dft.pathmapping-Popup sowie Optimizer Pro

Miau3 · 30.09.2013, 04:16

Hallo Leute,

trotz aller Vorsicht hat es auch mich mal erwischt: nach der Installation eins Programmes hat sich bei mir der Optimizer Pro eingenistet, der anscheinend nach meiner Recherche auch der Grund dafür ist, dass von dft.pathmapping.com ein Popup erscheint.

Da ich derzeit an meiner Abschlussarbeit schreibe und keine Zeit habe, den Rechner komplett platt zu machen, hoffe ich auf eure Hilfe. Ich habe bislang das Programm deinstalliert, entsprechende Ordner gelöscht und einen Check mit dem ADWCleaner und HijackThis gemacht, das schaut so aus:

Code:

ATTFilter

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 05:14:50, on 30.09.2013
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v10.0 (10.00.9200.16686)
Boot mode: Normal

Running processes:
C:\Windows\PLFSetI.exe
C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe
C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerQuick.exe
C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
C:\Users\Eve\AppData\Roaming\Dropbox\bin\Dropbox.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
D:\Downloads\HiJackThis204.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: Citavi Picker - {609D670F-B735-4da7-AC6D-F3BD358E325E} - mscoree.dll (file missing)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL
O2 - BHO: Evernote extension - {92EF2EAD-A7CE-4424-B0DB-499CF856608E} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~2\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
O2 - BHO: Microsoft-Webtestaufzeichnung 10.0-Hilfsprogramm - {DDA57003-0068-4ed2-9D32-4D1EC707D94D} - C:\Program Files (x86)\Microsoft Visual Studio 10.0\Common7\IDE\PrivateAssemblies\Microsoft.VisualStudio.QualityTools.RecorderBarBHO100.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETZWERKDIENST')
O4 - Startup: Dropbox.lnk = Eve\AppData\Roaming\Dropbox\bin\Dropbox.exe
O4 - Global Startup: AVer HID Receiver.lnk = C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe
O4 - Global Startup: AVerQuick.lnk = C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerQuick.exe
O4 - Global Startup: Box Sync.lnk = C:\Program Files\Box Sync\BoxSync.exe
O8 - Extra context menu item: &Citavi Picker... - file://C:\ProgramData\Swiss Academic Software\Citavi Picker\Internet Explorer\ShowContextMenu.html
O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~2\Office14\ONBttnIE.dll/105
O8 - Extra context menu item: An vorhandene PDF-Datei anfügen - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Auswahl speichern - C:\Program Files (x86)\Evernote\Evernote\\EvernoteIERes\Clip.html?clipAction=3
O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Bild ausschneiden - C:\Program Files (x86)\Evernote\Evernote\\EvernoteIERes\Clip.html?clipAction=4
O8 - Extra context menu item: Diese Seite ausschneiden - C:\Program Files (x86)\Evernote\Evernote\\EvernoteIERes\Clip.html?clipAction=1
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Eve\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
O8 - Extra context menu item: In Adobe PDF konvertieren - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Linkziel in Adobe PDF konvertieren - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~2\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Neue Notiz - C:\Program Files (x86)\Evernote\Evernote\\EvernoteIERes\NewNote.html
O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O8 - Extra context menu item: URL notieren - C:\Program Files (x86)\Evernote\Evernote\\EvernoteIERes\Clip.html?clipAction=0
O9 - Extra button: Citavi Picker - {619D670F-B735-4da7-AC6D-F3BD358E325E} - mscoree.dll (file missing)
O9 - Extra button: @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\\EvernoteIERes\AddNote.html
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\\EvernoteIERes\AddNote.html
O9 - Extra button: Senden an Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: Senden an &Bluetooth-Gerät... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0849F004-6A13-4013-9D58-C20F6E7859CE}: NameServer = 192.168.2.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{0849F004-6A13-4013-9D58-C20F6E7859CE}: NameServer = 192.168.2.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{0849F004-6A13-4013-9D58-C20F6E7859CE}: NameServer = 192.168.2.1
O17 - HKLM\System\CS3\Services\Tcpip\..\{0849F004-6A13-4013-9D58-C20F6E7859CE}: NameServer = 192.168.2.1
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AVerRemote - AVerMedia - C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe
O23 - Service: AVerScheduleService - Unknown owner - C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe
O23 - Service: LckFldService - Unknown owner - C:\Windows\system32\LckFldService.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: TeamViewer 8 (TeamViewer8) - TeamViewer GmbH - C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

--
End of file - 11702 bytes

Code:

ATTFilter

# AdwCleaner v3.005 - Bericht erstellt am 30/09/2013 um 04:55:45
# Updated 22/09/2013 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzername : Eve - EVE-PC
# Gestartet von : D:\Downloads\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\jetpack
Ordner Gelöscht : C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\536c2ac1-a17c-4de1-a3f2-1b869a3be96c@2f6608a0-8c65-4bfe-8e2f-c65b5cc757cb.com
Ordner Gelöscht : C:\Program Files (x86)\Mozilla Firefox\Extensions\afurladvisor@anchorfree.com
Datei Gelöscht : C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\\invalidprefs.js
Datei Gelöscht : C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\foxydeal.sqlite

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}
Schlüssel Gelöscht : HKCU\Software\APN PIP
Schlüssel Gelöscht : HKCU\Software\BI
Schlüssel Gelöscht : HKCU\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\InstalledBrowserExtensions
Schlüssel Gelöscht : HKCU\Software\Optimizer Pro
Schlüssel Gelöscht : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gelöscht : HKLM\Software\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gelöscht : HKLM\Software\PIP
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\systweak

***** [ Browser ] *****

-\\ Internet Explorer v10.0.9200.16686


-\\ Mozilla Firefox v24.0 (de)

[ Datei : C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\prefs.js ]

Zeile gelöscht : user_pref("extensions.crossrider.bic", "1415cebfad8c38f828334a426e317726");
Zeile gelöscht : user_pref("extensions.illimitux.ilx_pref_pt_veoh", true);

-\\ Google Chrome v

[ Datei : C:\Users\Eve\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [2816 octets] - [30/09/2013 04:54:01]
AdwCleaner[S0].txt - [2461 octets] - [30/09/2013 04:55:45]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2521 octets] ##########

Da das Popup aber noch auftaucht, scheint irgendwo noch was zu stecken. Könnt ihr mir vielleicht weiterhelfen?

schrauber · 30.09.2013, 07:51

hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Miau3 · 30.09.2013, 15:27

Hi schrauber,

danke, dass du dich meiner Sache annimmst! Hier die beiden Logs.

FRST.txt:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-09-2013 02
Ran by Eve (administrator) on EVE-PC on 30-09-2013 16:23:14
Running from C:\Users\Eve\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(AVerMedia) C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe
() C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe
() C:\Windows\SysWOW64\LckFldService.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
() C:\Windows\PLFSetI.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\egui.exe
(Box, Inc.) C:\Program Files\Box Sync\BoxSyncHelper.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
() C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe
(AVerMedia TECHNOLOGIES, Inc.) C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerQuick.exe
(Logitech, Inc.) C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
(Box, Inc.) C:\Program Files\Box Sync\BoxSync.exe
(Dropbox, Inc.) C:\Users\Eve\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe
(Logitech, Inc.) C:\Program Files\Common Files\LogiShrd\Unifying\DJCUHost.exe
(Microsoft Corporation) C:\Windows\System32\dinotify.exe
(Microsoft Corporation) C:\Windows\system32\DrvInst.exe
(Microsoft Corporation) C:\Windows\system32\DrvInst.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13307496 2011-10-17] (Realtek Semiconductor)
HKLM\...\Run: [PLFSetI] - C:\Windows\PLFSetI.exe [200704 2008-07-29] ()
HKLM\...\Run: [EvtMgr6] - C:\Program Files\Logitech\SetPointP\SetPoint.exe [1744152 2011-10-07] (Logitech, Inc.)
HKLM\...\Run: [NvCplDaemon] - RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1842472 2009-09-17] (Synaptics Incorporated)
HKLM\...\Run: [egui] - C:\Program Files\ESET\ESET Smart Security\egui.exe [6330568 2013-03-21] (ESET)
HKLM\...\Run: [BoxSyncHelper] - C:\Program Files\Box Sync\BoxSyncHelper.exe [393216 2013-06-07] (Box, Inc.)
HKLM\...\Run: [BCSSync] - C:\Program Files\Microsoft Office\Office14\BCSSync.exe [108144 2012-11-05] (Microsoft Corporation)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
MountPoints2: {263a2540-1303-11e1-b8c7-806e6f6e6963} - G:\autorun.exe
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe [41336 2013-09-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Acrobat Assistant 8.0] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe [840568 2013-09-03] (Adobe Systems Inc.)
AppInit_DLLs:  C:\PROGRA~2\OPTIMI~1\OPTPRO~2.DLL [97280 2009-07-14] ()
Startup: C:\Users\Eve\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Eve\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xBB71F3D34AB6CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Citavi Picker - {609D670F-B735-4da7-AC6D-F3BD358E325E} - C:\Windows\\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Evernote extension - {92EF2EAD-A7CE-4424-B0DB-499CF856608E} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
BHO-x32: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Microsoft-Webtestaufzeichnung 10.0-Hilfsprogramm - {DDA57003-0068-4ed2-9D32-4D1EC707D94D} - C:\Program Files (x86)\Microsoft Visual Studio 10.0\Common7\IDE\PrivateAssemblies\Microsoft.VisualStudio.QualityTools.RecorderBarBHO100.dll (Microsoft Corporation)
BHO-x32: SmartSelect Class - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKCU -  No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  No File
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{0849F004-6A13-4013-9D58-C20F6E7859CE}: [NameServer]192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default
FF Homepage: www.google.de
FF NetworkProxy: "backup.ftp", "50.30.32.39"
FF NetworkProxy: "backup.ftp_port", 3128
FF NetworkProxy: "backup.socks", "50.30.32.39"
FF NetworkProxy: "backup.socks_port", 3128
FF NetworkProxy: "backup.ssl", "50.30.32.39"
FF NetworkProxy: "backup.ssl_port", 3128
FF NetworkProxy: "ftp", "50.30.32.39"
FF NetworkProxy: "ftp_port", 3128
FF NetworkProxy: "http", "50.30.32.39"
FF NetworkProxy: "http_port", 3128
FF NetworkProxy: "no_proxies_on", "localhost, 127.0.0.1, stealthy.co"
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "socks", "50.30.32.39"
FF NetworkProxy: "socks_port", 3128
FF NetworkProxy: "socks_version", 4
FF NetworkProxy: "ssl", "50.30.32.39"
FF NetworkProxy: "ssl_port", 3128
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin: @java.com/DTPlugin,version=10.10.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.10.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.10.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre7\bin\new_plugin\npjp2.dll No File
FF Plugin-x32: @java.com/JavaPlugin,version=10.10.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Acrobat - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Eve\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Eve\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Wörterbuch Deutsch (de-DE), Hunspell-unterstützt - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\de_DE@dicts.j3e.de
FF Extension: ProxTube - Gesperrte YouTube Videos entsperren - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\ich@maltegoetz.de
FF Extension: Nightly Tester Tools - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\{8620c15f-30dc-4dba-a131-7c5d20cf4a29}
FF Extension: FT GraphiteGlow - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\{99e34760-2754-11e0-91fa-0800200c9a66}
FF Extension: Theme Font &amp; Size Changer - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\{f69e22c7-bc50-414a-9269-0f5c344cd94c}
FF Extension: customizable-shortcuts - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\customizable-shortcuts@timtaubert.de.xpi
FF Extension: elemhidehelper - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\elemhidehelper@adblockplus.org.xpi
FF Extension: firefox - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\firefox@ghostery.com.xpi
FF Extension: imageshack - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\imageshack@unsubstantial.info.xpi
FF Extension: menuiconsplus - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\menuiconsplus@codedawn.com.xpi
FF Extension: restart - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\restart@restart.org.xpi
FF Extension: sidebarBookmarkSelector - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\sidebarBookmarkSelector@alice.xpi
FF Extension: zotero - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\zotero@chnm.gmu.edu.xpi
FF Extension: No Name - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\{03A4A97B-1A44-4a3b-8A41-D982F0B6E73F}.xpi
FF Extension: No Name - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\{1A2D0EC4-75F5-4c91-89C4-3656F6E44B68}.xpi
FF Extension: No Name - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}.xpi
FF Extension: No Name - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\{AA6F0803-145A-4200-8E5E-68898D02B5B3}.xpi
FF Extension: No Name - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi
FF Extension: No Name - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\{d418aae0-8023-11dd-ad8b-0800200c9a66}.xpi
FF Extension: No Name - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\{dc572301-7619-498c-a57d-39143191b318}.xpi
FF Extension: No Name - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\{E10A6337-382E-4FE6-96DE-936ADC34DD04}.xpi
FF Extension: No Name - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\{EDA7B1D7-F793-4e03-B074-E6F303317FB0}.xpi
FF Extension: No Name - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi
FF Extension: Hotspot Shield Helper (Please allow this installation) - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\afurladvisor@anchorfree.com
FF HKLM\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird
FF Extension: ESET Smart Security Extension - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn
FF HKLM-x32\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox

Chrome: 
=======
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Shockwave Flash) - C:\Users\Eve\AppData\Local\Google\Chrome\Application\29.0.1547.76\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\Eve\AppData\Local\Google\Chrome\Application\29.0.1547.76\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Eve\AppData\Local\Google\Chrome\Application\29.0.1547.76\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll (Apple Inc.)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Java(TM) Platform SE 7 U10) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll No File
CHR Plugin: (VLC Web Plugin) - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
CHR Plugin: (Google Update) - C:\Users\Eve\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_6_602_180.dll No File
CHR Plugin: (Java Deployment Toolkit 7.0.100.18) - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
CHR Extension: (a2zLyrics-1) - C:\Users\Eve\AppData\Local\Google\Chrome\User Data\Default\Extensions\afeodekfkejjgjigfnhhifffljmhnpfn\1.24.19_0
CHR Extension: (Google Docs) - C:\Users\Eve\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0
CHR Extension: (Google Drive) - C:\Users\Eve\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (YouTube) - C:\Users\Eve\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Users\Eve\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (AdBlock) - C:\Users\Eve\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.6.8_0
CHR Extension: (Chrome In-App Payments service) - C:\Users\Eve\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.11_0
CHR Extension: (Citavi Picker) - C:\Users\Eve\AppData\Local\Google\Chrome\User Data\Default\Extensions\piehhloihgjjiomhieeddiidpekaajio\2013.5.30_0
CHR Extension: (Gmail) - C:\Users\Eve\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
CHR HKLM-x32\...\Chrome\Extension: [piehhloihgjjiomhieeddiidpekaajio] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Chrome\ChromePicker.crx

==================== Services (Whitelisted) =================

R2 AVerRemote; C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe [360448 2011-08-19] (AVerMedia)
R2 AVerScheduleService; C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe [403456 2011-04-01] ()
R2 ekrn; C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe [1341664 2013-03-21] (ESET)
R2 LckFldService; C:\Windows\SysWow64\LckFldService.exe [36864 2005-06-22] ()
R2 MSSQL$SQLEXPRESS; C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [58345832 2011-09-22] (Microsoft Corporation)
R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [75064 2012-11-17] ()
S4 SQLAgent$SQLEXPRESS; C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [431464 2011-09-22] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

S3 AVerAF35; C:\Windows\System32\Drivers\AVerAF35.sys [677632 2010-03-16] (AVerMedia TECHNOLOGIES, Inc.)
R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [213416 2013-02-14] (ESET)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [150616 2013-01-10] (ESET)
R2 epfw; C:\Windows\System32\DRIVERS\epfw.sys [190232 2013-01-10] (ESET)
R1 EpfwLWF; C:\Windows\System32\DRIVERS\EpfwLWF.sys [59440 2013-01-10] (ESET)
R0 epfwwfp; C:\Windows\System32\DRIVERS\epfwwfp.sys [58416 2013-02-14] (ESET)
S1 hola_net; C:\Windows\System32\DRIVERS\hola_net.sys [86976 2013-04-27] (Hola Networks Ltd.)
R3 nuvotoncir; C:\Windows\System32\DRIVERS\nuvotoncir.sys [48128 2009-06-24] (Nuvoton Technology Corporation)
R1 SLEE_17_DRIVER; C:\Windows\Sleen1764.sys [108256 2010-02-17] (Softwareentwicklung Remus - ArchiCrypt - )
R1 SLEE_17_DRIVER; C:\Windows\Sleen1764.sys [108256 2010-02-17] (Softwareentwicklung Remus - ArchiCrypt - )
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [530488 2011-11-19] ()
S3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42184 2013-06-21] (Anchorfree Inc.)
S3 VSPerfDrv100; C:\Program Files (x86)\Microsoft Visual Studio 10.0\Team Tools\Performance Tools\x64\VSPerfDrv100.sys [68440 2011-01-18] (Microsoft Corporation)
S3 VSPerfDrv100; C:\Program Files (x86)\Microsoft Visual Studio 10.0\Team Tools\Performance Tools\x64\VSPerfDrv100.sys [68440 2011-01-18] (Microsoft Corporation)
S3 winbondcir; C:\Windows\System32\DRIVERS\winbondcir.sys [46592 2007-03-28] (Winbond Electronics Corporation)
U3 ampwsucy; C:\Windows\System32\Drivers\ampwsucy.sys [0 ] (Advanced Micro Devices)
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [x]
S3 vpnva; system32\DRIVERS\vpnva64.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-30 16:22 - 2013-09-30 16:22 - 00000000 ____D C:\FRST
2013-09-30 16:21 - 2013-09-30 16:21 - 01953880 _____ (Farbar) C:\Users\Eve\Desktop\FRST64.exe
2013-09-30 16:18 - 2013-09-30 16:23 - 00000340 _____ C:\Windows\LkmdfCoInst.log
2013-09-30 04:53 - 2013-09-30 04:56 - 00000000 ____D C:\AdwCleaner
2013-09-30 02:33 - 2013-09-30 02:33 - 00000000 ____D C:\Program Files (x86)\StarUML
2013-09-27 23:17 - 2013-09-30 16:23 - 00000404 _____ C:\Windows\setupact.log
2013-09-27 23:17 - 2013-09-27 23:17 - 00000000 _____ C:\Windows\setuperr.log
2013-09-27 03:16 - 2013-09-27 03:16 - 00000000 ____D C:\Users\Eve\AppData\Local\DOSBox
2013-09-27 03:10 - 2013-09-28 02:17 - 00000000 ____D C:\Program Files (x86)\DOSBox-0.74
2013-09-27 02:59 - 2013-09-30 16:13 - 00001286 _____ C:\Windows\Tasks\a2zLyrics-1-updater.job
2013-09-27 02:59 - 2013-09-30 16:13 - 00001090 _____ C:\Windows\Tasks\a2zLyrics-1-enabler.job
2013-09-27 02:59 - 2013-09-27 02:59 - 00004316 _____ C:\Windows\System32\Tasks\a2zLyrics-1-updater
2013-09-27 02:59 - 2013-09-27 02:59 - 00004120 _____ C:\Windows\System32\Tasks\a2zLyrics-1-enabler
2013-09-27 02:57 - 2013-09-30 16:13 - 00001898 _____ C:\Windows\Tasks\a2zLyrics-1-chromeinstaller.job
2013-09-27 02:57 - 2013-09-30 16:13 - 00001822 _____ C:\Windows\Tasks\a2zLyrics-1-firefoxinstaller.job
2013-09-27 02:57 - 2013-09-30 16:13 - 00001190 _____ C:\Windows\Tasks\a2zLyrics-1-codedownloader.job
2013-09-27 02:57 - 2013-09-27 02:57 - 00004220 _____ C:\Windows\System32\Tasks\a2zLyrics-1-codedownloader
2013-09-26 00:23 - 2013-09-26 00:23 - 00000000 ____D C:\Users\Eve\AppData\Roaming\SketchUp
2013-09-26 00:22 - 2013-09-26 00:22 - 00003120 _____ C:\Windows\SysWOW64\ALLFSAF13a.ocx
2013-09-24 03:44 - 2013-09-24 03:44 - 00000723 _____ C:\Users\Eve\AppData\Local\recently-used.xbel
2013-09-23 08:06 - 2013-09-24 22:42 - 00007552 _____ C:\Users\Eve\Desktop\Strukto1.nsd
2013-09-23 07:09 - 2013-09-23 07:09 - 00002186 _____ C:\Users\Eve\Desktop\Structorizer.lnk
2013-09-23 07:09 - 2013-09-23 07:09 - 00000000 ____D C:\Users\Eve\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Structorizer
2013-09-23 07:09 - 2013-09-23 07:09 - 00000000 ____D C:\Users\Eve\.structorizer
2013-09-21 23:51 - 2013-09-21 23:51 - 00001154 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-09-21 23:32 - 2013-09-21 23:24 - 00000970 _____ C:\Users\Eve\Documents\indexfile.txt
2013-09-21 15:56 - 2013-09-24 19:47 - 00000000 ____D C:\Users\Eve\AppData\Roaming\vlc
2013-09-20 04:41 - 2013-09-20 04:49 - 01540096 _____ C:\Users\Eve\Documents\Database4.accdb
2013-09-18 06:15 - 2013-09-18 06:23 - 00823296 _____ C:\Users\Eve\Documents\Database3.accdb
2013-09-18 05:30 - 2013-09-18 05:41 - 01507328 _____ C:\Users\Eve\Documents\Database2.accdb
2013-09-18 05:24 - 2013-09-18 05:30 - 01220608 _____ C:\Users\Eve\Documents\Database1.accdb
2013-09-12 06:35 - 2013-08-10 07:22 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-12 06:35 - 2013-08-10 07:22 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-12 06:35 - 2013-08-10 07:22 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-09-12 06:35 - 2013-08-10 07:21 - 19246592 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-12 06:35 - 2013-08-10 07:21 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-12 06:35 - 2013-08-10 07:21 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-12 06:35 - 2013-08-10 07:20 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-12 06:35 - 2013-08-10 07:20 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-12 06:35 - 2013-08-10 07:20 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-12 06:35 - 2013-08-10 07:20 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-12 06:35 - 2013-08-10 07:20 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-12 06:35 - 2013-08-10 07:20 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-09-12 06:35 - 2013-08-10 07:20 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-09-12 06:35 - 2013-08-10 07:20 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-09-12 06:35 - 2013-08-10 05:59 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-09-12 06:35 - 2013-08-10 05:59 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-09-12 06:35 - 2013-08-10 05:58 - 14332928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-09-12 06:35 - 2013-08-10 05:58 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-09-12 06:35 - 2013-08-10 05:58 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-09-12 06:35 - 2013-08-10 05:58 - 02048000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-09-12 06:35 - 2013-08-10 05:58 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-09-12 06:35 - 2013-08-10 05:58 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-09-12 06:35 - 2013-08-10 05:58 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-09-12 06:35 - 2013-08-10 05:58 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-09-12 06:35 - 2013-08-10 05:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-09-12 06:35 - 2013-08-10 05:58 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-09-12 06:35 - 2013-08-10 05:58 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-09-12 06:35 - 2013-08-10 05:17 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-12 06:35 - 2013-08-10 05:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-09-12 06:35 - 2013-08-10 04:27 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-09-12 06:35 - 2013-08-10 04:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-09-12 06:00 - 2013-08-05 04:25 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys
2013-09-12 06:00 - 2013-08-02 04:23 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-09-12 06:00 - 2013-08-02 04:15 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-09-12 06:00 - 2013-08-02 04:15 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2013-09-12 06:00 - 2013-08-02 04:15 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-09-12 06:00 - 2013-08-02 04:15 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2013-09-12 06:00 - 2013-08-02 04:14 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2013-09-12 06:00 - 2013-08-02 04:14 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2013-09-12 06:00 - 2013-08-02 04:13 - 01161216 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2013-09-12 06:00 - 2013-08-02 04:13 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:59 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-09-12 06:00 - 2013-08-02 03:59 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-09-12 06:00 - 2013-08-02 03:51 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-09-12 06:00 - 2013-08-02 03:50 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2013-09-12 06:00 - 2013-08-02 03:50 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2013-09-12 06:00 - 2013-08-02 03:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2013-09-12 06:00 - 2013-08-02 02:59 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2013-09-12 06:00 - 2013-08-02 02:45 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-09-12 06:00 - 2013-08-02 02:45 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-09-12 06:00 - 2013-08-02 02:45 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-09-12 06:00 - 2013-08-02 02:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-09-12 06:00 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2013-09-12 05:59 - 2013-08-08 03:20 - 03155456 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-09-12 05:59 - 2013-07-26 04:24 - 14172672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2013-09-12 05:59 - 2013-07-26 04:24 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2013-09-12 05:59 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2013-09-12 05:59 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2013-09-12 03:48 - 2013-09-12 03:51 - 00000000 ____D C:\Users\Eve\AppData\Local\Temporary Projects
2013-09-12 03:43 - 2013-09-12 03:43 - 00000000 ____D C:\Users\Eve\AppData\Roaming\Microsoft Corporation
2013-09-12 02:48 - 2013-09-12 02:48 - 00000000 ____D C:\ProgramData\Microsoft Visual Studio
2013-09-11 16:04 - 2013-09-11 16:04 - 00000000 ____D C:\ProgramData\PreEmptive Solutions
2013-09-11 15:56 - 2013-09-11 15:56 - 00000000 ____D C:\Program Files\IIS
2013-09-11 15:56 - 2013-09-11 15:56 - 00000000 ____D C:\Program Files (x86)\Microsoft ASP.NET
2013-09-11 15:56 - 2013-09-11 15:56 - 00000000 ____D C:\Program Files (x86)\IIS
2013-09-11 15:55 - 2013-09-11 15:55 - 00000000 ____D C:\Users\Eve\Documents\Visual Studio 2008
2013-09-11 15:44 - 2013-09-11 15:49 - 00000000 ____D C:\Program Files (x86)\Microsoft F#
2013-09-11 15:44 - 2013-09-11 15:46 - 00000000 ____D C:\Program Files (x86)\HTML Help Workshop
2013-09-11 15:38 - 2013-09-11 16:07 - 00000000 ____D C:\Program Files\Microsoft Visual Studio 10.0
2013-09-11 15:38 - 2013-09-11 15:38 - 00000000 ____D C:\Windows\symbols
2013-09-06 00:14 - 2013-09-11 06:35 - 00000039 _____ C:\Windows\vbaddin.ini
2013-09-05 19:16 - 2013-09-05 19:22 - 00392704 _____ C:\Users\Eve\Documents\Konten2013.stb
2013-09-05 19:05 - 2013-09-05 19:05 - 00001147 _____ C:\Users\Public\Desktop\Steganos Online-Banking.lnk
2013-09-03 02:23 - 2013-09-03 02:25 - 00000000 ____D C:\Windows\system32\appmgmt
2013-09-02 15:13 - 2013-09-05 05:50 - 00000000 ____D C:\Users\Eve\AppData\Local\Microsoft Games
2013-09-02 01:34 - 2013-09-02 01:34 - 00000000 ____D C:\Program Files\Microsoft Games
2013-09-01 04:36 - 2013-09-01 04:36 - 00000000 ____D C:\ProgramData\Steam

