (x86)\IrfanView\i_view32.exe" "%1 /thumbs" (Irfan Skiljan)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [mplayerc64.enqueue] -- "E:\Treiber\MPC-HC.1.6.5.6366.x64\MPC-HC.1.6.5.6366.x64\mpc-hc64.exe" /add "%1" (MPC-HC Team)
Directory [mplayerc64.play] -- "E:\Treiber\MPC-HC.1.6.5.6366.x64\MPC-HC.1.6.5.6366.x64\mpc-hc64.exe" "%1" (MPC-HC Team)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
"DoNotAllowExceptions" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
"DoNotAllowExceptions" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{5BFCC678-B851-4911-8D19-838BC0C3F3B2}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\outlook.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{00CEB7F8-0A40-45A6-BB8A-050C73159A3C}" = dir=in | app=d:\users\admin\documents\the war z\warz.exe | 
"{05463F9E-6F7F-4420-89BB-B6AF49B6032D}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{0BEEDC34-17F9-4077-80AC-1E85A4CA23BA}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{165D3B4D-6406-44A2-890A-06B2F26062DC}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1267\agent.exe | 
"{18B3FB9D-AB9F-4A69-952C-483D01390AF6}" = protocol=17 | dir=in | app=d:\program files (x86)\combat arms\ca\combat arms eu\nmservice.exe | 
"{19A299F3-1991-41AD-AA44-9DBBB2B4F9FE}" = protocol=6 | dir=in | app=d:\combat arms\combat arms eu\nmservice.exe | 
"{1ABC2D16-8F86-48FC-958F-185FE0E6E8F5}" = protocol=17 | dir=in | app=d:\program files (x86)\premiumsoft\navicat premium\navicat.exe | 
"{20291E71-B9CB-41F1-AB1B-41AC0A389CB5}" = protocol=17 | dir=in | app=e:\metin2\sanii v2\client\clientstarter.exe | 
"{213AD472-7939-4CDA-9659-9047790C1EE5}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 
"{32E1C016-D173-4694-BED4-C94D5EC03132}" = protocol=17 | dir=in | app=c:\users\admin\appdata\roaming\icqm\icq.exe | 
"{378FFAA6-CB22-45CF-B24B-654715C91D29}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1544\agent.exe | 
"{3B5DB8AD-2C2F-4DA0-8A73-C834491E7873}" = protocol=6 | dir=in | app=d:\program files (x86)\teamviewer\version8\teamviewer_service.exe | 
"{3F20C220-4AF3-4475-9D38-4E99DB8E2826}" = protocol=17 | dir=in | app=d:\program files (x86)\teamviewer\version8\teamviewer_service.exe | 
"{42BB6E87-D31D-42DA-BBE5-05314CD3D5DA}" = protocol=17 | dir=in | app=c:\programdata\nexoneu\ngm\ngm.exe | 
"{46CE6459-1F6C-41BD-A587-87307B31212A}" = protocol=6 | dir=in | app=e:\metin2\clients\ephelion2\ephelion2.exe | 
"{47B30923-5340-4213-9BB8-32CB803F0272}" = protocol=6 | dir=in | app=d:\program files (x86)\starctaft ii\starcraft ii\starcraft ii public test.exe | 
"{4C36C975-9288-43C0-89D0-47B07B121648}" = protocol=6 | dir=in | app=c:\users\admin\appdata\roaming\icqm\icq.exe | 
"{50DC1E6D-6015-4E49-A5C9-011C49159E25}" = dir=in | app=e:\itunes\itunes.exe | 
"{53501722-AA70-44C9-A381-1C561B377C76}" = protocol=17 | dir=in | app=d:\combat arms\combat arms eu\nmservice.exe | 
"{5644CE3A-230B-4533-A6C0-9134D8F94E54}" = dir=in | app=d:\program files (x86)\skype\phone\skype.exe | 
"{57A1DA27-5CC9-43DB-8741-56023292E69E}" = protocol=6 | dir=in | app=d:\program files (x86)\steam\steam.exe | 
"{5A92FCBA-6A98-466E-9736-B6C45CD1D672}" = protocol=6 | dir=in | app=d:\program files (x86)\combat arms\ca\combat arms eu\nmservice.exe | 
"{63FC6CCD-CE7D-414F-A439-793A52C7375A}" = protocol=6 | dir=in | app=e:\metin2\clients\invoice-world2 client\metin2client.exe | 
"{79E5B22C-1B74-4132-AD9C-0A1E23B337E0}" = protocol=17 | dir=in | app=c:\users\admin\desktop\mymetin\clientstarter.exe | 
"{81CF026E-58DD-4E41-B9A6-1FAC6CB00EB2}" = protocol=6 | dir=in | app=d:\program files (x86)\teamviewer\version8\teamviewer.exe | 
"{82269EC7-ECBF-4CDC-AB56-9B30A5477723}" = protocol=17 | dir=in | app=e:\metin2\clients\invoice-world2 client\metin2client.exe | 
"{89CE3550-109F-4997-AA85-509AC353ED05}" = protocol=17 | dir=in | app=d:\program files (x86)\steam\steam.exe | 
"{8CA5A646-9D2E-444A-A412-1F2CA60CE80F}" = protocol=6 | dir=in | app=d:\program files (x86)\combat arms\ca\combat arms eu\nmservice.exe | 
"{A016CBDF-4DB7-4707-B5D9-3C9DDF94F76F}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 
"{A0A7CB43-55BD-4F31-B48E-31A1EE318EF3}" = protocol=17 | dir=in | app=d:\program files (x86)\teamviewer\version8\teamviewer.exe | 
"{A5E9CE63-10B4-4232-8062-E9E3F1936E3C}" = protocol=6 | dir=in | app=e:\metin2\sanii v2\client\clientstarter.exe | 
"{AE0414B9-9565-4F02-9792-32316338AD58}" = protocol=17 | dir=in | app=d:\program files (x86)\starctaft ii\starcraft ii\starcraft ii.exe | 
"{B94B19E1-9CD8-4889-B726-B9CA02D8B336}" = protocol=17 | dir=in | app=e:\metin2\clients\ephelion2\ephelion2.exe | 
"{BA3F0D78-14AA-4618-A7ED-13B4F851150D}" = protocol=6 | dir=in | app=c:\users\admin\desktop\metin2\portmap\portmap.exe | 
"{BF4229AC-8FCF-4B02-9A8E-965D0ABA1018}" = protocol=6 | dir=in | app=d:\program files (x86)\steam\steamapps\common\arma 2 free\arma2free.exe | 
"{C113297F-55CA-4B54-8974-6AE1BB83500B}" = protocol=6 | dir=in | app=d:\program files (x86)\starctaft ii\starcraft ii\starcraft ii.exe | 
"{C4011773-9C74-4138-9F86-A089E00475D0}" = protocol=6 | dir=in | app=c:\programdata\nexoneu\ngm\ngm.exe | 
"{CB407DD6-048A-48EC-9602-04521F5C22C1}" = protocol=17 | dir=in | app=d:\program files (x86)\steam\steamapps\common\arma 2 free\arma2free.exe | 
"{CDB8B6AE-F72E-4214-9C7F-1193FF84BDD8}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe | 
"{D09A58E3-3AAE-408E-AA48-EA6EC48F5366}" = protocol=17 | dir=in | app=d:\program files (x86)\combat arms\ca\combat arms eu\nmservice.exe | 
"{D0D141B7-CE32-4A5D-8AAE-0607DD694519}" = protocol=6 | dir=in | app=d:\program files (x86)\steam\steamapps\sodii_like\counter-strike source\hl2.exe | 
"{D470B6CF-BA94-4148-A2F9-E692184B0BEF}" = protocol=6 | dir=in | app=c:\users\admin\desktop\mymetin\clientstarter.exe | 
"{D7B4FFC7-9520-4B4D-A241-6C17F61D7192}" = protocol=17 | dir=in | app=c:\users\admin\desktop\metin2\portmap\portmap.exe | 
"{D8F11339-C369-40B7-A5A1-B5B51C6C2803}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe | 
"{DB4D9186-6D8A-4D05-9F11-255FC937D477}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1544\agent.exe | 
"{DF3A23D6-1A12-43C2-8AB4-FA601C032A8E}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe | 
"{E149499D-C8AA-4AD7-B1EF-3594BD436723}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1267\agent.exe | 
"{E96615CE-AD91-47C3-85A1-8FB0703CE0DB}" = protocol=17 | dir=in | app=d:\program files (x86)\starctaft ii\starcraft ii\starcraft ii public test.exe | 
"{FDBD1162-DD22-43D0-B24D-93079AD6686C}" = protocol=6 | dir=in | app=d:\program files (x86)\premiumsoft\navicat premium\navicat.exe | 
"{FF9E916A-012F-4CB6-8EBF-B426B57DE402}" = protocol=17 | dir=in | app=d:\program files (x86)\steam\steamapps\sodii_like\counter-strike source\hl2.exe | 
"TCP Query User{1294DB01-E4EC-4C63-8641-3E33EDE3A780}E:\metin2\clients\ephelion2\ephelion2.exe" = protocol=6 | dir=in | app=e:\metin2\clients\ephelion2\ephelion2.exe | 
"TCP Query User{18262028-7D15-4B7C-BD86-B3617805A0EE}E:\metin2\clients\nakumi3 client\nakumi3.exe" = protocol=6 | dir=in | app=e:\metin2\clients\nakumi3 client\nakumi3.exe | 
"TCP Query User{20A18353-F1E7-42E7-8C1B-5A8515CAEDA8}E:\zephos\zephos\zephos.exe" = protocol=6 | dir=in | app=e:\zephos\zephos\zephos.exe | 
"TCP Query User{280748C0-0667-442C-B37D-121877210894}D:\program files (x86)\six projects\six updater\tools\bin\rsync.exe" = protocol=6 | dir=in | app=d:\program files (x86)\six projects\six updater\tools\bin\rsync.exe | 
"TCP Query User{3E38A290-FCCF-4C8E-A8F8-3404DE9DAB74}C:\users\admin\desktop\ms paint\ms paint\ms paint updater.exe" = protocol=6 | dir=in | app=c:\users\admin\desktop\ms paint\ms paint\ms paint updater.exe | 
"TCP Query User{3ED3A606-1F75-4842-A111-9921863577E7}D:\program files (x86)\combat arms\ca\combat arms eu\engine.exe" = protocol=6 | dir=in | app=d:\program files (x86)\combat arms\ca\combat arms eu\engine.exe | 
"TCP Query User{43077FC4-A37B-48BF-988E-4D7695842261}C:\program files\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe | 
"TCP Query User{460FA642-82CF-47D7-9DCF-28168705F6AB}E:\metin2\clients\infernum - client -2013\infernum.exe" = protocol=6 | dir=in | app=e:\metin2\clients\infernum - client -2013\infernum.exe | 
