Guten Morgen.

Seit ca. einer halben Woche hat mein Computer die ersten Syptome für einen Virus gezeigt. Die da wären:
-Sicherheitscenter lässt sich nicht starten, da der Dienst deaktiviert ist. Wenn ich ihn auf Automatisch stelle aktiviert er sich, ist aber beim Neustart wieder aus.

-Nach der Aktivierung vom Sicherheitcenter kriege ich die Fehlermeldung Windows Firewall konnte nicht gestartet werden. Manuell starten kann ich ihn nicht.

-Der Taskmanager ist grau hinterlegt, wenn ich ihn mit Rechtsklick in der Taskleiste versuche zu starten. Wenn ich Strg-Alt-Entf drücke wird der Button für den Taskmanager gar nicht angezeigt. Das Problem ist, das der Wert im Schlüssel auf 1 gesetzt ist. Wenn ich den Wert auf 0 setze ändert er sich automatisch wieder zu 1.

-Malwarebytes blockiert alle 20 Sekunden eine Verbindung mit einer schädlichen Website. Die Verbindung wird von cvtres.exe automatisch gestartet.

-Der Prozess svchost.exe hat eine ungewöhnlich hohe Auslastung von 300.000.

Ich habe den Computer einmal mit Malwarebytes und ein Mal mit Norton Security durchlaufen lassen und so einiges gefunden, jedoch hat sich nichts geändert. Ich weiß wirklich nicht mehr was ich tun könnte. Sogar mein Mauszeiger hängt sich beim Bewegen auf und beim Tippen erscheinen die Buchstaben mit verzögerung.

Ich habe einen Fx-6100 Prozessor mit 8 GB RAM und Win 7.
Ich glaube ich weiß welches Programm den Virus eingeschleußt hat, jedoch weiß ich nicht wie ich ihn wieder entfernen könnte.

Hier die Log Files.

Addition

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 10-02-2014 01
Ran by Pc at 2014-02-11 22:29:03
Running from C:\Users\Pc\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: avast! Antivirus (Enabled - Up to date) {2B2D1395-420B-D5C9-657E-930FE358FC3C}
AS: avast! Antivirus (Enabled - Up to date) {904CF271-6431-DA47-5FCE-A87D98DFB681}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