==================== One Month Modified Files and Folders =======

2013-09-30 16:23 - 2013-09-30 16:18 - 00000340 _____ C:\Windows\LkmdfCoInst.log
2013-09-30 16:23 - 2013-09-27 23:17 - 00000404 _____ C:\Windows\setupact.log
2013-09-30 16:23 - 2011-10-22 17:28 - 01536169 _____ C:\Windows\WindowsUpdate.log
2013-09-30 16:22 - 2013-09-30 16:22 - 00000000 ____D C:\FRST
2013-09-30 16:22 - 2009-07-14 06:45 - 00021808 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-30 16:22 - 2009-07-14 06:45 - 00021808 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-30 16:21 - 2013-09-30 16:21 - 01953880 _____ (Farbar) C:\Users\Eve\Desktop\FRST64.exe
2013-09-30 16:18 - 2011-11-29 19:56 - 00018960 _____ (Logitech, Inc.) C:\Windows\system32\Drivers\LNonPnP.sys
2013-09-30 16:16 - 2013-05-28 14:40 - 00000000 ____D C:\Users\Eve\AppData\Roaming\Box Sync
2013-09-30 16:14 - 2011-10-22 18:01 - 00000000 ____D C:\Users\Eve\AppData\Roaming\Dropbox
2013-09-30 16:13 - 2013-09-27 02:59 - 00001286 _____ C:\Windows\Tasks\a2zLyrics-1-updater.job
2013-09-30 16:13 - 2013-09-27 02:59 - 00001090 _____ C:\Windows\Tasks\a2zLyrics-1-enabler.job
2013-09-30 16:13 - 2013-09-27 02:57 - 00001898 _____ C:\Windows\Tasks\a2zLyrics-1-chromeinstaller.job
2013-09-30 16:13 - 2013-09-27 02:57 - 00001822 _____ C:\Windows\Tasks\a2zLyrics-1-firefoxinstaller.job
2013-09-30 16:13 - 2013-09-27 02:57 - 00001190 _____ C:\Windows\Tasks\a2zLyrics-1-codedownloader.job
2013-09-30 16:13 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-30 05:01 - 2013-04-09 03:41 - 00001112 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1161904824-3949471311-470107347-1001UA.job
2013-09-30 05:00 - 2013-07-15 23:36 - 00000000 ____D C:\Users\Eve\Documents\Citavi 4
2013-09-30 04:58 - 2011-10-22 18:13 - 00000000 ____D C:\Users\Eve\AppData\Roaming\Notepad++
2013-09-30 04:56 - 2013-09-30 04:53 - 00000000 ____D C:\AdwCleaner
2013-09-30 02:33 - 2013-09-30 02:33 - 00000000 ____D C:\Program Files (x86)\StarUML
2013-09-29 00:28 - 2012-07-18 22:23 - 00000000 ____D C:\Users\Eve\Documents\AVerTV
2013-09-28 21:02 - 2012-03-29 22:36 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-09-28 21:02 - 2011-10-22 17:48 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-28 02:17 - 2013-09-27 03:10 - 00000000 ____D C:\Program Files (x86)\DOSBox-0.74
2013-09-27 23:17 - 2013-09-27 23:17 - 00000000 _____ C:\Windows\setuperr.log
2013-09-27 04:35 - 2011-10-27 01:02 - 00000000 ____D C:\Users\Eve\AppData\Roaming\Media Player Classic
2013-09-27 03:55 - 2013-08-17 22:36 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-09-27 03:16 - 2013-09-27 03:16 - 00000000 ____D C:\Users\Eve\AppData\Local\DOSBox
2013-09-27 02:59 - 2013-09-27 02:59 - 00004316 _____ C:\Windows\System32\Tasks\a2zLyrics-1-updater
2013-09-27 02:59 - 2013-09-27 02:59 - 00004120 _____ C:\Windows\System32\Tasks\a2zLyrics-1-enabler
2013-09-27 02:57 - 2013-09-27 02:57 - 00004220 _____ C:\Windows\System32\Tasks\a2zLyrics-1-codedownloader
2013-09-27 02:30 - 2011-10-22 17:33 - 00000000 ____D C:\Users\Eve
2013-09-26 01:19 - 2012-07-02 21:29 - 00000064 _____ C:\Windows\AVerText.ini
2013-09-26 00:23 - 2013-09-26 00:23 - 00000000 ____D C:\Users\Eve\AppData\Roaming\SketchUp
2013-09-26 00:22 - 2013-09-26 00:22 - 00003120 _____ C:\Windows\SysWOW64\ALLFSAF13a.ocx
2013-09-25 20:01 - 2013-04-09 03:41 - 00001060 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1161904824-3949471311-470107347-1001Core.job
2013-09-24 22:42 - 2013-09-23 08:06 - 00007552 _____ C:\Users\Eve\Desktop\Strukto1.nsd
2013-09-24 20:46 - 2013-06-11 01:33 - 00000000 ____D C:\Users\Eve\Documents\My Digital Editions
2013-09-24 19:50 - 2011-10-22 20:59 - 00000000 ____D C:\Users\Eve\AppData\Roaming\foobar2000
2013-09-24 19:47 - 2013-09-21 15:56 - 00000000 ____D C:\Users\Eve\AppData\Roaming\vlc
2013-09-24 05:59 - 2011-10-22 18:04 - 00001038 _____ C:\Users\Public\Desktop\foobar2000.lnk
2013-09-24 05:59 - 2011-10-22 18:04 - 00000000 ____D C:\Program Files (x86)\foobar2000
2013-09-24 03:44 - 2013-09-24 03:44 - 00000723 _____ C:\Users\Eve\AppData\Local\recently-used.xbel
2013-09-23 23:04 - 2013-07-03 18:43 - 00000000 ____D C:\Program Files (x86)\Zotero Standalone
2013-09-23 07:09 - 2013-09-23 07:09 - 00002186 _____ C:\Users\Eve\Desktop\Structorizer.lnk
2013-09-23 07:09 - 2013-09-23 07:09 - 00000000 ____D C:\Users\Eve\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Structorizer
2013-09-23 07:09 - 2013-09-23 07:09 - 00000000 ____D C:\Users\Eve\.structorizer
2013-09-23 01:50 - 2011-10-22 19:56 - 00000000 ____D C:\Cryptload
2013-09-23 01:49 - 2011-10-22 18:10 - 00000000 ____D C:\Program Files (x86)\JDownloader
2013-09-22 22:56 - 2011-10-22 18:01 - 00000000 ____D C:\Program Files\CCleaner
2013-09-21 23:51 - 2013-09-21 23:51 - 00001154 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-09-21 23:24 - 2013-09-21 23:32 - 00000970 _____ C:\Users\Eve\Documents\indexfile.txt
2013-09-21 16:07 - 2013-04-09 03:43 - 00002360 _____ C:\Users\Eve\Desktop\Google Chrome.lnk
2013-09-21 15:29 - 2010-11-21 08:50 - 00767748 _____ C:\Windows\system32\perfh007.dat
2013-09-21 15:29 - 2010-11-21 08:50 - 00175706 _____ C:\Windows\system32\perfc007.dat
2013-09-21 15:29 - 2009-07-14 07:13 - 01807410 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-20 04:49 - 2013-09-20 04:41 - 01540096 _____ C:\Users\Eve\Documents\Database4.accdb
2013-09-19 00:18 - 2011-10-22 19:41 - 00000000 ____D C:\Users\Eve\Desktop\Convert
2013-09-18 22:42 - 2012-09-27 15:01 - 00000000 ____D C:\Users\Eve\AppData\Roaming\Audacity
2013-09-18 06:23 - 2013-09-18 06:15 - 00823296 _____ C:\Users\Eve\Documents\Database3.accdb
2013-09-18 05:41 - 2013-09-18 05:30 - 01507328 _____ C:\Users\Eve\Documents\Database2.accdb
2013-09-18 05:30 - 2013-09-18 05:24 - 01220608 _____ C:\Users\Eve\Documents\Database1.accdb
2013-09-17 20:11 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-09-13 05:51 - 2011-11-19 05:30 - 00000000 ____D C:\Users\Eve\AppData\Roaming\DAEMON Tools Lite
2013-09-13 05:51 - 2011-10-22 18:25 - 00000000 ____D C:\Windows\Panther
2013-09-12 17:23 - 2011-10-22 18:25 - 00002033 _____ C:\Users\Public\Desktop\Adobe Acrobat X Pro.lnk
2013-09-12 17:15 - 2012-02-15 17:17 - 00000000 ___RD C:\Users\Eve\Virtual Machines
2013-09-12 17:15 - 2011-10-22 17:33 - 00000000 ___RD C:\Users\Eve\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-09-12 17:15 - 2011-10-22 17:33 - 00000000 ___RD C:\Users\Eve\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-09-12 17:12 - 2012-04-02 18:36 - 00439576 _____ C:\Windows\system32\FNTCACHE.DAT
2013-09-12 06:37 - 2011-10-22 19:54 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-09-12 06:34 - 2013-07-15 16:33 - 00000000 ____D C:\Windows\system32\MRT
2013-09-12 06:30 - 2011-10-22 21:19 - 79143768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-09-12 03:51 - 2013-09-12 03:48 - 00000000 ____D C:\Users\Eve\AppData\Local\Temporary Projects
2013-09-12 03:43 - 2013-09-12 03:43 - 00000000 ____D C:\Users\Eve\AppData\Roaming\Microsoft Corporation
2013-09-12 03:41 - 2013-06-10 03:48 - 00000000 ____D C:\Users\Eve\Documents\Visual Studio 2010
2013-09-12 02:48 - 2013-09-12 02:48 - 00000000 ____D C:\ProgramData\Microsoft Visual Studio
2013-09-11 23:58 - 2013-06-10 03:46 - 00000000 ____D C:\Program Files (x86)\Microsoft Visual Studio 10.0
2013-09-11 23:58 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\MSBuild
2013-09-11 22:57 - 2013-06-10 03:45 - 00000000 ____D C:\Program Files (x86)\Microsoft SDKs
2013-09-11 16:07 - 2013-09-11 15:38 - 00000000 ____D C:\Program Files\Microsoft Visual Studio 10.0
2013-09-11 16:04 - 2013-09-11 16:04 - 00000000 ____D C:\ProgramData\PreEmptive Solutions
2013-09-11 15:56 - 2013-09-11 15:56 - 00000000 ____D C:\Program Files\IIS
2013-09-11 15:56 - 2013-09-11 15:56 - 00000000 ____D C:\Program Files (x86)\Microsoft ASP.NET
2013-09-11 15:56 - 2013-09-11 15:56 - 00000000 ____D C:\Program Files (x86)\IIS
2013-09-11 15:55 - 2013-09-11 15:55 - 00000000 ____D C:\Users\Eve\Documents\Visual Studio 2008
2013-09-11 15:49 - 2013-09-11 15:44 - 00000000 ____D C:\Program Files (x86)\Microsoft F#
2013-09-11 15:46 - 2013-09-11 15:44 - 00000000 ____D C:\Program Files (x86)\HTML Help Workshop
2013-09-11 15:45 - 2013-06-10 03:56 - 00000000 ____D C:\Windows\SysWOW64\1031
2013-09-11 15:44 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\MSBuild
2013-09-11 15:39 - 2013-06-14 02:00 - 00000000 ____D C:\Program Files (x86)\Microsoft Visual Studio 9.0
2013-09-11 15:39 - 2009-07-14 05:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2013-09-11 15:38 - 2013-09-11 15:38 - 00000000 ____D C:\Windows\symbols
2013-09-11 15:38 - 2013-06-10 03:56 - 00000000 ____D C:\Windows\system32\1031
2013-09-11 06:35 - 2013-09-06 00:14 - 00000039 _____ C:\Windows\vbaddin.ini
2013-09-06 17:51 - 2013-05-06 21:42 - 00000000 ___SD C:\Users\Eve\Documents\Meine Shapes
2013-09-05 19:22 - 2013-09-05 19:16 - 00392704 _____ C:\Users\Eve\Documents\Konten2013.stb
2013-09-05 19:05 - 2013-09-05 19:05 - 00001147 _____ C:\Users\Public\Desktop\Steganos Online-Banking.lnk
2013-09-05 19:05 - 2013-01-18 20:00 - 00000000 ____D C:\Program Files (x86)\Steganos Online-Banking 2012
2013-09-05 19:00 - 2012-04-10 21:33 - 00000000 ____D C:\Users\Eve\AppData\Roaming\Steganos
2013-09-05 05:50 - 2013-09-02 15:13 - 00000000 ____D C:\Users\Eve\AppData\Local\Microsoft Games
2013-09-03 02:31 - 2011-11-11 06:49 - 00000000 ____D C:\Program Files (x86)\IceBreaker
2013-09-03 02:25 - 2013-09-03 02:23 - 00000000 ____D C:\Windows\system32\appmgmt
2013-09-03 02:23 - 2013-06-11 01:49 - 00000000 ____D C:\Python26
2013-09-03 02:18 - 2012-05-11 02:41 - 00000000 ____D C:\Program Files\Common Files\DESIGNER
2013-09-03 02:18 - 2012-05-11 02:37 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
2013-09-03 02:18 - 2011-10-22 19:54 - 00000000 ____D C:\Program Files\Microsoft Office
2013-09-02 01:34 - 2013-09-02 01:34 - 00000000 ____D C:\Program Files\Microsoft Games
2013-09-01 04:50 - 2012-04-16 23:17 - 00000000 ____D C:\Windows\Minidump
2013-09-01 04:36 - 2013-09-01 04:36 - 00000000 ____D C:\ProgramData\Steam
2013-08-31 15:51 - 2013-08-20 21:47 - 00000000 ____D C:\Program Files\FreeFileSync

Files to move or delete:
====================
C:\Users\Eve\AppData\Roaming\DesktopSave.ini


Some content of TEMP:
====================
C:\Users\Eve\AppData\Local\Temp\a2zLyrics_1060-8102_v122.exe
C:\Users\Eve\AppData\Local\Temp\appshat-distribution.exe
C:\Users\Eve\AppData\Local\Temp\DeltaTB.exe
C:\Users\Eve\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-09-28 23:01

==================== End Of Log ============================

--- --- ---

Addition.txt:

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 27-09-2013 02
Ran by Eve at 2013-09-30 16:25:23
Running from C:\Users\Eve\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: ESET Smart Security 6.0 (Enabled - Up to date) {77DEAFED-8149-104B-25A1-21771CA47CD1}
AS: ESET Smart Security 6.0 (Enabled - Up to date) {CCBF4E09-A773-1FC5-1F11-1A056723366C}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: ESET Personal Firewall (Enabled) {4FE52EC8-CB26-1113-0EFE-8842E2773BAA}

==================== Installed Programs ======================

7-Zip 9.20 (x64 edition) (Version: 9.20.00.0)
Acer Crystal Eye Webcam (x32 Version: 5.2.7.1)
Adobe Acrobat X Pro - English, Français, Deutsch (x32 Version: 10.1.8)
Adobe Digital Editions (x32)
Adobe Flash Player 11 ActiveX (x32 Version: 11.4.402.287)
Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.168)
Apple Application Support (x32 Version: 2.3)
Audacity 2.0.2 (x32 Version: 2.0.2)
AVerMedia A835 USB TV Tuner 8.2.64.61 (x32 Version: 8.2.64.61)
AVerTV 3D (x32 Version: 6.5)
Box Sync (64 bit) (Version: 3.4.25.0)
Brother MFL-Pro Suite MFC-255CW (x32 Version: 1.0.1.0)
BS.Player PRO (x32 Version: 2.56.1043)
CCleaner (Version: 4.05)
Citavi 4 (x32 Version: 4.1.0.3)
Crayon Physics Deluxe version 55 (x32 Version: 55)
Crystal Reports for Visual Studio (x32 Version: 12.51.0.240)
DAEMON Tools Lite (x32 Version: 4.45.1.0236)
dBpoweramp Music Converter (x32 Version: Release 13.1)
Definition Update for Microsoft Office 2010 (KB982726) 64-Bit Edition
Dotfuscator Software Services - Community Edition - DEU (x32 Version: 5.0.2300.0)
Dotfuscator Software Services - Community Edition (x32 Version: 5.0.2500.0)
Dropbox (HKCU Version: 2.0.22)
EPubsoft Adobe PDF ePub DRM Removal 4.8.8 (x32 Version: 4.8.8)
eReg (x32 Version: 1.20.138.34)
ESET Smart Security (Version: 6.0.316.1)
Evernote v. 4.6.6 (x32 Version: 4.6.6.8360)
FileZilla Client 3.7.1 (HKCU Version: 3.7.1)
foobar2000 v1.2.9 (x32 Version: 1.2.9)
Google Chrome (HKCU Version: 29.0.1547.76)
Hotfix für Microsoft Team Foundation Server 2010-Objektmodell - DEU (KB2813041) (x32 Version: 1)
Hotfix für Microsoft Visual Basic 2010 Express - DEU (KB2635973) (x32 Version: 1)
Hotfix für Microsoft Visual Studio 2010 Ultimate - DEU (KB2529927) (x32 Version: 1)
Hotfix für Microsoft Visual Studio 2010 Ultimate - DEU (KB2548139) (x32 Version: 1)
Hotfix für Microsoft Visual Studio 2010 Ultimate - DEU (KB2549864) (x32 Version: 1)
Hotfix für Microsoft Visual Studio 2010 Ultimate - DEU (KB2565057) (x32 Version: 1)
Hotfix für Microsoft Visual Studio 2010 Ultimate - DEU (KB2635973) (x32 Version: 1)
Hotfix für Microsoft Visual Studio 2010 Ultimate - DEU (KB2813041) (x32 Version: 1)
IceBreaker (x32)
ImgBurn (x32 Version: 2.5.8.0)
IrfanView (remove only) (x32 Version: 4.36)
JabRef 2.9.2 (x32 Version: 2.9.2)
Java 7 Update 10 (64-bit) (Version: 7.0.100)
Java 7 Update 10 (x32 Version: 7.0.100)
Java Auto Updater (x32 Version: 2.1.9.0)
JDownloader 0.9 (x32 Version: 0.9)
LAME v3.99.3 (for Windows) (x32)
LockHunter version 1.0 beta 3, 64 bit edition
Logitech SetPoint 6.32 (Version: 6.32.20)
Logitech Unifying-Software 2.10 (Version: 2.10.37)
Logon Screen (x32)
Media Player Classic - Home Cinema v1.5.2.3456 x64 (Version: 1.5.2.3456)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319)
Microsoft .NET Framework 4 Multi-Targeting Pack (x32 Version: 4.0.30319)
Microsoft .NET Framework 4.5 (Version: 4.5.50709)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Application Error Reporting (x32 Version: 12.0.6012.5000)
Microsoft ASP.NET MVC 2 - DEU (x32 Version: 2.0.50331.0)
Microsoft ASP.NET MVC 2 - Visual Studio 2010 Tools - DEU (x32 Version: 2.0.50331.0)
Microsoft ASP.NET MVC 2 - Visual Studio 2010 Tools (x32 Version: 2.0.50217.0)
Microsoft ASP.NET MVC 2 (x32 Version: 2.0.50217.0)
Microsoft Help Viewer 1.1 (Version: 1.1.40219)
Microsoft Help Viewer 1.1 Language Pack - DEU (Version: 1.1.40219)
Microsoft Office Access MUI (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office Excel MUI (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office Groove MUI (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office InfoPath MUI (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office Office 32-bit Components 2010 (Version: 14.0.7015.1000)
Microsoft Office OneNote MUI (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office Outlook MUI (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office PowerPoint MUI (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office Professional Plus 2010 (Version: 14.0.7015.1000)
Microsoft Office Proof (English) 2010 (Version: 14.0.7015.1000)
Microsoft Office Proof (French) 2010 (Version: 14.0.7015.1000)
Microsoft Office Proof (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office Proof (Italian) 2010 (Version: 14.0.7015.1000)
Microsoft Office Proofing (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office Publisher MUI (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office Shared 32-bit MUI (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office Shared MUI (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office Visio 2010 (Version: 14.0.7015.1000)
Microsoft Office Visio MUI (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office Word MUI (German) 2010 (Version: 14.0.7015.1000)
Microsoft redistributable runtime DLLs VS2005 SP1(x86) (x32 Version: 8.0.50727.4053)
Microsoft redistributable runtime DLLs VS2008 SP1(x86) (x32 Version: 9.0)
Microsoft Silverlight (Version: 5.1.20513.0)
Microsoft Silverlight 3 SDK - Deutsch (x32 Version: 3.0.40818.0)
Microsoft Silverlight 4 SDK - Deutsch (x32 Version: 4.0.50826.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft SQL Server 2008 (64-bit)
Microsoft SQL Server 2008 Browser (x32 Version: 10.3.5500.0)
Microsoft SQL Server 2008 Common Files (Version: 10.3.5500.0)
Microsoft SQL Server 2008 Database Engine Services (Version: 10.3.5500.0)
Microsoft SQL Server 2008 Database Engine Shared (Version: 10.3.5500.0)
Microsoft SQL Server 2008 Native Client (Version: 10.3.5500.0)
Microsoft SQL Server 2008 R2 Management Objects (x32 Version: 10.50.1750.9)
Microsoft SQL Server 2008 R2 Management Objects (x64) (Version: 10.50.1750.9)
Microsoft SQL Server 2008 R2 Transact-SQL-Sprachdienst (x32 Version: 10.50.1752.9)
Microsoft SQL Server 2008 R2-Datenebenenanwendungs-Framework (x32 Version: 10.50.1750.9)
Microsoft SQL Server 2008 R2-Datenebenenanwendungs-Projekt (x32 Version: 10.50.1750.9)
Microsoft SQL Server 2008 RsFx Driver (Version: 10.3.5500.0)
Microsoft SQL Server Compact 3.5 SP2 x64 DEU (Version: 3.5.8080.0)
Microsoft SQL Server Database Publishing Wizard 1.4 (x32 Version: 10.1.2512.8)
Microsoft SQL Server System CLR Types (x32 Version: 10.50.1750.9)
Microsoft SQL Server System CLR Types (x64) (Version: 10.50.1750.9)
Microsoft SQL Server VSS Writer (Version: 10.3.5500.0)
Microsoft Sync Framework Runtime v1.0 SP1 (x64) de (Version: 1.0.3010.0)
Microsoft Sync Framework SDK v1.0 SP1 de (x32 Version: 1.0.3010.0)
Microsoft Sync Framework Services v1.0 SP1 (x64) de (Version: 1.0.3010.0)
Microsoft Sync Services for ADO.NET v2.0 SP1 (x64) de (Version: 2.0.3010.0)
Microsoft Team Foundation Server 2010 Object Model - DEU (Version: 10.0.40219)
Microsoft Team Foundation Server 2010-Objektmodell - DEU (Version: 10.0.40219)
Microsoft Visio Premium 2010 (Version: 14.0.7015.1000)
Microsoft Visual Basic 2010 Express - DEU (x32 Version: 10.0.40219)
Microsoft Visual C++  Compilers 2010 Standard - enu - x64 (Version: 10.0.40219)
Microsoft Visual C++  Compilers 2010 Standard - enu - x86 (x32 Version: 10.0.40219)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (x32 Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x64 Designtime - 10.0.30319 (Version: 10.0.30319)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010  x64 Runtime - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Microsoft Visual C++ 2010  x86 Runtime - 10.0.40219 (x32 Version: 10.0.40219)
Microsoft Visual F# 2.0 Runtime (x32 Version: 10.0.40219)
Microsoft Visual F# 2.0 Runtime Language Pack - DEU (x32 Version: 10.0.30319)
Microsoft Visual Studio 2010 ADO.NET Entity Framework Tools (x32 Version: 10.0.40219)
Microsoft Visual Studio 2010 IntelliTrace Collection (x64) (Version: 10.0.40219)
Microsoft Visual Studio 2010 Office Developer Tools (x64) (Version: 10.0.40219)
Microsoft Visual Studio 2010 Office Developer Tools (x64) Language Pack - DEU (Version: 10.0.40219)
Microsoft Visual Studio 2010 Performance Collection Tools SP1 - DEU (Version: 10.0.40219)
Microsoft Visual Studio 2010 Service Pack 1 (x32 Version: 10.0.40219)
Microsoft Visual Studio 2010 SharePoint Developer Tools (x32 Version: 10.0.40219)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (Version: 10.0.40303)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (Version: 10.0.40308)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU (Version: 10.0.40303)
Microsoft Visual Studio 2010 Ultimate - DEU (x32 Version: 10.0.30319)
Microsoft Visual Studio 2010 Ultimate - DEU (x32 Version: 10.0.40219)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (Version: 10.0.40303)
Microsoft Visual Studio Macro Tools - DEU Language Pack (x32 Version: 9.0.30729)
Microsoft Visual Studio Macro Tools (x32 Version: 9.0.30729)
MiKTeX 2.9 (x32 Version: 2.9)
MozBackup 1.5.1 (x32)
Mozilla Firefox 24.0 (x86 de) (x32 Version: 24.0)
Mp3tag v2.52 (x32 Version: v2.52)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
Notepad++ (x32 Version: 5.9.4)
Nuvoton CIR Device Driver (x32 Version: 8.60.1000)
NVIDIA Drivers (Version: 1.7)
NVIDIA HD-Audiotreiber 1.3.18.0 (Version: 1.3.18.0)
NVIDIA Install Application (Version: 2.1002.109.718)
NVIDIA PhysX (x32 Version: 9.12.0213)
NVIDIA PhysX-Systemsoftware 9.12.0213 (Version: 9.12.0213)
Opera 12.16 (x32 Version: 12.16.1860)
Oracle VM VirtualBox 4.2.16 (Version: 4.2.16)
PicPick (x32 Version: 3.1.9)
PVSonyDll (Version: 1.00.0001)
QuickTime (x32 Version: 7.73.80.64)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6482)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition
Service Pack 3 für SQL Server 2008 (KB2546951) (64-bit) (Version: 10.3.5500.0)
Sicherheitsupdate für Microsoft Visual Studio 2010 Ultimate - DEU (KB2645410) (x32 Version: 1)
Skype™ 6.6 (x32 Version: 6.6.106)
Sql Server Customer Experience Improvement Program (Version: 10.3.5500.0)
StarMoney (x32 Version: 2.0)
StarUML 5.0.2.1570 (x32)
Steam (x32 Version: 1.0.0.0)
Steganos Online-Banking 2012 (x32 Version: 2.0.3)
Synaptics Pointing Device Driver (Version: 14.0.6.0)
TeamViewer 8 (x32 Version: 8.0.19617)
TeXstudio 2.5.2 (x32 Version: 2.5.2)
Unterstützungsdateien für Microsoft SQL Server 2008-Setup  (Version: 10.3.5500.0)
Update for Microsoft .NET Framework 4.5 (KB2750147) (x32 Version: 1)
Update for Microsoft .NET Framework 4.5 (KB2805221) (x32 Version: 1)
Update for Microsoft .NET Framework 4.5 (KB2805226) (x32 Version: 1)
Update for Microsoft Access 2010 (KB2553446) 64-Bit Edition
Update for Microsoft Filter Pack 2.0 (KB2810071) 64-Bit Edition
Update for Microsoft Office 2010 (KB2553092)
Update for Microsoft Office 2010 (KB2553157) 64-Bit Edition
Update for Microsoft Office 2010 (KB2589298) 64-Bit Edition
Update for Microsoft Office 2010 (KB2589370) 64-Bit Edition
Update for Microsoft Office 2010 (KB2589375) 64-Bit Edition
Update for Microsoft Office 2010 (KB2760598) 64-Bit Edition
Update for Microsoft Office 2010 (KB2760631) 64-Bit Edition
Update for Microsoft Office 2010 (KB2760758) 64-Bit Edition
Update for Microsoft Office 2010 (KB2794737) 64-Bit Edition
Update for Microsoft Office 2010 (KB2825640) 64-Bit Edition
Update for Microsoft OneNote 2010 (KB2810072) 64-Bit Edition
Update for Microsoft PowerPoint 2010 (KB2553145) 64-Bit Edition
Update for Microsoft Visio Viewer 2010 (KB2810066) 64-Bit Edition
Uplink (x32 Version: 1.00.0000)
Visual Studio 2010 Prerequisites - English (Version: 10.0.40219)
VLC media player 2.0.8 (x32 Version: 2.0.8)
WCF RIA Services V1.0 SP1 (x32 Version: 4.1.60114.0)
Web Deployment Tool (Version: 1.1.0618)
WIDCOMM Bluetooth Software (Version: 6.2.0.9700)
WinRAR 4.01 (64-Bit) (Version: 4.01.0)
Worms Revolution (x32)
Xvid Video Codec (x32 Version: 1.3.2)
Your Uninstaller! 7 (x32 Version: 7.3.2011.2)
Zotero Standalone 4.0.8 (x86 en-US) (x32 Version: 4.0.8)