"TCP Query User{4D17C74E-94B8-43BB-8E4D-E1472DA3A940}C:\nexon\nexon_eu_downloader\nexon_eu_downloader_engine.exe" = protocol=6 | dir=in | app=c:\nexon\nexon_eu_downloader\nexon_eu_downloader_engine.exe | 
"TCP Query User{6774DBF0-E10B-46EB-B14E-CA447F821733}D:\downloads\zephos\zephos.exe" = protocol=6 | dir=in | app=d:\downloads\zephos\zephos.exe | 
"TCP Query User{7E81B9D8-67D0-4098-8CAB-57520740E7C5}E:\metin2\sanii v2\client\clientstarter.exe" = protocol=6 | dir=in | app=e:\metin2\sanii v2\client\clientstarter.exe | 
"TCP Query User{80F8685F-B4C1-44C2-B4D2-15926CA7A798}D:\combat arms\combat arms eu\engine.exe" = protocol=6 | dir=in | app=d:\combat arms\combat arms eu\engine.exe | 
"TCP Query User{96B4FD43-760C-4175-829B-0166E0C03A63}E:\dokumente\legonia\legonia-client\legonia.exe" = protocol=6 | dir=in | app=e:\dokumente\legonia\legonia-client\legonia.exe | 
"TCP Query User{A590A9D9-8610-4C5B-B8D3-A468BA4D19A0}C:\users\admin\desktop\metin2\portmap\portmap.exe" = protocol=6 | dir=in | app=c:\users\admin\desktop\metin2\portmap\portmap.exe | 
"TCP Query User{A804A08E-E03E-4E50-B7CC-1EAC1603905A}D:\program files (x86)\steam\steamapps\common\arma 2 operation arrowhead\expansion\beta\arma2oa.exe" = protocol=6 | dir=in | app=d:\program files (x86)\steam\steamapps\common\arma 2 operation arrowhead\expansion\beta\arma2oa.exe | 
"TCP Query User{AADBC681-C686-4940-B719-E6750301C9DB}C:\users\admin\desktop\mymetin\clientstarter.exe" = protocol=6 | dir=in | app=c:\users\admin\desktop\mymetin\clientstarter.exe | 
"TCP Query User{C4030AE6-1557-4DAE-BD5B-380E04B235C3}D:\program files (x86)\java\bin\javaw.exe" = protocol=6 | dir=in | app=d:\program files (x86)\java\bin\javaw.exe | 
"TCP Query User{D24251A2-EEFA-44D5-8BFD-618B57EEA5CC}E:\metin2\clients\sharvan 2\sharvan 2 64bit.exe" = protocol=6 | dir=in | app=e:\metin2\clients\sharvan 2\sharvan 2 64bit.exe | 
"TCP Query User{D8BBF850-AF24-485C-B55A-1F340980CE45}D:\program files (x86)\java\64bit\bin\javaw.exe" = protocol=6 | dir=in | app=d:\program files (x86)\java\64bit\bin\javaw.exe | 
"TCP Query User{E2DF6E6F-1B61-4DE9-A697-6FDC395EE4CB}C:\nexon\nexon_eu_downloader\nexon_eu_downloader_engine.exe" = protocol=6 | dir=in | app=c:\nexon\nexon_eu_downloader\nexon_eu_downloader_engine.exe | 
"TCP Query User{F923A3F1-A8F3-4231-81D4-2C97625931F4}E:\metin2\clients\invoice-world2 client\metin2client.exe" = protocol=6 | dir=in | app=e:\metin2\clients\invoice-world2 client\metin2client.exe | 
"TCP Query User{FFE29F5E-4A8A-43AF-8CE9-697BC4981A70}D:\program files (x86)\premiumsoft\navicat premium\navicat.exe" = protocol=6 | dir=in | app=d:\program files (x86)\premiumsoft\navicat premium\navicat.exe | 
"UDP Query User{02EAD615-CD0D-45D6-BBCA-A0FB5851FAA2}C:\program files\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe | 
"UDP Query User{1660815E-C52C-4277-A9B6-203A50AB6773}D:\program files (x86)\java\bin\javaw.exe" = protocol=17 | dir=in | app=d:\program files (x86)\java\bin\javaw.exe | 
"UDP Query User{1F898738-1E0A-4D83-BDE9-1DFA34E0AC3D}E:\metin2\clients\nakumi3 client\nakumi3.exe" = protocol=17 | dir=in | app=e:\metin2\clients\nakumi3 client\nakumi3.exe | 
"UDP Query User{2376399C-2B40-4011-B64A-29CC5BC11F4F}D:\program files (x86)\combat arms\ca\combat arms eu\engine.exe" = protocol=17 | dir=in | app=d:\program files (x86)\combat arms\ca\combat arms eu\engine.exe | 
"UDP Query User{281A444E-75CD-4ADB-AE32-901032631311}D:\program files (x86)\steam\steamapps\common\arma 2 operation arrowhead\expansion\beta\arma2oa.exe" = protocol=17 | dir=in | app=d:\program files (x86)\steam\steamapps\common\arma 2 operation arrowhead\expansion\beta\arma2oa.exe | 
"UDP Query User{36E4A32A-0A7C-4F77-B16B-C3EC26B2B6A8}E:\metin2\clients\invoice-world2 client\metin2client.exe" = protocol=17 | dir=in | app=e:\metin2\clients\invoice-world2 client\metin2client.exe | 
"UDP Query User{3E963272-0BDB-4954-8748-9AE94B7361E6}E:\dokumente\legonia\legonia-client\legonia.exe" = protocol=17 | dir=in | app=e:\dokumente\legonia\legonia-client\legonia.exe | 
"UDP Query User{421FF8E5-DCF8-4B74-8A6F-C6226B37B1D5}C:\users\admin\desktop\mymetin\clientstarter.exe" = protocol=17 | dir=in | app=c:\users\admin\desktop\mymetin\clientstarter.exe | 
"UDP Query User{466AE488-9774-4C68-BE9A-4F0A0EE08BD9}E:\metin2\clients\infernum - client -2013\infernum.exe" = protocol=17 | dir=in | app=e:\metin2\clients\infernum - client -2013\infernum.exe | 
"UDP Query User{5B5DAC7F-F289-4ECE-B28D-0F43F78B7C71}E:\metin2\clients\sharvan 2\sharvan 2 64bit.exe" = protocol=17 | dir=in | app=e:\metin2\clients\sharvan 2\sharvan 2 64bit.exe | 
"UDP Query User{64491142-FE6E-4250-B72A-478FAD49BEB8}D:\program files (x86)\six projects\six updater\tools\bin\rsync.exe" = protocol=17 | dir=in | app=d:\program files (x86)\six projects\six updater\tools\bin\rsync.exe | 
"UDP Query User{80A5A919-8E06-4BF7-B505-82F1AC46D20D}D:\downloads\zephos\zephos.exe" = protocol=17 | dir=in | app=d:\downloads\zephos\zephos.exe | 
"UDP Query User{8161A08F-E2EE-4E5B-A92F-CAF489B2DB79}C:\nexon\nexon_eu_downloader\nexon_eu_downloader_engine.exe" = protocol=17 | dir=in | app=c:\nexon\nexon_eu_downloader\nexon_eu_downloader_engine.exe | 
"UDP Query User{9E414BFE-8F2B-4F60-B3F4-5FD170389420}C:\users\admin\desktop\metin2\portmap\portmap.exe" = protocol=17 | dir=in | app=c:\users\admin\desktop\metin2\portmap\portmap.exe | 
"UDP Query User{B80658C6-99ED-49A3-B6C7-7AEE149E7815}E:\metin2\clients\ephelion2\ephelion2.exe" = protocol=17 | dir=in | app=e:\metin2\clients\ephelion2\ephelion2.exe | 
"UDP Query User{B8AB395B-CD1A-4914-A54F-9ACA915ABD2B}D:\program files (x86)\java\64bit\bin\javaw.exe" = protocol=17 | dir=in | app=d:\program files (x86)\java\64bit\bin\javaw.exe | 
"UDP Query User{C1165FB3-AB4F-4979-944B-7D0A155A5F22}C:\nexon\nexon_eu_downloader\nexon_eu_downloader_engine.exe" = protocol=17 | dir=in | app=c:\nexon\nexon_eu_downloader\nexon_eu_downloader_engine.exe | 
"UDP Query User{DD97BA1A-A556-4469-A3FB-FD35B33427B5}E:\metin2\sanii v2\client\clientstarter.exe" = protocol=17 | dir=in | app=e:\metin2\sanii v2\client\clientstarter.exe | 
"UDP Query User{DEC3763E-9614-4E9B-BD9A-9178D3E65C7F}D:\combat arms\combat arms eu\engine.exe" = protocol=17 | dir=in | app=d:\combat arms\combat arms eu\engine.exe | 
"UDP Query User{E2B94AE8-D306-4F3A-9928-5C615C9497EC}E:\zephos\zephos\zephos.exe" = protocol=17 | dir=in | app=e:\zephos\zephos\zephos.exe | 
"UDP Query User{EEF56FE2-15D9-4F11-AAD1-42A00BEEA156}D:\program files (x86)\premiumsoft\navicat premium\navicat.exe" = protocol=17 | dir=in | app=d:\program files (x86)\premiumsoft\navicat premium\navicat.exe | 
"UDP Query User{F94B54DE-1FD4-4301-BD9F-4DA3D4069BB6}C:\users\admin\desktop\ms paint\ms paint\ms paint updater.exe" = protocol=17 | dir=in | app=c:\users\admin\desktop\ms paint\ms paint\ms paint updater.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0F37D969-1260-419E-B308-EF7D29ABDE20}" = Web Deployment Tool
"{11EB3D68-A5BE-43EA-8D31-43B08ADB0DA4}" = Microsoft Sync Services for ADO.NET v2.0 SP1 (x64) de
"{197B3774-B7E6-4D50-AD0D-7F99B1E264D2}" = Microsoft SQL Server System CLR Types (x64)
"{1AD147D0-BE0E-3D6C-AC11-64F6DC4163F1}" = Microsoft .NET Framework 4.5
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219
"{26A24AE4-039D-4CA4-87B4-2F86417017FF}" = Java 7 Update 17 (64-bit)
"{2DF4C5DD-7417-301D-935D-939D3B7B5997}" = Microsoft Help Viewer 1.0 Language Pack - DEU
"{2F72F540-1F60-4266-9506-952B21D6640D}" = Apple Mobile Device Support
"{47BA3A3A-6B4E-307F-A43B-724079FE90C6}" = Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{5D068141-189F-39E2-A052-E40D4B561256}" = Microsoft Visual Studio 2010 Tools for Office Runtime (x64)
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{64A3A4F4-B792-11D6-A78A-00B0D0170170}" = Java SE Development Kit 7 Update 17 (64-bit)
"{690285C2-2481-44FB-8402-162EA970A6DD}" = Logitech Gaming Software
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{76FF0F03-B707-4332-B5D1-A56C8303514E}" = iTunes
"{7AC5FFA7-6815-4AED-B16D-8E0D7CC4B221}" = Microsoft Sync Framework Runtime v1.0 SP1 (x64) de