µTorrent (HKCU Version: 3.3.2.30303 - BitTorrent Inc.)
Adobe Flash Player 12 ActiveX (x32 Version: 12.0.0.44 - Adobe Systems Incorporated)
Adobe Flash Player 12 Plugin (x32 Version: 12.0.0.44 - Adobe Systems Incorporated)
Adobe Reader X (10.1.7) MUI (x32 Version: 10.1.7 - Adobe Systems Incorporated)
Advertising Center (x32 Version: 0.0.0.1 - Nero AG) Hidden
Aeria Ignite (x32 Version: 1.13.3296 - Aeria Games & Entertainment)
Aeria Ignite (x32 Version: 1.13.3296 - Aeria Games & Entertainment) Hidden
Age of Conan: Unchained (x32 Version:  - Funcom)
Age of Empires III (x32 Version: 1.00.0000 - Microsoft Game Studios)
Age of Empires III (x32 Version: 1.00.0000 - Microsoft Game Studios) Hidden
AI Suite (x32 Version: 1.06.22 - )
AION Free-To-Play (x32 Version: 2.70.0000 - Gameforge)
AION Free-To-Play (x32 Version: 2.70.0000 - Gameforge) Hidden
AirPlus XtremeG DWL-G122 (x32 Version: 1.0.30 - D-Link)
Aiseesoft MP4 Video Converter 7.1.20 (x32 Version: 7.1.20 - Aiseesoft Studio)
Akamai NetSession Interface (HKCU Version:  - Akamai Technologies, Inc)
Akamai NetSession Interface (x32 Version:  - Akamai Technologies, Inc)
Alliance of Valiant Arms (x32 Version:  - )
AMD Accelerated Video Transcoding (Version: 13.20.100.31206 - Advanced Micro Devices, Inc.) Hidden
AMD APP SDK Runtime (Version: 10.0.923.1 - Advanced Micro Devices Inc.) Hidden
AMD Catalyst Control Center (x32 Version: 2013.1206.1603.28764 - Ihr Firmenname) Hidden
AMD Catalyst Install Manager (Version: 8.0.915.0 - Advanced Micro Devices, Inc.)
AMD Drag and Drop Transcoding (Version: 2.00.0000 - ATI Technologies Inc.) Hidden
AMD Fuel (Version: 2013.1206.1603.28764 - Ihr Firmenname) Hidden
AMD Media Foundation Decoders (Version: 1.0.81206.1620 - Advanced Micro Devices, Inc.) Hidden
AMD Wireless Display v3.0 (Version: 1.0.0.14 - Advanced Micro Devices, Inc.) Hidden
American Conquest Fight Back (x32 Version:  - )
ANNO 2070 (x32 Version: 1.0.0.0 - Ubisoft)
ASUS WebStorage (x32 Version: 3.0.94.193 - eCareme Technologies, Inc.)
ASUSUpdate (x32 Version: 7.18.03 - ASUSTeK Computer Inc.)
ATI AVIVO64 Codecs (Version: 11.6.0.10707 - ATI Technologies Inc.) Hidden
Audacity 2.0.2 (x32 Version: 2.0.2 - Audacity Team)
Babylon Chrome Toolbar (x32 Version: 2.0.0.4 - Babylon Ltd) <==== ATTENTION
Babylon toolbar  (x32 Version:  - BabylonToolbar) <==== ATTENTION
Battle For Graxia (x32 Version:  - )
BioShock Infinite (x32 Version:  - Irrational Games)
Black & White® 2 (x32 Version: 1.00.0000 - Lionhead Studios)
Blitzkrieg Burning Horizon (x32 Version:  - )
Brick-Force  (x32 Version:  - Infernum Productions AG)
Browser Defender 3.0 (x32 Version: 3.0.0.314 - Threat Expert Ltd.)
Brytenwalda Version 1.40 (x32 Version: 1.40 - Brytenwalda Dev.)
Bundled software uninstaller (x32 Version:  - ) <==== ATTENTION
CAESAR IV (x32 Version: 1.2 - Tilted Mill Entertainment)
Call of Duty: Black Ops II - Multiplayer (x32 Version:  - )
Call of Duty: Black Ops II - Zombies (x32 Version:  - )
Camtasia Studio 8 (x32 Version: 8.0.3.994 - TechSmith Corporation)
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
CCleaner (Version: 4.09 - Piriform)
CDBurnerXP (x32 Version: 4.5.1.3868 - CDBurnerXP)
Celtic Kings - The Punic Wars (x32 Version:  - )
Chivalry Medieval Warfare (c) Torn Banner Studios version 1 (x32 Version: 1 - )
Codec Pack Packages (HKCU Version:  - ) <==== ATTENTION
Cossacks - The Art Of War (x32 Version:  - )
Cossacks 2 - Battle for Europe (x32 Version:  - )
Cossacks II (x32 Version:  - )
Cross Fire En (x32 Version:  - Z8Games.com)
Crossfire Europe (x32 Version: 1.107 - SG INTERACTIVE)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DAEMON Tools Lite (x32 Version: 4.48.1.0347 - Disc Soft Ltd)
DarthMod: Shogun II (x32 Version:  - )
DBO_CT_TW (x32 Version: 1.57.22 - Cayennetech)
DC-Bass Source 1.3.0 (x32 Version:  - )
Die Schlacht um Mittelerde™ II (x32 Version:  - )
DirectVobSub 2.40.4209 (x32 Version: 2.40.4209 - MPC-HC Team)
DivX-Setup (x32 Version: 2.6.1.8 - DivX, LLC)
Dota 2 (x32 Version:  - Valve )
Dungeons and Dragons Online (HKCU Version:  - )
Dynasty Warriors Online (x32 Version:  - )
Elsword_DE (x32 Version:  - )
EPU-4 Engine (x32 Version: 1.02.01 - )
Europa Universalis IV (x32 Version:  - Paradox Interactive)
ExpressFiles (HKCU Version: 1.8.1 - hxxp://www.express-files.com/) <==== ATTENTION
ffdshow v1.1.4399 [2012-03-22] (x32 Version: 1.1.4399.0 - )
Floris Mod Pack 2.54 (x32 Version:  - )
Forged By Chaos (x32 Version:  - )
Fotogalerie (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Fraps (remove only) (x32 Version:  - )
Free Audio CD Burner version 2.0.22.320 (x32 Version: 2.0.22.320 - DVDVideoSoft Ltd.)
Free MP4 Video Converter version 5.0.20.1031 (x32 Version: 5.0.20.1031 - DVDVideoSoft Ltd.)
From Dust (x32 Version: 1.0.0 - Ubisoft)
FuNDeaulls (x32 Version:  - FFunDeals)
Gameforge Live 1.7.0 "Legend" (x32 Version: 1.7.0 - Gameforge)
GameRanger (HKCU Version:  - GameRanger Technologies)
GamersFirst LIVE! (HKCU Version:  - GamersFirst)
Ghost Recon Online (EU) (HKCU Version: 1.34.9860.1 - Ubisoft)
GIMP 2.8.2 (Version: 2.8.2 - The GIMP Team)
Google Chrome (x32 Version: 31.0.1650.63 - Google Inc.)
Google Drive (x32 Version: 1.13.5782.599 - Google, Inc.)
Google Earth (x32 Version: 7.1.2.2041 - Google)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Google Toolbar for Internet Explorer (x32 Version: 7.5.4805.320 - Google Inc.)
Google Update Helper (x32 Version: 1.3.22.3 - Google Inc.) Hidden
Gothic III (x32 Version: 1.0.0 - JoWooD Productions Software AG)
grafstat4 (x32 Version: 4.276 - DrSoft)
GS-Supporter 1.80 (x32 Version:  - Verified Publisher) <==== ATTENTION
Guild Wars 2 (x32 Version:  - NCsoft Corporation, Ltd.)
Haali Media Splitter (x32 Version:  - )
Happy Cloud Client (HKCU Version: 3.41 - Happy Cloud, Inc.)
Haunt 1.0 64bit (HKCU Version:  - )
Hi-Rez Studios Authenticate and Update Service (x32 Version: 3.0.0.0 - Hi-Rez Studios)
HydraVision (x32 Version: 4.2.208.0 - ATI Technologies Inc.) Hidden
Infestation: Survivor Stories (x32 Version:  - Hammerpoint Interactive)
inSSIDer 3 (x32 Version: 3.0.6.42 - MetaGeek, LLC)
Installation (HKCU Version: 1.0.0.8 - Installation)
Intel(R) Processor Graphics (x32 Version: 8.15.10.2266 - Intel Corporation)
IrfanView (remove only) (x32 Version: 4.32 - Irfan Skiljan)
Java 7 Update 51 (x32 Version: 7.0.510 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
JDownloader 0.9 (x32 Version: 0.9 - AppWork GmbH)
King Arthur II (x32 Version:  - Paradox Interactive)
K-Lite Codec Pack 9.4.0 (Basic) (x32 Version: 9.4.0 - )
Lagarith Lossless Codec (1.3.27) (x32 Version:  - )
LAME v3.99.3 (for Windows) (x32 Version:  - )
League of Legends (x32 Version: 1.3 - Riot Games)
League of Legends (x32 Version: 3.0.1 - Riot Games )
League of Legends (x32 Version: 3.0.1 - Riot Games ) Hidden
LOCO EVOLUTION (x32 Version: EVOLUTION - DanalGames)
Logitech Print Service (x32 Version:  - )
Logitech QuickCam-Software (x32 Version: 8.47.0000 - Logitech, Inc.)
LOLReplay (x32 Version: 0.8.5.1 - www.leaguereplays.com)
Lost Empire - Immortals (x32 Version: 1.0.0 - Pollux Gamelabs)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300 - Malwarebytes Corporation)
McAfee Security Scan Plus (Version: 3.8.130.10 - McAfee, Inc.)
Metin2 (x32 Version:  - Gameforge 4D GmbH)
Microsoft .NET Framework 1.1 (x32 Version:  - )
Microsoft .NET Framework 1.1 (x32 Version: 1.1.4322 - Microsoft) Hidden
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5 (Version: 4.5.50709 - Microsoft Corporation) Hidden
Microsoft Age of Empires II (x32 Version:  - )
Microsoft Age of Empires II: The Conquerors Expansion (x32 Version:  - )
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Games for Windows - LIVE Redistributable (x32 Version: 3.5.92.0 - Microsoft Corporation)
Microsoft Games for Windows Marketplace (x32 Version: 3.5.50.0 - Microsoft Corporation)
Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (x32 Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (x32 Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (x32 Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106 (x32 Version: 11.0.51106.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.50727 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.51106 (x32 Version: 11.0.51106 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.50727 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.51106 (x32 Version: 11.0.51106 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (x32 Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft XNA Framework Redistributable 1.0 Refresh (x32 Version: 1.1.10405.0 - Microsoft Corporation)
Microsoft XNA Framework Redistributable 3.1 (x32 Version: 3.1.10527.0 - Microsoft Corporation)
Microsoft XNA Framework Redistributable 4.0 (x32 Version: 4.0.20823.0 - Microsoft Corporation)
Mobistel Cynus T1 Drivers(x86) (x32 Version: 2.00 - Mobistel)