==================== Restore Points  =========================


==================== Hosts content: ==========================

2009-07-14 04:34 - 2011-11-20 09:45 - 00000894 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 activate.adobe.com
127.0.0.1 redtube.com


==================== Scheduled Tasks (whitelisted) =============

Task: {1F5B7B5A-033F-4830-8111-074F54071FDE} - System32\Tasks\a2zLyrics-1-chromeinstaller => C:\Program Files (x86)\a2zLyrics-1\a2zLyrics-1-chromeinstaller.exe
Task: {22679EC8-B7C8-4085-8990-97B6DFF82274} - System32\Tasks\{7512712B-F92C-4A26-9552-9147E12265B1} => C:\Team17\Worms World Party\wwp.exe
Task: {44ECA205-0A28-4E6D-8C89-C302E796B5BD} - System32\Tasks\a2zLyrics-1-firefoxinstaller => C:\Program Files (x86)\a2zLyrics-1\a2zLyrics-1-firefoxinstaller.exe
Task: {6A9F6EEF-9F1C-4078-B521-69355A45C589} - System32\Tasks\a2zLyrics-1-updater => C:\Program Files (x86)\a2zLyrics-1\a2zLyrics-1-updater.exe
Task: {91A421E8-A432-4F03-B9B5-07C99F1B1CF5} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-08-21] (Piriform Ltd)
Task: {A1D60D55-A6B8-401B-BC05-2938E02DF2F2} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => d:\program files\windows defender\MpCmdRun.exe
Task: {A370FB38-57F7-42DE-A605-06A72FD85432} - System32\Tasks\a2zLyrics-1-enabler => C:\Program Files (x86)\a2zLyrics-1\a2zLyrics-1-enabler.exe
Task: {AAA48E7E-9DA2-4F11-89D8-BAFAF763F5ED} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1161904824-3949471311-470107347-1001UA => C:\Users\Eve\AppData\Local\Google\Update\GoogleUpdate.exe [2013-04-09] (Google Inc.)
Task: {C921E101-2576-49E1-92D8-C25E25335135} - System32\Tasks\{C90A5A0D-A0AF-4610-9281-73270640110B} => C:\Team17\Worms World Party\wwp.exe
Task: {CD4AB9AD-FDA3-43FC-9C14-9DDD8D373EB4} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1161904824-3949471311-470107347-1001Core => C:\Users\Eve\AppData\Local\Google\Update\GoogleUpdate.exe [2013-04-09] (Google Inc.)
Task: {E166049E-3044-4522-86CB-440B654562EE} - System32\Tasks\a2zLyrics-1-codedownloader => C:\Program Files (x86)\a2zLyrics-1\a2zLyrics-1-codedownloader.exe
Task: {EE017FE1-5963-4EC0-B45B-BE8201DC723F} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: C:\Windows\Tasks\a2zLyrics-1-chromeinstaller.job => C:\Program Files (x86)\a2zLyrics-1\a2zLyrics-1-chromeinstaller.exe
Task: C:\Windows\Tasks\a2zLyrics-1-codedownloader.job => C:\Program Files (x86)\a2zLyrics-1\a2zLyrics-1-codedownloader.exe
Task: C:\Windows\Tasks\a2zLyrics-1-enabler.job => C:\Program Files (x86)\a2zLyrics-1\a2zLyrics-1-enabler.exe
Task: C:\Windows\Tasks\a2zLyrics-1-firefoxinstaller.job => C:\Program Files (x86)\a2zLyrics-1\a2zLyrics-1-firefoxinstaller.exe
Task: C:\Windows\Tasks\a2zLyrics-1-updater.job => C:\Program Files (x86)\a2zLyrics-1\a2zLyrics-1-updater.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1161904824-3949471311-470107347-1001Core.job => C:\Users\Eve\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1161904824-3949471311-470107347-1001UA.job => C:\Users\Eve\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2013-04-04 01:09 - 2013-04-04 01:09 - 04300432 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2010-01-02 16:42 - 2010-01-02 16:42 - 00098304 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext_64.dll
2011-10-07 11:39 - 2011-10-07 11:39 - 01304856 _____ () C:\Program Files\Logitech\SetPointP\Macros\MacroCore.dll
2013-07-11 21:43 - 2013-07-11 21:43 - 00537600 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_64\Python.Runtime\8bdd14828ee35fc0ea86e54380c74c1f\Python.Runtime.ni.dll
2013-01-03 19:12 - 2013-01-03 19:12 - 00471552 _____ () C:\Program Files\Box Sync\_hashlib.pyd
2013-01-03 19:12 - 2013-01-03 19:12 - 00046080 _____ () C:\Program Files\Box Sync\_socket.pyd
2013-01-03 19:12 - 2013-01-03 19:12 - 01167360 _____ () C:\Program Files\Box Sync\_ssl.pyd
2013-01-03 19:12 - 2013-01-03 19:12 - 00689664 _____ () C:\Program Files\Box Sync\unicodedata.pyd
2013-01-03 19:12 - 2013-01-03 19:12 - 00166912 _____ () C:\Program Files\Box Sync\_elementtree.pyd
2013-01-03 19:12 - 2013-01-03 19:12 - 00164352 _____ () C:\Program Files\Box Sync\pyexpat.pyd
2013-01-03 19:12 - 2013-01-03 19:12 - 00111616 _____ () C:\Program Files\Box Sync\_ctypes.pyd
2013-01-03 19:12 - 2013-01-03 19:12 - 00127488 _____ () C:\Program Files\Box Sync\win32api.pyd
2013-01-03 19:12 - 2013-01-03 19:12 - 00136704 _____ () C:\Program Files\Box Sync\pywintypes27.dll
2013-01-03 19:12 - 2013-01-03 19:12 - 00058368 _____ () C:\Program Files\Box Sync\_sqlite3.pyd
2013-01-03 19:12 - 2013-01-03 19:12 - 00535040 _____ () C:\Program Files\Box Sync\sqlite3.dll
2013-01-03 19:12 - 2013-01-03 19:12 - 00037888 _____ () C:\Program Files\Box Sync\_testcapi.pyd
2013-01-03 19:12 - 2013-01-03 19:12 - 00135168 _____ () C:\Program Files\Box Sync\win32security.pyd
2013-01-03 19:12 - 2013-01-03 19:12 - 00007168 _____ () C:\Program Files\Box Sync\_win32sysloader.pyd
2013-01-03 19:12 - 2013-01-03 19:12 - 00138752 _____ () C:\Program Files\Box Sync\win32file.pyd
2013-09-03 15:54 - 2013-09-03 15:54 - 00019968 _____ () C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\locale\de_de\acrotray.deu
2013-03-13 22:48 - 2013-03-13 22:48 - 24978944 _____ () C:\Users\Eve\AppData\Roaming\Dropbox\bin\libcef.dll
2013-09-21 23:51 - 2013-09-11 04:26 - 03279768 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2013-04-04 01:09 - 2013-04-04 01:09 - 04300456 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2013-09-28 21:02 - 2013-09-28 21:02 - 16177544 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\ProgramData\TEMP:1CE11B51

==================== Safe Mode (whitelisted) ===================


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (09/30/2013 04:15:07 PM) (Source: Microsoft-Windows-WMI) (User: NT-AUTORITÄT)
Description: Der Ereignisfilter mit der Abfrage "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" konnte im Namespace "//./root/CIMV2" aufgrund des Fehlers "0x80041003" nicht reaktiviert werden. Solange dieses Problem besteht, können mit diesem Filter keine Ereignisse übermittelt werden.

Error: (09/30/2013 04:59:19 AM) (Source: Microsoft-Windows-WMI) (User: NT-AUTORITÄT)
Description: Der Ereignisfilter mit der Abfrage "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" konnte im Namespace "//./root/CIMV2" aufgrund des Fehlers "0x80041003" nicht reaktiviert werden. Solange dieses Problem besteht, können mit diesem Filter keine Ereignisse übermittelt werden.

Error: (09/30/2013 00:51:00 AM) (Source: Microsoft-Windows-WMI) (User: NT-AUTORITÄT)
Description: Der Ereignisfilter mit der Abfrage "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" konnte im Namespace "//./root/CIMV2" aufgrund des Fehlers "0x80041003" nicht reaktiviert werden. Solange dieses Problem besteht, können mit diesem Filter keine Ereignisse übermittelt werden.

Error: (09/29/2013 05:57:56 PM) (Source: Microsoft-Windows-WMI) (User: NT-AUTORITÄT)
Description: Der Ereignisfilter mit der Abfrage "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" konnte im Namespace "//./root/CIMV2" aufgrund des Fehlers "0x80041003" nicht reaktiviert werden. Solange dieses Problem besteht, können mit diesem Filter keine Ereignisse übermittelt werden.

Error: (09/28/2013 09:00:57 PM) (Source: Microsoft-Windows-WMI) (User: NT-AUTORITÄT)
Description: Der Ereignisfilter mit der Abfrage "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" konnte im Namespace "//./root/CIMV2" aufgrund des Fehlers "0x80041003" nicht reaktiviert werden. Solange dieses Problem besteht, können mit diesem Filter keine Ereignisse übermittelt werden.

Error: (09/28/2013 01:33:49 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: AVerTV.exe, Version: 6.8.1.45, Zeitstempel: 0x4eee9b2c
Name des fehlerhaften Moduls: A800Graph.dll, Version: 3.1.1.3, Zeitstempel: 0x4e7a982c
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000fa540
ID des fehlerhaften Prozesses: 0x12e8
Startzeit der fehlerhaften Anwendung: 0xAVerTV.exe0
Pfad der fehlerhaften Anwendung: AVerTV.exe1
Pfad des fehlerhaften Moduls: AVerTV.exe2
Berichtskennung: AVerTV.exe3

Error: (09/27/2013 11:19:05 PM) (Source: Microsoft-Windows-WMI) (User: NT-AUTORITÄT)
Description: Der Ereignisfilter mit der Abfrage "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" konnte im Namespace "//./root/CIMV2" aufgrund des Fehlers "0x80041003" nicht reaktiviert werden. Solange dieses Problem besteht, können mit diesem Filter keine Ereignisse übermittelt werden.

Error: (09/27/2013 02:28:03 AM) (Source: Microsoft-Windows-WMI) (User: NT-AUTORITÄT)
Description: Der Ereignisfilter mit der Abfrage "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" konnte im Namespace "//./root/CIMV2" aufgrund des Fehlers "0x80041003" nicht reaktiviert werden. Solange dieses Problem besteht, können mit diesem Filter keine Ereignisse übermittelt werden.

Error: (09/25/2013 06:35:12 PM) (Source: Microsoft-Windows-WMI) (User: NT-AUTORITÄT)
Description: Der Ereignisfilter mit der Abfrage "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" konnte im Namespace "//./root/CIMV2" aufgrund des Fehlers "0x80041003" nicht reaktiviert werden. Solange dieses Problem besteht, können mit diesem Filter keine Ereignisse übermittelt werden.

Error: (09/24/2013 04:12:13 PM) (Source: Microsoft-Windows-WMI) (User: NT-AUTORITÄT)
Description: Der Ereignisfilter mit der Abfrage "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" konnte im Namespace "//./root/CIMV2" aufgrund des Fehlers "0x80041003" nicht reaktiviert werden. Solange dieses Problem besteht, können mit diesem Filter keine Ereignisse übermittelt werden.


System errors:
=============
Error: (09/30/2013 04:14:23 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler beendet: 
%%-2140993535

Error: (09/30/2013 04:14:23 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%-2140993535

Error: (09/30/2013 04:14:23 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Heimnetzgruppen-Listener" wurde mit folgendem dienstspezifischem Fehler beendet: %%-2147023143.

Error: (09/30/2013 04:14:23 PM) (Source: PNRPSvc) (User: )
Description: 0x80630801

Error: (09/30/2013 04:14:15 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%-2140993535

Error: (09/30/2013 04:14:15 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler beendet: 
%%-2140993535

Error: (09/30/2013 04:14:14 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Heimnetzgruppen-Listener" wurde mit folgendem dienstspezifischem Fehler beendet: %%-2147023143.

Error: (09/30/2013 04:14:14 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler beendet: 
%%-2140993535

Error: (09/30/2013 04:14:14 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%-2140993535

Error: (09/30/2013 04:14:14 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Heimnetzgruppen-Listener" wurde mit folgendem dienstspezifischem Fehler beendet: %%-2147023143.


Microsoft Office Sessions:
=========================
Error: (09/30/2013 04:15:07 PM) (Source: Microsoft-Windows-WMI)(User: NT-AUTORITÄT)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/30/2013 04:59:19 AM) (Source: Microsoft-Windows-WMI)(User: NT-AUTORITÄT)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/30/2013 00:51:00 AM) (Source: Microsoft-Windows-WMI)(User: NT-AUTORITÄT)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/29/2013 05:57:56 PM) (Source: Microsoft-Windows-WMI)(User: NT-AUTORITÄT)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/28/2013 09:00:57 PM) (Source: Microsoft-Windows-WMI)(User: NT-AUTORITÄT)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/28/2013 01:33:49 AM) (Source: Application Error)(User: )
Description: AVerTV.exe6.8.1.454eee9b2cA800Graph.dll3.1.1.34e7a982cc0000005000fa54012e801cebbc87937522dC:\Program Files (x86)\AVerMedia\AVerTV 3D\AVerTV.exeC:\Program Files (x86)\Common Files\AVerMedia\dll\A800Graph.dll420255f7-27cd-11e3-bc68-00269e001701

Error: (09/27/2013 11:19:05 PM) (Source: Microsoft-Windows-WMI)(User: NT-AUTORITÄT)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/27/2013 02:28:03 AM) (Source: Microsoft-Windows-WMI)(User: NT-AUTORITÄT)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/25/2013 06:35:12 PM) (Source: Microsoft-Windows-WMI)(User: NT-AUTORITÄT)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/24/2013 04:12:13 PM) (Source: Microsoft-Windows-WMI)(User: NT-AUTORITÄT)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


CodeIntegrity Errors:
===================================
  Date: 2013-09-18 21:37:29.945
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-09-18 21:37:29.742
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-09-18 21:37:29.504
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-09-18 21:37:29.276
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-09-18 21:37:27.565
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-09-18 21:37:27.304
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-08-15 17:50:35.295
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-08-15 17:50:35.036
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-08-15 17:50:34.697
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-08-15 17:50:34.451
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Percentage of memory in use: 53%
Total physical RAM: 4060.93 MB
Available physical RAM: 1897.38 MB
Total Pagefile: 8120.04 MB
Available Pagefile: 5621.68 MB
Total Virtual: 8192 MB
Available Virtual: 8191.8 MB

==================== Drives ================================

Drive c: (Windows) (Fixed) (Total:100.78 GB) (Free:35.93 GB) NTFS
Drive d: (Data) (Fixed) (Total:364.88 GB) (Free:319.81 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: EA5BFAFE)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=101 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=365 GB) - (Type=07 NTFS)

==================== End Of Log ============================

Danke für deine Hilfe!

schrauber · 01.10.2013, 07:52

hi,

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Miau3 · 01.10.2013, 14:13

Hi schrauber,

ich hoffe, das hat so hingehauen. Hatte ESET zwar komplett ausgeschaltet, das hat sich dann aber selbst wieder eingeschaltet als der PC neu gestartet wurde - ist das schlimm?

Hier auf jeden Fall das Logfile:

Code:

ATTFilter

ComboFix 13-09-30.02 - Eve 01.10.2013  14:46:32.1.2 - x64
Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.4061.2191 [GMT 2:00]
ausgeführt von:: c:\users\Eve\Desktop\ComboFix.exe
AV: ESET Smart Security 6.0 *Disabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
FW: ESET Personal Firewall *Disabled* {4FE52EC8-CB26-1113-0EFE-8842E2773BAA}
SP: ESET Smart Security 6.0 *Disabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\SecureW2
c:\programdata\Microsoft\Windows\Start Menu\Programs\SecureW2\TTLS Manager.lnk
c:\programdata\Microsoft\Windows\Start Menu\Programs\SecureW2\Uninstall.lnk
c:\users\Eve\AppData\Local\assembly\tmp
c:\users\Eve\AppData\Local\Google\Chrome\User Data\Default\Preferences
c:\windows\SysWow64\fldlckun.exe
.
.
(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_hola_net
.
.
(((((((((((((((((((((((   Dateien erstellt von 2013-09-01 bis 2013-10-01  ))))))))))))))))))))))))))))))
.
.
2013-09-30 14:22 . 2013-09-30 14:22	--------	d-----w-	C:\FRST
2013-09-30 02:53 . 2013-09-30 02:56	--------	d-----w-	C:\AdwCleaner
2013-09-30 00:33 . 2013-09-30 00:33	--------	d-----w-	c:\program files (x86)\StarUML
2013-09-27 01:16 . 2013-09-27 01:16	--------	d-----w-	c:\users\Eve\AppData\Local\DOSBox
2013-09-27 01:10 . 2013-09-28 00:17	--------	d-----w-	c:\program files (x86)\DOSBox-0.74
2013-09-25 22:23 . 2013-09-25 22:23	--------	d-----w-	c:\users\Eve\AppData\Roaming\SketchUp
2013-09-23 05:09 . 2013-09-23 05:09	--------	d-----w-	c:\users\Eve\.structorizer
2013-09-21 13:56 . 2013-09-24 17:47	--------	d-----w-	c:\users\Eve\AppData\Roaming\vlc
2013-09-12 04:00 . 2013-08-05 02:25	155584	----a-w-	c:\windows\system32\drivers\ataport.sys
2013-09-12 03:59 . 2013-08-08 01:20	3155456	----a-w-	c:\windows\system32\win32k.sys
2013-09-12 03:59 . 2013-07-26 02:24	14172672	----a-w-	c:\windows\system32\shell32.dll
2013-09-12 03:59 . 2013-07-26 02:24	197120	----a-w-	c:\windows\system32\shdocvw.dll
2013-09-12 02:01 . 2013-10-01 12:55	--------	d-----w-	c:\users\Eve\AppData\Local\assembly
2013-09-12 01:48 . 2013-09-12 01:51	--------	d-----w-	c:\users\Eve\AppData\Local\Temporary Projects
2013-09-12 01:43 . 2013-09-12 01:43	--------	d-----w-	c:\users\Eve\AppData\Roaming\Microsoft Corporation
2013-09-12 00:48 . 2013-09-12 00:48	--------	d-----w-	c:\programdata\Microsoft Visual Studio
2013-09-11 14:04 . 2013-09-11 14:04	--------	d-----w-	c:\programdata\PreEmptive Solutions
2013-09-11 13:56 . 2013-09-11 13:56	--------	d-----w-	c:\program files (x86)\Microsoft ASP.NET
2013-09-11 13:56 . 2013-09-11 13:56	--------	d-----w-	c:\program files\IIS
2013-09-11 13:56 . 2013-09-11 13:56	--------	d-----w-	c:\program files (x86)\IIS
2013-09-11 13:55 . 2013-09-12 20:14	2492736	----a-w-	c:\programdata\Microsoft\VisualStudio\10.0\1031\ResourceCache.dll
2013-09-11 13:44 . 2013-09-12 19:40	--------	d-----w-	c:\program files (x86)\Common Files\Merge Modules
2013-09-11 13:44 . 2013-09-11 13:49	--------	d-----w-	c:\program files (x86)\Microsoft F#
2013-09-11 13:44 . 2013-09-11 13:46	--------	d-----w-	c:\program files (x86)\HTML Help Workshop
2013-09-11 13:38 . 2013-09-11 13:38	--------	d-----w-	c:\windows\symbols
2013-09-11 13:38 . 2013-09-11 14:07	--------	d-----w-	c:\program files\Microsoft Visual Studio 10.0
2013-09-03 00:23 . 2013-09-03 00:25	--------	d-----w-	c:\windows\system32\appmgmt
2013-09-02 13:13 . 2013-09-05 03:50	--------	d-----w-	c:\users\Eve\AppData\Local\Microsoft Games
2013-09-01 23:34 . 2013-09-01 23:34	--------	d-----w-	c:\program files\Microsoft Games
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-09-30 14:18 . 2011-11-29 17:56	18960	----a-w-	c:\windows\system32\drivers\LNonPnP.sys
2013-09-28 19:02 . 2012-03-29 20:36	692616	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2013-09-28 19:02 . 2011-10-22 15:48	71048	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-09-12 04:30 . 2011-10-22 19:19	79143768	----a-w-	c:\windows\system32\MRT.exe
2013-09-12 04:18 . 2013-06-10 01:49	207008	----a-w-	c:\programdata\Microsoft\VBExpress\10.0\1031\ResourceCache.dll
2013-08-02 01:48 . 2013-09-12 04:00	44032	----a-w-	c:\windows\apppatch\acwow64.dll
2013-07-25 09:25 . 2013-08-14 11:11	1888768	----a-w-	c:\windows\system32\WMVDECOD.DLL
2013-07-25 08:57 . 2013-08-14 11:11	1620992	----a-w-	c:\windows\SysWow64\WMVDECOD.DLL
2013-07-19 01:58 . 2013-08-14 11:11	2048	----a-w-	c:\windows\system32\tzres.dll
2013-07-19 01:41 . 2013-08-14 11:11	2048	----a-w-	c:\windows\SysWow64\tzres.dll
2013-07-09 05:52 . 2013-08-14 11:11	224256	----a-w-	c:\windows\system32\wintrust.dll
2013-07-09 05:51 . 2013-08-14 11:11	1217024	----a-w-	c:\windows\system32\rpcrt4.dll
2013-07-09 05:46 . 2013-08-14 11:11	1472512	----a-w-	c:\windows\system32\crypt32.dll
2013-07-09 05:46 . 2013-08-14 11:11	184320	----a-w-	c:\windows\system32\cryptsvc.dll
2013-07-09 05:46 . 2013-08-14 11:11	139776	----a-w-	c:\windows\system32\cryptnet.dll
2013-07-09 04:52 . 2013-08-14 11:11	663552	----a-w-	c:\windows\SysWow64\rpcrt4.dll
2013-07-09 04:52 . 2013-08-14 11:11	175104	----a-w-	c:\windows\SysWow64\wintrust.dll
2013-07-09 04:46 . 2013-08-14 11:11	140288	----a-w-	c:\windows\SysWow64\cryptsvc.dll
2013-07-09 04:46 . 2013-08-14 11:11	1166848	----a-w-	c:\windows\SysWow64\crypt32.dll
2013-07-09 04:46 . 2013-08-14 11:11	103936	----a-w-	c:\windows\SysWow64\cryptnet.dll
2013-07-06 06:03 . 2013-08-14 11:09	1910208	----a-w-	c:\windows\system32\drivers\tcpip.sys
2013-07-04 13:58 . 2013-07-30 22:51	238352	----a-w-	c:\windows\system32\drivers\VBoxDrv.sys
2013-07-04 13:57 . 2013-07-30 22:50	120080	----a-w-	c:\windows\system32\drivers\VBoxUSBMon.sys
2013-07-04 13:57 . 2013-07-04 13:57	146704	----a-w-	c:\windows\system32\drivers\VBoxNetFlt.sys
2013-07-04 13:57 . 2013-07-04 13:57	131856	----a-w-	c:\windows\system32\drivers\VBoxNetAdp.sys
2013-07-04 13:56 . 2013-07-04 13:56	204048	----a-w-	c:\windows\system32\VBoxNetFltNobj.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36	130736	----a-w-	c:\users\Eve\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36	130736	----a-w-	c:\users\Eve\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36	130736	----a-w-	c:\users\Eve\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36	130736	----a-w-	c:\users\Eve\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"Adobe Acrobat Speed Launcher"="c:\program files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe" [2013-09-03 41336]
"Acrobat Assistant 8.0"="c:\program files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe" [2013-09-03 840568]
.
c:\users\Eve\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Eve\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2013-5-25 27776968]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
AVer HID Receiver.lnk - c:\program files (x86)\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe [2012-7-18 155648]
AVerQuick.lnk - c:\program files (x86)\Common Files\AVerMedia\AVerQuick\AVerQuick.exe [2012-7-18 675840]
Box Sync.lnk - c:\program files\Box Sync\BoxSync.exe -hidden [2013-6-7 7959552]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 AVerAF35;AVerMedia A835 USB DVB-T;c:\windows\system32\Drivers\AVerAF35.sys;c:\windows\SYSNATIVE\Drivers\AVerAF35.sys [x]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys;c:\windows\SYSNATIVE\DRIVERS\btwl2cap.sys [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys;c:\windows\SYSNATIVE\drivers\EagleX64.sys [x]
R3 HTCAND64;HTC Device Driver;c:\windows\system32\Drivers\ANDROIDUSB.sys;c:\windows\SYSNATIVE\Drivers\ANDROIDUSB.sys [x]
R3 LEqdUsb;Logitech SetPoint Unifying KMDF USB Filter;c:\windows\system32\DRIVERS\LEqdUsb.Sys;c:\windows\SYSNATIVE\DRIVERS\LEqdUsb.Sys [x]
R3 LHidEqd;Logitech SetPoint Unifying KMDF HID Filter;c:\windows\system32\DRIVERS\LHidEqd.Sys;c:\windows\SYSNATIVE\DRIVERS\LHidEqd.Sys [x]
R3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series - Adaptertreiber für Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys;c:\windows\SYSNATIVE\DRIVERS\netw5v64.sys [x]
R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 taphss6;Anchorfree HSS VPN Adapter;c:\windows\system32\DRIVERS\taphss6.sys;c:\windows\SYSNATIVE\DRIVERS\taphss6.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 VSPerfDrv100;Performance Tools Driver 10.0;c:\program files (x86)\Microsoft Visual Studio 10.0\Team Tools\Performance Tools\x64\VSPerfDrv100.sys;c:\program files (x86)\Microsoft Visual Studio 10.0\Team Tools\Performance Tools\x64\VSPerfDrv100.sys [x]
R3 winbondcir;Winbond IR Transceiver;c:\windows\system32\DRIVERS\winbondcir.sys;c:\windows\SYSNATIVE\DRIVERS\winbondcir.sys [x]
R4 MSSQLServerADHelper100;SQL Server Hilfsdienst für Active Directory;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [x]
R4 RsFx0105;RsFx0105 Driver;c:\windows\system32\DRIVERS\RsFx0105.sys;c:\windows\SYSNATIVE\DRIVERS\RsFx0105.sys [x]
R4 SQLAgent$SQLEXPRESS;SQL Server-Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE;c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [x]
S0 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys;c:\windows\SYSNATIVE\DRIVERS\epfwwfp.sys [x]
S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S1 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys;c:\windows\SYSNATIVE\DRIVERS\eamonm.sys [x]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys;c:\windows\SYSNATIVE\DRIVERS\ehdrv.sys [x]
S1 EpfwLWF;Epfw NDIS LightWeight Filter;c:\windows\system32\DRIVERS\EpfwLWF.sys;c:\windows\SYSNATIVE\DRIVERS\EpfwLWF.sys [x]
S1 SLEE_17_DRIVER;Steganos Live Encryption Engine 17 [Driver];c:\windows\Sleen1764.sys;c:\windows\Sleen1764.sys [x]
S1 VBoxDrv;VirtualBox Service;c:\windows\system32\DRIVERS\VBoxDrv.sys;c:\windows\SYSNATIVE\DRIVERS\VBoxDrv.sys [x]
S1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\DRIVERS\VBoxUSBMon.sys;c:\windows\SYSNATIVE\DRIVERS\VBoxUSBMon.sys [x]
S2 AVerRemote;AVerRemote;c:\program files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe;c:\program files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe [x]
S2 AVerScheduleService;AVerScheduleService;c:\program files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe;c:\program files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe [x]
S2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\x86\ekrn.exe;c:\program files\ESET\ESET Smart Security\x86\ekrn.exe [x]
S2 TeamViewer8;TeamViewer 8;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe [x]
S3 L1C;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20);c:\windows\system32\DRIVERS\L1C62x64.sys;c:\windows\SYSNATIVE\DRIVERS\L1C62x64.sys [x]
S3 NETw5s64;Intel(R) Wireless WiFi Link Adaptertreiber für Windows 7 64-Bit;c:\windows\system32\DRIVERS\NETw5s64.sys;c:\windows\SYSNATIVE\DRIVERS\NETw5s64.sys [x]
S3 nuvotoncir;Nuvoton IR Transceiver;c:\windows\system32\DRIVERS\nuvotoncir.sys;c:\windows\SYSNATIVE\DRIVERS\nuvotoncir.sys [x]
S3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys;c:\windows\SYSNATIVE\DRIVERS\VBoxNetAdp.sys [x]
S3 VBoxNetFlt;VirtualBox Bridged Networking Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys;c:\windows\SYSNATIVE\DRIVERS\VBoxNetFlt.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
Inhalt des "geplante Tasks" Ordners
.
2013-09-30 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1161904824-3949471311-470107347-1001Core.job
- c:\users\Eve\AppData\Local\Google\Update\GoogleUpdate.exe [2013-04-09 01:41]
.
2013-10-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1161904824-3949471311-470107347-1001UA.job
- c:\users\Eve\AppData\Local\Google\Update\GoogleUpdate.exe [2013-04-09 01:41]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\000BoxDesktopFileLocked]
@="{C253B817-3A00-475f-A5A3-6F2DD704B48D}"
[HKEY_CLASSES_ROOT\CLSID\{C253B817-3A00-475f-A5A3-6F2DD704B48D}]
2010-11-21 03:23	444752	----a-w-	c:\windows\System32\mscoree.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\000BoxDesktopNotSynced]
@="{19ACC806-F7AA-46AA-A80A-726A07CA6637}"
[HKEY_CLASSES_ROOT\CLSID\{19ACC806-F7AA-46AA-A80A-726A07CA6637}]
2010-11-21 03:23	444752	----a-w-	c:\windows\System32\mscoree.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\000BoxDesktopNotSyncedCollabs]
@="{337D9DE0-3F8B-4430-AF0F-FFC24A95AE8F}"
[HKEY_CLASSES_ROOT\CLSID\{337D9DE0-3F8B-4430-AF0F-FFC24A95AE8F}]
2010-11-21 03:23	444752	----a-w-	c:\windows\System32\mscoree.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\000BoxDesktopSynced]
@="{B7AC9C6D-F15B-4B1A-A88D-F518D13861D9}"
[HKEY_CLASSES_ROOT\CLSID\{B7AC9C6D-F15B-4B1A-A88D-F518D13861D9}]
2010-11-21 03:23	444752	----a-w-	c:\windows\System32\mscoree.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\000BoxDesktopSyncedCollab]
@="{9E48C232-F601-4E41-BB3E-16CBAF317AA4}"
[HKEY_CLASSES_ROOT\CLSID\{9E48C232-F601-4E41-BB3E-16CBAF317AA4}]
2010-11-21 03:23	444752	----a-w-	c:\windows\System32\mscoree.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36	164016	----a-w-	c:\users\Eve\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36	164016	----a-w-	c:\users\Eve\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36	164016	----a-w-	c:\users\Eve\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36	164016	----a-w-	c:\users\Eve\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-10-17 13307496]
"PLFSetI"="c:\windows\PLFSetI.exe" [2008-07-29 200704]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2011-10-07 1744152]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-08-06 16336416]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2013-03-21 6330568]
"BoxSyncHelper"="c:\program files\Box Sync\BoxSyncHelper.exe" [2013-06-07 393216]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2012-11-05 108144]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: &Citavi Picker... - file://c:\programdata\Swiss Academic Software\Citavi Picker\Internet Explorer\ShowContextMenu.html
IE: An OneNote s&enden - c:\progra~2\MICROS~2\Office14\ONBttnIE.dll/105
IE: An vorhandene PDF-Datei anfügen - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Auswahl speichern - c:\program files (x86)\Evernote\Evernote\\EvernoteIERes\Clip.html?clipAction=3
IE: Bild an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Bild ausschneiden - c:\program files (x86)\Evernote\Evernote\\EvernoteIERes\Clip.html?clipAction=4
IE: Diese Seite ausschneiden - c:\program files (x86)\Evernote\Evernote\\EvernoteIERes\Clip.html?clipAction=1
IE: Free YouTube to MP3 Converter - c:\users\Eve\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: In Adobe PDF konvertieren - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Linkziel an vorhandene PDF-Datei anhängen - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Linkziel in Adobe PDF konvertieren - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~2\Office14\EXCEL.EXE/3000
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000
IE: Neue Notiz - c:\program files (x86)\Evernote\Evernote\\EvernoteIERes\NewNote.html
IE: Seite an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: URL notieren - c:\program files (x86)\Evernote\Evernote\\EvernoteIERes\Clip.html?clipAction=0
TCP: DhcpNameServer = 192.168.178.1
TCP: Interfaces\{0849F004-6A13-4013-9D58-C20F6E7859CE}: NameServer = 192.168.2.1
FF - ProfilePath - c:\users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\
FF - prefs.js: browser.startup.homepage - www.google.de
FF - ExtSQL: 2013-08-15 13:37; menuiconsplus@codedawn.com; c:\users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\extensions\menuiconsplus@codedawn.com.xpi
FF - ExtSQL: 2013-08-26 02:16; firefox@ghostery.com; c:\users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\extensions\firefox@ghostery.com.xpi
FF - ExtSQL: 2013-08-27 03:21; {8AA36F4F-6DC7-4c06-77AF-5035170634FE}; c:\programdata\Swiss Academic Software\Citavi Picker\Firefox
FF - ExtSQL: 2013-09-01 04:57; {46551EC9-40F0-4e47-8E18-8E5CF550CFB8}; c:\users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}.xpi
FF - ExtSQL: 2013-09-05 20:44; {fe272bd1-5f76-4ea4-8501-a05d35d823fc}; c:\users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi
FF - ExtSQL: 2013-09-17 05:27; customizable-shortcuts@timtaubert.de; c:\users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\extensions\customizable-shortcuts@timtaubert.de.xpi
FF - ExtSQL: 2013-09-17 06:52; sidebarBookmarkSelector@alice; c:\users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\extensions\sidebarBookmarkSelector@alice.xpi
FF - ExtSQL: 2013-09-22 22:55; {d40f5e7b-d2cf-4856-b441-cc613eeffbe3}; c:\users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-dBpoweramp Music Converter - c:\windows\system32\SpoonUninstall.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
"Key"="ActionsPane3"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0\Solutions\hxxp://schemas.microsoft.com/office/smartdocuments/2003\0]
"Key"="hxxp://schemas.microsoft.com/office/smartdocuments/2003"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0\Solutions\hxxp://schemas.microsoft.com/office/smartdocuments/2003\0\{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}\Alias]
"0"="Microsoft Actions Pane 3"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\windows\SysWOW64\LckFldService.exe
c:\windows\SysWOW64\PnkBstrA.exe
c:\users\Eve\AppData\Roaming\Dropbox\bin\Dropbox.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2013-10-01  15:08:53 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2013-10-01 13:08
.
Vor Suchlauf: 13 Verzeichnis(se), 38.325.444.608 Bytes frei
Nach Suchlauf: 19 Verzeichnis(se), 37.839.171.584 Bytes frei
.
- - End Of File - - 4426EF3E601F9A15930C22FF9A23C5E7
A36C5E4F47E84449FF07ED3517B43A31

Liebe Grüße und nochmals vielen, vielen Dank!

schrauber · 01.10.2013, 19:10

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

Miau3 · 01.10.2013, 22:50

Hi schrauber,

hier die Logfiles.

MBAM Log:

Code:

ATTFilter

 Malwarebytes Anti-Malware  (Test) 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.10.01.09

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16686
Eve :: EVE-PC [Administrator]

Schutz: Aktiviert

01.10.2013 22:52:17
mbam-log-2013-10-01 (22-52-17).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: Autostart | P2P
Durchsuchte Objekte: 206125
Laufzeit: 6 Minute(n), 46 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 2
HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C} (PUP.Optional.OptimzerPro.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\Software\a2zLyrics-1 (PUP.Optional.A2ZLyrics.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 1
C:\Windows\Resources\Themes\explorer.exe (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

ADW-Cleaner

Code:

ATTFilter

# AdwCleaner v3.006 - Bericht erstellt am 01/10/2013 um 23:22:15
# Updated 01/10/2013 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzername : Eve - EVE-PC
# Gestartet von : C:\Users\Eve\Desktop\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\jetpack
Datei Gelöscht : C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\foxydeal.sqlite

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Schlüssel Gelöscht : HKCU\Software\InstalledThirdPartyPrograms
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\InstalledThirdPartyPrograms

***** [ Browser ] *****

-\\ Internet Explorer v10.0.9200.16686


-\\ Mozilla Firefox v24.0 (de)

[ Datei : C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\prefs.js ]


-\\ Google Chrome v

[ Datei : C:\Users\Eve\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R1].txt - [1407 octets] - [01/10/2013 23:12:45]
AdwCleaner[R2].txt - [1467 octets] - [01/10/2013 23:21:12]
AdwCleaner[S1].txt - [1312 octets] - [01/10/2013 23:22:15]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [1372 octets] ##########

JRT

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.3 (09.27.2013:1)
OS: Windows 7 Professional x64
Ran by Eve on 01.10.2013 at 23:25:26,97
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\anchorfree
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{55555555-5555-5555-5555-550455155554}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{66666666-6666-6666-6666-660466156654}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\TypeLib\{44444444-4444-4444-4444-440444154454}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Wow6432Node\Interface\{55555555-5555-5555-5555-550455155554}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Wow6432Node\Interface\{66666666-6666-6666-6666-660466156654}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Wow6432Node\TypeLib\{44444444-4444-4444-4444-440444154454}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Interface\{55555555-5555-5555-5555-550455155554}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Interface\{66666666-6666-6666-6666-660466156654}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\TypeLib\{44444444-4444-4444-4444-440444154454}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\sob14prode_dealsde_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\sob14prode_dealsde_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110411151154}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\Interface\{55555555-5555-5555-5555-550455155554}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\Interface\{66666666-6666-6666-6666-660466156654}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\TypeLib\{44444444-4444-4444-4444-440444154454}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\sob14prode_dealsde_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\sob14prode_dealsde_RASMANCS



~~~ Files