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8583E7E3-2237-4981-B957-E28E5E9AB678}" = Microsoft SQL Server 2008 R2 Management Objects (x64)
"{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010
"{90140000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2010
"{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031" = Microsoft .NET Framework 4.5 DEU Language Pack
"{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033" = Microsoft .NET Framework 4.5
"{94D70749-4281-39AC-AD90-B56A0E0A402E}" = Microsoft Visual C++ 2010  x64 Runtime - 10.0.30319
"{95A2AD24-BD44-3E39-A31F-CE928276577E}" = Microsoft Visual C++ 2010  x64 Designtime - 10.0.30319
"{9AB0D5B6-4779-8C4F-CA91-A1FEDB56D7EC}" = AMD Catalyst Install Manager
"{A1A75F4F-9C9F-11E2-8FCB-F04DA23A5C58}" = Vegas Pro 12.0 (64-bit)
"{A1F50E06-E514-393D-AAEB-2F989F0B7C68}" = Microsoft Team Foundation Server 2010 Object Model - DEU
"{A2585A63-ADD2-3F54-9819-125E680CC7E1}" = Microsoft .NET Framework 4.5 DEU Language Pack
"{A528BDDE-9C9F-11E2-9F0C-F04DA23A5C58}" = MSVCRT Redists
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{C3EAE456-7E7A-451F-80EF-F34C7A13C558}" = Microsoft SQL Server Compact 3.5 SP2 x64 DEU
"{EF9A1373-9238-4E11-8FF8-7B83996F5BE5}" = Microsoft Sync Framework Services v1.0 SP1 (x64) de
"{FCADA26A-5672-31DD-BF0E-BA76ECF9B02D}" = Microsoft Help Viewer 1.0
"Bitdefender" = Bitdefender Internet Security
"Logitech Gaming Software" = Logitech Gaming Software 8.45
"Microsoft Help Viewer 1.0" = Microsoft Help Viewer 1.0
"Microsoft Help Viewer 1.0 Language Pack - DEU" = Microsoft Help Viewer 1.0 Language Pack - DEU
"Microsoft Team Foundation Server 2010 Object Model - DEU" = Microsoft Team Foundation Server 2010-Objektmodell - DEU
"Microsoft Visual Studio 2010 Tools for Office Runtime (x64)" = Microsoft Visual Studio 2010 Tools for Office Runtime (x64)
"Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU" = Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU
"PROSet" = Intel(R) Network Connections Drivers
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"WinRAR archiver" = WinRAR 4.20 (64-Bit)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0125D081-30D0-4A97-82A8-C28D444B6256}" = Microsoft SQL Server Compact 3.5 SP2 DEU
"{072A5217-8165-4AB7-8366-36CB3245DB60}" = OpenVPN Client
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{08DA8E46-ED67-451A-9246-50E0FF6959C9}" = Microsoft Sync Framework SDK v1.0 SP1 de
"{1798D459-6B8B-474B-868D-1229EADA3B95}" = Adobe AIR
"{1803A630-3C38-4D2B-9B9A-0CB37243539C}" = Microsoft ASP.NET MVC 2
"{181241DD-2FC2-4CF9-94CE-97F3E37D6F0B}" = Adobe Edge Animate
"{185F9795-9663-4F13-9EF9-307A282ADB5A}" = ph
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{289AC7E0-0AEE-4a7b-913C-709D9803D23E}" = Nexon Game Manager
"{2A075BB4-E976-4278-BF3F-E5C6945D84C0}" = bl
"{30FD541D-3C9D-41C4-B240-A994EE4E0231}" = Adobe Audition CS6
"{31C3C6EA-E991-405F-A3AA-2C070CCCC47C}" = Microsoft ASP.NET MVC 2 - Visual Studio 2010 Tools - DEU
"{40416836-56CC-4C0E-A6AF-5C34BADCE483}" = Microsoft ASP.NET MVC 2 - Visual Studio 2010 Tools
"{4817D846-700B-474E-A31B-80892B3E92E3}" = Adobe After Effects CS6
"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.6
"{51682D1A-7FFF-44B4-960F-447C0F63E90D}" = RAMDisk
"{5242B252-01BB-4F2E-BBF4-5C01BC3B6619}" = Microsoft SQL Server 2008 R2 Data-Tier Application Project
"{5449FB4F-1802-4D5B-A6D8-087DB1142147}" = Realtek HDMI Audio Driver for ATI
"{5A08C9D1-37AD-4A8D-90D3-33F92C578AA5}" = Microsoft SQL Server System CLR Types
"{5A883D2B-D279-0D01-6E62-B810AFD8CC62}" = Catalyst Control Center InstallProxy
"{5D09C772-ECB3-442B-9CC6-B4341C78FDC2}" = Apple Application Support
"{5E386C5B-CDE7-435A-B5C9-EC73A1B0553A}" = NVIDIA Photoshop Plug-ins 64 bit
"{616C6F39-4CE1-3434-A665-2F6A04C09A7F}" = Microsoft Visual Studio 2010 ADO.NET Entity Framework Tools
"{681F4E9F-34E0-36BD-BF2C-100554E403A5}" = Microsoft Visual F# 2.0 Runtime Language Pack - DEU
"{6A86554B-8928-30E4-A53C-D7337689134D}" = Microsoft Visual C++ 2010  x86 Runtime - 10.0.30319
"{6CDEAD7E-F8D8-37F7-AB6F-1E22716E30F3}" = Microsoft Visual Studio Macro Tools
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{729A3000-BC8A-3B74-BA5D-5068FE12D70C}" = Microsoft Visual F# 2.0 Runtime
"{74EB3499-8B95-4B5C-96EB-7B342F3FD0C6}" = Adobe Photoshop CS6
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7FC7AD70-1DF3-4B84-9AA2-4FB680F45572}_is1" = Hex-Editor MX
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-003D-0000-0000-0000000FF1CE}" = Microsoft Office Single Image 2010
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{91F54E1D-804A-46D8-A56C-53EA9C4B3177}" = Microsoft Silverlight 3 SDK - Deutsch
"{92606477-9366-4D3B-8AE3-6BE4B29727AB}" = League of Legends
"{92C5C058-E941-47C3-B7E8-38A79C605969}" = Microsoft SQL Server 2008 R2 Transact-SQL Language Service
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95140000-0081-0407-0000-0000000FF1CE}" = Microsoft Office Outlook Connector
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9C3B8582-A72A-4835-8903-877A834407BB}" = Microsoft SQL Server 2008 R2-Datenebenenanwendungs-Framework
"{9C4D79B6-238E-49D8-AEBC-26384EBDE6B3}" = Windows Phone app for desktop
"{A106D33E-6B43-42C0-9BFC-D03303261FA7}" = Microsoft SQL Server 2008 R2 Management Objects
"{A4ED5E53-7AA0-11E1-BF04-B2D4D4A5360E}" = Adobe Dreamweaver CS6
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC41D924-8C68-4BD5-A7A1-0AE4176C31A6}" = Crystal Reports for Visual Studio
"{ACE28263-76A4-4BF5-B6F4-8BD719595969}" = Microsoft SQL Server Database Publishing Wizard 1.4
"{AF37176A-78CA-545B-34EF-8B6A21514DD1}" = Adobe Help Manager
"{BFEAAE77-BD7F-4534-B286-9C5CB4697EB1}" = PDF Settings CS6
"{C3592426-531E-4110-911D-BFECE2CE284B}" = puush
"{CAD6AA29-9CA1-384D-8034-566261CFCC9B}" = Microsoft Visual Studio 2010 Professional - DEU
"{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}" = Microsoft .NET Framework 4 Multi-Targeting Pack
"{D40EB009-0499-459c-A8AF-C9C110766215}" = Logitech Webcam-Software
"{E4E9CBC9-1CF5-48E3-AF6F-1AB44A856346}" = Microsoft ASP.NET MVC 2 - DEU
"{EC66418E-DAA2-36D5-809E-40BEC94E622A}" = Microsoft Visual Studio Macro Tools - DEU Language Pack
"{EFBE6DD5-B224-96E5-72B9-68D328CB12A6}" = Adobe Widget Browser
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Help Manager
"com.adobe.WidgetBrowser" = Adobe Widget Browser
"FileZilla Client" = FileZilla Client 3.6.0.2
"Fraps" = Fraps (remove only)
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.12.1.320
"IrfanView" = IrfanView (remove only)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.75.0.1300
"Microsoft Visual Studio 2010 Professional - DEU" = Microsoft Visual Studio 2010 Professional - DEU
"Microsoft Visual Studio Macro Tools" = Microsoft Visual Studio Macro Tools
"Microsoft Visual Studio Macro Tools - DEU Language Pack" = Microsoft Visual Studio Macro Tools - DEU Language Pack
"Mozilla Firefox 17.0.5 (x86 de)" = Mozilla Firefox 17.0.5 (x86 de)
"Notepad++" = Notepad++
"Office14.SingleImage" = Microsoft Office Professional 2010
"Pidgin" = Pidgin
"pidgin-otr" = pidgin-otr 4.0.0-1
"SumatraPDF" = SumatraPDF
"TrueCrypt" = TrueCrypt
"WinPcapInst" = WinPcap 4.1.3
"winscp3_is1" = WinSCP 5.1.4
"Wireshark" = Wireshark 1.10.0 (64-bit)
"x264vfw" = x264vfw - H.264/MPEG-4 AVC codec (remove only)
"xampp" = XAMPP 1.8.1-0
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Amazon MP3-Downloader" = Amazon MP3-Downloader 1.0.18
"ICQ" = ICQ 8.0 (build 6017)
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 20.07.2013 07:09:01 | Computer Name = Admin-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: FlashPlayerPlugin_11_7_700_224.exe,
 Version: 11.7.700.224, Zeitstempel: 0x51a67447  Name des fehlerhaften Moduls: FlashPlayerPlugin_11_7_700_224.exe,
 Version: 11.7.700.224, Zeitstempel: 0x51a67447  Ausnahmecode: 0x40000015  Fehleroffset:
 0x000178f0  ID des fehlerhaften Prozesses: 0xfc8  Startzeit der fehlerhaften Anwendung:
 0x01ce8536ad2d6f6e  Pfad der fehlerhaften Anwendung: C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe
Pfad
 des fehlerhaften Moduls: C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe
Berichtskennung:
 c78d5844-f12c-11e2-842c-00016c6ebaf1
 