Mount&Blade Warband (x32 Version:  - )
Mount&Blade With Fire and Sword (x32 Version:  - )
MountMusket Battalion (x32 Version: 0.4.2 - MountMusket Battalion Team)
Movie Maker (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Movie2KDownloader (x32 Version: 2.1 Build 26473 - Movie2KDownloader.com)
Mozilla Firefox 26.0 (x86 de) (x32 Version: 26.0 - Mozilla)
Mozilla Maintenance Service (x32 Version: 26.0 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft) Hidden
MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0 - Microsoft Corporation)
MySQL Connector/ODBC 3.51 (x32 Version: 3.51.12 - MySQL AB)
Napoleonic Wars (x32 Version: 1.0 - Mount&Blade Napoleonic Wars)
NC Launcher (GameForge) (x32 Version:  - NCsoft)
Nero 9 Essentials (x32 Version:  - Nero AG)
Nero ControlCenter (x32 Version: 9.0.0.1 - Nero AG) Hidden
Nero Installer (x32 Version: 4.4.9.0 - Nero AG) Hidden
Nero Online Upgrade (x32 Version: 1.3.0.0 - Nero AG) Hidden
Nero StartSmart (x32 Version: 9.4.12.100 - Nero AG) Hidden
Nero StartSmart OEM (x32 Version: 9.4.10.100 - Nero AG) Hidden
neroxml (x32 Version: 1.0.0 - Nero AG) Hidden
Norton Internet Security (x32 Version: 21.1.0.18 - Symantec Corporation)
Notepad++ (x32 Version: 6.4.2 - Notepad++ Team)
NVIDIA 3D Vision Treiber 270.61 (Version: 270.61 - NVIDIA Corporation)
NVIDIA Drivers (Version: 1.10.57.35 - NVIDIA Corporation)
NVIDIA ForceWare Network Access Manager (x32 Version: 1.00.7325.0 - NVIDIA Corporation)
NVIDIA Grafiktreiber 270.61 (Version: 270.61 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.2.22.1 (Version: 1.2.22.1 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.270.54.0 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.10.0513 - NVIDIA Corporation)
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.12.7061 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 270.61 (Version: 270.61 - NVIDIA Corporation) Hidden
Open It! (x32 Version: 1.1.1 - OpenIt)
OpenOffice.org 3.4.1 (x32 Version: 3.41.9593 - Apache Software Foundation)
OpenSource Flash Video Splitter 1.0.0.5 (x32 Version: 1.0.0.5 - )
Pando Media Booster (x32 Version: 2.6.0.8 - Pando Networks Inc.)
Panzar (x32 Version: 1.0 - Panzar)
Patch v2.2 (x32 Version:  - RUNEFORGE Games Studios)
Patrizier IV (x32 Version: 1.0.0 - Kalypso Media)
PC Probe II (x32 Version: 1.04.92 - ASUSTeK Computer Inc.)
Photo Gallery (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
PileFile reminder (HKCU Version:  - FINEDREAM INVEST LTD)
Pixsta (HKCU Version: 2.5.0.48600 - Pokki)
PlanetSide 2 (HKCU Version: 1.0.3.183 - Sony Online Entertainment)
Platform (x32 Version: 1.34 - VIA Technologies, Inc.) Hidden
Pokki (HKCU Version: 0.266.1.172 - Pokki)
Pokki Download Helper (HKCU Version: 1.3.1.282 - Pokki)
PowerISO (x32 Version: 5.4 - Power Software Ltd)
PrivitizeVPN (x32 Version: 1.0.0 - OOO Industry) <==== ATTENTION
ProtectDisc Driver, Version 11 (x32 Version: 11.0.0.14 - ProtectDisc Software GmbH)
PunkBuster Services (x32 Version: 0.993 - Even Balance, Inc.)
Qtrax Connection Manager (HKCU Version: 20.13.07.02 - Qtrax Inc)
Qtrax Player (HKCU Version:  - portal.qtrax.com)
QuickShare (x32 Version: 1.38.61.10911 - Linkury Inc.) <==== ATTENTION
RaiderZ (x32 Version: 1.0.0.36787 - Gameforge)
RAIDXpert (x32 Version: 3.2.1540.10 - AMD)
RAIDXpert (x32 Version: 3.2.1540.10 - AMD) Hidden
Realtek Ethernet Controller Driver (x32 Version: 7.52.203.2012 - Realtek)
Realtek Ethernet Diagnostic Utility (x32 Version: 1.00.0000 - Realtek)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6526 - Realtek Semiconductor Corp.)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.0.34.0 - Renesas Electronics Corporation)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.0.34.0 - Renesas Electronics Corporation) Hidden
Rise and Fall (x32 Version: 1.00.0000 - Midway Games)
Roads of Rome 3 (x32 Version:  - Realore Studios)
Roma Surrectum Deutsch 1.1.0.5 (x32 Version: 1.1.0.5 - ecozone)
Roma Surrectum II 2.5 (x32 Version: 2.5 - Roma Surrectum Team)
Rome - Total War(TM) (x32 Version: 1.0 - Activision)
Rome - Total War(TM) (x32 Version: 1.0 - Activision) Hidden
Rome Total War - patch 1.3 (x32 Version: 1.3 - )
S4 League_EU (x32 Version: 1.00.0000 - )
Search Protect (x32 Version: 2.7.23.2 - Conduit) <==== ATTENTION
Security Task Manager 1.8g (x32 Version: 1.8g - Neuber Software)
SeeSimilar (x32 Version: 1.0.0.5 - SeeSimilar.com)
Sid Meier's Civilization IV Colonization (x32 Version: 1.00 - Firaxis Games)
Skype™ 6.11 (x32 Version: 6.11.102 - Skype Technologies S.A.)
Smite (x32 Version: 0.1.1850.0 - Hi-Rez Studios)
SOE Web Installer (HKCU Version: 1.0.3.171 - Sony Online Entertainment)
Sony Ericsson Update Engine (x32 Version: 2.13.6.201305161305 - Sony Ericsson Communications AB)
Sony PC Companion 2.10.181 (x32 Version: 2.10.181 - Sony)
Special Force 2  1.0 (x32 Version:  - )
Spotify (HKCU Version: 0.9.7.16.g4b197456 - Spotify AB)
Spotydl 0.9.36.0 (x32 Version: 0.9.36.0 - spotydl.com)
Spyware Doctor 8.0 (x32 Version: 8.0 - PC Tools)
Steam (x32 Version: 1.0.0.0 - Valve Corporation)
Stronghold 2 (x32 Version: 1.00 - Firefly Studios)
surf aand kEEp (x32 Version: 1.2.0.1049 - surif aand keep) <==== ATTENTION
Swords and Sandals 3 Multiplae Ultratus (x32 Version: 1.2.7 - 3rdsense Pty Ltd)
System Requirements Lab CYRI (x32 Version: 6.0.7.0 - Husdawg, LLC)
System Requirements Lab Detection (x32 Version: 1.0.5.0 - Husdawg, LLC)
System Requirements Lab for Intel (x32 Version: 4.5.13.0 - Husdawg, LLC)
TAP-Windows 9.9.2 (Version: 9.9.2 - )
TeamSpeak 3 Client (Version: 3.0.13.1 - TeamSpeak Systems GmbH)
The War Z version 1.0 (x32 Version: 1.0 - Arktos Entertainment Group LLC)
Tube Karaoke (x32 Version:  - Dacotta SoftEngineering)
Tunngle beta (x32 Version:  - Tunngle.net GmbH)
Turbo Key (x32 Version: 1.01.03 - )
Ubisoft Game Launcher (x32 Version: 1.0.0.0 - UBISOFT)
Update for Microsoft .NET Framework 4.5 (KB2750147) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4.5 (KB2805221) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4.5 (KB2805226) (x32 Version: 1 - Microsoft Corporation)
Vanguard: Saga of Heroes (x32 Version: 1.00.000 - Sigil Games Online)
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden
VIA Plattform-Geräte-Manager (x32 Version: 1.34 - VIA Technologies, Inc.)
Video downloader 2.0.0.433 (Version: 2.0.0.433 - Southstarco)
VirtualCloneDrive (x32 Version:  - Elaborate Bytes)
VLC media player 2.0.2 (x32 Version: 2.0.2 - VideoLAN)
VLC Media Player DB Toolbar Toolbar (x32 Version:  - )
War Thunder Launcher 1.0.1.278 (x32 Version:  - 2013 Gaijin Entertainment Corporation)
Wargame AirLand Battle (c) Focus Home Interactive version RLD! (x32 Version: RLD! - )
Winamp (x32 Version: 5.63  - Nullsoft, Inc)
Windows Live Communications Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 16.4.3505.0912 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4311.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Mobile Device Updater Component (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
WinRAR 4.00 (64-Bit) (Version: 4.00.0 - win.rar GmbH)
World of Tanks (x32 Version:  - Wargaming.net)
Xfire (remove only) (x32 Version:  - )
Xvid Video Codec (x32 Version: 1.3.2 - Xvid Team)
YGOPro DevPro Version 1.9.6 r0 (x32 Version: 1.9.6 r0 - YGOPro DevPro Online)
Yontoo 1.12.02 (Version: 1.12.02 - Yontoo LLC) <==== ATTENTION
YoutubeAdblocker (x32 Version: 2.3.0.1751 - YoutubeAdblocker) <==== ATTENTION
Zip Opener Packages (HKCU Version:  - ) <==== ATTENTION
Zune (Version: 04.08.2345.00 - Microsoft Corporation)
Zune (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (CHS) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (CHT) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (CSY) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (DAN) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (DEU) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (ELL) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (ESP) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (FIN) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (FRA) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (HUN) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (IND) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (ITA) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (JPN) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (KOR) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (MSL) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (NLD) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (NOR) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (PLK) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (PTB) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (PTG) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (RUS) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (SVE) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden

==================== Restore Points  =========================

04-02-2014 12:03:18 Windows-Sicherung
04-02-2014 12:09:33 Microsoft Visual C++ 2005 Redistributable (x64) wird installiert
04-02-2014 12:10:40 Installed League of Legends
04-02-2014 12:11:27 DirectX wurde installiert
04-02-2014 14:39:51 Windows-Sicherung
04-02-2014 16:41:35 Windows-Sicherung
04-02-2014 17:06:40 Windows-Sicherung
04-02-2014 18:20:49 Windows Defender Checkpoint
10-02-2014 16:09:55 Windows-Sicherung
11-02-2014 14:49:45 Windows Update
11-02-2014 15:28:55 Installed Java 7 Update 51
11-02-2014 15:33:50 avast! Free Antivirus Setup
11-02-2014 16:17:07 Norton_Power_Eraser_20140211171701336

==================== Hosts content: ==========================

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {07441F79-075D-46D1-9621-B4385A0413E1} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-10-18] (Google Inc.)
Task: {0ACDB7B0-58EC-44A5-B853-C74A95AB7C8B} - System32\Tasks\{350C38A0-1817-4215-9180-5D11686186E7} => C:\Program Files (x86)\Ubisoft\Related Designs\ANNO 2070\Anno5.exe [2011-11-26] ()
Task: {175BF8A3-9AD4-4F9A-B98B-598E8F706334} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-10-18] (Google Inc.)
Task: {2691ADFB-DB4E-45E7-9439-ACD0C99AA70D} - System32\Tasks\{B7AB28D8-B0B8-4B92-82A6-19F4C878FB44} => C:\Users\Public\Sony Online Entertainment\Installed Games\PlanetSide 2 PSG\LaunchPad.exe [2013-03-05] (Sony Online Entertainment)
Task: {278F70B7-06C4-4D40-B948-858B1C8E33C9} - System32\Tasks\Norton Internet Security\Norton Error Processor => C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\SymErr.exe [2013-08-01] (Symantec Corporation)
Task: {2B8021C3-95EB-4032-8827-F4F20FC80119} - System32\Tasks\{2AF4B969-DDA4-42BC-AC4D-0202126F86FA} => C:\Program Files (x86)\Ubisoft\Related Designs\ANNO 2070\Anno5.exe [2011-11-26] ()
Task: {2E3A57BD-04E8-453A-AE42-B25FECD4F834} - System32\Tasks\{B08B504C-C99F-4CA5-AB04-41F9856C1544} => C:\Program Files (x86)\American Conquest - Fight Back\dmcr.exe [2003-04-24] (-GSC-)
Task: {46983AB9-9DB0-4B15-9866-70EB3D8ED964} - System32\Tasks\Digital Sites => C:\Users\Pc\AppData\Roaming\DIGITA~1\UPDATE~1\UPDATE~1.EXE
Task: {4913A02B-EF24-4AAE-98AF-0834AF4DCD6F} - System32\Tasks\{BB6CE9F5-E484-406C-AD0E-5A4DC75E4283} => D:\support\DrvSetup.exe
Task: {742E0C46-1F1B-4465-9AFF-E499A0C68AA9} - System32\Tasks\ASUS\ASUS SIX Engine => C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe [2010-02-03] (ASUSTeK Computer Inc.)
Task: {78BBB10A-F364-4E92-8219-8439ED42836E} - System32\Tasks\PileFile reminder => C:\Users\Pc\AppData\Local\Temp\Rust ESP GOD SPAWN HackDownload_BE8D\Rust_ESP_GOD_SPAWN_Hack_Downloader.exe <==== ATTENTION
Task: {7F1E600F-A1FB-44A2-95B1-0A9CFB4AED02} - System32\Tasks\{BEE78D85-4CF3-4479-8433-33E17174DFEB} => C:\Program Files (x86)\American Conquest - Fight Back\dmcr.exe [2003-04-24] (-GSC-)
Task: {85F44FDF-4E73-4F08-858C-DC3F9505CFEB} - System32\Tasks\DSite => C:\Users\Pc\AppData\Roaming\DSite\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: {8BDCC15A-AFC6-4F6B-9A3E-2D7C1ACF8C54} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\WSCStub.exe [2013-10-08] (Symantec Corporation)
Task: {8EDAF150-B25F-4F96-8025-08EF10739F82} - System32\Tasks\{31CDF611-4FF3-4119-866C-074E0E880CD6} => D:\support\DrvSetup.exe
Task: {8EDF384F-376F-4AB7-BA38-D81A4DAC2105} - System32\Tasks\DealPly => C:\Users\Pc\AppData\Roaming\DealPly\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: {981EBD38-9CF4-43D6-917F-8EFD65DC3C76} - System32\Tasks\{59A28418-2F35-48CC-8491-DB29133B4A07} => C:\Program Files (x86)\Ubisoft\Related Designs\ANNO 2070\Anno5.exe [2011-11-26] ()
Task: {99E34A15-E072-4951-88AF-47AFBAFFADE7} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {9F055FC0-CA38-4918-A35F-E6909C3003BB} - System32\Tasks\{0CA4769F-3858-49F3-9E24-950045D22EC6} => D:\support\DrvSetup.exe
Task: {9FE6EAD7-A7CA-4ADC-BDE3-78CA35F5CD32} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-02-07] (Adobe Systems Incorporated)
Task: {ADB9BBC4-A3DA-49FF-A644-3E893812D24D} - System32\Tasks\PileFile logon => C:\Users\Pc\AppData\Local\Temp\Rust ESP GOD SPAWN HackDownload_BE8D\Rust_ESP_GOD_SPAWN_Hack_Downloader.exe <==== ATTENTION
Task: {B2D48DE0-F4A7-42F9-816C-1AC56B1A8872} - System32\Tasks\DealPlyUpdate => C:\Program
Task: {B5285F3B-D7AF-45AE-9F2E-1BB7DBCFE22C} - System32\Tasks\EPUpdater => C:\Users\Pc\AppData\Roaming\BABSOL~1\Shared\BabMaint.exe <==== ATTENTION
Task: {B7F72847-9DC9-4BB9-83F3-9AADE971AD15} - System32\Tasks\ASUS\ASUS RegRun Loader => C:\Program Files (x86)\ASUS\AASP\1.01.12\AsLoader.exe [2010-01-14] (ASUSTeK Computer Inc.)
Task: {BDAE8D31-C31A-436B-B816-F52EBF6947BA} - System32\Tasks\{69E6A0E4-9323-4511-9F4D-F69A398016E0} => D:\support\DrvSetup.exe
Task: {BE8F4974-67DF-4139-8246-206804A585FD} - System32\Tasks\{0C835611-E4AA-47E2-B53B-38A3543F30E8} => C:\Program Files (x86)\Cossacks - Back To War\dmcr.exe
Task: {C68FBEF9-502F-4103-B36B-27B4CDCDDD95} - System32\Tasks\{DA870EE4-507F-42F9-9DFB-BB41BD1ACED8} => C:\Program Files (x86)\American Conquest - Fight Back\dmcr.exe [2003-04-24] (-GSC-)
Task: {CA19F92B-7524-4334-B5E5-3F47A5A3A453} - System32\Tasks\ASUS\Cpu Level Up Hook Lanunch => C:\Program Files\ASUS\Ai Suite\CpuLevelUpHookLaunch.exe [2009-12-28] ()
Task: {D57D1710-AB16-40CD-A68E-A83485C47529} - System32\Tasks\{C02B44A9-7C7F-4B5E-87FD-8BFE74268C40} => C:\Program Files (x86)\American Conquest - Fight Back\dmcr.exe [2003-04-24] (-GSC-)
Task: {EB55C353-1ABB-4AFA-91C2-31D786524836} - System32\Tasks\Norton Internet Security\Norton Error Analyzer => C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\SymErr.exe [2013-08-01] (Symantec Corporation)
Task: {F04B063C-0CD8-4D1E-941D-A30B17FF7A50} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-12-17] (Piriform Ltd)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\Digital Sites.job => C:\Users\Pc\AppData\Roaming\DIGITA~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: C:\Windows\Tasks\DSite.job => C:\Users\Pc\AppData\Roaming\DSite\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2013-11-01 06:31 - 2013-11-01 06:31 - 02329928 _____ () C:\Users\Pc\AppData\Local\Pokki\ocdeskband_0.dll
2011-04-11 04:34 - 2011-04-11 04:34 - 00003584 _____ () C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.94.193\LogicNP.PropSheetExtensionHelper_x64.dll
2011-05-10 01:56 - 2011-03-02 11:40 - 00164864 _____ () C:\Program Files\WinRAR\rarext.dll
2012-10-18 00:42 - 2009-03-19 21:35 - 00208896 _____ () C:\Program Files (x86)\ASUS\EPU-4 Engine\AiNap.dll
2012-10-18 00:42 - 2009-03-19 21:35 - 00008704 _____ () C:\Program Files (x86)\ASUS\EPU-4 Engine\vvc.dll
2012-10-18 00:42 - 2009-01-15 13:55 - 00565248 _____ () C:\Program Files (x86)\ASUS\EPU-4 Engine\pngio.dll
2012-10-18 00:42 - 2009-03-25 15:53 - 00053248 _____ () C:\Program Files (x86)\ASUS\EPU-4 Engine\AsSpindownTimeout.dll
2009-12-15 16:40 - 2009-12-15 16:40 - 00065536 _____ () C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe
2009-12-15 22:44 - 2009-12-15 22:44 - 00516096 _____ () C:\Program Files (x86)\AMD\RAIDXpert\bin\libxml2.dll
2013-08-18 17:42 - 2014-01-24 22:17 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2014-02-11 17:54 - 2011-09-01 14:50 - 00157656 _____ () C:\Program Files (x86)\PC Tools Security\NetworkLayer\PCTCFHook.dll
2014-02-11 17:54 - 2011-09-01 14:50 - 00091608 _____ () C:\Program Files (x86)\PC Tools Security\avengine\sdkBSCtrl.dll
2014-02-11 17:54 - 2011-09-01 14:51 - 01394648 _____ () C:\Program Files (x86)\PC Tools Security\UserModeFileCache.dll
2009-12-15 16:40 - 2009-12-15 16:40 - 00122880 _____ () C:\Windows\SysWOW64\WinMsgBalloonServer.exe
2009-12-15 16:41 - 2009-12-15 16:41 - 00139264 _____ () C:\Windows\SysWOW64\WinMsgBalloonClient.exe
2012-10-18 00:33 - 2009-04-29 13:24 - 00253952 _____ () C:\Program Files\ASUS\Turbo Key\pngio.dll
2012-10-18 00:33 - 2009-04-29 13:24 - 00208896 _____ () C:\Program Files\ASUS\Turbo Key\AiNap.dll
2012-10-18 00:33 - 2009-04-29 13:24 - 00008704 _____ () C:\Program Files\ASUS\Turbo Key\vvc.dll
2013-09-07 03:11 - 2013-09-07 03:11 - 00569856 _____ () C:\Users\Pc\AppData\Local\Pokki\Engine\ppGoogleNaClPluginChrome.dll
2013-09-07 03:11 - 2013-09-07 03:11 - 01400846 _____ () C:\Users\Pc\AppData\Local\Pokki\Engine\avcodec-54.dll
2013-09-07 03:11 - 2013-09-07 03:11 - 00151054 _____ () C:\Users\Pc\AppData\Local\Pokki\Engine\avutil-51.dll
2013-09-07 03:11 - 2013-09-07 03:11 - 00222734 _____ () C:\Users\Pc\AppData\Local\Pokki\Engine\avformat-54.dll
2013-12-20 11:56 - 2013-12-20 11:56 - 03559024 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2011-04-07 20:54 - 2011-04-07 20:54 - 00239720 _____ () C:\Program Files (x86)\NVIDIA Corporation\3D Vision\Nv3DVStreaming.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\ProgramData\TEMP:373E1720
AlternateDataStreams: C:\ProgramData\TEMP:430C6D84
AlternateDataStreams: C:\ProgramData\TEMP:DFC5A2B2