~~~ Folders



~~~ FireFox

Emptied folder: C:\Users\Eve\AppData\Roaming\mozilla\firefox\profiles\jzjui5nb.default\minidumps [8 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 01.10.2013 at 23:38:57,00
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST.txt

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-09-2013 02
Ran by Eve (administrator) on EVE-PC on 01-10-2013 23:48:15
Running from C:\Users\Eve\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(AVerMedia) C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe
() C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe
() C:\Windows\SysWOW64\LckFldService.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
() C:\Windows\PLFSetI.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\egui.exe
(Box, Inc.) C:\Program Files\Box Sync\BoxSyncHelper.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
() C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe
(Logitech, Inc.) C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
(AVerMedia TECHNOLOGIES, Inc.) C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerQuick.exe
(Box, Inc.) C:\Program Files\Box Sync\BoxSync.exe
(Dropbox, Inc.) C:\Users\Eve\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe
(Don HO don.h@free.fr) C:\Program Files (x86)\Notepad++\notepad++.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13307496 2011-10-17] (Realtek Semiconductor)
HKLM\...\Run: [PLFSetI] - C:\Windows\PLFSetI.exe [200704 2008-07-29] ()
HKLM\...\Run: [EvtMgr6] - C:\Program Files\Logitech\SetPointP\SetPoint.exe [1744152 2011-10-07] (Logitech, Inc.)
HKLM\...\Run: [NvCplDaemon] - RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1842472 2009-09-17] (Synaptics Incorporated)
HKLM\...\Run: [egui] - C:\Program Files\ESET\ESET Smart Security\egui.exe [6330568 2013-03-21] (ESET)
HKLM\...\Run: [BoxSyncHelper] - C:\Program Files\Box Sync\BoxSyncHelper.exe [393216 2013-06-07] (Box, Inc.)
HKLM\...\Run: [BCSSync] - C:\Program Files\Microsoft Office\Office14\BCSSync.exe [108144 2012-11-05] (Microsoft Corporation)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe [41336 2013-09-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Acrobat Assistant 8.0] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe [840568 2013-09-03] (Adobe Systems Inc.)
Startup: C:\Users\Eve\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Eve\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xBB71F3D34AB6CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Citavi Picker - {609D670F-B735-4da7-AC6D-F3BD358E325E} - C:\Windows\\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Evernote extension - {92EF2EAD-A7CE-4424-B0DB-499CF856608E} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
BHO-x32: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Microsoft-Webtestaufzeichnung 10.0-Hilfsprogramm - {DDA57003-0068-4ed2-9D32-4D1EC707D94D} - C:\Program Files (x86)\Microsoft Visual Studio 10.0\Common7\IDE\PrivateAssemblies\Microsoft.VisualStudio.QualityTools.RecorderBarBHO100.dll (Microsoft Corporation)
BHO-x32: SmartSelect Class - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKCU -  No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  No File
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{0849F004-6A13-4013-9D58-C20F6E7859CE}: [NameServer]192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default
FF Homepage: www.google.de
FF NetworkProxy: "backup.ftp", "50.30.32.39"
FF NetworkProxy: "backup.ftp_port", 3128
FF NetworkProxy: "backup.socks", "50.30.32.39"
FF NetworkProxy: "backup.socks_port", 3128
FF NetworkProxy: "backup.ssl", "50.30.32.39"
FF NetworkProxy: "backup.ssl_port", 3128
FF NetworkProxy: "ftp", "50.30.32.39"
FF NetworkProxy: "ftp_port", 3128
FF NetworkProxy: "http", "50.30.32.39"
FF NetworkProxy: "http_port", 3128
FF NetworkProxy: "no_proxies_on", "localhost, 127.0.0.1, stealthy.co"
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "socks", "50.30.32.39"
FF NetworkProxy: "socks_port", 3128
FF NetworkProxy: "socks_version", 4
FF NetworkProxy: "ssl", "50.30.32.39"
FF NetworkProxy: "ssl_port", 3128
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin: @java.com/DTPlugin,version=10.10.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.10.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.10.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre7\bin\new_plugin\npjp2.dll No File
FF Plugin-x32: @java.com/JavaPlugin,version=10.10.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Acrobat - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Eve\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Eve\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Wörterbuch Deutsch (de-DE), Hunspell-unterstützt - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\de_DE@dicts.j3e.de
FF Extension: ProxTube - Gesperrte YouTube Videos entsperren - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\ich@maltegoetz.de
FF Extension: Nightly Tester Tools - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\{8620c15f-30dc-4dba-a131-7c5d20cf4a29}
FF Extension: FT GraphiteGlow - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\{99e34760-2754-11e0-91fa-0800200c9a66}
FF Extension: Theme Font &amp; Size Changer - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\{f69e22c7-bc50-414a-9269-0f5c344cd94c}
FF Extension: customizable-shortcuts - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\customizable-shortcuts@timtaubert.de.xpi
FF Extension: elemhidehelper - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\elemhidehelper@adblockplus.org.xpi
FF Extension: firefox - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\firefox@ghostery.com.xpi
FF Extension: imageshack - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\imageshack@unsubstantial.info.xpi
FF Extension: menuiconsplus - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\menuiconsplus@codedawn.com.xpi
FF Extension: restart - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\restart@restart.org.xpi
FF Extension: sidebarBookmarkSelector - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\sidebarBookmarkSelector@alice.xpi
FF Extension: zotero - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\zotero@chnm.gmu.edu.xpi
FF Extension: No Name - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\{03A4A97B-1A44-4a3b-8A41-D982F0B6E73F}.xpi
FF Extension: No Name - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\{1A2D0EC4-75F5-4c91-89C4-3656F6E44B68}.xpi
FF Extension: No Name - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}.xpi
FF Extension: No Name - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\{AA6F0803-145A-4200-8E5E-68898D02B5B3}.xpi
FF Extension: No Name - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi
FF Extension: No Name - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\{d418aae0-8023-11dd-ad8b-0800200c9a66}.xpi
FF Extension: No Name - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\{dc572301-7619-498c-a57d-39143191b318}.xpi
FF Extension: No Name - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\{E10A6337-382E-4FE6-96DE-936ADC34DD04}.xpi
FF Extension: No Name - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\{EDA7B1D7-F793-4e03-B074-E6F303317FB0}.xpi
FF Extension: No Name - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi
FF Extension: Hotspot Shield Helper (Please allow this installation) - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\afurladvisor@anchorfree.com
FF HKLM\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird
FF Extension: ESET Smart Security Extension - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn
FF HKLM-x32\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox

Chrome: 
=======
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Shockwave Flash) - C:\Users\Eve\AppData\Local\Google\Chrome\Application\29.0.1547.76\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\Eve\AppData\Local\Google\Chrome\Application\29.0.1547.76\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Eve\AppData\Local\Google\Chrome\Application\29.0.1547.76\pdf.dll ()
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll (Apple Inc.)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Java(TM) Platform SE 7 U10) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
CHR Plugin: (VLC Web Plugin) - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
CHR Plugin: (Google Update) - C:\Users\Eve\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
CHR Plugin: (Java Deployment Toolkit 7.0.100.18) - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
CHR Extension: (Google Docs) - C:\Users\Eve\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_1
CHR Extension: (Google Drive) - C:\Users\Eve\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_1
CHR Extension: (YouTube) - C:\Users\Eve\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_1
CHR Extension: (Google Search) - C:\Users\Eve\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_1
CHR Extension: (Chrome In-App Payments service) - C:\Users\Eve\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.11_1
CHR Extension: (Citavi Picker) - C:\Users\Eve\AppData\Local\Google\Chrome\User Data\Default\Extensions\piehhloihgjjiomhieeddiidpekaajio\2013.5.30_1
CHR Extension: (Gmail) - C:\Users\Eve\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_2
CHR HKLM-x32\...\Chrome\Extension: [piehhloihgjjiomhieeddiidpekaajio] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Chrome\ChromePicker.crx

==================== Services (Whitelisted) =================

R2 AVerRemote; C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe [360448 2011-08-19] (AVerMedia)
R2 AVerScheduleService; C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe [403456 2011-04-01] ()
R2 ekrn; C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe [1341664 2013-03-21] (ESET)
R2 LckFldService; C:\Windows\SysWow64\LckFldService.exe [36864 2005-06-22] ()
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 MSSQL$SQLEXPRESS; C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [58345832 2011-09-22] (Microsoft Corporation)
R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [75064 2012-11-17] ()
S4 SQLAgent$SQLEXPRESS; C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [431464 2011-09-22] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

S3 AVerAF35; C:\Windows\System32\Drivers\AVerAF35.sys [677632 2010-03-16] (AVerMedia TECHNOLOGIES, Inc.)
R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [213416 2013-02-14] (ESET)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [150616 2013-01-10] (ESET)
R2 epfw; C:\Windows\System32\DRIVERS\epfw.sys [190232 2013-01-10] (ESET)
R1 EpfwLWF; C:\Windows\System32\DRIVERS\EpfwLWF.sys [59440 2013-01-10] (ESET)
R0 epfwwfp; C:\Windows\System32\DRIVERS\epfwwfp.sys [58416 2013-02-14] (ESET)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 nuvotoncir; C:\Windows\System32\DRIVERS\nuvotoncir.sys [48128 2009-06-24] (Nuvoton Technology Corporation)
R1 SLEE_17_DRIVER; C:\Windows\Sleen1764.sys [108256 2010-02-17] (Softwareentwicklung Remus - ArchiCrypt - )
R1 SLEE_17_DRIVER; C:\Windows\Sleen1764.sys [108256 2010-02-17] (Softwareentwicklung Remus - ArchiCrypt - )
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [530488 2011-11-19] ()
S3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42184 2013-06-21] (Anchorfree Inc.)
S3 vpnva; C:\Windows\System32\DRIVERS\vpnva64-6.sys [52080 2013-08-30] (Cisco Systems, Inc.)
S3 VSPerfDrv100; C:\Program Files (x86)\Microsoft Visual Studio 10.0\Team Tools\Performance Tools\x64\VSPerfDrv100.sys [68440 2011-01-18] (Microsoft Corporation)
S3 VSPerfDrv100; C:\Program Files (x86)\Microsoft Visual Studio 10.0\Team Tools\Performance Tools\x64\VSPerfDrv100.sys [68440 2011-01-18] (Microsoft Corporation)
S3 winbondcir; C:\Windows\System32\DRIVERS\winbondcir.sys [46592 2007-03-28] (Winbond Electronics Corporation)
U3 arf06g3h; C:\Windows\System32\Drivers\arf06g3h.sys [0 ] (Advanced Micro Devices)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-10-01 23:39 - 2013-10-01 23:39 - 00000000 ____D C:\FRST
2013-10-01 23:38 - 2013-10-01 23:38 - 00002888 _____ C:\Users\Eve\Desktop\JRT.txt
2013-10-01 23:25 - 2013-10-01 23:25 - 00000000 ____D C:\Windows\ERUNT
2013-10-01 23:12 - 2013-10-01 23:22 - 00000000 ____D C:\AdwCleaner
2013-10-01 22:49 - 2013-10-01 22:49 - 00001116 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-10-01 22:49 - 2013-10-01 22:49 - 00000000 ____D C:\Users\Eve\AppData\Roaming\Malwarebytes
2013-10-01 22:49 - 2013-10-01 22:49 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-01 22:49 - 2013-10-01 22:49 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-10-01 22:49 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-10-01 22:47 - 2013-10-01 22:47 - 01953880 _____ (Farbar) C:\Users\Eve\Desktop\FRST64.exe
2013-10-01 22:46 - 2013-10-01 22:46 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Eve\Downloads\mbam-setup-1.75.0.1300.exe
2013-10-01 22:46 - 2013-10-01 22:46 - 01045226 _____ C:\Users\Eve\Desktop\adwcleaner.exe
2013-10-01 22:46 - 2013-10-01 22:46 - 01030305 _____ (Thisisu) C:\Users\Eve\Desktop\JRT.exe
2013-10-01 17:45 - 2013-10-01 23:08 - 00000000 ____D C:\Program Files (x86)\Cisco
2013-10-01 17:45 - 2013-10-01 17:45 - 00000000 ____D C:\Users\Eve\AppData\Local\Cisco
2013-10-01 16:19 - 2013-10-01 16:20 - 00000000 ____D C:\Program Files (x86)\Visual Paradigm for UML CE 10.2
2013-10-01 15:54 - 2013-10-01 16:24 - 00000000 ____D C:\Users\Eve\vpworkspace
2013-10-01 15:54 - 2013-10-01 16:22 - 00000000 ____D C:\Users\Eve\visualparadigm
2013-10-01 15:08 - 2013-10-01 15:08 - 00029309 _____ C:\ComboFix.txt
2013-10-01 14:57 - 2013-10-01 23:03 - 00003394 _____ C:\Windows\PFRO.log
2013-10-01 14:44 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-10-01 14:44 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-10-01 14:44 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-10-01 14:44 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-10-01 14:44 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-10-01 14:44 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-10-01 14:44 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-10-01 14:44 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-10-01 14:43 - 2013-10-01 15:08 - 00000000 ____D C:\Qoobox
2013-10-01 14:43 - 2013-10-01 15:03 - 00000000 ____D C:\Windows\erdnt
2013-09-30 16:18 - 2013-09-30 16:23 - 00000340 _____ C:\Windows\LkmdfCoInst.log
2013-09-30 02:33 - 2013-10-01 16:18 - 00000000 ____D C:\Program Files (x86)\StarUML
2013-09-27 23:17 - 2013-10-01 23:23 - 00000684 _____ C:\Windows\setupact.log
2013-09-27 23:17 - 2013-09-27 23:17 - 00000000 _____ C:\Windows\setuperr.log
2013-09-27 03:16 - 2013-09-27 03:16 - 00000000 ____D C:\Users\Eve\AppData\Local\DOSBox
2013-09-27 03:10 - 2013-09-28 02:17 - 00000000 ____D C:\Program Files (x86)\DOSBox-0.74
2013-09-26 00:23 - 2013-09-26 00:23 - 00000000 ____D C:\Users\Eve\AppData\Roaming\SketchUp
2013-09-26 00:22 - 2013-09-26 00:22 - 00003120 _____ C:\Windows\SysWOW64\ALLFSAF13a.ocx
2013-09-24 03:44 - 2013-09-24 03:44 - 00000723 _____ C:\Users\Eve\AppData\Local\recently-used.xbel
2013-09-23 08:06 - 2013-09-24 22:42 - 00007552 _____ C:\Users\Eve\Desktop\Strukto1.nsd
2013-09-23 07:09 - 2013-09-23 07:09 - 00002186 _____ C:\Users\Eve\Desktop\Structorizer.lnk
2013-09-23 07:09 - 2013-09-23 07:09 - 00000000 ____D C:\Users\Eve\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Structorizer
2013-09-23 07:09 - 2013-09-23 07:09 - 00000000 ____D C:\Users\Eve\.structorizer
2013-09-21 23:51 - 2013-09-21 23:51 - 00001154 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-09-21 23:32 - 2013-09-21 23:24 - 00000970 _____ C:\Users\Eve\Documents\indexfile.txt
2013-09-21 15:56 - 2013-09-24 19:47 - 00000000 ____D C:\Users\Eve\AppData\Roaming\vlc
2013-09-20 04:41 - 2013-09-20 04:49 - 01540096 _____ C:\Users\Eve\Documents\Database4.accdb
2013-09-18 06:15 - 2013-09-18 06:23 - 00823296 _____ C:\Users\Eve\Documents\Database3.accdb
2013-09-18 05:30 - 2013-09-18 05:41 - 01507328 _____ C:\Users\Eve\Documents\Database2.accdb
2013-09-18 05:24 - 2013-09-18 05:30 - 01220608 _____ C:\Users\Eve\Documents\Database1.accdb
2013-09-12 06:35 - 2013-08-10 07:22 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-12 06:35 - 2013-08-10 07:22 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-12 06:35 - 2013-08-10 07:22 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-09-12 06:35 - 2013-08-10 07:21 - 19246592 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-12 06:35 - 2013-08-10 07:21 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-12 06:35 - 2013-08-10 07:21 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-12 06:35 - 2013-08-10 07:20 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-12 06:35 - 2013-08-10 07:20 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-12 06:35 - 2013-08-10 07:20 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-12 06:35 - 2013-08-10 07:20 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-12 06:35 - 2013-08-10 07:20 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-12 06:35 - 2013-08-10 07:20 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-09-12 06:35 - 2013-08-10 07:20 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-09-12 06:35 - 2013-08-10 07:20 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-09-12 06:35 - 2013-08-10 05:59 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-09-12 06:35 - 2013-08-10 05:59 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-09-12 06:35 - 2013-08-10 05:58 - 14332928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-09-12 06:35 - 2013-08-10 05:58 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-09-12 06:35 - 2013-08-10 05:58 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-09-12 06:35 - 2013-08-10 05:58 - 02048000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-09-12 06:35 - 2013-08-10 05:58 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-09-12 06:35 - 2013-08-10 05:58 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-09-12 06:35 - 2013-08-10 05:58 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-09-12 06:35 - 2013-08-10 05:58 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-09-12 06:35 - 2013-08-10 05:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-09-12 06:35 - 2013-08-10 05:58 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-09-12 06:35 - 2013-08-10 05:58 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-09-12 06:35 - 2013-08-10 05:17 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-12 06:35 - 2013-08-10 05:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-09-12 06:35 - 2013-08-10 04:27 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-09-12 06:35 - 2013-08-10 04:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-09-12 06:00 - 2013-08-05 04:25 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys
2013-09-12 06:00 - 2013-08-02 04:23 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-09-12 06:00 - 2013-08-02 04:15 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-09-12 06:00 - 2013-08-02 04:15 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2013-09-12 06:00 - 2013-08-02 04:15 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-09-12 06:00 - 2013-08-02 04:15 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2013-09-12 06:00 - 2013-08-02 04:14 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2013-09-12 06:00 - 2013-08-02 04:14 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2013-09-12 06:00 - 2013-08-02 04:13 - 01161216 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2013-09-12 06:00 - 2013-08-02 04:13 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:59 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-09-12 06:00 - 2013-08-02 03:59 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-09-12 06:00 - 2013-08-02 03:51 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-09-12 06:00 - 2013-08-02 03:50 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2013-09-12 06:00 - 2013-08-02 03:50 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2013-09-12 06:00 - 2013-08-02 03:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2013-09-12 06:00 - 2013-08-02 02:59 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2013-09-12 06:00 - 2013-08-02 02:45 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-09-12 06:00 - 2013-08-02 02:45 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-09-12 06:00 - 2013-08-02 02:45 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-09-12 06:00 - 2013-08-02 02:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-09-12 06:00 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2013-09-12 05:59 - 2013-08-08 03:20 - 03155456 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-09-12 05:59 - 2013-07-26 04:24 - 14172672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2013-09-12 05:59 - 2013-07-26 04:24 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2013-09-12 05:59 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2013-09-12 05:59 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2013-09-12 03:48 - 2013-09-12 03:51 - 00000000 ____D C:\Users\Eve\AppData\Local\Temporary Projects
2013-09-12 03:43 - 2013-09-12 03:43 - 00000000 ____D C:\Users\Eve\AppData\Roaming\Microsoft Corporation
2013-09-12 02:48 - 2013-09-12 02:48 - 00000000 ____D C:\ProgramData\Microsoft Visual Studio
2013-09-11 16:04 - 2013-09-11 16:04 - 00000000 ____D C:\ProgramData\PreEmptive Solutions
2013-09-11 15:56 - 2013-09-11 15:56 - 00000000 ____D C:\Program Files\IIS
2013-09-11 15:56 - 2013-09-11 15:56 - 00000000 ____D C:\Program Files (x86)\Microsoft ASP.NET
2013-09-11 15:56 - 2013-09-11 15:56 - 00000000 ____D C:\Program Files (x86)\IIS
2013-09-11 15:55 - 2013-09-11 15:55 - 00000000 ____D C:\Users\Eve\Documents\Visual Studio 2008
2013-09-11 15:44 - 2013-09-11 15:49 - 00000000 ____D C:\Program Files (x86)\Microsoft F#
2013-09-11 15:44 - 2013-09-11 15:46 - 00000000 ____D C:\Program Files (x86)\HTML Help Workshop
2013-09-11 15:38 - 2013-09-11 16:07 - 00000000 ____D C:\Program Files\Microsoft Visual Studio 10.0
2013-09-11 15:38 - 2013-09-11 15:38 - 00000000 ____D C:\Windows\symbols
2013-09-06 00:14 - 2013-09-11 06:35 - 00000039 _____ C:\Windows\vbaddin.ini
2013-09-05 19:16 - 2013-09-05 19:22 - 00392704 _____ C:\Users\Eve\Documents\Konten2013.stb
2013-09-05 19:05 - 2013-09-05 19:05 - 00001147 _____ C:\Users\Public\Desktop\Steganos Online-Banking.lnk
2013-09-03 02:23 - 2013-09-03 02:25 - 00000000 ____D C:\Windows\system32\appmgmt
2013-09-02 15:13 - 2013-09-05 05:50 - 00000000 ____D C:\Users\Eve\AppData\Local\Microsoft Games
2013-09-02 01:34 - 2013-09-02 01:34 - 00000000 ____D C:\Program Files\Microsoft Games
2013-09-01 04:36 - 2013-09-01 04:36 - 00000000 ____D C:\ProgramData\Steam

==================== One Month Modified Files and Folders =======

2013-10-01 23:39 - 2013-10-01 23:39 - 00000000 ____D C:\FRST
2013-10-01 23:38 - 2013-10-01 23:38 - 00002888 _____ C:\Users\Eve\Desktop\JRT.txt
2013-10-01 23:30 - 2009-07-14 06:45 - 00021808 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-01 23:30 - 2009-07-14 06:45 - 00021808 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-01 23:27 - 2011-10-22 17:28 - 01595281 _____ C:\Windows\WindowsUpdate.log
2013-10-01 23:25 - 2013-10-01 23:25 - 00000000 ____D C:\Windows\ERUNT
2013-10-01 23:25 - 2013-05-28 14:40 - 00000000 ____D C:\Users\Eve\AppData\Roaming\Box Sync
2013-10-01 23:25 - 2011-10-22 18:01 - 00000000 ____D C:\Users\Eve\AppData\Roaming\Dropbox
2013-10-01 23:23 - 2013-09-27 23:17 - 00000684 _____ C:\Windows\setupact.log
2013-10-01 23:23 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-10-01 23:22 - 2013-10-01 23:12 - 00000000 ____D C:\AdwCleaner
2013-10-01 23:08 - 2013-10-01 17:45 - 00000000 ____D C:\Program Files (x86)\Cisco
2013-10-01 23:03 - 2013-10-01 14:57 - 00003394 _____ C:\Windows\PFRO.log
2013-10-01 23:01 - 2013-04-09 03:41 - 00001112 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1161904824-3949471311-470107347-1001UA.job
2013-10-01 22:49 - 2013-10-01 22:49 - 00001116 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-10-01 22:49 - 2013-10-01 22:49 - 00000000 ____D C:\Users\Eve\AppData\Roaming\Malwarebytes
2013-10-01 22:49 - 2013-10-01 22:49 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-01 22:49 - 2013-10-01 22:49 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-10-01 22:47 - 2013-10-01 22:47 - 01953880 _____ (Farbar) C:\Users\Eve\Desktop\FRST64.exe
2013-10-01 22:46 - 2013-10-01 22:46 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Eve\Downloads\mbam-setup-1.75.0.1300.exe
2013-10-01 22:46 - 2013-10-01 22:46 - 01045226 _____ C:\Users\Eve\Desktop\adwcleaner.exe
2013-10-01 22:46 - 2013-10-01 22:46 - 01030305 _____ (Thisisu) C:\Users\Eve\Desktop\JRT.exe
2013-10-01 20:03 - 2013-04-09 03:41 - 00001060 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1161904824-3949471311-470107347-1001Core.job
2013-10-01 17:45 - 2013-10-01 17:45 - 00000000 ____D C:\Users\Eve\AppData\Local\Cisco
2013-10-01 17:45 - 2013-05-06 14:18 - 00000000 ____D C:\ProgramData\Cisco
2013-10-01 16:24 - 2013-10-01 15:54 - 00000000 ____D C:\Users\Eve\vpworkspace
2013-10-01 16:22 - 2013-10-01 15:54 - 00000000 ____D C:\Users\Eve\visualparadigm
2013-10-01 16:20 - 2013-10-01 16:19 - 00000000 ____D C:\Program Files (x86)\Visual Paradigm for UML CE 10.2
2013-10-01 16:18 - 2013-09-30 02:33 - 00000000 ____D C:\Program Files (x86)\StarUML
2013-10-01 16:17 - 2013-07-15 23:36 - 00000000 ____D C:\Users\Eve\Documents\Citavi 4
2013-10-01 15:54 - 2011-10-22 17:33 - 00000000 ____D C:\Users\Eve
2013-10-01 15:08 - 2013-10-01 15:08 - 00029309 _____ C:\ComboFix.txt
2013-10-01 15:08 - 2013-10-01 14:43 - 00000000 ____D C:\Qoobox
2013-10-01 15:08 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default
2013-10-01 15:03 - 2013-10-01 14:43 - 00000000 ____D C:\Windows\erdnt
2013-10-01 14:58 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2013-10-01 14:56 - 2009-07-14 04:34 - 36700160 _____ C:\Windows\system32\config\SYSTEM.bak
2013-10-01 14:56 - 2009-07-14 04:34 - 104857600 _____ C:\Windows\system32\config\SOFTWARE.bak
2013-10-01 14:56 - 2009-07-14 04:34 - 06029312 _____ C:\Windows\system32\config\DEFAULT.bak
2013-10-01 14:56 - 2009-07-14 04:34 - 00262144 _____ C:\Windows\system32\config\SECURITY.bak
2013-10-01 14:56 - 2009-07-14 04:34 - 00262144 _____ C:\Windows\system32\config\SAM.bak
2013-09-30 16:23 - 2013-09-30 16:18 - 00000340 _____ C:\Windows\LkmdfCoInst.log
2013-09-30 16:18 - 2011-11-29 19:56 - 00018960 _____ (Logitech, Inc.) C:\Windows\system32\Drivers\LNonPnP.sys
2013-09-30 04:58 - 2011-10-22 18:13 - 00000000 ____D C:\Users\Eve\AppData\Roaming\Notepad++
2013-09-29 00:28 - 2012-07-18 22:23 - 00000000 ____D C:\Users\Eve\Documents\AVerTV
2013-09-28 21:02 - 2012-03-29 22:36 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-09-28 21:02 - 2011-10-22 17:48 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-28 02:17 - 2013-09-27 03:10 - 00000000 ____D C:\Program Files (x86)\DOSBox-0.74
2013-09-27 23:17 - 2013-09-27 23:17 - 00000000 _____ C:\Windows\setuperr.log
2013-09-27 04:35 - 2011-10-27 01:02 - 00000000 ____D C:\Users\Eve\AppData\Roaming\Media Player Classic
2013-09-27 03:55 - 2013-08-17 22:36 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-09-27 03:16 - 2013-09-27 03:16 - 00000000 ____D C:\Users\Eve\AppData\Local\DOSBox
2013-09-26 01:19 - 2012-07-02 21:29 - 00000064 _____ C:\Windows\AVerText.ini
2013-09-26 00:23 - 2013-09-26 00:23 - 00000000 ____D C:\Users\Eve\AppData\Roaming\SketchUp
2013-09-26 00:22 - 2013-09-26 00:22 - 00003120 _____ C:\Windows\SysWOW64\ALLFSAF13a.ocx
2013-09-24 22:42 - 2013-09-23 08:06 - 00007552 _____ C:\Users\Eve\Desktop\Strukto1.nsd
2013-09-24 20:46 - 2013-06-11 01:33 - 00000000 ____D C:\Users\Eve\Documents\My Digital Editions
2013-09-24 19:50 - 2011-10-22 20:59 - 00000000 ____D C:\Users\Eve\AppData\Roaming\foobar2000
2013-09-24 19:47 - 2013-09-21 15:56 - 00000000 ____D C:\Users\Eve\AppData\Roaming\vlc
2013-09-24 05:59 - 2011-10-22 18:04 - 00001038 _____ C:\Users\Public\Desktop\foobar2000.lnk
2013-09-24 05:59 - 2011-10-22 18:04 - 00000000 ____D C:\Program Files (x86)\foobar2000
2013-09-24 03:44 - 2013-09-24 03:44 - 00000723 _____ C:\Users\Eve\AppData\Local\recently-used.xbel