Error - 20.07.2013 07:48:54 | Computer Name = Admin-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 20.07.2013 08:51:30 | Computer Name = Admin-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 20.07.2013 08:53:46 | Computer Name = Admin-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: icq.exe, Version: 8.0.6017.0, Zeitstempel:
 0x51681572  Name des fehlerhaften Moduls: YLUSBTEL.dll_unloaded, Version: 0.0.0.0,
 Zeitstempel: 0x4c19cc23  Ausnahmecode: 0xc0000005  Fehleroffset: 0x1008d9a8  ID des fehlerhaften
 Prozesses: 0x970  Startzeit der fehlerhaften Anwendung: 0x01ce85479d36cf7b  Pfad der
 fehlerhaften Anwendung: C:\Users\Admin\AppData\Roaming\ICQM\icq.exe  Pfad des fehlerhaften
 Moduls: YLUSBTEL.dll  Berichtskennung: 69844db4-f13b-11e2-a565-00016c6ebaf1
 
Error - 20.07.2013 08:53:52 | Computer Name = Admin-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: icq.exe, Version: 8.0.6017.0, Zeitstempel:
 0x51681572  Name des fehlerhaften Moduls: YLUSBTEL.dll_unloaded, Version: 0.0.0.0,
 Zeitstempel: 0x4c19cc23  Ausnahmecode: 0xc0000005  Fehleroffset: 0x100150e6  ID des fehlerhaften
 Prozesses: 0x970  Startzeit der fehlerhaften Anwendung: 0x01ce85479d36cf7b  Pfad der
 fehlerhaften Anwendung: C:\Users\Admin\AppData\Roaming\ICQM\icq.exe  Pfad des fehlerhaften
 Moduls: YLUSBTEL.dll  Berichtskennung: 6d817ae8-f13b-11e2-a565-00016c6ebaf1
 
Error - 20.07.2013 08:53:53 | Computer Name = Admin-PC | Source = Microsoft-Windows-RestartManager | ID = 10006
Description = Die Anwendung oder der Dienst "ICQ" konnte nicht heruntergefahren 
werden.
 
Error - 20.07.2013 09:59:56 | Computer Name = Admin-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 20.07.2013 10:05:02 | Computer Name = Admin-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 20.07.2013 10:29:45 | Computer Name = Admin-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: FlashPlayerPlugin_11_7_700_224.exe,
 Version: 11.7.700.224, Zeitstempel: 0x51a67447  Name des fehlerhaften Moduls: FlashPlayerPlugin_11_7_700_224.exe,
 Version: 11.7.700.224, Zeitstempel: 0x51a67447  Ausnahmecode: 0x40000015  Fehleroffset:
 0x000178f0  ID des fehlerhaften Prozesses: 0xbd8  Startzeit der fehlerhaften Anwendung:
 0x01ce8552016673b1  Pfad der fehlerhaften Anwendung: C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe
Pfad
 des fehlerhaften Moduls: C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe
Berichtskennung:
 d25d0acd-f148-11e2-82ad-00016c6ebaf1
 
Error - 20.07.2013 11:33:42 | Computer Name = Admin-PC | Source = WinMgmt | ID = 10
Description = 
 
[ System Events ]
Error - 17.05.2013 10:59:53 | Computer Name = Admin-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1058
 
Error - 17.05.2013 10:59:53 | Computer Name = Admin-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1058
 
Error - 17.05.2013 10:59:53 | Computer Name = Admin-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1058
 
Error - 17.05.2013 10:59:59 | Computer Name = Admin-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1058
 
Error - 17.05.2013 10:59:59 | Computer Name = Admin-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1058
 
Error - 17.05.2013 10:59:59 | Computer Name = Admin-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1058
 
Error - 17.05.2013 11:00:31 | Computer Name = Admin-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1058
 
Error - 17.05.2013 11:00:31 | Computer Name = Admin-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1058
 
Error - 17.05.2013 11:00:31 | Computer Name = Admin-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1058
 
Error - 17.05.2013 11:04:28 | Computer Name = Admin-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1058
 
 
< End of report >
         

--- --- ---

hi.