==================== Safe Mode (whitelisted) ===================


==================== Disabled items from MSCONFIG ==============

MSCONFIG\Services: AdobeARMservice => 2
MSCONFIG\Services: McComponentHostService => 3
MSCONFIG\Services: Nero BackItUp Scheduler 4.0 => 2
MSCONFIG\Services: Sony PC Companion => 3
MSCONFIG\Services: TunngleService => 3
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk => C:\Windows\pss\McAfee Security Scan Plus.lnk.CommonStartup
MSCONFIG\startupfolder: C:^Users^Pc^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^GamersFirst LIVE!.lnk => C:\Windows\pss\GamersFirst LIVE!.lnk.Startup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
MSCONFIG\startupreg: Aeria Ignite => "C:\Program Files (x86)\Aeria Games\Ignite\aeriaignite.exe" silent
MSCONFIG\startupreg: ASUSWebStorage => C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.94.193\AsusWSPanel.exe /S
MSCONFIG\startupreg: cefbaeacdccceasacfsfdsf => "C:\ProgramData\cefbaeacdccceasacfsfdsf.exe"
MSCONFIG\startupreg: DAEMON Tools Lite => "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
MSCONFIG\startupreg: DivXMediaServer => C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe
MSCONFIG\startupreg: GoogleDriveSync => "C:\Program Files (x86)\Google\Drive\googledrivesync.exe" /autostart
MSCONFIG\startupreg: HDAudDeck => C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe -r
MSCONFIG\startupreg: ISUSPM => "C:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
MSCONFIG\startupreg: LogitechSoftwareUpdate => "C:\Program Files (x86)\Logitech\Video\ManifestEngine.exe" boot
MSCONFIG\startupreg: LogitechVideoRepair => C:\Program Files (x86)\Logitech\Video\ISStart.exe /RegAll
MSCONFIG\startupreg: LogitechVideoTray => C:\Program Files (x86)\Logitech\Video\LogiTray.exe
MSCONFIG\startupreg: Pokki => C:\Windows\system32\rundll32.exe "%LOCALAPPDATA%\Pokki\Engine\Launcher.dll",RunLaunchPlatform
MSCONFIG\startupreg: PrivitizeVPN => C:\Program Files (x86)\PrivitizeVPN\PrivitizeVPN.exe /autorun
MSCONFIG\startupreg: QtraxNotification => C:\Users\Pc\Qtrax\Player\Notification.exe
MSCONFIG\startupreg: Skype => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
MSCONFIG\startupreg: Sony PC Companion => "C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe" /Background
MSCONFIG\startupreg: Spotify => "C:\Users\Pc\AppData\Roaming\Spotify\Spotify.exe" /uri spotify:autostart
MSCONFIG\startupreg: Spotify Web Helper => "C:\Users\Pc\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"
MSCONFIG\startupreg: StartCCC => "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe" MSRun
MSCONFIG\startupreg: Steam => "C:\Program Files (x86)\Steam\Steam.exe" -silent
MSCONFIG\startupreg: swg => "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
MSCONFIG\startupreg: uTorrent => "C:\Users\Pc\AppData\Roaming\uTorrent\uTorrent.exe"  /MINIMIZED
MSCONFIG\startupreg: VirtualCloneDrive => "C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
MSCONFIG\startupreg: vProt => "C:\Program Files (x86)\AVG SafeGuard toolbar\vprot.exe"
MSCONFIG\startupreg: Xvid => C:\Program Files (x86)\Xvid\CheckUpdate.exe
MSCONFIG\startupreg: Zune Launcher => "C:\Program Files\Zune\ZuneLauncher.exe"

==================== Faulty Device Manager Devices =============

Name: TAP-Win32 Adapter V9 (Tunngle)
Description: TAP-Win32 Adapter V9 (Tunngle)
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: TAP-Win32 Provider V9 (Tunngle)
Service: tap0901t
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: PC Tools Data Store
Description: PC Tools Data Store
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer: 
Service: pctDS
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.


==================== Event log errors: =========================

Application errors:
==================
Error: (02/11/2014 05:48:58 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (02/11/2014 03:43:11 PM) (Source: Software Protection Platform Service) (User: )
Description: Fehler bei der Lizenzaktivierung (slui.exe). Fehlercode:
0x80080005

Error: (02/05/2014 01:05:13 PM) (Source: Application Hang) (User: )
Description: Programm Infestation.exe, Version 0.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 105c

Startzeit: 01cf22667e20cc8f

Endzeit: 281

Anwendungspfad: C:\Program Files (x86)\Steam\steamapps\common\The War Z\Infestation.exe

Berichts-ID:

Error: (02/05/2014 10:07:05 AM) (Source: Winlogon) (User: )
Description: Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.

Error: (02/04/2014 10:22:24 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4
Name des fehlerhaften Moduls: wwanapi.dll, Version: 6.1.7600.16385, Zeitstempel: 0x4a5be0a8
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000000333eb
ID des fehlerhaften Prozesses: 0x714
Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0
Pfad der fehlerhaften Anwendung: Explorer.EXE1
Pfad des fehlerhaften Moduls: Explorer.EXE2
Berichtskennung: Explorer.EXE3

Error: (02/04/2014 10:15:34 PM) (Source: Winlogon) (User: )
Description: Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.

Error: (02/04/2014 07:20:49 PM) (Source: VSS) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.


Vorgang:
   Generatordaten werden gesammelt

Kontext:
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {eb0c23e6-5da4-4c15-af73-54cfc9bff500}

Error: (02/04/2014 06:07:56 PM) (Source: Application Hang) (User: )
Description: Programm firefox.exe, Version 26.0.0.5087 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 978

Startzeit: 01cf21cb7fe36447

Endzeit: 62

Anwendungspfad: C:\Program Files (x86)\Mozilla Firefox\firefox.exe

Berichts-ID: e06d2591-8dbe-11e3-badf-3085a94266a8

Error: (02/04/2014 06:06:17 PM) (Source: Windows Backup) (User: )
Description: Die Sicherung war nicht erfolgreich. Fehler: "Der RPC-Server ist nicht verfügbar. (0x800706BA)"

Error: (02/04/2014 05:33:07 PM) (Source: Winlogon) (User: )
Description: Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.


System errors:
=============
Error: (02/11/2014 09:44:08 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Automatische WLAN-Konfiguration" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (02/11/2014 09:44:08 PM) (Source: Service Control Manager) (User: )
Description: Dienst "Diagnosesystemhost" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (02/11/2014 09:44:08 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Sitzungs-Manager für Desktopfenster-Manager" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (02/11/2014 09:44:08 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Überwachung verteilter Verknüpfungen (Client)" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (02/11/2014 09:44:08 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Superfetch" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (02/11/2014 09:44:08 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Programmkompatibilitäts-Assistent-Dienst" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (02/11/2014 09:44:08 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Netzwerkverbindungen" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 100 Millisekunden durchgeführt: Neustart des Diensts.

Error: (02/11/2014 09:44:08 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Zugriff auf Eingabegeräte" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (02/11/2014 09:44:08 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Offlinedateien" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (02/11/2014 09:44:08 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows-Audio-Endpunkterstellung" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.