2013-09-23 23:04 - 2013-07-03 18:43 - 00000000 ____D C:\Program Files (x86)\Zotero Standalone
2013-09-23 07:09 - 2013-09-23 07:09 - 00002186 _____ C:\Users\Eve\Desktop\Structorizer.lnk
2013-09-23 07:09 - 2013-09-23 07:09 - 00000000 ____D C:\Users\Eve\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Structorizer
2013-09-23 07:09 - 2013-09-23 07:09 - 00000000 ____D C:\Users\Eve\.structorizer
2013-09-23 01:50 - 2011-10-22 19:56 - 00000000 ____D C:\Cryptload
2013-09-23 01:49 - 2011-10-22 18:10 - 00000000 ____D C:\Program Files (x86)\JDownloader
2013-09-22 22:56 - 2011-10-22 18:01 - 00000000 ____D C:\Program Files\CCleaner
2013-09-21 23:51 - 2013-09-21 23:51 - 00001154 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-09-21 23:24 - 2013-09-21 23:32 - 00000970 _____ C:\Users\Eve\Documents\indexfile.txt
2013-09-21 16:07 - 2013-04-09 03:43 - 00002360 _____ C:\Users\Eve\Desktop\Google Chrome.lnk
2013-09-21 15:29 - 2010-11-21 08:50 - 00767748 _____ C:\Windows\system32\perfh007.dat
2013-09-21 15:29 - 2010-11-21 08:50 - 00175706 _____ C:\Windows\system32\perfc007.dat
2013-09-21 15:29 - 2009-07-14 07:13 - 01807410 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-20 04:49 - 2013-09-20 04:41 - 01540096 _____ C:\Users\Eve\Documents\Database4.accdb
2013-09-19 00:18 - 2011-10-22 19:41 - 00000000 ____D C:\Users\Eve\Desktop\Convert
2013-09-18 22:42 - 2012-09-27 15:01 - 00000000 ____D C:\Users\Eve\AppData\Roaming\Audacity
2013-09-18 06:23 - 2013-09-18 06:15 - 00823296 _____ C:\Users\Eve\Documents\Database3.accdb
2013-09-18 05:41 - 2013-09-18 05:30 - 01507328 _____ C:\Users\Eve\Documents\Database2.accdb
2013-09-18 05:30 - 2013-09-18 05:24 - 01220608 _____ C:\Users\Eve\Documents\Database1.accdb
2013-09-17 20:11 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-09-13 05:51 - 2011-11-19 05:30 - 00000000 ____D C:\Users\Eve\AppData\Roaming\DAEMON Tools Lite
2013-09-13 05:51 - 2011-10-22 18:25 - 00000000 ____D C:\Windows\Panther
2013-09-12 17:23 - 2011-10-22 18:25 - 00002033 _____ C:\Users\Public\Desktop\Adobe Acrobat X Pro.lnk
2013-09-12 17:15 - 2012-02-15 17:17 - 00000000 ___RD C:\Users\Eve\Virtual Machines
2013-09-12 17:15 - 2011-10-22 17:33 - 00000000 ___RD C:\Users\Eve\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-09-12 17:15 - 2011-10-22 17:33 - 00000000 ___RD C:\Users\Eve\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-09-12 17:12 - 2012-04-02 18:36 - 00439576 _____ C:\Windows\system32\FNTCACHE.DAT
2013-09-12 06:37 - 2011-10-22 19:54 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-09-12 06:34 - 2013-07-15 16:33 - 00000000 ____D C:\Windows\system32\MRT
2013-09-12 06:30 - 2011-10-22 21:19 - 79143768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-09-12 03:51 - 2013-09-12 03:48 - 00000000 ____D C:\Users\Eve\AppData\Local\Temporary Projects
2013-09-12 03:43 - 2013-09-12 03:43 - 00000000 ____D C:\Users\Eve\AppData\Roaming\Microsoft Corporation
2013-09-12 03:41 - 2013-06-10 03:48 - 00000000 ____D C:\Users\Eve\Documents\Visual Studio 2010
2013-09-12 02:48 - 2013-09-12 02:48 - 00000000 ____D C:\ProgramData\Microsoft Visual Studio
2013-09-11 23:58 - 2013-06-10 03:46 - 00000000 ____D C:\Program Files (x86)\Microsoft Visual Studio 10.0
2013-09-11 23:58 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\MSBuild
2013-09-11 22:57 - 2013-06-10 03:45 - 00000000 ____D C:\Program Files (x86)\Microsoft SDKs
2013-09-11 16:07 - 2013-09-11 15:38 - 00000000 ____D C:\Program Files\Microsoft Visual Studio 10.0
2013-09-11 16:04 - 2013-09-11 16:04 - 00000000 ____D C:\ProgramData\PreEmptive Solutions
2013-09-11 15:56 - 2013-09-11 15:56 - 00000000 ____D C:\Program Files\IIS
2013-09-11 15:56 - 2013-09-11 15:56 - 00000000 ____D C:\Program Files (x86)\Microsoft ASP.NET
2013-09-11 15:56 - 2013-09-11 15:56 - 00000000 ____D C:\Program Files (x86)\IIS
2013-09-11 15:55 - 2013-09-11 15:55 - 00000000 ____D C:\Users\Eve\Documents\Visual Studio 2008
2013-09-11 15:49 - 2013-09-11 15:44 - 00000000 ____D C:\Program Files (x86)\Microsoft F#
2013-09-11 15:46 - 2013-09-11 15:44 - 00000000 ____D C:\Program Files (x86)\HTML Help Workshop
2013-09-11 15:45 - 2013-06-10 03:56 - 00000000 ____D C:\Windows\SysWOW64\1031
2013-09-11 15:44 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\MSBuild
2013-09-11 15:39 - 2013-06-14 02:00 - 00000000 ____D C:\Program Files (x86)\Microsoft Visual Studio 9.0
2013-09-11 15:39 - 2009-07-14 05:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2013-09-11 15:38 - 2013-09-11 15:38 - 00000000 ____D C:\Windows\symbols
2013-09-11 15:38 - 2013-06-10 03:56 - 00000000 ____D C:\Windows\system32\1031
2013-09-11 06:35 - 2013-09-06 00:14 - 00000039 _____ C:\Windows\vbaddin.ini
2013-09-06 17:51 - 2013-05-06 21:42 - 00000000 ___SD C:\Users\Eve\Documents\Meine Shapes
2013-09-05 19:22 - 2013-09-05 19:16 - 00392704 _____ C:\Users\Eve\Documents\Konten2013.stb
2013-09-05 19:05 - 2013-09-05 19:05 - 00001147 _____ C:\Users\Public\Desktop\Steganos Online-Banking.lnk
2013-09-05 19:05 - 2013-01-18 20:00 - 00000000 ____D C:\Program Files (x86)\Steganos Online-Banking 2012
2013-09-05 19:00 - 2012-04-10 21:33 - 00000000 ____D C:\Users\Eve\AppData\Roaming\Steganos
2013-09-05 05:50 - 2013-09-02 15:13 - 00000000 ____D C:\Users\Eve\AppData\Local\Microsoft Games
2013-09-03 02:31 - 2011-11-11 06:49 - 00000000 ____D C:\Program Files (x86)\IceBreaker
2013-09-03 02:25 - 2013-09-03 02:23 - 00000000 ____D C:\Windows\system32\appmgmt
2013-09-03 02:23 - 2013-06-11 01:49 - 00000000 ____D C:\Python26
2013-09-03 02:18 - 2012-05-11 02:41 - 00000000 ____D C:\Program Files\Common Files\DESIGNER
2013-09-03 02:18 - 2012-05-11 02:37 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
2013-09-03 02:18 - 2011-10-22 19:54 - 00000000 ____D C:\Program Files\Microsoft Office
2013-09-02 01:34 - 2013-09-02 01:34 - 00000000 ____D C:\Program Files\Microsoft Games
2013-09-01 04:50 - 2012-04-16 23:17 - 00000000 ____D C:\Windows\Minidump
2013-09-01 04:36 - 2013-09-01 04:36 - 00000000 ____D C:\ProgramData\Steam

Files to move or delete:
====================
C:\Users\Eve\AppData\Roaming\DesktopSave.ini


Some content of TEMP:
====================
C:\Users\Eve\AppData\Local\Temp\Quarantine.exe
C:\Users\Eve\AppData\Local\Temp\sqlite-3.7.2-sqlitejdbc.dll


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-10-01 01:49

==================== End Of Log ============================

--- --- ---

Addition.txt

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 27-09-2013 02
Ran by Eve at 2013-10-01 23:49:28
Running from C:\Users\Eve\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: ESET Smart Security 6.0 (Disabled - Up to date) {77DEAFED-8149-104B-25A1-21771CA47CD1}
AS: ESET Smart Security 6.0 (Disabled - Up to date) {CCBF4E09-A773-1FC5-1F11-1A056723366C}
AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: ESET Personal Firewall (Disabled) {4FE52EC8-CB26-1113-0EFE-8842E2773BAA}

==================== Installed Programs ======================

7-Zip 9.20 (x64 edition) (Version: 9.20.00.0)
Acer Crystal Eye Webcam (x32 Version: 5.2.7.1)
Adobe Acrobat X Pro - English, Français, Deutsch (x32 Version: 10.1.8)
Adobe Digital Editions (x32)
Adobe Flash Player 11 ActiveX (x32 Version: 11.4.402.287)
Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.168)
Apple Application Support (x32 Version: 2.3)
Audacity 2.0.2 (x32 Version: 2.0.2)
AVerMedia A835 USB TV Tuner 8.2.64.61 (x32 Version: 8.2.64.61)
AVerTV 3D (x32 Version: 6.5)
Box Sync (64 bit) (Version: 3.4.25.0)
Brother MFL-Pro Suite MFC-255CW (x32 Version: 1.0.1.0)
BS.Player PRO (x32 Version: 2.56.1043)
CCleaner (Version: 4.05)
Citavi 4 (x32 Version: 4.1.0.3)
Crayon Physics Deluxe version 55 (x32 Version: 55)
Crystal Reports for Visual Studio (x32 Version: 12.51.0.240)
DAEMON Tools Lite (x32 Version: 4.45.1.0236)
dBpoweramp Music Converter (x32 Version: Release 13.1)
Definition Update for Microsoft Office 2010 (KB982726) 64-Bit Edition
Dotfuscator Software Services - Community Edition - DEU (x32 Version: 5.0.2300.0)
Dotfuscator Software Services - Community Edition (x32 Version: 5.0.2500.0)
Dropbox (HKCU Version: 2.0.22)
EPubsoft Adobe PDF ePub DRM Removal 4.8.8 (x32 Version: 4.8.8)
eReg (x32 Version: 1.20.138.34)
ESET Smart Security (Version: 6.0.316.1)
Evernote v. 4.6.6 (x32 Version: 4.6.6.8360)
FileZilla Client 3.7.1 (HKCU Version: 3.7.1)
foobar2000 v1.2.9 (x32 Version: 1.2.9)
Google Chrome (HKCU Version: 29.0.1547.76)
Hotfix für Microsoft Team Foundation Server 2010-Objektmodell - DEU (KB2813041) (x32 Version: 1)
Hotfix für Microsoft Visual Basic 2010 Express - DEU (KB2635973) (x32 Version: 1)
Hotfix für Microsoft Visual Studio 2010 Ultimate - DEU (KB2529927) (x32 Version: 1)
Hotfix für Microsoft Visual Studio 2010 Ultimate - DEU (KB2548139) (x32 Version: 1)
Hotfix für Microsoft Visual Studio 2010 Ultimate - DEU (KB2549864) (x32 Version: 1)
Hotfix für Microsoft Visual Studio 2010 Ultimate - DEU (KB2565057) (x32 Version: 1)
Hotfix für Microsoft Visual Studio 2010 Ultimate - DEU (KB2635973) (x32 Version: 1)
Hotfix für Microsoft Visual Studio 2010 Ultimate - DEU (KB2813041) (x32 Version: 1)
IceBreaker (x32)
ImgBurn (x32 Version: 2.5.8.0)
IrfanView (remove only) (x32 Version: 4.36)
JabRef 2.9.2 (x32 Version: 2.9.2)
Java 7 Update 10 (64-bit) (Version: 7.0.100)
Java 7 Update 10 (x32 Version: 7.0.100)
Java Auto Updater (x32 Version: 2.1.9.0)
JDownloader 0.9 (x32 Version: 0.9)
LAME v3.99.3 (for Windows) (x32)
LockHunter version 1.0 beta 3, 64 bit edition
Logitech SetPoint 6.32 (Version: 6.32.20)
Logitech Unifying-Software 2.10 (Version: 2.10.37)
Logon Screen (x32)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)
Media Player Classic - Home Cinema v1.5.2.3456 x64 (Version: 1.5.2.3456)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319)
Microsoft .NET Framework 4 Multi-Targeting Pack (x32 Version: 4.0.30319)
Microsoft .NET Framework 4.5 (Version: 4.5.50709)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Application Error Reporting (x32 Version: 12.0.6012.5000)
Microsoft ASP.NET MVC 2 - DEU (x32 Version: 2.0.50331.0)
Microsoft ASP.NET MVC 2 - Visual Studio 2010 Tools - DEU (x32 Version: 2.0.50331.0)
Microsoft ASP.NET MVC 2 - Visual Studio 2010 Tools (x32 Version: 2.0.50217.0)
Microsoft ASP.NET MVC 2 (x32 Version: 2.0.50217.0)
Microsoft Help Viewer 1.1 (Version: 1.1.40219)
Microsoft Help Viewer 1.1 Language Pack - DEU (Version: 1.1.40219)
Microsoft Office Access MUI (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office Excel MUI (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office Groove MUI (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office InfoPath MUI (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office Office 32-bit Components 2010 (Version: 14.0.7015.1000)
Microsoft Office OneNote MUI (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office Outlook MUI (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office PowerPoint MUI (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office Professional Plus 2010 (Version: 14.0.7015.1000)
Microsoft Office Proof (English) 2010 (Version: 14.0.7015.1000)
Microsoft Office Proof (French) 2010 (Version: 14.0.7015.1000)
Microsoft Office Proof (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office Proof (Italian) 2010 (Version: 14.0.7015.1000)
Microsoft Office Proofing (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office Publisher MUI (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office Shared 32-bit MUI (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office Shared MUI (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office Visio 2010 (Version: 14.0.7015.1000)
Microsoft Office Visio MUI (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office Word MUI (German) 2010 (Version: 14.0.7015.1000)
Microsoft redistributable runtime DLLs VS2005 SP1(x86) (x32 Version: 8.0.50727.4053)
Microsoft redistributable runtime DLLs VS2008 SP1(x86) (x32 Version: 9.0)
Microsoft Silverlight (Version: 5.1.20513.0)
Microsoft Silverlight 3 SDK - Deutsch (x32 Version: 3.0.40818.0)
Microsoft Silverlight 4 SDK - Deutsch (x32 Version: 4.0.50826.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft SQL Server 2008 (64-bit)
Microsoft SQL Server 2008 Browser (x32 Version: 10.3.5500.0)
Microsoft SQL Server 2008 Common Files (Version: 10.3.5500.0)
Microsoft SQL Server 2008 Database Engine Services (Version: 10.3.5500.0)
Microsoft SQL Server 2008 Database Engine Shared (Version: 10.3.5500.0)
Microsoft SQL Server 2008 Native Client (Version: 10.3.5500.0)
Microsoft SQL Server 2008 R2 Management Objects (x32 Version: 10.50.1750.9)
Microsoft SQL Server 2008 R2 Management Objects (x64) (Version: 10.50.1750.9)
Microsoft SQL Server 2008 R2 Transact-SQL-Sprachdienst (x32 Version: 10.50.1752.9)
Microsoft SQL Server 2008 R2-Datenebenenanwendungs-Framework (x32 Version: 10.50.1750.9)
Microsoft SQL Server 2008 R2-Datenebenenanwendungs-Projekt (x32 Version: 10.50.1750.9)
Microsoft SQL Server 2008 RsFx Driver (Version: 10.3.5500.0)
Microsoft SQL Server Compact 3.5 SP2 x64 DEU (Version: 3.5.8080.0)
Microsoft SQL Server Database Publishing Wizard 1.4 (x32 Version: 10.1.2512.8)
Microsoft SQL Server System CLR Types (x32 Version: 10.50.1750.9)
Microsoft SQL Server System CLR Types (x64) (Version: 10.50.1750.9)
Microsoft SQL Server VSS Writer (Version: 10.3.5500.0)
Microsoft Sync Framework Runtime v1.0 SP1 (x64) de (Version: 1.0.3010.0)
Microsoft Sync Framework SDK v1.0 SP1 de (x32 Version: 1.0.3010.0)
Microsoft Sync Framework Services v1.0 SP1 (x64) de (Version: 1.0.3010.0)
Microsoft Sync Services for ADO.NET v2.0 SP1 (x64) de (Version: 2.0.3010.0)
Microsoft Team Foundation Server 2010 Object Model - DEU (Version: 10.0.40219)
Microsoft Team Foundation Server 2010-Objektmodell - DEU (Version: 10.0.40219)
Microsoft Visio Premium 2010 (Version: 14.0.7015.1000)
Microsoft Visual Basic 2010 Express - DEU (x32 Version: 10.0.40219)
Microsoft Visual C++  Compilers 2010 Standard - enu - x64 (Version: 10.0.40219)
Microsoft Visual C++  Compilers 2010 Standard - enu - x86 (x32 Version: 10.0.40219)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (x32 Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x64 Designtime - 10.0.30319 (Version: 10.0.30319)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010  x64 Runtime - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Microsoft Visual C++ 2010  x86 Runtime - 10.0.40219 (x32 Version: 10.0.40219)
Microsoft Visual F# 2.0 Runtime (x32 Version: 10.0.40219)
Microsoft Visual F# 2.0 Runtime Language Pack - DEU (x32 Version: 10.0.30319)
Microsoft Visual Studio 2010 ADO.NET Entity Framework Tools (x32 Version: 10.0.40219)
Microsoft Visual Studio 2010 IntelliTrace Collection (x64) (Version: 10.0.40219)
Microsoft Visual Studio 2010 Office Developer Tools (x64) (Version: 10.0.40219)
Microsoft Visual Studio 2010 Office Developer Tools (x64) Language Pack - DEU (Version: 10.0.40219)
Microsoft Visual Studio 2010 Performance Collection Tools SP1 - DEU (Version: 10.0.40219)
Microsoft Visual Studio 2010 Service Pack 1 (x32 Version: 10.0.40219)
Microsoft Visual Studio 2010 SharePoint Developer Tools (x32 Version: 10.0.40219)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (Version: 10.0.40303)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (Version: 10.0.40308)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU (Version: 10.0.40303)
Microsoft Visual Studio 2010 Ultimate - DEU (x32 Version: 10.0.30319)
Microsoft Visual Studio 2010 Ultimate - DEU (x32 Version: 10.0.40219)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (Version: 10.0.40303)
Microsoft Visual Studio Macro Tools - DEU Language Pack (x32 Version: 9.0.30729)
Microsoft Visual Studio Macro Tools (x32 Version: 9.0.30729)
MiKTeX 2.9 (x32 Version: 2.9)
MozBackup 1.5.1 (x32)
Mozilla Firefox 24.0 (x86 de) (x32 Version: 24.0)
Mp3tag v2.52 (x32 Version: v2.52)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
Notepad++ (x32 Version: 5.9.4)
Nuvoton CIR Device Driver (x32 Version: 8.60.1000)
NVIDIA Drivers (Version: 1.7)
NVIDIA HD-Audiotreiber 1.3.18.0 (Version: 1.3.18.0)
NVIDIA Install Application (Version: 2.1002.109.718)
NVIDIA PhysX (x32 Version: 9.12.0213)
NVIDIA PhysX-Systemsoftware 9.12.0213 (Version: 9.12.0213)
Opera 12.16 (x32 Version: 12.16.1860)
Oracle VM VirtualBox 4.2.16 (Version: 4.2.16)
PicPick (x32 Version: 3.1.9)
PVSonyDll (Version: 1.00.0001)
QuickTime (x32 Version: 7.73.80.64)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6482)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition
Service Pack 3 für SQL Server 2008 (KB2546951) (64-bit) (Version: 10.3.5500.0)
Sicherheitsupdate für Microsoft Visual Studio 2010 Ultimate - DEU (KB2645410) (x32 Version: 1)
Skype™ 6.6 (x32 Version: 6.6.106)
Sql Server Customer Experience Improvement Program (Version: 10.3.5500.0)
StarMoney (x32 Version: 2.0)
Steam (x32 Version: 1.0.0.0)
Steganos Online-Banking 2012 (x32 Version: 2.0.3)
Synaptics Pointing Device Driver (Version: 14.0.6.0)
TeamViewer 8 (x32 Version: 8.0.19617)
TeXstudio 2.5.2 (x32 Version: 2.5.2)
Unterstützungsdateien für Microsoft SQL Server 2008-Setup  (Version: 10.3.5500.0)
Update for Microsoft .NET Framework 4.5 (KB2750147) (x32 Version: 1)
Update for Microsoft .NET Framework 4.5 (KB2805221) (x32 Version: 1)
Update for Microsoft .NET Framework 4.5 (KB2805226) (x32 Version: 1)
Update for Microsoft Access 2010 (KB2553446) 64-Bit Edition
Update for Microsoft Filter Pack 2.0 (KB2810071) 64-Bit Edition
Update for Microsoft Office 2010 (KB2553092)
Update for Microsoft Office 2010 (KB2553157) 64-Bit Edition
Update for Microsoft Office 2010 (KB2589298) 64-Bit Edition
Update for Microsoft Office 2010 (KB2589370) 64-Bit Edition
Update for Microsoft Office 2010 (KB2589375) 64-Bit Edition
Update for Microsoft Office 2010 (KB2760598) 64-Bit Edition
Update for Microsoft Office 2010 (KB2760631) 64-Bit Edition
Update for Microsoft Office 2010 (KB2760758) 64-Bit Edition
Update for Microsoft Office 2010 (KB2794737) 64-Bit Edition
Update for Microsoft Office 2010 (KB2825640) 64-Bit Edition
Update for Microsoft OneNote 2010 (KB2810072) 64-Bit Edition
Update for Microsoft PowerPoint 2010 (KB2553145) 64-Bit Edition
Update for Microsoft Visio Viewer 2010 (KB2810066) 64-Bit Edition
Uplink (x32 Version: 1.00.0000)
Visual Paradigm for UML CE 10.2 (x32 Version: 10.2)
Visual Studio 2010 Prerequisites - English (Version: 10.0.40219)
VLC media player 2.0.8 (x32 Version: 2.0.8)
WCF RIA Services V1.0 SP1 (x32 Version: 4.1.60114.0)
Web Deployment Tool (Version: 1.1.0618)
WIDCOMM Bluetooth Software (Version: 6.2.0.9700)
WinRAR 4.01 (64-Bit) (Version: 4.01.0)
Worms Revolution (x32)
Xvid Video Codec (x32 Version: 1.3.2)
Your Uninstaller! 7 (x32 Version: 7.3.2011.2)
Zotero Standalone 4.0.8 (x86 en-US) (x32 Version: 4.0.8)

==================== Restore Points  =========================


==================== Hosts content: ==========================

2009-07-14 04:34 - 2013-10-01 23:11 - 00000029 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {22679EC8-B7C8-4085-8990-97B6DFF82274} - System32\Tasks\{7512712B-F92C-4A26-9552-9147E12265B1} => C:\Team17\Worms World Party\wwp.exe
Task: {91A421E8-A432-4F03-B9B5-07C99F1B1CF5} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-08-21] (Piriform Ltd)
Task: {AAA48E7E-9DA2-4F11-89D8-BAFAF763F5ED} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1161904824-3949471311-470107347-1001UA => C:\Users\Eve\AppData\Local\Google\Update\GoogleUpdate.exe [2013-04-09] (Google Inc.)
Task: {C921E101-2576-49E1-92D8-C25E25335135} - System32\Tasks\{C90A5A0D-A0AF-4610-9281-73270640110B} => C:\Team17\Worms World Party\wwp.exe
Task: {CD4AB9AD-FDA3-43FC-9C14-9DDD8D373EB4} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1161904824-3949471311-470107347-1001Core => C:\Users\Eve\AppData\Local\Google\Update\GoogleUpdate.exe [2013-04-09] (Google Inc.)
Task: {EE017FE1-5963-4EC0-B45B-BE8201DC723F} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1161904824-3949471311-470107347-1001Core.job => C:\Users\Eve\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1161904824-3949471311-470107347-1001UA.job => C:\Users\Eve\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2011-10-07 11:39 - 2011-10-07 11:39 - 01304856 _____ () C:\Program Files\Logitech\SetPointP\Macros\MacroCore.dll
2013-04-04 01:09 - 2013-04-04 01:09 - 04300432 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2013-07-11 21:43 - 2013-07-11 21:43 - 00537600 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_64\Python.Runtime\8bdd14828ee35fc0ea86e54380c74c1f\Python.Runtime.ni.dll
2013-01-03 19:12 - 2013-01-03 19:12 - 00471552 _____ () C:\Program Files\Box Sync\_hashlib.pyd
2013-01-03 19:12 - 2013-01-03 19:12 - 00046080 _____ () C:\Program Files\Box Sync\_socket.pyd
2013-01-03 19:12 - 2013-01-03 19:12 - 01167360 _____ () C:\Program Files\Box Sync\_ssl.pyd
2013-01-03 19:12 - 2013-01-03 19:12 - 00689664 _____ () C:\Program Files\Box Sync\unicodedata.pyd
2013-01-03 19:12 - 2013-01-03 19:12 - 00166912 _____ () C:\Program Files\Box Sync\_elementtree.pyd
2013-01-03 19:12 - 2013-01-03 19:12 - 00164352 _____ () C:\Program Files\Box Sync\pyexpat.pyd
2013-01-03 19:12 - 2013-01-03 19:12 - 00111616 _____ () C:\Program Files\Box Sync\_ctypes.pyd
2013-01-03 19:12 - 2013-01-03 19:12 - 00127488 _____ () C:\Program Files\Box Sync\win32api.pyd
2013-01-03 19:12 - 2013-01-03 19:12 - 00136704 _____ () C:\Program Files\Box Sync\pywintypes27.dll
2013-01-03 19:12 - 2013-01-03 19:12 - 00058368 _____ () C:\Program Files\Box Sync\_sqlite3.pyd
2013-01-03 19:12 - 2013-01-03 19:12 - 00535040 _____ () C:\Program Files\Box Sync\sqlite3.dll
2013-01-03 19:12 - 2013-01-03 19:12 - 00037888 _____ () C:\Program Files\Box Sync\_testcapi.pyd
2013-01-03 19:12 - 2013-01-03 19:12 - 00135168 _____ () C:\Program Files\Box Sync\win32security.pyd
2013-01-03 19:12 - 2013-01-03 19:12 - 00007168 _____ () C:\Program Files\Box Sync\_win32sysloader.pyd
2013-01-03 19:12 - 2013-01-03 19:12 - 00138752 _____ () C:\Program Files\Box Sync\win32file.pyd
2010-01-02 16:42 - 2010-01-02 16:42 - 00098304 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext_64.dll
2011-10-22 18:08 - 2011-05-28 22:05 - 00164864 _____ () C:\Program Files\WinRAR\rarext.dll
2013-09-03 15:54 - 2013-09-03 15:54 - 00019968 _____ () C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\locale\de_de\acrotray.deu
2013-03-13 22:48 - 2013-03-13 22:48 - 24978944 _____ () C:\Users\Eve\AppData\Roaming\Dropbox\bin\libcef.dll
2013-09-21 23:51 - 2013-09-11 04:26 - 03279768 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2013-09-28 21:02 - 2013-09-28 21:02 - 16177544 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll
2011-07-18 23:07 - 2011-07-18 23:07 - 00014336 _____ () C:\Program Files (x86)\Notepad++\plugins\NppExport.dll
2011-09-21 22:46 - 2011-09-21 22:46 - 01673728 _____ () C:\Program Files (x86)\Notepad++\plugins\NppFTP.dll
2013-04-04 01:09 - 2013-04-04 01:09 - 04300456 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\ProgramData\TEMP:1CE11B51

==================== Safe Mode (whitelisted) ===================


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============

Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2013-10-01 14:55:34.170
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-10-01 14:55:34.061
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-09-18 21:37:29.945
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-09-18 21:37:29.742
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-09-18 21:37:29.504
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-09-18 21:37:29.276
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-09-18 21:37:27.565
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-09-18 21:37:27.304
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-08-15 17:50:35.295
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-08-15 17:50:35.036
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Percentage of memory in use: 59%
Total physical RAM: 4060.93 MB
Available physical RAM: 1639.75 MB
Total Pagefile: 8120.04 MB
Available Pagefile: 5299.21 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: (Windows) (Fixed) (Total:100.78 GB) (Free:35.02 GB) NTFS
Drive d: (Data) (Fixed) (Total:364.88 GB) (Free:319.58 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: EA5BFAFE)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=101 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=365 GB) - (Type=07 NTFS)

==================== End Of Log ============================

schrauber · 02.10.2013, 08:02

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

Miau3 · 02.10.2013, 23:17

Hi schrauber,

soweit wieder alles gut, eine Frage hätte ich aber noch: woher rekrutiert ihr eigentlich eure Freiwilligen hier? Ich fang demnächst mit meinem Studium in der Informatik an und hätte dann schon Lust, in Boards wie beispielsweise diesem mitzuhelfen, sofern da noch Leute gebraucht werden.

ESET:

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=f1282d017f6de548825c4c17d4438bc6
# engine=15335
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-10-02 07:18:56
# local_time=2013-10-02 09:18:56 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776573 100 94 14371 132371386 0 0
# compatibility_mode=8216 16776701 100 98 8543380 130754488 0 0
# scanned=260136
# found=0
# cleaned=0
# scan_time=14206
# nod_component=V3 Build:0x30000000

Security Check:

Code:

ATTFilter

 Results of screen317's Security Check version 0.99.73  
 Windows 7 Service Pack 1 x64 (UAC is disabled!)  
 Internet Explorer 10  
``````````````Antivirus/Firewall Check:`````````````` 
ESET Smart Security 6.0   
 Antivirus up to date!   
`````````Anti-malware/Other Utilities Check:````````` 
 Malwarebytes Anti-Malware Version 1.75.0.1300  
 Java 7 Update 10  
 Java version out of Date! 
 Adobe Flash Player 11.8.800.168  
 Mozilla Firefox (24.0) 
 Google Chrome 29.0.1547.66  
 Google Chrome 29.0.1547.76  
````````Process Check: objlist.exe by Laurent````````  
 ESET NOD32 Antivirus egui.exe  
 ESET NOD32 Antivirus ekrn.exe  
 Malwarebytes' Anti-Malware mbamscheduler.exe   
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  
````````````````````End of Log``````````````````````

FRST:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-10-2013
Ran by Eve (administrator) on EVE-PC on 02-10-2013 23:40:39
Running from C:\Users\Eve\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(AVerMedia) C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe
() C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe
() C:\Windows\SysWOW64\LckFldService.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
() C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
() C:\Windows\PLFSetI.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\egui.exe
(Box, Inc.) C:\Program Files\Box Sync\BoxSyncHelper.exe
(AVerMedia TECHNOLOGIES, Inc.) C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerQuick.exe
(Box, Inc.) C:\Program Files\Box Sync\BoxSync.exe
(Logitech, Inc.) C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
(Dropbox, Inc.) C:\Users\Eve\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(Oracle Corporation) c:\program files (x86)\visual paradigm for uml ce 10.2\jre\bin\java.exe
(Don HO don.h@free.fr) C:\Program Files (x86)\Notepad++\notepad++.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe
(Mozilla Messaging) D:\Daten\Portable Thunderbird\thunderbird\thunderbird.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13307496 2011-10-17] (Realtek Semiconductor)
HKLM\...\Run: [PLFSetI] - C:\Windows\PLFSetI.exe [200704 2008-07-29] ()
HKLM\...\Run: [EvtMgr6] - C:\Program Files\Logitech\SetPointP\SetPoint.exe [1744152 2011-10-07] (Logitech, Inc.)
HKLM\...\Run: [NvCplDaemon] - RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1842472 2009-09-17] (Synaptics Incorporated)
HKLM\...\Run: [egui] - C:\Program Files\ESET\ESET Smart Security\egui.exe [6330568 2013-03-21] (ESET)
HKLM\...\Run: [BoxSyncHelper] - C:\Program Files\Box Sync\BoxSyncHelper.exe [393216 2013-06-07] (Box, Inc.)
HKLM\...\Run: [BCSSync] - C:\Program Files\Microsoft Office\Office14\BCSSync.exe [108144 2012-11-05] (Microsoft Corporation)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe [41336 2013-09-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Acrobat Assistant 8.0] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe [840568 2013-09-03] (Adobe Systems Inc.)