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

• Starte jetzt FRST.
• Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
• Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
• Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Addition.txt

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 23-07-2013
Ran by Admin at 2013-07-24 12:36:40
Running from C:\Users\Admin\Desktop\Scann
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================


Adobe Flash Player 11 ActiveX (x32 Version: 11.3.300.265)
Adobe Flash Player 11 Plugin (x32 Version: 11.7.700.224)
Adobe Help Manager (x32 Version: 4.0.244)
Adobe Widget Browser (x32 Version: 2.0 Build 348)
Adobe Widget Browser (x32 Version: 2.0.348)
Amazon MP3-Downloader 1.0.18 (HKCU Version: 1.0.18)
AMD Catalyst Install Manager (Version: 8.0.911.0)
Apple Application Support (x32 Version: 2.3.4)
Apple Mobile Device Support (Version: 6.1.0.13)
Apple Software Update (x32 Version: 2.1.3.127)
ASUS GPU Tweak (x32 Version: 2.2.8.1)
ASUS Product Register Program (x32 Version: 1.0.017)
bl (x32 Version: 1.0.0)
Bonjour (Version: 3.0.0.10)
Catalyst Control Center InstallProxy (x32 Version: 2013.0328.2218.38225)
Crystal Reports for Visual Studio (x32 Version: 12.51.0.240)
defender Internet Security (Version: 17.13.0.551)
EVEREST Home Edition v2.20 (x32 Version: 2.20)
FileZilla Client 3.6.0.2 (x32 Version: 3.6.0.2)
Fraps (remove only) (x32)
Free YouTube to MP3 Converter version 3.12.1.320 (x32 Version: 3.12.1.320)
Google Update Helper (x32 Version: 1.3.21.135)
Hex-Editor MX (x32 Version: 6.0)
ICQ 8.0 (build 6017) (HKCU Version: 8.0.6017.0)
Intel(R) Network Connections Drivers (Version: 17.4)
IrfanView (remove only) (x32 Version: 4.35)
iTunes (Version: 11.0.4.4)
Java 7 Update 17 (64-bit) (Version: 7.0.170)
Java SE Development Kit 7 Update 17 (64-bit) (Version: 1.7.0.170)
League of Legends (x32 Version: 1.3)
Logitech Gaming Software (Version: 8.40.83)
Logitech Gaming Software 8.45 (Version: 8.45.88)
Logitech Webcam-Software (x32 Version: 2.51)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)
Microsoft .NET Framework 4 Multi-Targeting Pack (x32 Version: 4.0.30319)
Microsoft .NET Framework 4.5 (Version: 4.5.50709)
Microsoft .NET Framework 4.5 DEU Language Pack (Version: 4.5.50709)
Microsoft Application Error Reporting (x32 Version: 12.0.6012.5000)
Microsoft ASP.NET MVC 2 - DEU (x32 Version: 2.0.50331.0)
Microsoft ASP.NET MVC 2 - Visual Studio 2010 Tools - DEU (x32 Version: 2.0.50331.0)
Microsoft ASP.NET MVC 2 - Visual Studio 2010 Tools (x32 Version: 2.0.50217.0)
Microsoft ASP.NET MVC 2 (x32 Version: 2.0.50217.0)
Microsoft Help Viewer 1.0 (Version: 1.0.30319)
Microsoft Help Viewer 1.0 Language Pack - DEU (Version: 1.0.30319)
Microsoft Silverlight (x32 Version: 3.0.40818.0)
Microsoft Silverlight 3 SDK - Deutsch (x32 Version: 3.0.40818.0)
Microsoft SQL Server 2008 R2 Data-Tier Application Project (x32 Version: 10.50.1447.4)
Microsoft SQL Server 2008 R2 Management Objects (x32 Version: 10.50.1447.4)
Microsoft SQL Server 2008 R2 Management Objects (x64) (Version: 10.50.1447.4)
Microsoft SQL Server 2008 R2 Transact-SQL Language Service (x32 Version: 10.50.1447.4)
Microsoft SQL Server 2008 R2-Datenebenenanwendungs-Framework (x32 Version: 10.50.1447.4)
Microsoft SQL Server Compact 3.5 SP2 DEU (x32 Version: 3.5.8080.0)
Microsoft SQL Server Compact 3.5 SP2 x64 DEU (Version: 3.5.8080.0)
Microsoft SQL Server Database Publishing Wizard 1.4 (x32 Version: 10.1.2512.8)
Microsoft SQL Server System CLR Types (x32 Version: 10.50.1447.4)
Microsoft SQL Server System CLR Types (x64) (Version: 10.50.1447.4)
Microsoft Sync Framework Runtime v1.0 SP1 (x64) de (Version: 1.0.3010.0)
Microsoft Sync Framework SDK v1.0 SP1 de (x32 Version: 1.0.3010.0)
Microsoft Sync Framework Services v1.0 SP1 (x64) de (Version: 1.0.3010.0)
Microsoft Sync Services for ADO.NET v2.0 SP1 (x64) de (Version: 2.0.3010.0)
Microsoft Team Foundation Server 2010 Object Model - DEU (Version: 10.0.30319)
Microsoft Team Foundation Server 2010-Objektmodell - DEU (Version: 10.0.30319)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x64 Designtime - 10.0.30319 (Version: 10.0.30319)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010  x64 Runtime - 10.0.30319 (Version: 10.0.30319)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Microsoft Visual C++ 2010  x86 Runtime - 10.0.30319 (x32 Version: 10.0.30319)
Microsoft Visual F# 2.0 Runtime (x32 Version: 10.0.30319)
Microsoft Visual F# 2.0 Runtime Language Pack - DEU (x32 Version: 10.0.30319)
Microsoft Visual Studio 2010 ADO.NET Entity Framework Tools (x32 Version: 10.0.30319)
Microsoft Visual Studio 2010 Professional - DEU (x32 Version: 10.0.30319)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (Version: 10.0.30319)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU (Version: 10.0.30319)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (Version: 10.0.30319)
Microsoft Visual Studio Macro Tools - DEU Language Pack (x32 Version: 9.0.30729)
Microsoft Visual Studio Macro Tools (x32 Version: 9.0.30729)
Microsoft_VC80_CRT_x86 (x32 Version: 8.0.50727.4053)
Microsoft_VC90_CRT_x86 (x32 Version: 1.00.0000)
Mozilla Firefox 17.0.5 (x86 de) (x32 Version: 17.0.5)
MSVCRT Redists (Version: 1.0)
Nexon Game Manager (x32)
Notepad++ (x32 Version: 6.2.3)
NVIDIA Photoshop Plug-ins 64 bit (x32 Version: 8.50)
OpenVPN Client (x32 Version: 1.5.6)
PDF Settings CS6 (x32 Version: 11.0)
ph (x32 Version: 1.0.0)
Pidgin (x32 Version: 2.10.7)
pidgin-otr 4.0.0-1 (x32 Version: 4.0.0-1)
puush (x32 Version: 1.0.0.0)
RAMDisk (x32 Version: 4.0.1.9)
Realtek HDMI Audio Driver for ATI (x32 Version: 6.0.1.6650)
Skype™ 6.6 (x32 Version: 6.6.106)
SumatraPDF (x32 Version: 2.2.1)
TeamSpeak 3 Client (Version: 3.0.10)
TrueCrypt (x32 Version: 7.1a)
Update for Microsoft .NET Framework 4.5 (KB2750147) (x32 Version: 1)
Vegas Pro 12.0 (64-bit) (Version: 12.0.563)
Web Deployment Tool (Version: 1.1.0618)
Windows Phone app for desktop (x32 Version: 1.0.1720.1)
WinPcap 4.1.3 (x32 Version: 4.1.0.2980)
WinRAR 4.20 (64-Bit) (Version: 4.20.0)
WinSCP 5.1.4 (x32 Version: 5.1.4)
Wireshark 1.10.0 (64-bit) (x32 Version: 1.10.0)
x264vfw - H.264/MPEG-4 AVC codec (remove only) (x32)
XAMPP 1.8.1-0 (x32 Version: 1.8.1-0)

==================== Restore Points  =========================

23-07-2013 10:18:07 Geplanter Prüfpunkt
23-07-2013 17:25:21 Installiert ASUS GPU Tweak

==================== Hosts content: ==========================

2013-04-28 18:06 - 2013-03-12 15:36 - 00002213 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 crl.verisign.net
127.0.0.1 CRL.VERISIGN.NET.*
127.0.0.1 ood.opsource.net
127.0.0.1 209-34-83-73.ood.opsource.net



==================== Scheduled Tasks (whitelisted) =============

Task: {526FDA22-0007-4674-82B4-7A8412524668} - System32\Tasks\FRAPS => D:\Fraps\fraps.exe [2013-02-26] (Beepa P/L)
Task: {EF0240A3-0A40-4C97-B149-57A7FE66A998} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => c:\program files\windows defender\MpCmdRun.exe [2009-07-14] (Microsoft Corporation)

==================== Faulty Device Manager Devices =============

Name: Standardtastatur (PS/2)
Description: Standardtastatur (PS/2)
Class Guid: {4d36e96b-e325-11ce-bfc1-08002be10318}
Manufacturer: (Standardtastaturen)
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name: Microsoft PS/2-Maus
Description: Microsoft PS/2-Maus
Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.


==================== Event log errors: =========================

Application errors:
==================
Error: (07/24/2013 00:13:39 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/23/2013 08:53:39 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/23/2013 07:45:27 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/23/2013 07:35:17 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/23/2013 07:30:07 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: CCC.exe, Version: 3.5.0.0, Zeitstempel: 0x4f8350ef
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725, Zeitstempel: 0x4ec4aa8e
Ausnahmecode: 0xc0000374
Fehleroffset: 0x00000000000c40f2
ID des fehlerhaften Prozesses: 0xa44
Startzeit der fehlerhaften Anwendung: 0xCCC.exe0
Pfad der fehlerhaften Anwendung: CCC.exe1
Pfad des fehlerhaften Moduls: CCC.exe2
Berichtskennung: CCC.exe3

Error: (07/23/2013 07:29:44 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/23/2013 07:29:34 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: MMLoadDrv.exe, Version: 2.0.0.0, Zeitstempel: 0x4fd61ef5
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725, Zeitstempel: 0x4ec49b8f
Ausnahmecode: 0xc0000374
Fehleroffset: 0x000ce6c3
ID des fehlerhaften Prozesses: 0xa04
Startzeit der fehlerhaften Anwendung: 0xMMLoadDrv.exe0
Pfad der fehlerhaften Anwendung: MMLoadDrv.exe1
Pfad des fehlerhaften Moduls: MMLoadDrv.exe2
Berichtskennung: MMLoadDrv.exe3

Error: (07/23/2013 07:28:19 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: CCC.exe, Version: 3.5.0.0, Zeitstempel: 0x4f8350ef
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725, Zeitstempel: 0x4ec4aa8e
Ausnahmecode: 0xc0000374
Fehleroffset: 0x00000000000c40f2
ID des fehlerhaften Prozesses: 0xa84
Startzeit der fehlerhaften Anwendung: 0xCCC.exe0
Pfad der fehlerhaften Anwendung: CCC.exe1
Pfad des fehlerhaften Moduls: CCC.exe2
Berichtskennung: CCC.exe3

Error: (07/23/2013 07:28:07 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: MMLoadDrv.exe, Version: 2.0.0.0, Zeitstempel: 0x4fd61ef5
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725, Zeitstempel: 0x4ec49b8f
Ausnahmecode: 0xc0000374
Fehleroffset: 0x000ce6c3
ID des fehlerhaften Prozesses: 0xb78
Startzeit der fehlerhaften Anwendung: 0xMMLoadDrv.exe0
Pfad der fehlerhaften Anwendung: MMLoadDrv.exe1
Pfad des fehlerhaften Moduls: MMLoadDrv.exe2
Berichtskennung: MMLoadDrv.exe3

Error: (07/23/2013 07:07:35 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (07/24/2013 00:12:04 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "UPnP-Gerätehost" ist vom Dienst "SSDP-Suche" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1058

Error: (07/24/2013 00:12:04 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "UPnP-Gerätehost" ist vom Dienst "SSDP-Suche" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1058

Error: (07/24/2013 00:12:04 PM) (Source: DCOM) (User: )
Description: 1068upnphost{204810B9-73B2-11D4-BF42-00B0D0118B56}

Error: (07/24/2013 00:12:04 PM) (Source: WMPNetworkSvc) (User: )
Description: WMPNetworkSvc0x80070422

Error: (07/24/2013 00:11:58 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1058

Error: (07/24/2013 00:11:57 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1058

Error: (07/24/2013 00:11:49 PM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am ‎23.‎07.‎2013 um 21:50:49 unerwartet heruntergefahren.