Microsoft Office Sessions:
=========================
Error: (02/11/2014 05:48:58 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Pc\Downloads\SoftonicDownloader_fuer_pc-tools-spyware-doctor-mit-antivirus-2011.exe

Error: (02/11/2014 03:43:11 PM) (Source: Software Protection Platform Service)(User: )
Description: 0x80080005

Error: (02/05/2014 01:05:13 PM) (Source: Application Hang)(User: )
Description: Infestation.exe0.0.0.0105c01cf22667e20cc8f281C:\Program Files (x86)\Steam\steamapps\common\The War Z\Infestation.exe

Error: (02/05/2014 10:07:05 AM) (Source: Winlogon)(User: )
Description: 0x800700050x00000000

Error: (02/04/2014 10:22:24 PM) (Source: Application Error)(User: )
Description: Explorer.EXE6.1.7601.175674d672ee4wwanapi.dll6.1.7600.163854a5be0a8c000000500000000000333eb71401cf21ee3eb25316C:\Windows\Explorer.EXEC:\Windows\system32\wwanapi.dll70658b1d-8de2-11e3-bd0b-3085a94266a8

Error: (02/04/2014 10:15:34 PM) (Source: Winlogon)(User: )
Description: 0x800700050x00000000

Error: (02/04/2014 07:20:49 PM) (Source: VSS)(User: )
Description: 0x80070005, Zugriff verweigert


Vorgang:
   Generatordaten werden gesammelt

Kontext:
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {eb0c23e6-5da4-4c15-af73-54cfc9bff500}

Error: (02/04/2014 06:07:56 PM) (Source: Application Hang)(User: )
Description: firefox.exe26.0.0.508797801cf21cb7fe3644762C:\Program Files (x86)\Mozilla Firefox\firefox.exee06d2591-8dbe-11e3-badf-3085a94266a8

Error: (02/04/2014 06:06:17 PM) (Source: Windows Backup)(User: )
Description: Der RPC-Server ist nicht verfügbar. (0x800706BA)

Error: (02/04/2014 05:33:07 PM) (Source: Winlogon)(User: )
Description: 0x800700050x00000000


CodeIntegrity Errors:
===================================
  Date: 2014-02-11 21:35:50.012
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-02-11 21:35:49.887
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-02-11 21:35:16.487
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\atksgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-02-11 21:35:16.378
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\atksgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-02-11 17:29:57.547
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-02-11 17:29:57.438
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-02-11 17:29:25.599
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\atksgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-02-11 17:29:25.489
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\atksgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-02-11 16:57:44.864
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-02-11 16:57:44.755
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info =========================== 

Percentage of memory in use: 43%
Total physical RAM: 8174.12 MB
Available physical RAM: 4613.23 MB
Total Pagefile: 16346.41 MB
Available Pagefile: 12342.45 MB
Total Virtual: 8192 MB
Available Virtual: 8191.78 MB

==================== Drives ================================

Drive c: (Windows7) (Fixed) (Total:931.41 GB) (Free:261.45 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 85EAEEE9)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=931 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

FRST.txt


FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 10-02-2014 01
Ran by Pc (administrator) on PC-PC on 11-02-2014 22:27:43
Running from C:\Users\Pc\Desktop
Windows 7 Enterprise Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal


==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe
(AMD) C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe
() C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler64.exe
(Threat Expert Ltd.) C:\Program Files (x86)\PC Tools Security\BDT\BDTUpdateService.exe
(Hi-Rez Studios) C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(PC Tools) C:\Program Files (x86)\PC Tools Security\pctsAuxs.exe
(PC Tools) C:\Program Files (x86)\PC Tools Security\pctsSvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
(CyberGhost S.R.L) C:\Program Files\CyberGhost 5\Service.exe
() C:\Windows\SysWOW64\WinMsgBalloonServer.exe
() C:\Windows\SysWOW64\WinMsgBalloonClient.exe
(Pokki) C:\Users\Pc\AppData\Local\Pokki\Engine\pokki.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraMD.exe
(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe
(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraMD64.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe
(ASUSTeK Computer Inc.) C:\Program Files\ASUS\Turbo Key\TurboKey.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(PC Tools) C:\Program Files (x86)\PC Tools Security\pctsGui.exe
(Threat Expert Ltd.) C:\Program Files (x86)\PC Tools Security\BDT\FGuard.exe
(Microsoft Corporation) C:\Windows\system32\taskmgr.exe
(AutoIt Team) C:\Users\Pc\cc4j5zs76kd2kj\SQeUDVpi.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
(Pokki) C:\Users\Pc\AppData\Local\Pokki\Engine\pokki.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Pokki) C:\Users\Pc\AppData\Local\Pokki\Engine\pokki.exe
(PC Tools) C:\Program Files (x86)\PC Tools Security\upgrade.exe
(Microsoft Corporation) C:\Windows\system32\AUDIODG.EXE