Startup: C:\Users\Eve\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Eve\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xBB71F3D34AB6CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Citavi Picker - {609D670F-B735-4da7-AC6D-F3BD358E325E} - C:\Windows\\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Evernote extension - {92EF2EAD-A7CE-4424-B0DB-499CF856608E} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
BHO-x32: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Microsoft-Webtestaufzeichnung 10.0-Hilfsprogramm - {DDA57003-0068-4ed2-9D32-4D1EC707D94D} - C:\Program Files (x86)\Microsoft Visual Studio 10.0\Common7\IDE\PrivateAssemblies\Microsoft.VisualStudio.QualityTools.RecorderBarBHO100.dll (Microsoft Corporation)
BHO-x32: SmartSelect Class - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKCU -  No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  No File
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{0849F004-6A13-4013-9D58-C20F6E7859CE}: [NameServer]192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default
FF Homepage: www.google.de
FF NetworkProxy: "backup.ftp", "50.30.32.39"
FF NetworkProxy: "backup.ftp_port", 3128
FF NetworkProxy: "backup.socks", "50.30.32.39"
FF NetworkProxy: "backup.socks_port", 3128
FF NetworkProxy: "backup.ssl", "50.30.32.39"
FF NetworkProxy: "backup.ssl_port", 3128
FF NetworkProxy: "ftp", "50.30.32.39"
FF NetworkProxy: "ftp_port", 3128
FF NetworkProxy: "http", "50.30.32.39"
FF NetworkProxy: "http_port", 3128
FF NetworkProxy: "no_proxies_on", "localhost, 127.0.0.1, stealthy.co"
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "socks", "50.30.32.39"
FF NetworkProxy: "socks_port", 3128
FF NetworkProxy: "socks_version", 4
FF NetworkProxy: "ssl", "50.30.32.39"
FF NetworkProxy: "ssl_port", 3128
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin: @java.com/DTPlugin,version=10.10.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.10.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.10.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre7\bin\new_plugin\npjp2.dll No File
FF Plugin-x32: @java.com/JavaPlugin,version=10.10.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Acrobat - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Eve\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Eve\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Wörterbuch Deutsch (de-DE), Hunspell-unterstützt - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\de_DE@dicts.j3e.de
FF Extension: ProxTube - Gesperrte YouTube Videos entsperren - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\ich@maltegoetz.de
FF Extension: Nightly Tester Tools - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\{8620c15f-30dc-4dba-a131-7c5d20cf4a29}
FF Extension: FT GraphiteGlow - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\{99e34760-2754-11e0-91fa-0800200c9a66}
FF Extension: Theme Font &amp; Size Changer - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\{f69e22c7-bc50-414a-9269-0f5c344cd94c}
FF Extension: customizable-shortcuts - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\customizable-shortcuts@timtaubert.de.xpi
FF Extension: elemhidehelper - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\elemhidehelper@adblockplus.org.xpi
FF Extension: firefox - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\firefox@ghostery.com.xpi
FF Extension: imageshack - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\imageshack@unsubstantial.info.xpi
FF Extension: menuiconsplus - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\menuiconsplus@codedawn.com.xpi
FF Extension: restart - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\restart@restart.org.xpi
FF Extension: sidebarBookmarkSelector - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\sidebarBookmarkSelector@alice.xpi
FF Extension: zotero - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\zotero@chnm.gmu.edu.xpi
FF Extension: No Name - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\{03A4A97B-1A44-4a3b-8A41-D982F0B6E73F}.xpi
FF Extension: No Name - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\{1A2D0EC4-75F5-4c91-89C4-3656F6E44B68}.xpi
FF Extension: No Name - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}.xpi
FF Extension: No Name - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\{AA6F0803-145A-4200-8E5E-68898D02B5B3}.xpi
FF Extension: No Name - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi
FF Extension: No Name - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\{d418aae0-8023-11dd-ad8b-0800200c9a66}.xpi
FF Extension: No Name - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\{dc572301-7619-498c-a57d-39143191b318}.xpi
FF Extension: No Name - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\{E10A6337-382E-4FE6-96DE-936ADC34DD04}.xpi
FF Extension: No Name - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\{EDA7B1D7-F793-4e03-B074-E6F303317FB0}.xpi
FF Extension: No Name - C:\Users\Eve\AppData\Roaming\Mozilla\Firefox\Profiles\jzjui5nb.default\Extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi
FF Extension: Hotspot Shield Helper (Please allow this installation) - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\afurladvisor@anchorfree.com
FF HKLM\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird
FF Extension: ESET Smart Security Extension - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn
FF HKLM-x32\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox

Chrome: 
=======
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Shockwave Flash) - C:\Users\Eve\AppData\Local\Google\Chrome\Application\29.0.1547.76\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\Eve\AppData\Local\Google\Chrome\Application\29.0.1547.76\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Eve\AppData\Local\Google\Chrome\Application\29.0.1547.76\pdf.dll ()
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll (Apple Inc.)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Java(TM) Platform SE 7 U10) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
CHR Plugin: (VLC Web Plugin) - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
CHR Plugin: (Google Update) - C:\Users\Eve\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
CHR Plugin: (Java Deployment Toolkit 7.0.100.18) - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
CHR Extension: (Google Docs) - C:\Users\Eve\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_1
CHR Extension: (Google Drive) - C:\Users\Eve\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_1
CHR Extension: (YouTube) - C:\Users\Eve\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_1
CHR Extension: (Google Search) - C:\Users\Eve\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_1
CHR Extension: (Chrome In-App Payments service) - C:\Users\Eve\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.11_1
CHR Extension: (Citavi Picker) - C:\Users\Eve\AppData\Local\Google\Chrome\User Data\Default\Extensions\piehhloihgjjiomhieeddiidpekaajio\2013.5.30_1
CHR Extension: (Gmail) - C:\Users\Eve\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_2
CHR HKLM-x32\...\Chrome\Extension: [piehhloihgjjiomhieeddiidpekaajio] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Chrome\ChromePicker.crx

==================== Services (Whitelisted) =================

R2 AVerRemote; C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe [360448 2011-08-19] (AVerMedia)
R2 AVerScheduleService; C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe [403456 2011-04-01] ()
R2 ekrn; C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe [1341664 2013-03-21] (ESET)
R2 LckFldService; C:\Windows\SysWow64\LckFldService.exe [36864 2005-06-22] ()
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 MSSQL$SQLEXPRESS; C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [58345832 2011-09-22] (Microsoft Corporation)
R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [75064 2012-11-17] ()
S4 SQLAgent$SQLEXPRESS; C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [431464 2011-09-22] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

S3 AVerAF35; C:\Windows\System32\Drivers\AVerAF35.sys [677632 2010-03-16] (AVerMedia TECHNOLOGIES, Inc.)
R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [213416 2013-02-14] (ESET)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [150616 2013-01-10] (ESET)
R2 epfw; C:\Windows\System32\DRIVERS\epfw.sys [190232 2013-01-10] (ESET)
R1 EpfwLWF; C:\Windows\System32\DRIVERS\EpfwLWF.sys [59440 2013-01-10] (ESET)
R0 epfwwfp; C:\Windows\System32\DRIVERS\epfwwfp.sys [58416 2013-02-14] (ESET)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 nuvotoncir; C:\Windows\System32\DRIVERS\nuvotoncir.sys [48128 2009-06-24] (Nuvoton Technology Corporation)
R1 SLEE_17_DRIVER; C:\Windows\Sleen1764.sys [108256 2010-02-17] (Softwareentwicklung Remus - ArchiCrypt - )
R1 SLEE_17_DRIVER; C:\Windows\Sleen1764.sys [108256 2010-02-17] (Softwareentwicklung Remus - ArchiCrypt - )
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [530488 2011-11-19] ()
S3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42184 2013-06-21] (Anchorfree Inc.)
S3 vpnva; C:\Windows\System32\DRIVERS\vpnva64-6.sys [52080 2013-08-30] (Cisco Systems, Inc.)
S3 VSPerfDrv100; C:\Program Files (x86)\Microsoft Visual Studio 10.0\Team Tools\Performance Tools\x64\VSPerfDrv100.sys [68440 2011-01-18] (Microsoft Corporation)
S3 VSPerfDrv100; C:\Program Files (x86)\Microsoft Visual Studio 10.0\Team Tools\Performance Tools\x64\VSPerfDrv100.sys [68440 2011-01-18] (Microsoft Corporation)
S3 winbondcir; C:\Windows\System32\DRIVERS\winbondcir.sys [46592 2007-03-28] (Winbond Electronics Corporation)
U3 ablufxk4; C:\Windows\System32\Drivers\ablufxk4.sys [0 ] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-10-02 23:40 - 2013-10-02 23:40 - 01954124 _____ (Farbar) C:\Users\Eve\Desktop\FRST64.exe
2013-10-02 23:39 - 2013-10-02 23:40 - 01954124 _____ (Farbar) C:\Users\Eve\Downloads\FRST64.exe
2013-10-02 17:21 - 2013-10-02 17:22 - 00891144 _____ C:\Users\Eve\Desktop\SecurityCheck.exe
2013-10-01 23:39 - 2013-10-01 23:39 - 00000000 ____D C:\FRST
2013-10-01 23:25 - 2013-10-01 23:25 - 00000000 ____D C:\Windows\ERUNT
2013-10-01 23:12 - 2013-10-01 23:22 - 00000000 ____D C:\AdwCleaner
2013-10-01 22:49 - 2013-10-01 22:49 - 00001116 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-10-01 22:49 - 2013-10-01 22:49 - 00000000 ____D C:\Users\Eve\AppData\Roaming\Malwarebytes
2013-10-01 22:49 - 2013-10-01 22:49 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-01 22:49 - 2013-10-01 22:49 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-10-01 22:49 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-10-01 22:46 - 2013-10-01 22:46 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Eve\Downloads\mbam-setup-1.75.0.1300.exe
2013-10-01 17:45 - 2013-10-01 23:08 - 00000000 ____D C:\Program Files (x86)\Cisco
2013-10-01 17:45 - 2013-10-01 17:45 - 00000000 ____D C:\Users\Eve\AppData\Local\Cisco
2013-10-01 16:19 - 2013-10-02 02:56 - 00000000 ____D C:\Program Files (x86)\Visual Paradigm for UML CE 10.2
2013-10-01 15:54 - 2013-10-01 16:24 - 00000000 ____D C:\Users\Eve\vpworkspace
2013-10-01 15:54 - 2013-10-01 16:22 - 00000000 ____D C:\Users\Eve\visualparadigm
2013-10-01 15:08 - 2013-10-01 15:08 - 00029309 _____ C:\ComboFix.txt
2013-10-01 14:57 - 2013-10-01 23:03 - 00003394 _____ C:\Windows\PFRO.log
2013-10-01 14:44 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-10-01 14:44 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-10-01 14:44 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-10-01 14:44 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-10-01 14:44 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-10-01 14:44 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-10-01 14:44 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-10-01 14:44 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-10-01 14:43 - 2013-10-01 15:08 - 00000000 ____D C:\Qoobox
2013-10-01 14:43 - 2013-10-01 15:03 - 00000000 ____D C:\Windows\erdnt
2013-09-30 16:18 - 2013-09-30 16:23 - 00000340 _____ C:\Windows\LkmdfCoInst.log
2013-09-30 02:33 - 2013-10-01 16:18 - 00000000 ____D C:\Program Files (x86)\StarUML
2013-09-27 23:17 - 2013-10-02 17:12 - 00000796 _____ C:\Windows\setupact.log
2013-09-27 23:17 - 2013-09-27 23:17 - 00000000 _____ C:\Windows\setuperr.log
2013-09-27 03:16 - 2013-09-27 03:16 - 00000000 ____D C:\Users\Eve\AppData\Local\DOSBox
2013-09-27 03:10 - 2013-09-28 02:17 - 00000000 ____D C:\Program Files (x86)\DOSBox-0.74
2013-09-26 00:23 - 2013-09-26 00:23 - 00000000 ____D C:\Users\Eve\AppData\Roaming\SketchUp
2013-09-26 00:22 - 2013-09-26 00:22 - 00003120 _____ C:\Windows\SysWOW64\ALLFSAF13a.ocx
2013-09-24 03:44 - 2013-09-24 03:44 - 00000723 _____ C:\Users\Eve\AppData\Local\recently-used.xbel
2013-09-23 08:06 - 2013-09-24 22:42 - 00007552 _____ C:\Users\Eve\Desktop\Strukto1.nsd
2013-09-23 07:09 - 2013-09-23 07:09 - 00002186 _____ C:\Users\Eve\Desktop\Structorizer.lnk
2013-09-23 07:09 - 2013-09-23 07:09 - 00000000 ____D C:\Users\Eve\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Structorizer
2013-09-23 07:09 - 2013-09-23 07:09 - 00000000 ____D C:\Users\Eve\.structorizer
2013-09-21 23:51 - 2013-09-21 23:51 - 00001154 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-09-21 23:32 - 2013-09-21 23:24 - 00000970 _____ C:\Users\Eve\Documents\indexfile.txt
2013-09-21 15:56 - 2013-09-24 19:47 - 00000000 ____D C:\Users\Eve\AppData\Roaming\vlc
2013-09-20 04:41 - 2013-09-20 04:49 - 01540096 _____ C:\Users\Eve\Documents\Database4.accdb
2013-09-18 06:15 - 2013-09-18 06:23 - 00823296 _____ C:\Users\Eve\Documents\Database3.accdb
2013-09-18 05:30 - 2013-09-18 05:41 - 01507328 _____ C:\Users\Eve\Documents\Database2.accdb
2013-09-18 05:24 - 2013-09-18 05:30 - 01220608 _____ C:\Users\Eve\Documents\Database1.accdb
2013-09-12 06:35 - 2013-08-10 07:22 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-12 06:35 - 2013-08-10 07:22 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-12 06:35 - 2013-08-10 07:22 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-09-12 06:35 - 2013-08-10 07:21 - 19246592 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-12 06:35 - 2013-08-10 07:21 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-12 06:35 - 2013-08-10 07:21 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-12 06:35 - 2013-08-10 07:20 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-12 06:35 - 2013-08-10 07:20 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-12 06:35 - 2013-08-10 07:20 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-12 06:35 - 2013-08-10 07:20 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-12 06:35 - 2013-08-10 07:20 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-12 06:35 - 2013-08-10 07:20 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-09-12 06:35 - 2013-08-10 07:20 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-09-12 06:35 - 2013-08-10 07:20 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-09-12 06:35 - 2013-08-10 05:59 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-09-12 06:35 - 2013-08-10 05:59 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-09-12 06:35 - 2013-08-10 05:58 - 14332928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-09-12 06:35 - 2013-08-10 05:58 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-09-12 06:35 - 2013-08-10 05:58 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-09-12 06:35 - 2013-08-10 05:58 - 02048000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-09-12 06:35 - 2013-08-10 05:58 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-09-12 06:35 - 2013-08-10 05:58 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-09-12 06:35 - 2013-08-10 05:58 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-09-12 06:35 - 2013-08-10 05:58 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-09-12 06:35 - 2013-08-10 05:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-09-12 06:35 - 2013-08-10 05:58 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-09-12 06:35 - 2013-08-10 05:58 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-09-12 06:35 - 2013-08-10 05:17 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-12 06:35 - 2013-08-10 05:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-09-12 06:35 - 2013-08-10 04:27 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-09-12 06:35 - 2013-08-10 04:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-09-12 06:00 - 2013-08-05 04:25 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys
2013-09-12 06:00 - 2013-08-02 04:23 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-09-12 06:00 - 2013-08-02 04:15 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-09-12 06:00 - 2013-08-02 04:15 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2013-09-12 06:00 - 2013-08-02 04:15 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-09-12 06:00 - 2013-08-02 04:15 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2013-09-12 06:00 - 2013-08-02 04:14 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2013-09-12 06:00 - 2013-08-02 04:14 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2013-09-12 06:00 - 2013-08-02 04:13 - 01161216 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2013-09-12 06:00 - 2013-08-02 04:13 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:59 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-09-12 06:00 - 2013-08-02 03:59 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-09-12 06:00 - 2013-08-02 03:51 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-09-12 06:00 - 2013-08-02 03:50 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2013-09-12 06:00 - 2013-08-02 03:50 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2013-09-12 06:00 - 2013-08-02 03:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 03:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2013-09-12 06:00 - 2013-08-02 02:59 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2013-09-12 06:00 - 2013-08-02 02:45 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-09-12 06:00 - 2013-08-02 02:45 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-09-12 06:00 - 2013-08-02 02:45 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-09-12 06:00 - 2013-08-02 02:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-09-12 06:00 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2013-09-12 06:00 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2013-09-12 05:59 - 2013-08-08 03:20 - 03155456 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-09-12 05:59 - 2013-07-26 04:24 - 14172672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2013-09-12 05:59 - 2013-07-26 04:24 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2013-09-12 05:59 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2013-09-12 05:59 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2013-09-12 03:48 - 2013-09-12 03:51 - 00000000 ____D C:\Users\Eve\AppData\Local\Temporary Projects
2013-09-12 03:43 - 2013-09-12 03:43 - 00000000 ____D C:\Users\Eve\AppData\Roaming\Microsoft Corporation
2013-09-12 02:48 - 2013-09-12 02:48 - 00000000 ____D C:\ProgramData\Microsoft Visual Studio
2013-09-11 16:04 - 2013-09-11 16:04 - 00000000 ____D C:\ProgramData\PreEmptive Solutions
2013-09-11 15:56 - 2013-09-11 15:56 - 00000000 ____D C:\Program Files\IIS
2013-09-11 15:56 - 2013-09-11 15:56 - 00000000 ____D C:\Program Files (x86)\Microsoft ASP.NET
2013-09-11 15:56 - 2013-09-11 15:56 - 00000000 ____D C:\Program Files (x86)\IIS
2013-09-11 15:55 - 2013-09-11 15:55 - 00000000 ____D C:\Users\Eve\Documents\Visual Studio 2008
2013-09-11 15:44 - 2013-09-11 15:49 - 00000000 ____D C:\Program Files (x86)\Microsoft F#
2013-09-11 15:44 - 2013-09-11 15:46 - 00000000 ____D C:\Program Files (x86)\HTML Help Workshop
2013-09-11 15:38 - 2013-09-11 16:07 - 00000000 ____D C:\Program Files\Microsoft Visual Studio 10.0
2013-09-11 15:38 - 2013-09-11 15:38 - 00000000 ____D C:\Windows\symbols
2013-09-06 00:14 - 2013-09-11 06:35 - 00000039 _____ C:\Windows\vbaddin.ini
2013-09-05 19:16 - 2013-09-05 19:22 - 00392704 _____ C:\Users\Eve\Documents\Konten2013.stb
2013-09-05 19:05 - 2013-09-05 19:05 - 00001147 _____ C:\Users\Public\Desktop\Steganos Online-Banking.lnk
2013-09-03 02:23 - 2013-09-03 02:25 - 00000000 ____D C:\Windows\system32\appmgmt
2013-09-02 15:13 - 2013-09-05 05:50 - 00000000 ____D C:\Users\Eve\AppData\Local\Microsoft Games
2013-09-02 01:34 - 2013-09-02 01:34 - 00000000 ____D C:\Program Files\Microsoft Games

==================== One Month Modified Files and Folders =======

2013-10-02 23:40 - 2013-10-02 23:40 - 01954124 _____ (Farbar) C:\Users\Eve\Desktop\FRST64.exe
2013-10-02 23:40 - 2013-10-02 23:39 - 01954124 _____ (Farbar) C:\Users\Eve\Downloads\FRST64.exe
2013-10-02 23:01 - 2013-04-09 03:41 - 00001112 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1161904824-3949471311-470107347-1001UA.job
2013-10-02 23:00 - 2011-10-22 18:01 - 00000000 ____D C:\Users\Eve\AppData\Roaming\Dropbox
2013-10-02 20:07 - 2013-04-09 03:41 - 00001060 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1161904824-3949471311-470107347-1001Core.job
2013-10-02 18:22 - 2013-07-15 23:36 - 00000000 ____D C:\Users\Eve\Documents\Citavi 4
2013-10-02 17:22 - 2013-10-02 17:21 - 00891144 _____ C:\Users\Eve\Desktop\SecurityCheck.exe
2013-10-02 17:22 - 2009-07-14 06:45 - 00021808 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-02 17:22 - 2009-07-14 06:45 - 00021808 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-02 17:19 - 2011-10-22 17:28 - 01652142 _____ C:\Windows\WindowsUpdate.log
2013-10-02 17:16 - 2013-05-28 14:40 - 00000000 ____D C:\Users\Eve\AppData\Roaming\Box Sync
2013-10-02 17:12 - 2013-09-27 23:17 - 00000796 _____ C:\Windows\setupact.log
2013-10-02 17:12 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-10-02 02:56 - 2013-10-01 16:19 - 00000000 ____D C:\Program Files (x86)\Visual Paradigm for UML CE 10.2
2013-10-01 23:39 - 2013-10-01 23:39 - 00000000 ____D C:\FRST
2013-10-01 23:25 - 2013-10-01 23:25 - 00000000 ____D C:\Windows\ERUNT
2013-10-01 23:22 - 2013-10-01 23:12 - 00000000 ____D C:\AdwCleaner
2013-10-01 23:08 - 2013-10-01 17:45 - 00000000 ____D C:\Program Files (x86)\Cisco
2013-10-01 23:03 - 2013-10-01 14:57 - 00003394 _____ C:\Windows\PFRO.log
2013-10-01 22:49 - 2013-10-01 22:49 - 00001116 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-10-01 22:49 - 2013-10-01 22:49 - 00000000 ____D C:\Users\Eve\AppData\Roaming\Malwarebytes
2013-10-01 22:49 - 2013-10-01 22:49 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-01 22:49 - 2013-10-01 22:49 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-10-01 22:46 - 2013-10-01 22:46 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Eve\Downloads\mbam-setup-1.75.0.1300.exe
2013-10-01 17:45 - 2013-10-01 17:45 - 00000000 ____D C:\Users\Eve\AppData\Local\Cisco
2013-10-01 17:45 - 2013-05-06 14:18 - 00000000 ____D C:\ProgramData\Cisco
2013-10-01 16:24 - 2013-10-01 15:54 - 00000000 ____D C:\Users\Eve\vpworkspace
2013-10-01 16:22 - 2013-10-01 15:54 - 00000000 ____D C:\Users\Eve\visualparadigm
2013-10-01 16:18 - 2013-09-30 02:33 - 00000000 ____D C:\Program Files (x86)\StarUML
2013-10-01 15:54 - 2011-10-22 17:33 - 00000000 ____D C:\Users\Eve
2013-10-01 15:08 - 2013-10-01 15:08 - 00029309 _____ C:\ComboFix.txt
2013-10-01 15:08 - 2013-10-01 14:43 - 00000000 ____D C:\Qoobox
2013-10-01 15:08 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default
2013-10-01 15:03 - 2013-10-01 14:43 - 00000000 ____D C:\Windows\erdnt
2013-10-01 14:58 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2013-10-01 14:56 - 2009-07-14 04:34 - 36700160 _____ C:\Windows\system32\config\SYSTEM.bak
2013-10-01 14:56 - 2009-07-14 04:34 - 104857600 _____ C:\Windows\system32\config\SOFTWARE.bak
2013-10-01 14:56 - 2009-07-14 04:34 - 06029312 _____ C:\Windows\system32\config\DEFAULT.bak
2013-10-01 14:56 - 2009-07-14 04:34 - 00262144 _____ C:\Windows\system32\config\SECURITY.bak
2013-10-01 14:56 - 2009-07-14 04:34 - 00262144 _____ C:\Windows\system32\config\SAM.bak
2013-09-30 16:23 - 2013-09-30 16:18 - 00000340 _____ C:\Windows\LkmdfCoInst.log
2013-09-30 16:18 - 2011-11-29 19:56 - 00018960 _____ (Logitech, Inc.) C:\Windows\system32\Drivers\LNonPnP.sys
2013-09-30 04:58 - 2011-10-22 18:13 - 00000000 ____D C:\Users\Eve\AppData\Roaming\Notepad++
2013-09-29 00:28 - 2012-07-18 22:23 - 00000000 ____D C:\Users\Eve\Documents\AVerTV
2013-09-28 21:02 - 2012-03-29 22:36 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-09-28 21:02 - 2011-10-22 17:48 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-28 02:17 - 2013-09-27 03:10 - 00000000 ____D C:\Program Files (x86)\DOSBox-0.74
2013-09-27 23:17 - 2013-09-27 23:17 - 00000000 _____ C:\Windows\setuperr.log
2013-09-27 04:35 - 2011-10-27 01:02 - 00000000 ____D C:\Users\Eve\AppData\Roaming\Media Player Classic
2013-09-27 03:55 - 2013-08-17 22:36 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-09-27 03:16 - 2013-09-27 03:16 - 00000000 ____D C:\Users\Eve\AppData\Local\DOSBox
2013-09-26 01:19 - 2012-07-02 21:29 - 00000064 _____ C:\Windows\AVerText.ini
2013-09-26 00:23 - 2013-09-26 00:23 - 00000000 ____D C:\Users\Eve\AppData\Roaming\SketchUp
2013-09-26 00:22 - 2013-09-26 00:22 - 00003120 _____ C:\Windows\SysWOW64\ALLFSAF13a.ocx
2013-09-24 22:42 - 2013-09-23 08:06 - 00007552 _____ C:\Users\Eve\Desktop\Strukto1.nsd
2013-09-24 20:46 - 2013-06-11 01:33 - 00000000 ____D C:\Users\Eve\Documents\My Digital Editions
2013-09-24 19:50 - 2011-10-22 20:59 - 00000000 ____D C:\Users\Eve\AppData\Roaming\foobar2000
2013-09-24 19:47 - 2013-09-21 15:56 - 00000000 ____D C:\Users\Eve\AppData\Roaming\vlc
2013-09-24 05:59 - 2011-10-22 18:04 - 00001038 _____ C:\Users\Public\Desktop\foobar2000.lnk
2013-09-24 05:59 - 2011-10-22 18:04 - 00000000 ____D C:\Program Files (x86)\foobar2000
2013-09-24 03:44 - 2013-09-24 03:44 - 00000723 _____ C:\Users\Eve\AppData\Local\recently-used.xbel
2013-09-23 23:04 - 2013-07-03 18:43 - 00000000 ____D C:\Program Files (x86)\Zotero Standalone
2013-09-23 07:09 - 2013-09-23 07:09 - 00002186 _____ C:\Users\Eve\Desktop\Structorizer.lnk
2013-09-23 07:09 - 2013-09-23 07:09 - 00000000 ____D C:\Users\Eve\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Structorizer
2013-09-23 07:09 - 2013-09-23 07:09 - 00000000 ____D C:\Users\Eve\.structorizer
2013-09-23 01:50 - 2011-10-22 19:56 - 00000000 ____D C:\Cryptload
2013-09-23 01:49 - 2011-10-22 18:10 - 00000000 ____D C:\Program Files (x86)\JDownloader
2013-09-22 22:56 - 2011-10-22 18:01 - 00000000 ____D C:\Program Files\CCleaner
2013-09-21 23:51 - 2013-09-21 23:51 - 00001154 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-09-21 23:24 - 2013-09-21 23:32 - 00000970 _____ C:\Users\Eve\Documents\indexfile.txt
2013-09-21 16:07 - 2013-04-09 03:43 - 00002360 _____ C:\Users\Eve\Desktop\Google Chrome.lnk
2013-09-21 15:29 - 2010-11-21 08:50 - 00767748 _____ C:\Windows\system32\perfh007.dat
2013-09-21 15:29 - 2010-11-21 08:50 - 00175706 _____ C:\Windows\system32\perfc007.dat
2013-09-21 15:29 - 2009-07-14 07:13 - 01807410 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-20 04:49 - 2013-09-20 04:41 - 01540096 _____ C:\Users\Eve\Documents\Database4.accdb
2013-09-19 00:18 - 2011-10-22 19:41 - 00000000 ____D C:\Users\Eve\Desktop\Convert
2013-09-18 22:42 - 2012-09-27 15:01 - 00000000 ____D C:\Users\Eve\AppData\Roaming\Audacity
2013-09-18 06:23 - 2013-09-18 06:15 - 00823296 _____ C:\Users\Eve\Documents\Database3.accdb
2013-09-18 05:41 - 2013-09-18 05:30 - 01507328 _____ C:\Users\Eve\Documents\Database2.accdb
2013-09-18 05:30 - 2013-09-18 05:24 - 01220608 _____ C:\Users\Eve\Documents\Database1.accdb
2013-09-17 20:11 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-09-13 05:51 - 2011-11-19 05:30 - 00000000 ____D C:\Users\Eve\AppData\Roaming\DAEMON Tools Lite
2013-09-13 05:51 - 2011-10-22 18:25 - 00000000 ____D C:\Windows\Panther
2013-09-12 17:23 - 2011-10-22 18:25 - 00002033 _____ C:\Users\Public\Desktop\Adobe Acrobat X Pro.lnk
2013-09-12 17:15 - 2012-02-15 17:17 - 00000000 ___RD C:\Users\Eve\Virtual Machines