Error: (07/23/2013 09:37:08 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1058

Error: (07/23/2013 09:37:08 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1058

Error: (07/23/2013 09:37:06 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1058


Microsoft Office Sessions:
=========================
Error: (07/24/2013 00:13:39 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/23/2013 08:53:39 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/23/2013 07:45:27 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/23/2013 07:35:17 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/23/2013 07:30:07 PM) (Source: Application Error)(User: )
Description: CCC.exe3.5.0.04f8350efntdll.dll6.1.7601.177254ec4aa8ec000037400000000000c40f2a4401ce87ca3200f416C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exeC:\Windows\SYSTEM32\ntdll.dll840a848e-f3bd-11e2-bdef-00016c6ebaf1

Error: (07/23/2013 07:29:44 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/23/2013 07:29:34 PM) (Source: Application Error)(User: )
Description: MMLoadDrv.exe2.0.0.04fd61ef5ntdll.dll6.1.7601.177254ec49b8fc0000374000ce6c3a0401ce87ca328fc6a6C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MMLoadDrv.exeC:\Windows\SysWOW64\ntdll.dll703eb2e7-f3bd-11e2-bdef-00016c6ebaf1

Error: (07/23/2013 07:28:19 PM) (Source: Application Error)(User: )
Description: CCC.exe3.5.0.04f8350efntdll.dll6.1.7601.177254ec4aa8ec000037400000000000c40f2a8401ce87c9fd73be5aC:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exeC:\Windows\SYSTEM32\ntdll.dll43bbd7a7-f3bd-11e2-bdef-00016c6ebaf1

Error: (07/23/2013 07:28:07 PM) (Source: Application Error)(User: )
Description: MMLoadDrv.exe2.0.0.04fd61ef5ntdll.dll6.1.7601.177254ec49b8fc0000374000ce6c3b7801ce87c9fe539ef3C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MMLoadDrv.exeC:\Windows\SysWOW64\ntdll.dll3ca5d02f-f3bd-11e2-bdef-00016c6ebaf1

Error: (07/23/2013 07:07:35 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


CodeIntegrity Errors:
===================================
  Date: 2013-07-20 17:48:00.067
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Users\Admin\AppData\Local\Temp\EverestDriver.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-07-20 17:48:00.037
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Users\Admin\AppData\Local\Temp\EverestDriver.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-07-20 17:47:59.997
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\Lavalys\EVEREST Home Edition\kerneld.amd64" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-07-20 17:47:59.977
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\Lavalys\EVEREST Home Edition\kerneld.amd64" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-05-26 02:31:21.625
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Downloads\32Bit Injector\Injector.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-05-26 02:31:21.596
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Downloads\32Bit Injector\Injector.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-04-09 22:02:25.159
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Downloads\32Bit Injector\Injector.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-04-09 22:02:25.147
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Downloads\32Bit Injector\Injector.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-04-09 22:02:18.814
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Downloads\32Bit Injector\Injector.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-04-09 22:02:18.802
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Downloads\32Bit Injector\Injector.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info =========================== 

Percentage of memory in use: 25%
Total physical RAM: 10231.05 MB
Available physical RAM: 7601.58 MB
Total Pagefile: 11253.23 MB
Available Pagefile: 8464.46 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB

==================== Drives ================================

Drive c: (System) (Fixed) (Total:59.62 GB) (Free:11.36 GB) NTFS (Disk=1 Partition=1) ==>[Drive with boot components (obtained from BCD)]
Drive d: (Programme) (Fixed) (Total:781.25 GB) (Free:609.55 GB) NTFS (Disk=0 Partition=1)
Drive e: (Daten) (Fixed) (Total:616.01 GB) (Free:595.13 GB) NTFS (Disk=0 Partition=2)
Drive f: (KINGSTON) (Removable) (Total:7.23 GB) (Free:7.14 GB) FAT32 (Disk=3 Partition=1)
Drive r: () (Fixed) (Total:1 GB) (Free:1 GB) FAT32 (Disk=2 Partition=1)
Drive z: (V1055) (CDROM) (Total:1.05 GB) (Free:0 GB) CDFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 1397 GB) (Disk ID: 596B4CA3)
Partition 1: (Not Active) - (Size=-698722811904) - (Type=05)

========================================================
Disk: 1 (Size: 60 GB) (Disk ID: 596B4C9B)
Partition 1: (Active) - (Size=60 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (Size: 1 GB) (Disk ID: C1D1AF3C)
Partition 1: (Active) - (Size=1024 MB) - (Type=0B)

========================================================
Disk: 3 (Size: 7 GB) (Disk ID: 04030201)
Partition 1: (Not Active) - (Size=7 GB) - (Type=0B)

==================== End Of Log ============================
         

FRST.txt

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 23-07-2013
Ran by Admin (administrator) on 24-07-2013 12:36:24
Running from C:\Users\Admin\Desktop\Scann
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
() C:\Windows\SysWOW64\ASGT.exe
() C:\Program Files (x86)\ASUS\APRP\AsusProductRegisterService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Windows\system32\CISVC.EXE
() C:\Program Files (x86)\OpenVPN Technologies\OpenVPN Client\core\capiws.exe
(Realtek Semiconductor.) C:\Program Files (x86)\Realtek\Audio\SetupAfterRebootService.exe
(ASUS) C:\Program Files (x86)\ASUS\GPU Tweak\GPUTweak.exe
() C:\Program Files (x86)\puush\puush.exe
(Apple Inc.) E:\iTunes\iTunesHelper.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Mozilla Corporation) D:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Macrovision Corporation) C:\Program Files (x86)\Realtek\Audio\Drivers\HDADrv\Setup.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Bdagent] - "D:\BITDefender\Bitdefender\Bitdefender\bdagent.exe" [x]
HKLM\...\Run: [InstallerLauncher] - C:\Program Files\Common Files\Bitdefender\SetupInformation\{6F57816A-791A-4159-A75F-CFD0C7EA4FBF}\setuplauncher.exe [676568 2013-06-19] (Bitdefender)
HKCU\...\Run: [puush] - C:\Program Files (x86)\puush\puush.exe [567880 2013-07-14] ()
MountPoints2: Z - Z:\install.exe
MountPoints2: {92ac53d7-6290-11e2-bc43-806e6f6e6963} - Z:\CheckID.exe
HKLM-x32\...\Run: [APSDaemon] - "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - "E:\iTunes\iTunesHelper.exe" [152392 2013-05-31] (Apple Inc.)
HKLM-x32\...\Run: [bdruninstaller] - "C:\Program Files\Common Files\Bitdefender\SetupInformation\downloader\setuplauncher.exe" /run:"C:\Program Files\Common Files\Bitdefender\SetupInformation\downloader\setupdownloader.exe" /args:"/after_restart" [747096 2013-05-15] (Bitdefender)
HKU\Default\...\Run: [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun [x]
HKU\Default User\...\Run: [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun [x]
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9oid3g3q.default
FF NetworkProxy: "share_proxy_settings", true
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - E:\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.17.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\3.0.40818.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @ngm.nexoneu.com/NxGame - C:\ProgramData\NexonEU\NGM\npNxGameeu.dll (Nexon)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Users\Admin\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll (Amazon.com, Inc.)
FF SearchPlugin: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9oid3g3q.default\searchplugins\11-suche.xml
FF SearchPlugin: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9oid3g3q.default\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9oid3g3q.default\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9oid3g3q.default\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9oid3g3q.default\searchplugins\webde-suche.xml
FF Extension: No Name - C:\Users\Admin\AppData\Roaming\Mozilla\Extensions\net.openvpn.client
FF Extension: ProxTube - Gesperrte YouTube Videos entsperren - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9oid3g3q.default\Extensions\ich@maltegoetz.de
FF Extension: Flashblock - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9oid3g3q.default\Extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a}
FF Extension: firefox - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9oid3g3q.default\Extensions\firefox@mega.co.nz.xpi
FF Extension: No Name - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9oid3g3q.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: No Name - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9oid3g3q.default\Extensions\{f36c6cd1-da73-491d-b290-8fc9115bfa55}.xpi
FF HKLM\...\Thunderbird\Extensions: [eplgTb@eset.com] C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird
FF HKLM\...\Thunderbird\Extensions: [bdThunderbird@bitdefender.com] C:\Program Files\Bitdefender\Bitdefender\bdtbext
FF Extension: No Name - C:\Program Files\Bitdefender\Bitdefender\bdtbext
FF HKLM-x32\...\Firefox\Extensions: [{ACAA314B-EEBA-48e4-AD47-84E31C44796C}] C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\
FF HKLM-x32\...\Thunderbird\Extensions: [eplgTb@eset.com] C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird
FF HKLM-x32\...\Thunderbird\Extensions: [bdThunderbird@bitdefender.com] C:\Program Files\Bitdefender\Bitdefender\bdtbext
FF Extension: No Name - C:\Program Files\Bitdefender\Bitdefender\bdtbext
FF StartMenuInternet: FIREFOX.EXE - D:\Program Files (x86)\Mozilla Firefox\firefox.exe

==================== Services (Whitelisted) =================

R2 ASGT; C:\Windows\SysWOW64\ASGT.exe [55296 2012-01-17] ()
R2 Asus Product Register Service; C:\Program Files (x86)\ASUS\APRP\AsusProductRegisterService.exe [62128 2012-09-11] ()
S4 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [45056 2013-01-24] ()
S3 Brother XP spl Service; C:\Windows\SysWOW64\brsvc01a.exe [57344 2004-06-14] (brother Industries Ltd)
R2 OpenVPNAccessClient; C:\Program Files (x86)\OpenVPN Technologies\OpenVPN Client\core\capiws.exe [24064 2010-08-12] ()
R2 SetupARService; C:\Program Files (x86)\Realtek\Audio\SetupAfterRebootService.exe [24576 2013-05-17] (Realtek Semiconductor.)
S2 SkypeUpdate; D:\Program Files (x86)\Skype\Updater\Updater.exe [162408 2013-06-21] (Skype Technologies)
S4 rpcapd; "%ProgramFiles(x86)%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles(x86)%\WinPcap\rpcapd.ini" [x]

==================== Drivers (Whitelisted) ====================

R4 IOMap; C:\Windows\system32\drivers\IOMap64.sys [23680 2010-02-23] (ASUSTeK Computer Inc.)
R4 IOMap; C:\Windows\system32\drivers\IOMap64.sys [23680 2010-02-23] (ASUSTeK Computer Inc.)
R3 LGSHidFilt; C:\Windows\System32\DRIVERS\LGSHidFilt.Sys [66800 2013-01-17] (Logitech Inc.)
S3 NPF; C:\Windows\System32\drivers\npf.sys [36600 2013-03-01] (Riverbed Technology, Inc.)
R3 RAMDiskVE; C:\Windows\System32\Drivers\RAMDiskVE.sys [73552 2012-11-29] (Dataram, Inc.)
S3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42184 2013-02-22] (Anchorfree Inc.)
R3 tapoas; C:\Windows\System32\DRIVERS\tapoas.sys [30720 2010-08-03] (The OpenVPN Project)
U4 bdselfpr; \??\C:\Program Files\Bitdefender\Bitdefender\bdselfpr.sys
S3 DRHARD; \??\C:\Windows\system32\DRIVERS\DRHARD.SYS [x]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [x]
S4 GPU-Z; \??\C:\Users\Admin\AppData\Local\Temp\GPU-Z.sys [x]
S3 GPUZ; \??\C:\Windows\TEMP\GPUZ.sys [x]
S4 nvlddmkm; system32\DRIVERS\nvlddmkm.sys [x]
S3 VBoxNetFlt; system32\DRIVERS\VBoxNetFlt.sys [x]
U4 vsserv; 