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7560296 2011-12-12] (Realtek Semiconductor)
HKLM-x32\...\Run: [NUSB3MON] - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [Cpu Level Up help] - C:\Program Files\ASUS\Ai Suite\CpuLevelUpHelp.exe [887936 2009-12-28] ()
HKLM-x32\...\Run: [Turbo Key] - C:\Program Files\ASUS\Turbo Key\TurboKey.exe [1874432 2009-11-24] (ASUSTeK Computer Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [ISTray] - C:\Program Files (x86)\PC Tools Security\pctsGui.exe [1600984 2011-09-01] (PC Tools)
HKLM-x32\...\Run: [PCTools FGuard] - C:\Program Files (x86)\PC Tools Security\BDT\FGuard.exe [247760 2011-09-01] (Threat Expert Ltd.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [TaskbarNoNotification] 0
HKLM\...\Policies\Explorer: [HideSCAHealth] 0
HKU\.DEFAULT\...\Policies\Explorer: [TaskbarNoNotification] 0
HKU\.DEFAULT\...\Policies\Explorer: [HideSCAHealth] 0
HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Run: [Akamai NetSession Interface] - "C:\Users\Pc\AppData\Local\Akamai\netsession_win.exe"
HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Run: [HydraVisionMDEngine] - C:\Program Files (x86)\ATI Technologies\HydraVision\HydraMD.exe [569344 2011-07-07] (AMD)
HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Run: [HydraVisionDesktopManager] - C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe [393216 2011-07-07] (AMD)
HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Run: [Load] - C:\Users\Pc\AppData\Roaming\vbc.exe [1169224 2010-11-05] (Microsoft Corporation)
HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Run: [Wcenter] - C:\Users\Pc\AppData\Roaming\Microsoft\Wcenter34.exe [32768 2010-11-05] (Microsoft Corporation)
HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\RunOnce: [cc4j5zs76kd2kj] - C:\Users\Pc\cc4j5zs76kd2kj\92050.vbs [190 2014-02-11] ()
HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Policies\system: [DisableTaskMgr] 1
HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Policies\Explorer: [TaskbarNoNotification] 0
HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Policies\Explorer: [HideSCAHealth] 0
HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Policies\Explorer: [NoFolderOptions] 1
HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\MountPoints2: {045dbeba-7158-11e3-9483-3085a94266a8} - E:\setup.exe
HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\MountPoints2: {2549caac-7476-11e2-9477-3085a94266a8} - H:\Startme.exe
AppInit_DLLs-x32: c:\progra~2\searchprotect\searchprotect\bin\spvc32loader.dll => File Not Found
AppInit_DLLs-x32: c:\progra~2\gs-ena~1\browsafe.dll => File Not Found
Startup: C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk
ShortcutTarget: start.lnk -> C:\Users\Pc\cc4j5zs76kd2kj\92050.vbs ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xEA5B1E2628BDCD01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
URLSearchHook: ATTENTION ==> Default URLSearchHook is missing.
URLSearchHook: HKCU - ToolbarURLSearchHook Class - {CA3EB689-8F09-4026-AA10-B9534C691CE0} - C:\Program Files (x86)\VLC Media Player DB Toolbar Toolbar\tbhelper.dll ()
URLSearchHook: HKCU - PC Tools Browser Guard - {472734EA-242A-422b-ADF8-83D1E48CC825} - C:\Program Files (x86)\PC Tools Security\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
SearchScopes: HKLM-x32 - DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 
SearchScopes: HKCU - DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/Results.aspx?ctid=CT3312375&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=2&UP=SP09C9C74C-9231-4E89-8648-D5B7D174D75E&q={searchTerms}
SearchScopes: HKCU - ToolbarSearchProviderProgress {96bd48dd-741b-41ae-ac4a-aff96ba00f7e}
SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=QuickObrw&dpid=QuickObrw&co=DE&userid=f0e6090c-d942-4ce4-94f4-095b9a73bb7a&searchtype=ds&q={searchTerms}&installDate=07/04/2013
SearchScopes: HKCU - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/Results.aspx?ctid=CT3312375&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=2&UP=SP09C9C74C-9231-4E89-8648-D5B7D174D75E&q={searchTerms}
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www.holasearch.com/?q={searchTerms}&babsrc=SP_ss&mntrId=289500240103DCA8&affID=121963&tsp=4980
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 
BHO: FuNDeaulls - {4CEECF2F-7433-3E1D-4954-FE2A3682FC20} - C:\ProgramData\FuNDeaulls\DD2qL.x64.dll No File
BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine64\21.1.0.18\coIEPlg.dll (Symantec Corporation)
BHO: 50Coeuupons - {A257D1AE-C8F9-32E7-03CF-8F68563FB5A4} - C:\ProgramData\50Coeuupons\gKoa.x64.dll No File
BHO-x32: PC Tools Browser Guard BHO - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Program Files (x86)\PC Tools Security\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\coIEPlg.dll (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\IPS\IPSBHO.DLL (Symantec Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine64\21.1.0.18\coIEPlg.dll (Symantec Corporation)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\coIEPlg.dll (Symantec Corporation)
Toolbar: HKLM-x32 - PC Tools Browser Guard - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files (x86)\PC Tools Security\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKCU - No Name - {338B4DFE-2E2C-4338-9E41-E176D497299E} -  No File
DPF: HKLM-x32 {E6F480FC-BD44-4CBA-B74A-89AF7842937D} hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.5.1.0.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler-x32: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\15.0.0\ViProtocol.dll No File
Winsock: Catalog9 01 C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp.dll [329688] (PC Tools Research Pty Ltd.)
Winsock: Catalog9 02 C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp.dll [329688] (PC Tools Research Pty Ltd.)
Winsock: Catalog9 03 C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp.dll [329688] (PC Tools Research Pty Ltd.)
Winsock: Catalog9 04 C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp.dll [329688] (PC Tools Research Pty Ltd.)
Winsock: Catalog9 05 C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp.dll [329688] (PC Tools Research Pty Ltd.)
Winsock: Catalog9 06 C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp.dll [329688] (PC Tools Research Pty Ltd.)
Winsock: Catalog9 18 C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp.dll [329688] (PC Tools Research Pty Ltd.)
Winsock: Catalog9-x64 01 C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp64.dll [447960] (PC Tools Research Pty Ltd.)
Winsock: Catalog9-x64 02 C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp64.dll [447960] (PC Tools Research Pty Ltd.)
Winsock: Catalog9-x64 03 C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp64.dll [447960] (PC Tools Research Pty Ltd.)
Winsock: Catalog9-x64 04 C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp64.dll [447960] (PC Tools Research Pty Ltd.)
Winsock: Catalog9-x64 05 C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp64.dll [447960] (PC Tools Research Pty Ltd.)
Winsock: Catalog9-x64 06 C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp64.dll [447960] (PC Tools Research Pty Ltd.)
Winsock: Catalog9-x64 18 C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp64.dll [447960] (PC Tools Research Pty Ltd.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566
FF user.js: detected! => C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\user.js
FF NewTab: hxxp://search.conduit.com/?ctid=CT3312375&octid=EB_ORIGINAL_CTID&SearchSource=69&CUI=&SSPV=EB_SSPV&Lay=1&UM=2&UP=SP09C9C74C-9231-4E89-8648-D5B7D174D75E
FF Homepage: hxxp://www.google.de/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_43.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_44.dll ()
FF Plugin-x32: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin - C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\15.0.0\\npsitesafety.dll No File
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.130\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @soe.sony.com/installer,version=1.0.3 - C:\Users\Pc\AppData\LocalLow\Sony Online Entertainment\npsoe.dll ()
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin HKCU: pokki.com/PokkiDownloadHelper - C:\Users\Pc\AppData\Local\Pokki\Download Helper\npPokkiDownloadHelper.1.2.0.78.dll (Pokki)
FF Plugin HKCU: thehappycloud.com/HappyCloudPlugin - C:\ProgramData\HappyCloud\Application\npHappyCloudPlugin.dll (The Happy Cloud)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\searchplugins\conduit-search.xml
FF SearchPlugin: C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\searchplugins\ividi.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Adblock Plus - C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-01-03]
FF HKLM\...\Firefox\Extensions: [{77BEC163-D389-42c1-91A4-C758846296A5}] - C:\Program Files\Video downloader\Firefox
FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\IPSFF
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\IPSFF [2014-02-11]
FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\coFFPlgn\
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\coFFPlgn\ []
FF HKLM-x32\...\Firefox\Extensions: [{cb84136f-9c44-433a-9048-c5cd9df1dc16}] - C:\Program Files (x86)\PC Tools Security\BDT\Firefox\
FF Extension: Browser Defender Toolbar - C:\Program Files (x86)\PC Tools Security\BDT\Firefox\ []
FF HKCU\...\Firefox\Extensions: [lyricsmonkey@mendoni.net] - C:\Program Files (x86)\LyricsMonkey\FF\
FF HKCU\...\Firefox\Extensions: [YTKaraoke@DacSoft.org] - C:\Program Files (x86)\YTKaraoke\FF\

Chrome: 
=======
CHR HomePage: hxxp://search.conduit.com/?ctid=CT3312375&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=2&UP=SP09C9C74C-9231-4E89-8648-D5B7D174D75E
CHR RestoreOnStartup: "hxxp://search.conduit.com/?ctid=CT3312375&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=2&UP=SP09C9C74C-9231-4E89-8648-D5B7D174D75E"
CHR DefaultSearchKeyword: conduit.search
CHR DefaultSearchProvider: Conduit Search
CHR DefaultSearchURL: hxxp://search.conduit.com/Results.aspx?ctid=CT3312375&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=2&UP=SP09C9C74C-9231-4E89-8648-D5B7D174D75E&q={searchTerms}
CHR DefaultNewTabURL: 
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 7 U25) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
CHR Plugin: (Pando Web Plugin) - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
CHR Plugin: (VLC Web Plugin) - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
CHR Plugin: (Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Happy Cloud Plugin) - C:\ProgramData\HappyCloud\Application\npHappyCloudPlugin.dll (The Happy Cloud)
CHR Plugin: (SOE Web Installer) - C:\Users\Pc\AppData\LocalLow\Sony Online Entertainment\npsoe.dll ()
CHR Plugin: (Pokki Download Helper) - C:\Users\Pc\AppData\Local\Pokki\Download Helper\npPokkiDownloadHelper.1.2.0.78.dll (Pokki)
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll No File
CHR Plugin: (Java Deployment Toolkit 7.0.250.17) - C:\Windows\SysWOW64\npDeployJava1.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll No File
CHR Extension: (FuNDeaulls) - C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\eimkiigpdkahjnigfhahhebfencphpll [2013-12-31]
CHR Extension: (Coupons Malibu) - C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\hnofepcmbghfcimfbjicplikedjcnalm [2013-09-03]
CHR Extension: (BargainJoy) - C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\khongjfjjmklggionajlpjcpmnppdace [2013-09-09]
CHR Extension: (Google Wallet) - C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-31]
CHR Extension: (50Coeuupons) - C:\ProgramData\cfcjpjohfcdpkpkiobmplajfgaafdgpb [2013-12-31]
CHR HKLM\...\Chrome\Extension: [bmobdmpfgfimbnmhhnkmmecdboblafdh] - C:\Users\Pc\AppData\Local\BazaarFriend.crx [2013-07-29]
CHR HKLM\...\Chrome\Extension: [hnofepcmbghfcimfbjicplikedjcnalm] - C:\Users\Pc\AppData\Local\CouponsMalibu.crx [2013-09-03]
CHR HKLM\...\Chrome\Extension: [khongjfjjmklggionajlpjcpmnppdace] - C:\Users\Pc\AppData\Local\BargainJoy.crx [2013-09-08]
CHR HKCU\...\Chrome\Extension: [bmobdmpfgfimbnmhhnkmmecdboblafdh] - C:\Users\Pc\AppData\Local\BazaarFriend.crx [2013-07-29]
CHR HKCU\...\Chrome\Extension: [hnofepcmbghfcimfbjicplikedjcnalm] - C:\Users\Pc\AppData\Local\CouponsMalibu.crx [2013-09-03]
CHR HKCU\...\Chrome\Extension: [khongjfjjmklggionajlpjcpmnppdace] - C:\Users\Pc\AppData\Local\BargainJoy.crx [2013-09-08]
CHR HKCU\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Users\Pc\AppData\Roaming\DVDVideoSoft\DVDVideoSoftBrowserExtension.crx [2012-11-09]
CHR HKLM-x32\...\Chrome\Extension: [bmobdmpfgfimbnmhhnkmmecdboblafdh] - C:\Users\Pc\AppData\Local\BazaarFriend.crx [2013-07-29]
CHR HKLM-x32\...\Chrome\Extension: [fmfnfnpmhcllokmkepffndflpnadjmma] - C:\Program Files (x86)\DealPly\DealPly.crx [2013-07-29]
CHR HKLM-x32\...\Chrome\Extension: [hnofepcmbghfcimfbjicplikedjcnalm] - C:\Users\Pc\AppData\Local\CouponsMalibu.crx [2013-09-03]
CHR HKLM-x32\...\Chrome\Extension: [jpmbfleldcgkldadpdinhjjopdfpjfjp] - C:\Users\Pc\AppData\Local\Wajam\Chrome\wajam.crx [2012-07-26]
CHR HKLM-x32\...\Chrome\Extension: [khialnikbocfgkohdegnebhmmaifoglp] - C:\Program Files (x86)\LyricsMonkey\Chrome.crx [2012-07-26]
CHR HKLM-x32\...\Chrome\Extension: [khongjfjjmklggionajlpjcpmnppdace] - C:\Users\Pc\AppData\Local\BargainJoy.crx [2013-09-08]
CHR HKLM-x32\...\Chrome\Extension: [lgnhgbflngpggpmpfdkhmhmfdophhepe] - C:\Program Files (x86)\YTKaraoke\Chrome.crx [2013-09-08]
CHR HKLM-x32\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\Exts\Chrome.crx [2014-02-11]
CHR HKLM-x32\...\Chrome\Extension: [niapdbllcanepiiimjjndipklodoedlc] - C:\Program Files (x86)\Yontoo\YontooLayers.crx [2013-02-10]
CHR HKLM-x32\...\Chrome\Extension: [pggagllhehfjjfgnfnfkjedjlmbchamf] - C:\Users\Pc\AppData\Roaming\SeeSimilar\SeeSimilar.crx [2013-06-20]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