2013-09-12 17:15 - 2011-10-22 17:33 - 00000000 ___RD C:\Users\Eve\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-09-12 17:15 - 2011-10-22 17:33 - 00000000 ___RD C:\Users\Eve\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-09-12 17:12 - 2012-04-02 18:36 - 00439576 _____ C:\Windows\system32\FNTCACHE.DAT
2013-09-12 06:37 - 2011-10-22 19:54 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-09-12 06:34 - 2013-07-15 16:33 - 00000000 ____D C:\Windows\system32\MRT
2013-09-12 06:30 - 2011-10-22 21:19 - 79143768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-09-12 03:51 - 2013-09-12 03:48 - 00000000 ____D C:\Users\Eve\AppData\Local\Temporary Projects
2013-09-12 03:43 - 2013-09-12 03:43 - 00000000 ____D C:\Users\Eve\AppData\Roaming\Microsoft Corporation
2013-09-12 03:41 - 2013-06-10 03:48 - 00000000 ____D C:\Users\Eve\Documents\Visual Studio 2010
2013-09-12 02:48 - 2013-09-12 02:48 - 00000000 ____D C:\ProgramData\Microsoft Visual Studio
2013-09-11 23:58 - 2013-06-10 03:46 - 00000000 ____D C:\Program Files (x86)\Microsoft Visual Studio 10.0
2013-09-11 23:58 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\MSBuild
2013-09-11 22:57 - 2013-06-10 03:45 - 00000000 ____D C:\Program Files (x86)\Microsoft SDKs
2013-09-11 16:07 - 2013-09-11 15:38 - 00000000 ____D C:\Program Files\Microsoft Visual Studio 10.0
2013-09-11 16:04 - 2013-09-11 16:04 - 00000000 ____D C:\ProgramData\PreEmptive Solutions
2013-09-11 15:56 - 2013-09-11 15:56 - 00000000 ____D C:\Program Files\IIS
2013-09-11 15:56 - 2013-09-11 15:56 - 00000000 ____D C:\Program Files (x86)\Microsoft ASP.NET
2013-09-11 15:56 - 2013-09-11 15:56 - 00000000 ____D C:\Program Files (x86)\IIS
2013-09-11 15:55 - 2013-09-11 15:55 - 00000000 ____D C:\Users\Eve\Documents\Visual Studio 2008
2013-09-11 15:49 - 2013-09-11 15:44 - 00000000 ____D C:\Program Files (x86)\Microsoft F#
2013-09-11 15:46 - 2013-09-11 15:44 - 00000000 ____D C:\Program Files (x86)\HTML Help Workshop
2013-09-11 15:45 - 2013-06-10 03:56 - 00000000 ____D C:\Windows\SysWOW64\1031
2013-09-11 15:44 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\MSBuild
2013-09-11 15:39 - 2013-06-14 02:00 - 00000000 ____D C:\Program Files (x86)\Microsoft Visual Studio 9.0
2013-09-11 15:39 - 2009-07-14 05:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2013-09-11 15:38 - 2013-09-11 15:38 - 00000000 ____D C:\Windows\symbols
2013-09-11 15:38 - 2013-06-10 03:56 - 00000000 ____D C:\Windows\system32\1031
2013-09-11 06:35 - 2013-09-06 00:14 - 00000039 _____ C:\Windows\vbaddin.ini
2013-09-06 17:51 - 2013-05-06 21:42 - 00000000 ___SD C:\Users\Eve\Documents\Meine Shapes
2013-09-05 19:22 - 2013-09-05 19:16 - 00392704 _____ C:\Users\Eve\Documents\Konten2013.stb
2013-09-05 19:05 - 2013-09-05 19:05 - 00001147 _____ C:\Users\Public\Desktop\Steganos Online-Banking.lnk
2013-09-05 19:05 - 2013-01-18 20:00 - 00000000 ____D C:\Program Files (x86)\Steganos Online-Banking 2012
2013-09-05 19:00 - 2012-04-10 21:33 - 00000000 ____D C:\Users\Eve\AppData\Roaming\Steganos
2013-09-05 05:50 - 2013-09-02 15:13 - 00000000 ____D C:\Users\Eve\AppData\Local\Microsoft Games
2013-09-03 02:31 - 2011-11-11 06:49 - 00000000 ____D C:\Program Files (x86)\IceBreaker
2013-09-03 02:25 - 2013-09-03 02:23 - 00000000 ____D C:\Windows\system32\appmgmt
2013-09-03 02:23 - 2013-06-11 01:49 - 00000000 ____D C:\Python26
2013-09-03 02:18 - 2012-05-11 02:41 - 00000000 ____D C:\Program Files\Common Files\DESIGNER
2013-09-03 02:18 - 2012-05-11 02:37 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
2013-09-03 02:18 - 2011-10-22 19:54 - 00000000 ____D C:\Program Files\Microsoft Office
2013-09-02 01:34 - 2013-09-02 01:34 - 00000000 ____D C:\Program Files\Microsoft Games

Files to move or delete:
====================
C:\Users\Eve\AppData\Roaming\DesktopSave.ini


Some content of TEMP:
====================
C:\Users\Eve\AppData\Local\Temp\Quarantine.exe
C:\Users\Eve\AppData\Local\Temp\sqlite-3.7.2-sqlitejdbc.dll


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-10-01 01:49

==================== End Of Log ============================

--- --- ---

Addition:

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 02-10-2013
Ran by Eve at 2013-10-02 23:42:23
Running from C:\Users\Eve\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: ESET Smart Security 6.0 (Enabled - Up to date) {77DEAFED-8149-104B-25A1-21771CA47CD1}
AS: ESET Smart Security 6.0 (Enabled - Up to date) {CCBF4E09-A773-1FC5-1F11-1A056723366C}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: ESET Personal Firewall (Enabled) {4FE52EC8-CB26-1113-0EFE-8842E2773BAA}

==================== Installed Programs ======================

7-Zip 9.20 (x64 edition) (Version: 9.20.00.0)
Acer Crystal Eye Webcam (x32 Version: 5.2.7.1)
Adobe Acrobat X Pro - English, Français, Deutsch (x32 Version: 10.1.8)
Adobe Digital Editions (x32)
Adobe Flash Player 11 ActiveX (x32 Version: 11.4.402.287)
Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.168)
Apple Application Support (x32 Version: 2.3)
Audacity 2.0.2 (x32 Version: 2.0.2)
AVerMedia A835 USB TV Tuner 8.2.64.61 (x32 Version: 8.2.64.61)
AVerTV 3D (x32 Version: 6.5)
Box Sync (64 bit) (Version: 3.4.25.0)
Brother MFL-Pro Suite MFC-255CW (x32 Version: 1.0.1.0)
BS.Player PRO (x32 Version: 2.56.1043)
CCleaner (Version: 4.05)
Citavi 4 (x32 Version: 4.1.0.3)
Crayon Physics Deluxe version 55 (x32 Version: 55)
Crystal Reports for Visual Studio (x32 Version: 12.51.0.240)
DAEMON Tools Lite (x32 Version: 4.45.1.0236)
dBpoweramp Music Converter (x32 Version: Release 13.1)
Definition Update for Microsoft Office 2010 (KB982726) 64-Bit Edition
Dotfuscator Software Services - Community Edition - DEU (x32 Version: 5.0.2300.0)
Dotfuscator Software Services - Community Edition (x32 Version: 5.0.2500.0)
Dropbox (HKCU Version: 2.0.22)
EPubsoft Adobe PDF ePub DRM Removal 4.8.8 (x32 Version: 4.8.8)
eReg (x32 Version: 1.20.138.34)
ESET Smart Security (Version: 6.0.316.1)
Evernote v. 4.6.6 (x32 Version: 4.6.6.8360)
FileZilla Client 3.7.1 (HKCU Version: 3.7.1)
foobar2000 v1.2.9 (x32 Version: 1.2.9)
Google Chrome (HKCU Version: 29.0.1547.76)
Hotfix für Microsoft Team Foundation Server 2010-Objektmodell - DEU (KB2813041) (x32 Version: 1)
Hotfix für Microsoft Visual Basic 2010 Express - DEU (KB2635973) (x32 Version: 1)
Hotfix für Microsoft Visual Studio 2010 Ultimate - DEU (KB2529927) (x32 Version: 1)
Hotfix für Microsoft Visual Studio 2010 Ultimate - DEU (KB2548139) (x32 Version: 1)
Hotfix für Microsoft Visual Studio 2010 Ultimate - DEU (KB2549864) (x32 Version: 1)
Hotfix für Microsoft Visual Studio 2010 Ultimate - DEU (KB2565057) (x32 Version: 1)
Hotfix für Microsoft Visual Studio 2010 Ultimate - DEU (KB2635973) (x32 Version: 1)
Hotfix für Microsoft Visual Studio 2010 Ultimate - DEU (KB2813041) (x32 Version: 1)
IceBreaker (x32)
ImgBurn (x32 Version: 2.5.8.0)
IrfanView (remove only) (x32 Version: 4.36)
JabRef 2.9.2 (x32 Version: 2.9.2)
Java 7 Update 10 (64-bit) (Version: 7.0.100)
Java 7 Update 10 (x32 Version: 7.0.100)
Java Auto Updater (x32 Version: 2.1.9.0)
JDownloader 0.9 (x32 Version: 0.9)
LAME v3.99.3 (for Windows) (x32)
LockHunter version 1.0 beta 3, 64 bit edition
Logitech SetPoint 6.32 (Version: 6.32.20)
Logitech Unifying-Software 2.10 (Version: 2.10.37)
Logon Screen (x32)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)
Media Player Classic - Home Cinema v1.5.2.3456 x64 (Version: 1.5.2.3456)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319)
Microsoft .NET Framework 4 Multi-Targeting Pack (x32 Version: 4.0.30319)
Microsoft .NET Framework 4.5 (Version: 4.5.50709)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Application Error Reporting (x32 Version: 12.0.6012.5000)
Microsoft ASP.NET MVC 2 - DEU (x32 Version: 2.0.50331.0)
Microsoft ASP.NET MVC 2 - Visual Studio 2010 Tools - DEU (x32 Version: 2.0.50331.0)
Microsoft ASP.NET MVC 2 - Visual Studio 2010 Tools (x32 Version: 2.0.50217.0)
Microsoft ASP.NET MVC 2 (x32 Version: 2.0.50217.0)
Microsoft Help Viewer 1.1 (Version: 1.1.40219)
Microsoft Help Viewer 1.1 Language Pack - DEU (Version: 1.1.40219)
Microsoft Office Access MUI (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office Excel MUI (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office Groove MUI (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office InfoPath MUI (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office Office 32-bit Components 2010 (Version: 14.0.7015.1000)
Microsoft Office OneNote MUI (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office Outlook MUI (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office PowerPoint MUI (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office Professional Plus 2010 (Version: 14.0.7015.1000)
Microsoft Office Proof (English) 2010 (Version: 14.0.7015.1000)
Microsoft Office Proof (French) 2010 (Version: 14.0.7015.1000)
Microsoft Office Proof (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office Proof (Italian) 2010 (Version: 14.0.7015.1000)
Microsoft Office Proofing (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office Publisher MUI (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office Shared 32-bit MUI (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office Shared MUI (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office Visio 2010 (Version: 14.0.7015.1000)
Microsoft Office Visio MUI (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office Word MUI (German) 2010 (Version: 14.0.7015.1000)
Microsoft redistributable runtime DLLs VS2005 SP1(x86) (x32 Version: 8.0.50727.4053)
Microsoft redistributable runtime DLLs VS2008 SP1(x86) (x32 Version: 9.0)
Microsoft Silverlight (Version: 5.1.20513.0)
Microsoft Silverlight 3 SDK - Deutsch (x32 Version: 3.0.40818.0)
Microsoft Silverlight 4 SDK - Deutsch (x32 Version: 4.0.50826.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft SQL Server 2008 (64-bit)
Microsoft SQL Server 2008 Browser (x32 Version: 10.3.5500.0)
Microsoft SQL Server 2008 Common Files (Version: 10.3.5500.0)
Microsoft SQL Server 2008 Database Engine Services (Version: 10.3.5500.0)
Microsoft SQL Server 2008 Database Engine Shared (Version: 10.3.5500.0)
Microsoft SQL Server 2008 Native Client (Version: 10.3.5500.0)
Microsoft SQL Server 2008 R2 Management Objects (x32 Version: 10.50.1750.9)
Microsoft SQL Server 2008 R2 Management Objects (x64) (Version: 10.50.1750.9)
Microsoft SQL Server 2008 R2 Transact-SQL-Sprachdienst (x32 Version: 10.50.1752.9)
Microsoft SQL Server 2008 R2-Datenebenenanwendungs-Framework (x32 Version: 10.50.1750.9)
Microsoft SQL Server 2008 R2-Datenebenenanwendungs-Projekt (x32 Version: 10.50.1750.9)
Microsoft SQL Server 2008 RsFx Driver (Version: 10.3.5500.0)
Microsoft SQL Server Compact 3.5 SP2 x64 DEU (Version: 3.5.8080.0)
Microsoft SQL Server Database Publishing Wizard 1.4 (x32 Version: 10.1.2512.8)
Microsoft SQL Server System CLR Types (x32 Version: 10.50.1750.9)
Microsoft SQL Server System CLR Types (x64) (Version: 10.50.1750.9)
Microsoft SQL Server VSS Writer (Version: 10.3.5500.0)
Microsoft Sync Framework Runtime v1.0 SP1 (x64) de (Version: 1.0.3010.0)
Microsoft Sync Framework SDK v1.0 SP1 de (x32 Version: 1.0.3010.0)
Microsoft Sync Framework Services v1.0 SP1 (x64) de (Version: 1.0.3010.0)
Microsoft Sync Services for ADO.NET v2.0 SP1 (x64) de (Version: 2.0.3010.0)
Microsoft Team Foundation Server 2010 Object Model - DEU (Version: 10.0.40219)
Microsoft Team Foundation Server 2010-Objektmodell - DEU (Version: 10.0.40219)
Microsoft Visio Premium 2010 (Version: 14.0.7015.1000)
Microsoft Visual Basic 2010 Express - DEU (x32 Version: 10.0.40219)
Microsoft Visual C++  Compilers 2010 Standard - enu - x64 (Version: 10.0.40219)
Microsoft Visual C++  Compilers 2010 Standard - enu - x86 (x32 Version: 10.0.40219)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (x32 Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x64 Designtime - 10.0.30319 (Version: 10.0.30319)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010  x64 Runtime - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Microsoft Visual C++ 2010  x86 Runtime - 10.0.40219 (x32 Version: 10.0.40219)
Microsoft Visual F# 2.0 Runtime (x32 Version: 10.0.40219)
Microsoft Visual F# 2.0 Runtime Language Pack - DEU (x32 Version: 10.0.30319)
Microsoft Visual Studio 2010 ADO.NET Entity Framework Tools (x32 Version: 10.0.40219)
Microsoft Visual Studio 2010 IntelliTrace Collection (x64) (Version: 10.0.40219)
Microsoft Visual Studio 2010 Office Developer Tools (x64) (Version: 10.0.40219)
Microsoft Visual Studio 2010 Office Developer Tools (x64) Language Pack - DEU (Version: 10.0.40219)
Microsoft Visual Studio 2010 Performance Collection Tools SP1 - DEU (Version: 10.0.40219)
Microsoft Visual Studio 2010 Service Pack 1 (x32 Version: 10.0.40219)
Microsoft Visual Studio 2010 SharePoint Developer Tools (x32 Version: 10.0.40219)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (Version: 10.0.40303)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (Version: 10.0.40308)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU (Version: 10.0.40303)
Microsoft Visual Studio 2010 Ultimate - DEU (x32 Version: 10.0.30319)
Microsoft Visual Studio 2010 Ultimate - DEU (x32 Version: 10.0.40219)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (Version: 10.0.40303)
Microsoft Visual Studio Macro Tools - DEU Language Pack (x32 Version: 9.0.30729)
Microsoft Visual Studio Macro Tools (x32 Version: 9.0.30729)
MiKTeX 2.9 (x32 Version: 2.9)
MozBackup 1.5.1 (x32)
Mozilla Firefox 24.0 (x86 de) (x32 Version: 24.0)
Mp3tag v2.52 (x32 Version: v2.52)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
Notepad++ (x32 Version: 5.9.4)
Nuvoton CIR Device Driver (x32 Version: 8.60.1000)
NVIDIA Drivers (Version: 1.7)
NVIDIA HD-Audiotreiber 1.3.18.0 (Version: 1.3.18.0)
NVIDIA Install Application (Version: 2.1002.109.718)
NVIDIA PhysX (x32 Version: 9.12.0213)
NVIDIA PhysX-Systemsoftware 9.12.0213 (Version: 9.12.0213)
Opera 12.16 (x32 Version: 12.16.1860)
Oracle VM VirtualBox 4.2.16 (Version: 4.2.16)
PicPick (x32 Version: 3.1.9)
PVSonyDll (Version: 1.00.0001)
QuickTime (x32 Version: 7.73.80.64)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6482)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition
Service Pack 3 für SQL Server 2008 (KB2546951) (64-bit) (Version: 10.3.5500.0)
Sicherheitsupdate für Microsoft Visual Studio 2010 Ultimate - DEU (KB2645410) (x32 Version: 1)
Skype™ 6.6 (x32 Version: 6.6.106)
Sql Server Customer Experience Improvement Program (Version: 10.3.5500.0)
StarMoney (x32 Version: 2.0)
Steam (x32 Version: 1.0.0.0)
Steganos Online-Banking 2012 (x32 Version: 2.0.3)
Synaptics Pointing Device Driver (Version: 14.0.6.0)
TeamViewer 8 (x32 Version: 8.0.19617)
TeXstudio 2.5.2 (x32 Version: 2.5.2)
Unterstützungsdateien für Microsoft SQL Server 2008-Setup  (Version: 10.3.5500.0)
Update for Microsoft .NET Framework 4.5 (KB2750147) (x32 Version: 1)
Update for Microsoft .NET Framework 4.5 (KB2805221) (x32 Version: 1)
Update for Microsoft .NET Framework 4.5 (KB2805226) (x32 Version: 1)
Update for Microsoft Access 2010 (KB2553446) 64-Bit Edition
Update for Microsoft Filter Pack 2.0 (KB2810071) 64-Bit Edition
Update for Microsoft Office 2010 (KB2553092)
Update for Microsoft Office 2010 (KB2553157) 64-Bit Edition
Update for Microsoft Office 2010 (KB2589298) 64-Bit Edition
Update for Microsoft Office 2010 (KB2589370) 64-Bit Edition
Update for Microsoft Office 2010 (KB2589375) 64-Bit Edition
Update for Microsoft Office 2010 (KB2760598) 64-Bit Edition
Update for Microsoft Office 2010 (KB2760631) 64-Bit Edition
Update for Microsoft Office 2010 (KB2760758) 64-Bit Edition
Update for Microsoft Office 2010 (KB2794737) 64-Bit Edition
Update for Microsoft Office 2010 (KB2825640) 64-Bit Edition
Update for Microsoft OneNote 2010 (KB2810072) 64-Bit Edition
Update for Microsoft PowerPoint 2010 (KB2553145) 64-Bit Edition
Update for Microsoft Visio Viewer 2010 (KB2810066) 64-Bit Edition
Uplink (x32 Version: 1.00.0000)
Visual Paradigm for UML CE 10.2 (x32 Version: 10.2)
Visual Studio 2010 Prerequisites - English (Version: 10.0.40219)
VLC media player 2.0.8 (x32 Version: 2.0.8)
WCF RIA Services V1.0 SP1 (x32 Version: 4.1.60114.0)
Web Deployment Tool (Version: 1.1.0618)
WIDCOMM Bluetooth Software (Version: 6.2.0.9700)
WinRAR 4.01 (64-Bit) (Version: 4.01.0)
Worms Revolution (x32)
Xvid Video Codec (x32 Version: 1.3.2)
Your Uninstaller! 7 (x32 Version: 7.3.2011.2)
Zotero Standalone 4.0.8 (x86 en-US) (x32 Version: 4.0.8)

==================== Restore Points  =========================


==================== Hosts content: ==========================

2009-07-14 04:34 - 2013-10-01 23:54 - 00000058 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
127.0.0.1		activate.adobe.com


==================== Scheduled Tasks (whitelisted) =============

Task: {22679EC8-B7C8-4085-8990-97B6DFF82274} - System32\Tasks\{7512712B-F92C-4A26-9552-9147E12265B1} => C:\Team17\Worms World Party\wwp.exe
Task: {91A421E8-A432-4F03-B9B5-07C99F1B1CF5} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-08-21] (Piriform Ltd)
Task: {AAA48E7E-9DA2-4F11-89D8-BAFAF763F5ED} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1161904824-3949471311-470107347-1001UA => C:\Users\Eve\AppData\Local\Google\Update\GoogleUpdate.exe [2013-04-09] (Google Inc.)
Task: {C921E101-2576-49E1-92D8-C25E25335135} - System32\Tasks\{C90A5A0D-A0AF-4610-9281-73270640110B} => C:\Team17\Worms World Party\wwp.exe
Task: {CD4AB9AD-FDA3-43FC-9C14-9DDD8D373EB4} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1161904824-3949471311-470107347-1001Core => C:\Users\Eve\AppData\Local\Google\Update\GoogleUpdate.exe [2013-04-09] (Google Inc.)
Task: {EE017FE1-5963-4EC0-B45B-BE8201DC723F} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1161904824-3949471311-470107347-1001Core.job => C:\Users\Eve\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1161904824-3949471311-470107347-1001UA.job => C:\Users\Eve\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2013-04-04 01:09 - 2013-04-04 01:09 - 04300432 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2010-01-02 16:42 - 2010-01-02 16:42 - 00098304 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext_64.dll
2011-10-07 11:39 - 2011-10-07 11:39 - 01304856 _____ () C:\Program Files\Logitech\SetPointP\Macros\MacroCore.dll
2013-07-11 21:43 - 2013-07-11 21:43 - 00537600 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_64\Python.Runtime\8bdd14828ee35fc0ea86e54380c74c1f\Python.Runtime.ni.dll
2013-01-03 19:12 - 2013-01-03 19:12 - 00471552 _____ () C:\Program Files\Box Sync\_hashlib.pyd
2013-01-03 19:12 - 2013-01-03 19:12 - 00046080 _____ () C:\Program Files\Box Sync\_socket.pyd
2013-01-03 19:12 - 2013-01-03 19:12 - 01167360 _____ () C:\Program Files\Box Sync\_ssl.pyd
2013-01-03 19:12 - 2013-01-03 19:12 - 00689664 _____ () C:\Program Files\Box Sync\unicodedata.pyd
2013-01-03 19:12 - 2013-01-03 19:12 - 00166912 _____ () C:\Program Files\Box Sync\_elementtree.pyd
2013-01-03 19:12 - 2013-01-03 19:12 - 00164352 _____ () C:\Program Files\Box Sync\pyexpat.pyd
2013-01-03 19:12 - 2013-01-03 19:12 - 00111616 _____ () C:\Program Files\Box Sync\_ctypes.pyd
2013-01-03 19:12 - 2013-01-03 19:12 - 00127488 _____ () C:\Program Files\Box Sync\win32api.pyd
2013-01-03 19:12 - 2013-01-03 19:12 - 00136704 _____ () C:\Program Files\Box Sync\pywintypes27.dll
2013-01-03 19:12 - 2013-01-03 19:12 - 00058368 _____ () C:\Program Files\Box Sync\_sqlite3.pyd
2013-01-03 19:12 - 2013-01-03 19:12 - 00535040 _____ () C:\Program Files\Box Sync\sqlite3.dll
2013-01-03 19:12 - 2013-01-03 19:12 - 00037888 _____ () C:\Program Files\Box Sync\_testcapi.pyd
2013-01-03 19:12 - 2013-01-03 19:12 - 00135168 _____ () C:\Program Files\Box Sync\win32security.pyd
2013-01-03 19:12 - 2013-01-03 19:12 - 00007168 _____ () C:\Program Files\Box Sync\_win32sysloader.pyd
2013-01-03 19:12 - 2013-01-03 19:12 - 00138752 _____ () C:\Program Files\Box Sync\win32file.pyd
2013-09-03 15:54 - 2013-09-03 15:54 - 00019968 _____ () C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\locale\de_de\acrotray.deu
2013-03-13 22:48 - 2013-03-13 22:48 - 24978944 _____ () C:\Users\Eve\AppData\Roaming\Dropbox\bin\libcef.dll
2013-09-21 23:51 - 2013-09-11 04:26 - 03279768 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2013-04-04 01:09 - 2013-04-04 01:09 - 04300456 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2013-10-01 16:19 - 2013-09-16 23:11 - 00020480 _____ () C:\Program Files (x86)\Visual Paradigm for UML CE 10.2\bin\vp_windows\E1.dll
2013-10-01 16:19 - 2013-09-16 23:11 - 00020480 _____ () C:\Program Files (x86)\Visual Paradigm for UML CE 10.2\bin\vp_windows\I1.dll
2013-10-01 16:19 - 2013-09-16 23:11 - 00020480 _____ () C:\Program Files (x86)\Visual Paradigm for UML CE 10.2\bin\vp_windows\W1.dll
2013-10-01 16:19 - 2013-09-16 23:11 - 00040960 _____ () C:\Program Files (x86)\Visual Paradigm for UML CE 10.2\bin\vp_windows\CC.dll
2013-10-01 15:54 - 2013-10-01 15:54 - 00541696 _____ () C:\Users\Eve\AppData\Local\Temp\sqlite-3.7.2-sqlitejdbc.dll
2011-07-18 23:07 - 2011-07-18 23:07 - 00014336 _____ () C:\Program Files (x86)\Notepad++\plugins\NppExport.dll
2011-09-21 22:46 - 2011-09-21 22:46 - 01673728 _____ () C:\Program Files (x86)\Notepad++\plugins\NppFTP.dll
2013-09-28 21:02 - 2013-09-28 21:02 - 16177544 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll
2012-01-15 01:47 - 2012-03-14 23:55 - 00848536 _____ () D:\Daten\Portable Thunderbird\thunderbird\js3250.dll
2012-01-15 01:47 - 2012-03-14 23:55 - 00161944 _____ () D:\Daten\Portable Thunderbird\thunderbird\NSLDAP32V60.dll
2012-01-15 01:47 - 2012-03-14 23:55 - 00021656 _____ () D:\Daten\Portable Thunderbird\thunderbird\NSLDAPPR32V60.dll
2012-01-15 01:33 - 2009-12-09 17:31 - 00020992 _____ () D:\Daten\Portable Thunderbird\Profilordner\extensions\{de1b245c-de57-11da-ba2d-0050c2490048}\library\WINNT-32\MinimizeToTrayPlus.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\ProgramData\TEMP:1CE11B51

==================== Safe Mode (whitelisted) ===================


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (10/02/2013 11:39:07 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (10/02/2013 09:34:55 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (10/02/2013 05:19:43 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (10/02/2013 05:19:12 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (10/02/2013 05:14:15 PM) (Source: Microsoft-Windows-WMI) (User: NT-AUTORITÄT)
Description: Der Ereignisfilter mit der Abfrage "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" konnte im Namespace "//./root/CIMV2" aufgrund des Fehlers "0x80041003" nicht reaktiviert werden. Solange dieses Problem besteht, können mit diesem Filter keine Ereignisse übermittelt werden.

Error: (10/02/2013 01:55:22 AM) (Source: Microsoft-Windows-WMI) (User: NT-AUTORITÄT)
Description: Der Ereignisfilter mit der Abfrage "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" konnte im Namespace "//./root/CIMV2" aufgrund des Fehlers "0x80041003" nicht reaktiviert werden. Solange dieses Problem besteht, können mit diesem Filter keine Ereignisse übermittelt werden.


System errors:
=============
Error: (10/02/2013 10:16:14 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%-2140993535

Error: (10/02/2013 10:16:14 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler beendet: 
%%-2140993535

Error: (10/02/2013 10:16:14 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%-2140993535

Error: (10/02/2013 10:16:14 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler beendet: 
%%-2140993535

Error: (10/02/2013 10:16:14 PM) (Source: PNRPSvc) (User: )
Description: 0x80630801

Error: (10/02/2013 10:16:14 PM) (Source: PNRPSvc) (User: )
Description: 0x80630801

Error: (10/02/2013 09:09:03 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%-2140993535

Error: (10/02/2013 09:09:03 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler beendet: 
%%-2140993535

Error: (10/02/2013 09:09:03 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler beendet: 
%%-2140993535

Error: (10/02/2013 09:09:03 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%-2140993535


Microsoft Office Sessions:
=========================
Error: (10/02/2013 11:39:07 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestD:\$RECYCLE.BIN\S-1-5-21-1161904824-3949471311-470107347-1001\$R8BK2IC.exe

Error: (10/02/2013 09:34:55 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe

Error: (10/02/2013 05:19:43 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestD:\Downloads\esetsmartinstaller_enu.exe

Error: (10/02/2013 05:19:12 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestD:\Downloads\esetsmartinstaller_enu.exe

Error: (10/02/2013 05:14:15 PM) (Source: Microsoft-Windows-WMI)(User: NT-AUTORITÄT)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/02/2013 01:55:22 AM) (Source: Microsoft-Windows-WMI)(User: NT-AUTORITÄT)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


CodeIntegrity Errors:
===================================
  Date: 2013-10-01 14:55:34.170
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-10-01 14:55:34.061
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-09-18 21:37:29.945
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-09-18 21:37:29.742
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-09-18 21:37:29.504
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-09-18 21:37:29.276
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-09-18 21:37:27.565
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-09-18 21:37:27.304
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-08-15 17:50:35.295
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-08-15 17:50:35.036
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Percentage of memory in use: 60%
Total physical RAM: 4060.93 MB
Available physical RAM: 1608.43 MB
Total Pagefile: 8120.04 MB
Available Pagefile: 5359.43 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: (Windows) (Fixed) (Total:100.78 GB) (Free:34.85 GB) NTFS
Drive d: (Data) (Fixed) (Total:364.88 GB) (Free:319.83 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: EA5BFAFE)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=101 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=365 GB) - (Type=07 NTFS)

==================== End Of Log ============================

schrauber · 03.10.2013, 08:05

Java updaten. hast Du den Proxy in Firefox gesetzt?

Wir bilden die selbst aus, schau Dich mal im Forum um da gibt es nen Thread zu

Miau3 · 04.10.2013, 14:50

Java hab ich geupdated, den Proxy hatte ich selber vor nem Jahr oder so eingetragen gehabt.

Vielen lieben Dank noch mal für deine Hilfe!

Werde mich mal umschauen, vielleicht trete ich euch dann mal bei

schrauber · 05.10.2013, 10:03

Alles klar

Fertig

Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Hier noch ein paar Tipps zur Absicherung deines Systems.

Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
Windows Updates
- Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
- Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
Gehe sicher das die automatischen Updates aktiviert sind.
Software Updates
Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

MalwareBytes Anti Malware
Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
Ein Tutorial zur Verwendung findest Du hier.
WinPatrol
Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

SpywareBlaster
Eine kurze Einführung findest du Hier
MVPs hosts file
Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
WOT (Web of trust)
Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

Opera
Mozilla Firefox.
- Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
- NoScript
  Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
- AdblockPlus
  Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
  Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )

Don'ts

Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

03.10.2013, 08:05	#10
schrauber /// the machine /// TB-Ausbilder	dft.pathmapping-Popup sowie Optimizer Pro Java updaten. hast Du den Proxy in Firefox gesetzt? Wir bilden die selbst aus, schau Dich mal im Forum um da gibt es nen Thread zu __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

dft.pathmapping-Popup sowie Optimizer Pro

Plagegeister aller Art und deren Bekämpfung: dft.pathmapping-Popup sowie Optimizer Pro