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-07-24 12:36 - 2013-07-24 12:36 - 00000000 ____D C:\FRST
2013-07-24 12:35 - 2013-07-24 12:36 - 00000000 ____D C:\Users\Admin\Desktop\Scann
2013-07-23 21:20 - 2013-07-23 21:36 - 00000000 ____D C:\Users\Admin\Desktop\tools
2013-07-23 19:36 - 2013-07-23 19:36 - 00000022 _____ C:\Windows\GPU-Z.INI
2013-07-23 19:25 - 2013-07-23 19:25 - 00001049 _____ C:\Users\Public\Desktop\ASUS GPU Tweak.lnk
2013-07-23 19:25 - 2013-07-23 19:25 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ASUS
2013-07-23 19:24 - 2012-06-11 20:35 - 00070144 _____ (AMD) C:\Windows\system32\coinst_8.98.dll
2013-07-23 11:32 - 2013-07-23 11:32 - 00168123 _____ C:\ProgramData\1374571943.bdinstall.bin
2013-07-20 17:47 - 2013-07-20 17:47 - 04179293 _____ (Lavalys, Inc.                                               ) C:\Users\Admin\Downloads\everesthome220.exe
2013-07-20 17:47 - 2013-07-20 17:47 - 00001108 _____ C:\Users\Admin\Desktop\EVEREST Home Edition.lnk
2013-07-20 17:47 - 2013-07-20 17:47 - 00000000 ____D C:\Program Files (x86)\Lavalys
2013-07-20 17:41 - 2013-07-23 21:30 - 00078838 _____ C:\Users\Admin\Downloads\Extras.Txt
2013-07-20 17:40 - 2013-07-23 21:29 - 00097864 _____ C:\Users\Admin\Downloads\OTL.Txt
2013-07-20 17:38 - 2013-07-20 17:38 - 00602112 _____ (OldTimer Tools) C:\Users\Admin\Downloads\OTL.exe
2013-07-20 16:22 - 2013-07-20 16:22 - 00168982 _____ C:\ProgramData\1374329013.bdinstall.bin
2013-07-20 16:02 - 2013-07-20 16:02 - 00173843 _____ C:\ProgramData\1374328896.bdinstall.bin
2013-07-20 16:02 - 2013-07-20 16:02 - 00057414 _____ C:\ProgramData\1374328942.bdinstall.bin
2013-07-20 16:01 - 2013-07-20 16:01 - 00057149 _____ C:\ProgramData\1374328899.bdinstall.bin
2013-07-20 16:00 - 2013-07-20 16:00 - 00169617 _____ C:\ProgramData\1374328814.bdinstall.bin
2013-07-20 15:59 - 2013-07-20 15:59 - 00283948 _____ C:\ProgramData\1374328733.bdinstall.bin
2013-07-20 15:59 - 2013-07-20 15:59 - 00000000 ____D C:\Program Files\Bitdefender
2013-07-20 15:58 - 2013-07-24 12:11 - 00000952 _____ C:\Windows\setupact.log
2013-07-20 15:58 - 2013-07-20 15:58 - 00000000 _____ C:\Windows\setuperr.log
2013-07-20 15:44 - 2013-07-20 15:44 - 00001699 _____ C:\ProgramData\1374327580.844.bin
2013-07-20 15:44 - 2013-07-20 15:44 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Bitdefender
2013-07-20 15:41 - 2013-07-20 15:41 - 00001451 _____ C:\ProgramData\1374327580.1636.bin
2013-07-20 15:41 - 2013-07-20 15:41 - 00000000 ____D C:\Users\Admin\AppData\Roaming\QuickScan
2013-07-20 15:40 - 2013-07-20 15:46 - 00115484 _____ C:\ProgramData\1374327580.3984.bin
2013-07-20 15:40 - 2013-07-20 15:44 - 00016869 _____ C:\ProgramData\1374327580.1608.bin
2013-07-20 15:40 - 2013-07-20 15:44 - 00000000 ____D C:\ProgramData\Bitdefender
2013-07-20 15:40 - 2013-07-20 15:41 - 00001090 _____ C:\ProgramData\1374327580.3576.bin
2013-07-20 15:40 - 2013-07-20 15:41 - 00001089 _____ C:\ProgramData\1374327580.944.bin
2013-07-20 15:40 - 2013-07-20 15:40 - 00015990 _____ C:\ProgramData\1374327580.4016.bin
2013-07-20 15:40 - 2013-07-20 15:40 - 00008922 _____ C:\ProgramData\1374327580.2532.bin
2013-07-20 15:39 - 2013-07-20 15:46 - 00131047 _____ C:\ProgramData\1374327580.3848.bin
2013-07-20 15:39 - 2013-07-20 15:46 - 00115503 _____ C:\ProgramData\1374327580.3660.bin
2013-07-20 15:39 - 2013-07-20 15:46 - 00021541 _____ C:\ProgramData\1374327580.1772.bin
2013-07-20 15:39 - 2013-07-20 15:40 - 00002969 _____ C:\ProgramData\1374327580.2640.bin
2013-07-20 15:39 - 2013-07-20 15:40 - 00000000 ____D C:\Program Files\Common Files\Bitdefender
2013-07-20 15:39 - 2013-07-20 15:39 - 05701712 _____ C:\Users\Admin\Downloads\bitdefender_14isecurity.exe
2013-07-20 15:00 - 2013-07-20 15:00 - 00001115 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-07-20 15:00 - 2013-07-20 15:00 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-07-20 15:00 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-07-20 14:58 - 2013-05-29 08:15 - 17829376 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-20 14:58 - 2013-05-29 07:50 - 10926080 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-20 14:58 - 2013-05-29 07:43 - 02312704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-20 14:58 - 2013-05-29 07:36 - 01346560 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-20 14:58 - 2013-05-29 07:35 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-20 14:58 - 2013-05-29 07:34 - 01494528 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-07-20 14:58 - 2013-05-29 07:33 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-07-20 14:58 - 2013-05-29 07:31 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-20 14:58 - 2013-05-29 07:29 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-20 14:58 - 2013-05-29 07:29 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-07-20 14:58 - 2013-05-29 07:29 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-07-20 14:58 - 2013-05-29 07:27 - 02147840 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-20 14:58 - 2013-05-29 07:27 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-20 14:58 - 2013-05-29 07:25 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-20 14:58 - 2013-05-29 07:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-07-20 14:58 - 2013-05-29 07:18 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-20 14:58 - 2013-05-29 03:56 - 12333568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-20 14:58 - 2013-05-29 03:50 - 01800704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-20 14:58 - 2013-05-29 03:48 - 09738752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-20 14:58 - 2013-05-29 03:41 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-07-20 14:58 - 2013-05-29 03:41 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-20 14:58 - 2013-05-29 03:41 - 01104384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-20 14:58 - 2013-05-29 03:40 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-07-20 14:58 - 2013-05-29 03:38 - 00065024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-20 14:58 - 2013-05-29 03:37 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-07-20 14:58 - 2013-05-29 03:36 - 00420864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-07-20 14:58 - 2013-05-29 03:35 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-20 14:58 - 2013-05-29 03:35 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-20 14:58 - 2013-05-29 03:33 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-20 14:58 - 2013-05-29 03:33 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-20 14:58 - 2013-05-29 03:33 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-07-20 14:58 - 2013-05-29 03:29 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-07-20 14:56 - 2013-06-05 05:34 - 03153920 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-07-20 14:56 - 2013-06-04 08:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-07-20 14:56 - 2013-06-04 06:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-07-20 14:56 - 2013-05-13 07:51 - 01464320 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-07-20 14:56 - 2013-05-13 07:51 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-07-20 14:56 - 2013-05-13 07:51 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-07-20 14:56 - 2013-05-13 07:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\certenc.dll
2013-07-20 14:56 - 2013-05-13 06:45 - 01160192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-07-20 14:56 - 2013-05-13 06:45 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-07-20 14:56 - 2013-05-13 06:45 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-07-20 14:56 - 2013-05-13 05:43 - 01192448 _____ (Microsoft Corporation) C:\Windows\system32\certutil.exe
2013-07-20 14:56 - 2013-05-13 05:08 - 00903168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe
2013-07-20 14:56 - 2013-05-13 05:08 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll
2013-07-20 14:56 - 2013-05-10 07:49 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\cryptdlg.dll
2013-07-20 14:56 - 2013-05-10 05:20 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll
2013-07-20 14:56 - 2013-05-08 08:39 - 01910632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-07-20 14:56 - 2013-05-06 08:03 - 01887744 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-07-20 14:56 - 2013-05-06 06:56 - 01620480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-20 14:56 - 2013-04-26 07:51 - 00751104 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2013-07-20 14:56 - 2013-04-26 06:55 - 00492544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2013-07-20 14:56 - 2013-04-26 01:30 - 01505280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2013-07-20 14:56 - 2013-04-17 09:02 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2013-07-20 14:56 - 2013-04-17 08:24 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2013-07-20 14:56 - 2013-04-10 01:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-07-20 14:56 - 2013-04-03 00:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-07-20 14:56 - 2013-04-01 00:52 - 01887232 _____ (Microsoft Corporation) C:\Windows\system32\d3d11.dll
2013-07-20 14:56 - 2013-03-19 07:53 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2013-07-20 14:56 - 2013-03-19 07:53 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\wwanprotdim.dll
2013-07-20 01:59 - 2013-07-20 02:00 - 00011289 _____ C:\Users\Admin\Desktop\user.txt
2013-07-20 01:56 - 2013-07-20 01:56 - 00000000 _____ C:\Users\Admin\Desktop\code.txt
2013-07-20 01:17 - 2013-07-20 01:18 - 45833936 _____ C:\Users\Admin\Downloads\sopia3.rar
2013-07-19 21:32 - 2013-07-19 21:32 - 00000000 ____D C:\Users\Admin\Desktop\WBB Plugins
2013-07-19 21:22 - 2013-07-19 21:22 - 00000000 ____D C:\Users\Admin\Desktop\Board
2013-07-19 21:02 - 2013-07-19 21:04 - 00584335 _____ C:\Users\Admin\Documents\air-style.tgz
2013-07-19 15:30 - 2013-07-20 02:03 - 523763712 _____ C:\Users\Admin\Downloads\WERM9zW4fc.mega
2013-07-18 17:08 - 2013-07-18 17:08 - 00000218 _____ C:\Users\Admin\.recently-used.xbel
2013-07-18 16:48 - 2013-07-17 14:58 - 00000000 ____D C:\Users\Admin\Desktop\DerVote_Gerät_unbugged
2013-07-18 13:58 - 2013-07-18 14:03 - 00000000 ____D C:\Users\Admin\AppData\Local\gtk-2.0
2013-07-18 13:57 - 2013-07-23 11:58 - 00000000 ____D C:\Users\Admin\AppData\Roaming\.purple
2013-07-18 13:56 - 2013-07-18 13:56 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\pidgin-otr
2013-07-18 13:46 - 2013-07-18 13:46 - 00001445 _____ C:\Users\Public\Desktop\iTunes.lnk
2013-07-18 13:46 - 2013-07-18 13:46 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-07-18 13:46 - 2013-07-18 13:46 - 00000000 ____D C:\Program Files\iTunes
2013-07-18 13:46 - 2013-07-18 13:46 - 00000000 ____D C:\Program Files\iPod
2013-07-18 13:45 - 2013-07-18 13:45 - 00000000 ____D C:\Program Files\Common Files\Apple
2013-07-18 13:45 - 2013-07-18 13:45 - 00000000 ____D C:\Program Files\Bonjour
2013-07-18 13:45 - 2013-07-18 13:45 - 00000000 ____D C:\Program Files (x86)\Bonjour
2013-07-17 22:25 - 2013-07-17 22:25 - 02431767 _____ C:\Users\Admin\Downloads\Nexodia-accounts.sql
2013-07-17 22:18 - 2013-07-17 22:18 - 00025168 _____ C:\Users\Admin\Downloads\Nexodia-accounts.lnk
2013-07-17 18:35 - 2013-07-17 18:38 - 00010752 _____ C:\Users\Admin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-07-17 18:34 - 2013-07-17 18:49 - 00000000 ____D C:\Users\Admin\Desktop\Neues Textdokument (1)
2013-07-14 16:18 - 2013-07-14 16:20 - 27686480 _____ C:\Users\Admin\ts3_recording_13_07_14_16_18_17.wav
2013-07-14 14:25 - 2013-07-14 14:25 - 00003306 _____ C:\Users\Admin\Phoenixgames advertising.txt
2013-07-14 14:25 - 2013-07-14 14:25 - 00003199 _____ C:\Users\Admin\PhoenixGames ausschreibung.txt
2013-07-14 00:42 - 2013-07-14 00:42 - 00000000 ____D C:\Program Files (x86)\Apple Software Update
2013-07-13 23:08 - 2013-07-13 23:09 - 00000028 _____ C:\Users\Admin\Desktop\dice.txt
2013-07-13 13:27 - 2013-07-13 13:27 - 00000000 ____D C:\Program Files (x86)\Windows Phone
2013-07-12 17:36 - 2013-07-12 17:42 - 74106320 _____ C:\Users\Admin\ts3_recording_13_07_12_17_36_16.wav
2013-07-11 16:14 - 2013-07-11 16:14 - 00000000 ____D C:\Users\Admin\Desktop\Bilder
2013-07-10 19:45 - 2013-07-10 20:13 - 192999621 _____ C:\Users\Admin\Documents\Bilder.zip
2013-07-05 13:58 - 2013-07-05 13:58 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Amazon
2013-07-03 19:47 - 2013-07-03 19:48 - 00057856 _____ (Microsoft) C:\Users\Admin\Downloads\Solaria2 Patcher.exe
2013-07-03 18:35 - 2013-07-03 18:41 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Bitcoin
2013-07-02 22:20 - 2013-07-02 22:20 - 00004142 _____ C:\Users\Admin\Documents\Xertonia.ovpn
2013-07-01 22:21 - 2013-07-01 22:21 - 01835008 _____ C:\Users\Admin\Documents\TrueCrypt Rescue Disk.iso
2013-07-01 22:15 - 2013-07-01 22:15 - 00000017 _____ C:\Users\Admin\Documents\hallo.txt
2013-06-30 20:29 - 2013-06-30 20:29 - 00000000 ____D C:\ProgramData\TrueCrypt
2013-06-30 20:24 - 2013-07-01 22:26 - 00000000 ____D C:\Users\Admin\AppData\Roaming\TrueCrypt
2013-06-30 20:23 - 2013-06-30 20:23 - 00231376 _____ (TrueCrypt Foundation) C:\Windows\system32\Drivers\truecrypt.sys
2013-06-30 20:23 - 2013-06-30 20:23 - 00000881 _____ C:\Users\Public\Desktop\TrueCrypt.lnk
2013-06-30 20:23 - 2013-06-30 20:23 - 00000000 ____D C:\Program Files\TrueCrypt
2013-06-30 14:52 - 2013-06-30 17:19 - 00000000 ____D C:\Users\Admin\Documents\Sodii Site
2013-06-29 21:16 - 2013-06-30 14:33 - 38586582 _____ C:\Users\Admin\Desktop\Neues Textdokument (2).txt
2013-06-29 21:16 - 2011-08-07 00:07 - 00000000 ____D C:\Users\Admin\Desktop\HiTFaKeR-v0.4
2013-06-29 21:14 - 2013-06-29 21:14 - 01362472 _____ C:\Users\Admin\Documents\adsdasfs.rar
2013-06-29 21:11 - 2013-06-29 21:11 - 05235871 _____ C:\Users\Admin\Downloads\2018857 Unredliche Proxys.rar
2013-06-28 19:38 - 2013-06-28 19:38 - 00001376 _____ C:\Users\Public\Desktop\OpenVPN Client.lnk
2013-06-28 19:38 - 2013-06-28 19:38 - 00000000 ____D C:\Users\Admin\AppData\Roaming\OpenVPN Technologies
2013-06-28 19:38 - 2013-06-28 19:38 - 00000000 ____D C:\Users\Admin\AppData\Local\OpenVPN Technologies
2013-06-28 19:37 - 2013-06-28 19:37 - 00000000 ____D C:\Program Files (x86)\OpenVPN Technologies
2013-06-28 19:36 - 2013-06-28 19:36 - 00004100 _____ C:\Users\Admin\Downloads\Xertonia.ovpn
2013-06-28 17:02 - 2013-06-28 17:35 - 1352610187 _____ C:\Users\Admin\Downloads\Mesonia Client Release.rar
2013-06-24 20:13 - 2013-06-24 20:38 - 24641536 _____ C:\Users\Admin\Downloads\CMh7akKEg5.mega
2013-06-24 19:42 - 2013-06-24 20:03 - 843636773 _____ C:\Users\Admin\Downloads\Solaria2-Client.rar
2013-06-24 18:45 - 2013-06-24 18:47 - 05195636 _____ C:\Users\Admin\Documents\sodii.rar
2013-06-24 18:16 - 2013-06-24 18:16 - 00465195 _____ C:\Users\Admin\Documents\pack.rar

==================== One Month Modified Files and Folders =======

2013-07-24 12:36 - 2013-07-24 12:36 - 00000000 ____D C:\FRST
2013-07-24 12:36 - 2013-07-24 12:35 - 00000000 ____D C:\Users\Admin\Desktop\Scann
2013-07-24 12:18 - 2009-07-14 06:45 - 00021664 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-24 12:18 - 2009-07-14 06:45 - 00021664 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-24 12:16 - 2010-11-21 08:50 - 00705126 _____ C:\Windows\system32\perfh007.dat
2013-07-24 12:16 - 2010-11-21 08:50 - 00151418 _____ C:\Windows\system32\perfc007.dat
2013-07-24 12:16 - 2009-07-14 07:13 - 01636058 _____ C:\Windows\system32\PerfStringBackup.INI
2013-07-24 12:11 - 2013-07-20 15:58 - 00000952 _____ C:\Windows\setupact.log
2013-07-24 12:11 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-07-23 21:50 - 2013-01-20 12:41 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Skype
2013-07-23 21:37 - 2013-01-20 01:38 - 01458107 _____ C:\Windows\WindowsUpdate.log
2013-07-23 21:36 - 2013-07-23 21:20 - 00000000 ____D C:\Users\Admin\Desktop\tools
2013-07-23 21:36 - 2013-01-20 01:36 - 00000000 ____D C:\Users\Admin
2013-07-23 21:30 - 2013-07-20 17:41 - 00078838 _____ C:\Users\Admin\Downloads\Extras.Txt
2013-07-23 21:29 - 2013-07-20 17:40 - 00097864 _____ C:\Users\Admin\Downloads\OTL.Txt
2013-07-23 20:59 - 2013-03-28 23:30 - 00000000 ____D C:\Users\Admin\Documents\Outlook-Dateien
2013-07-23 20:07 - 2013-05-17 19:25 - 00000000 ____D C:\Users\Admin\Documents\Schule
2013-07-23 19:36 - 2013-07-23 19:36 - 00000022 _____ C:\Windows\GPU-Z.INI
2013-07-23 19:31 - 2013-05-17 16:14 - 00000000 ____D C:\Program Files (x86)\ATI Technologies
2013-07-23 19:25 - 2013-07-23 19:25 - 00001049 _____ C:\Users\Public\Desktop\ASUS GPU Tweak.lnk
2013-07-23 19:25 - 2013-07-23 19:25 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ASUS
2013-07-23 19:25 - 2013-05-17 16:19 - 00000032 _____ C:\setup.log
2013-07-23 19:25 - 2013-05-17 16:19 - 00000000 ____D C:\Program Files (x86)\ASUS
2013-07-23 19:25 - 2013-04-22 18:43 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-07-23 12:18 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-07-23 11:58 - 2013-07-18 13:57 - 00000000 ____D C:\Users\Admin\AppData\Roaming\.purple
2013-07-23 11:32 - 2013-07-23 11:32 - 00168123 _____ C:\ProgramData\1374571943.bdinstall.bin
2013-07-20 19:29 - 2013-04-05 17:37 - 00002036 ____H C:\Users\Admin\Documents\Default.rdp
2013-07-20 17:47 - 2013-07-20 17:47 - 04179293 _____ (Lavalys, Inc.                                               ) C:\Users\Admin\Downloads\everesthome220.exe
2013-07-20 17:47 - 2013-07-20 17:47 - 00001108 _____ C:\Users\Admin\Desktop\EVEREST Home Edition.lnk
2013-07-20 17:47 - 2013-07-20 17:47 - 00000000 ____D C:\Program Files (x86)\Lavalys
2013-07-20 17:38 - 2013-07-20 17:38 - 00602112 _____ (OldTimer Tools) C:\Users\Admin\Downloads\OTL.exe
2013-07-20 16:22 - 2013-07-20 16:22 - 00168982 _____ C:\ProgramData\1374329013.bdinstall.bin
2013-07-20 16:02 - 2013-07-20 16:02 - 00173843 _____ C:\ProgramData\1374328896.bdinstall.bin
2013-07-20 16:02 - 2013-07-20 16:02 - 00057414 _____ C:\ProgramData\1374328942.bdinstall.bin
2013-07-20 16:01 - 2013-07-20 16:01 - 00057149 _____ C:\ProgramData\1374328899.bdinstall.bin
2013-07-20 16:01 - 2010-11-21 05:47 - 09244328 _____ C:\Windows\PFRO.log
2013-07-20 16:00 - 2013-07-20 16:00 - 00169617 _____ C:\ProgramData\1374328814.bdinstall.bin
2013-07-20 15:59 - 2013-07-20 15:59 - 00283948 _____ C:\ProgramData\1374328733.bdinstall.bin
2013-07-20 15:59 - 2013-07-20 15:59 - 00000000 ____D C:\Program Files\Bitdefender
2013-07-20 15:58 - 2013-07-20 15:58 - 00000000 _____ C:\Windows\setuperr.log
2013-07-20 15:58 - 2009-07-14 06:45 - 05095072 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-20 15:57 - 2013-06-03 16:05 - 00000000 ____D C:\Program Files (x86)\Pando Networks
2013-07-20 15:57 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-07-20 15:57 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-07-20 15:46 - 2013-07-20 15:40 - 00115484 _____ C:\ProgramData\1374327580.3984.bin
2013-07-20 15:46 - 2013-07-20 15:39 - 00131047 _____ C:\ProgramData\1374327580.3848.bin
2013-07-20 15:46 - 2013-07-20 15:39 - 00115503 _____ C:\ProgramData\1374327580.3660.bin
2013-07-20 15:46 - 2013-07-20 15:39 - 00021541 _____ C:\ProgramData\1374327580.1772.bin
2013-07-20 15:44 - 2013-07-20 15:44 - 00001699 _____ C:\ProgramData\1374327580.844.bin
2013-07-20 15:44 - 2013-07-20 15:44 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Bitdefender
2013-07-20 15:44 - 2013-07-20 15:40 - 00016869 _____ C:\ProgramData\1374327580.1608.bin
2013-07-20 15:44 - 2013-07-20 15:40 - 00000000 ____D C:\ProgramData\Bitdefender
2013-07-20 15:41 - 2013-07-20 15:41 - 00001451 _____ C:\ProgramData\1374327580.1636.bin
2013-07-20 15:41 - 2013-07-20 15:41 - 00000000 ____D C:\Users\Admin\AppData\Roaming\QuickScan
2013-07-20 15:41 - 2013-07-20 15:40 - 00001090 _____ C:\ProgramData\1374327580.3576.bin
2013-07-20 15:41 - 2013-07-20 15:40 - 00001089 _____ C:\ProgramData\1374327580.944.bin
2013-07-20 15:40 - 2013-07-20 15:40 - 00015990 _____ C:\ProgramData\1374327580.4016.bin
2013-07-20 15:40 - 2013-07-20 15:40 - 00008922 _____ C:\ProgramData\1374327580.2532.bin
2013-07-20 15:40 - 2013-07-20 15:39 - 00002969 _____ C:\ProgramData\1374327580.2640.bin
2013-07-20 15:40 - 2013-07-20 15:39 - 00000000 ____D C:\Program Files\Common Files\Bitdefender
2013-07-20 15:39 - 2013-07-20 15:39 - 05701712 _____ C:\Users\Admin\Downloads\bitdefender_14isecurity.exe
2013-07-20 15:04 - 2013-05-26 00:10 - 00003140 _____ C:\Windows\System32\Tasks\FRAPS
2013-07-20 15:00 - 2013-07-20 15:00 - 00001115 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-07-20 15:00 - 2013-07-20 15:00 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-07-20 15:00 - 2013-06-17 13:12 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Admin\Downloads\mbam-setup-1.75.0.1300.exe
2013-07-20 02:03 - 2013-07-19 15:30 - 523763712 _____ C:\Users\Admin\Downloads\WERM9zW4fc.mega
2013-07-20 02:00 - 2013-07-20 01:59 - 00011289 _____ C:\Users\Admin\Desktop\user.txt
2013-07-20 01:56 - 2013-07-20 01:56 - 00000000 _____ C:\Users\Admin\Desktop\code.txt
2013-07-20 01:18 - 2013-07-20 01:17 - 45833936 _____ C:\Users\Admin\Downloads\sopia3.rar
2013-07-19 21:32 - 2013-07-19 21:32 - 00000000 ____D C:\Users\Admin\Desktop\WBB Plugins
2013-07-19 21:32 - 2013-01-22 23:02 - 00000000 ____D C:\Users\Admin\AppData\Roaming\FileZilla
2013-07-19 21:22 - 2013-07-19 21:22 - 00000000 ____D C:\Users\Admin\Desktop\Board
2013-07-19 21:04 - 2013-07-19 21:02 - 00584335 _____ C:\Users\Admin\Documents\air-style.tgz
2013-07-18 17:08 - 2013-07-18 17:08 - 00000218 _____ C:\Users\Admin\.recently-used.xbel
2013-07-18 14:03 - 2013-07-18 13:58 - 00000000 ____D C:\Users\Admin\AppData\Local\gtk-2.0
2013-07-18 13:56 - 2013-07-18 13:56 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\pidgin-otr
2013-07-18 13:46 - 2013-07-18 13:46 - 00001445 _____ C:\Users\Public\Desktop\iTunes.lnk
2013-07-18 13:46 - 2013-07-18 13:46 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-07-18 13:46 - 2013-07-18 13:46 - 00000000 ____D C:\Program Files\iTunes
2013-07-18 13:46 - 2013-07-18 13:46 - 00000000 ____D C:\Program Files\iPod
2013-07-18 13:46 - 2013-03-20 21:28 - 00000000 ____D C:\ProgramData\Apple Computer
2013-07-18 13:45 - 2013-07-18 13:45 - 00000000 ____D C:\Program Files\Common Files\Apple
2013-07-18 13:45 - 2013-07-18 13:45 - 00000000 ____D C:\Program Files\Bonjour
2013-07-18 13:45 - 2013-07-18 13:45 - 00000000 ____D C:\Program Files (x86)\Bonjour
2013-07-17 22:25 - 2013-07-17 22:25 - 02431767 _____ C:\Users\Admin\Downloads\Nexodia-accounts.sql
2013-07-17 22:18 - 2013-07-17 22:18 - 00025168 _____ C:\Users\Admin\Downloads\Nexodia-accounts.lnk
2013-07-17 18:49 - 2013-07-17 18:34 - 00000000 ____D C:\Users\Admin\Desktop\Neues Textdokument (1)
2013-07-17 18:38 - 2013-07-17 18:35 - 00010752 _____ C:\Users\Admin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-07-17 17:47 - 2009-07-14 07:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-07-17 14:58 - 2013-07-18 16:48 - 00000000 ____D C:\Users\Admin\Desktop\DerVote_Gerät_unbugged
2013-07-17 12:15 - 2013-04-28 14:59 - 00000000 ____D C:\Program Files\WinPcap
2013-07-14 20:40 - 2013-05-20 00:51 - 00000000 ____D C:\Program Files (x86)\puush
2013-07-14 16:20 - 2013-07-14 16:18 - 27686480 _____ C:\Users\Admin\ts3_recording_13_07_14_16_18_17.wav
2013-07-14 14:25 - 2013-07-14 14:25 - 00003306 _____ C:\Users\Admin\Phoenixgames advertising.txt
2013-07-14 14:25 - 2013-07-14 14:25 - 00003199 _____ C:\Users\Admin\PhoenixGames ausschreibung.txt
2013-07-14 00:42 - 2013-07-14 00:42 - 00000000 ____D C:\Program Files (x86)\Apple Software Update
2013-07-13 23:09 - 2013-07-13 23:08 - 00000028 _____ C:\Users\Admin\Desktop\dice.txt
2013-07-13 13:27 - 2013-07-13 13:27 - 00000000 ____D C:\Program Files (x86)\Windows Phone
2013-07-13 10:50 - 2013-01-20 12:41 - 00000000 ____D C:\ProgramData\Skype
2013-07-12 17:42 - 2013-07-12 17:36 - 74106320 _____ C:\Users\Admin\ts3_recording_13_07_12_17_36_16.wav
2013-07-12 13:54 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2013-07-11 16:14 - 2013-07-11 16:14 - 00000000 ____D C:\Users\Admin\Desktop\Bilder
2013-07-10 20:13 - 2013-07-10 19:45 - 192999621 _____ C:\Users\Admin\Documents\Bilder.zip
2013-07-05 13:59 - 2013-02-08 14:49 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Amazon
2013-07-05 13:58 - 2013-07-05 13:58 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Amazon
2013-07-03 19:48 - 2013-07-03 19:47 - 00057856 _____ (Microsoft) C:\Users\Admin\Downloads\Solaria2 Patcher.exe
2013-07-03 18:41 - 2013-07-03 18:35 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Bitcoin
2013-07-02 22:20 - 2013-07-02 22:20 - 00004142 _____ C:\Users\Admin\Documents\Xertonia.ovpn
2013-07-01 22:26 - 2013-06-30 20:24 - 00000000 ____D C:\Users\Admin\AppData\Roaming\TrueCrypt
2013-07-01 22:21 - 2013-07-01 22:21 - 01835008 _____ C:\Users\Admin\Documents\TrueCrypt Rescue Disk.iso
2013-07-01 22:15 - 2013-07-01 22:15 - 00000017 _____ C:\Users\Admin\Documents\hallo.txt
2013-06-30 20:29 - 2013-06-30 20:29 - 00000000 ____D C:\ProgramData\TrueCrypt
2013-06-30 20:23 - 2013-06-30 20:23 - 00231376 _____ (TrueCrypt Foundation) C:\Windows\system32\Drivers\truecrypt.sys
2013-06-30 20:23 - 2013-06-30 20:23 - 00000881 _____ C:\Users\Public\Desktop\TrueCrypt.lnk
2013-06-30 20:23 - 2013-06-30 20:23 - 00000000 ____D C:\Program Files\TrueCrypt
2013-06-30 17:19 - 2013-06-30 14:52 - 00000000 ____D C:\Users\Admin\Documents\Sodii Site
2013-06-30 14:33 - 2013-06-29 21:16 - 38586582 _____ C:\Users\Admin\Desktop\Neues Textdokument (2).txt
2013-06-29 21:14 - 2013-06-29 21:14 - 01362472 _____ C:\Users\Admin\Documents\adsdasfs.rar
2013-06-29 21:11 - 2013-06-29 21:11 - 05235871 _____ C:\Users\Admin\Downloads\2018857 Unredliche Proxys.rar
2013-06-28 19:38 - 2013-06-28 19:38 - 00001376 _____ C:\Users\Public\Desktop\OpenVPN Client.lnk
2013-06-28 19:38 - 2013-06-28 19:38 - 00000000 ____D C:\Users\Admin\AppData\Roaming\OpenVPN Technologies
2013-06-28 19:38 - 2013-06-28 19:38 - 00000000 ____D C:\Users\Admin\AppData\Local\OpenVPN Technologies
2013-06-28 19:37 - 2013-06-28 19:37 - 00000000 ____D C:\Program Files (x86)\OpenVPN Technologies
2013-06-28 19:36 - 2013-06-28 19:36 - 00004100 _____ C:\Users\Admin\Downloads\Xertonia.ovpn
2013-06-28 17:35 - 2013-06-28 17:02 - 1352610187 _____ C:\Users\Admin\Downloads\Mesonia Client Release.rar
2013-06-24 20:38 - 2013-06-24 20:13 - 24641536 _____ C:\Users\Admin\Downloads\CMh7akKEg5.mega
2013-06-24 20:03 - 2013-06-24 19:42 - 843636773 _____ C:\Users\Admin\Downloads\Solaria2-Client.rar
2013-06-24 18:47 - 2013-06-24 18:45 - 05195636 _____ C:\Users\Admin\Documents\sodii.rar
2013-06-24 18:16 - 2013-06-24 18:16 - 00465195 _____ C:\Users\Admin\Documents\pack.rar

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-07-23 12:11

==================== End Of Log ============================
         

--- --- ---

HKCU\...\Run: [puush] - C:\Program Files (x86)\puush\puush.exe [567880 2013-07-14] ()

Kennst Du das?

Ja, puu.sh ist ein Screencapturing Programm (freeware), welchem ich auch vertraue und das ohne Probleme funktioniert.
puush / home ist die Homepage von Puush.

Edit:
Bluescreen Fehler

Deine Codebox mit dem bluescreen ist leer

Komisch, bei mir gehts...
Ich lade mal den Anhang hoch.

P.s. auch im abgesicherten Modus erhalte ich den bluescreen

hi,

Scan mit Farbar's Recovery Scan Tool (Recovery Mode - Windows Vista, 7, 8)

Hinweise für Windows 8-Nutzer: Anleitung 1 (FRST-Variante) und Anleitung 2 (zweiter Teil)

• Downloade dir bitte die passende Version des Tools (im Zweifel beide) und speichere diese auf einen USB Stick: FRST 32-Bit | FRST 64-Bit
• Schließe den USB Stick an das infizierte System an und boote das System in die System Reparatur Option.
• Scanne jetzt nach der bebilderten Anleitung oder verwende die folgende Kurzanleitung:

Über den Boot Manager:

• Starte den Rechner neu.
• Während dem Hochfahren drücke mehrmals die F8 Taste
• Wähle nun Computer reparieren.
• Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".

Mit Windows CD/DVD (auch bei Windows 8 möglich):

• Lege die Windows CD in dein Laufwerk.
• Starte den Rechner neu und starte von der CD.
• Wähle die Spracheinstellungen und klicke "Weiter".
• Klicke auf Computerreparaturoptionen !
• Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".

Wähle in den Reparaturoptionen: Eingabeaufforderung

• Gib nun bitte notepad ein und drücke Enter.
• Im öffnenden Textdokument: Datei > Speichern unter... und wähle Computer.
  Hier wird dir der Laufwerksbuchstabe deines USB Sticks angezeigt, merke ihn dir.
• Schließe Notepad wieder
• Gib nun bitte folgenden Befehl ein.
  e:\frst.exe bzw. e:\frst64.exe
  Hinweis: e steht für den Laufwerksbuchstaben deines USB Sticks, den du dir gemerkt hast. Gegebenfalls anpassen.
• Akzeptiere den Disclaimer mit Ja und klicke Untersuchen

Das Tool erstellt eine FRST.txt auf deinem USB Stick. Poste den Inhalt bitte hier nach Möglichkeit in Code-Tags (Anleitung).