R2 Akamai; c:\program files (x86)\common files\akamai/netsession_win_8fa3539.dll [4569856 2013-07-01] (Akamai Technologies, Inc.)
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2013-12-06] (Advanced Micro Devices, Inc.)
R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [96896 2009-12-29] (ASUSTeK Computer Inc.)
R2 Browser Defender Update Service; C:\Program Files (x86)\PC Tools Security\BDT\BDTUpdateService.exe [337872 2011-09-01] (Threat Expert Ltd.)
R2 CGVPNCliService; C:\Program Files\CyberGhost 5\Service.exe [64112 2014-01-16] (CyberGhost S.R.L)
R2 ForceWare Intelligent Application Manager (IAM); C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe [496232 2010-01-21] ()
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S4 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe [288776 2013-09-06] (McAfee, Inc.)
S2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\NIS.exe [275696 2013-10-08] (Symantec Corporation)
S3 npggsvc; C:\Windows\SysWOW64\GameMon.des [4521720 2012-09-26] (INCA Internet Co., Ltd.)
R2 nSvcIp; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe [209000 2010-01-21] ()
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2014-01-24] ()
R2 sdAuxService; C:\Program Files (x86)\PC Tools Security\pctsAuxs.exe [371472 2011-02-18] (PC Tools)
R2 sdCoreService; C:\Program Files (x86)\PC Tools Security\pctsSvc.exe [1117144 2011-09-01] (PC Tools)
S4 TunngleService; C:\Program Files (x86)\Tunngle\TnglCtrl.exe [745368 2012-11-26] (Tunngle.net GmbH)
S3 ArcService; C:\Users\Pc\Desktop\ArcService.exe [X]
S2 e81a9dc1; "C:\Windows\system32\rundll32.exe" "c:\progra~2\gs-ena~1\BrowsafeSvc.dll",service
S2 vToolbarUpdater15.0.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.0.0\ToolbarUpdater.exe [X]

==================== Drivers (Whitelisted) ====================

R2 AODDriver4.2.0; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [59648 2013-09-19] (Advanced Micro Devices)
R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2010-08-25] ()
R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [13368 2009-07-07] ()
S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [303616 2013-05-13] ()
R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [39768 2013-04-14] (AVG Technologies)
R1 BHDrvx64; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\BASHDefs\20140121.001\BHDrvx64.sys [1526488 2014-01-21] (Symantec Corporation)
R1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1501000.012\ccSetx64.sys [162392 2013-09-26] (Symantec Corporation)
S3 cpudrv64; C:\Program Files (x86)\SystemRequirementsLab\cpudrv64.sys [17864 2011-06-02] ()
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2013-12-30] (Disc Soft Ltd)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2014-02-11] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [137648 2014-02-11] (Symantec Corporation)
R3 hxctlflt; C:\Windows\System32\Drivers\hxctlflt.sys [111104 2009-02-08] (Guillemot Corporation)
R1 IDSVia64; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\IPSDefs\20140209.002\IDSvia64.sys [521944 2014-02-09] (Symantec Corporation)
S2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [35328 2013-05-13] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-16] ()
R3 NAVENG; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\VirusDefs\20140211.003\ENG64.SYS [126040 2014-02-11] (Symantec Corporation)
R3 NAVEX15; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\VirusDefs\20140211.003\EX64.SYS [2099288 2014-02-11] (Symantec Corporation)
R0 PCTCore; C:\Windows\System32\drivers\PCTCore64.sys [360696 2011-08-23] (PC Tools)
R0 pctDS; C:\Windows\System32\drivers\pctDS64.sys [452872 2010-06-29] (PC Tools)
R0 pctEFA; C:\Windows\System32\drivers\pctEFA64.sys [816016 2010-07-16] (PC Tools)
R1 PCTSD; C:\Windows\System32\Drivers\PCTSD64.sys [228392 2011-08-18] (PC Tools)
S3 RT73; C:\Windows\System32\DRIVERS\Dr71WU.sys [610816 2008-01-16] (Ralink Technology, Corp.)
S3 RTL85n64; C:\Windows\System32\DRIVERS\RTL85n64.sys [378368 2009-06-10] (Realtek)
R0 sfdrv01; C:\Windows\System32\drivers\sfdrv01.sys [75384 2009-02-03] (Protection Technology (StarForce))
R0 sfdrv01a; C:\Windows\System32\drivers\sfdrv01a.sys [77432 2009-02-03] (Protection Technology (StarForce))
R0 sfsync04; C:\Windows\System32\drivers\sfsync04.sys [79800 2012-06-19] (Protection Technology (StarForce))
R0 sfvfs02; C:\Windows\System32\drivers\sfvfs02.sys [107384 2007-02-08] (Protection Technology (StarForce))
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [3552384 2009-04-22] ()
R1 SRTSP; C:\Windows\system32\drivers\NISx64\1501000.012\SRTSP64.SYS [858200 2013-09-27] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1501000.012\SRTSPX64.SYS [36952 2013-09-10] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\NISx64\1501000.012\SYMDS64.SYS [493656 2013-09-10] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NISx64\1501000.012\SYMEFA64.SYS [1147480 2013-09-27] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177752 2014-02-11] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NISx64\1501000.012\Ironx64.SYS [264280 2013-09-27] (Symantec Corporation)
R1 SymNetS; C:\Windows\system32\drivers\NISx64\1501000.012\SYMNETS.SYS [590936 2013-09-26] (Symantec Corporation)
S3 tap0901t; C:\Windows\System32\DRIVERS\tap0901t.sys [31232 2009-09-16] (Tunngle.net)
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
S3 X6va011; \??\C:\Windows\SysWOW64\Drivers\X6va011 [X]
S3 X6va012; \??\C:\Windows\SysWOW64\Drivers\X6va012 [X]
S3 X6va013; \??\C:\Windows\SysWOW64\Drivers\X6va013 [X]
S3 X6va015; \??\C:\Windows\SysWOW64\Drivers\X6va015 [X]
S3 xhunter1; \??\C:\Windows\xhunter1.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-02-11 22:27 - 2014-02-11 22:27 - 00000000 ____D () C:\Users\Pc\Desktop\Dokus
2014-02-11 22:24 - 2014-02-11 22:27 - 00031586 _____ () C:\Users\Pc\Desktop\FRST.txt
2014-02-11 22:23 - 2014-02-11 22:27 - 00000000 ____D () C:\FRST
2014-02-11 22:22 - 2014-02-11 22:23 - 02151424 _____ (Farbar) C:\Users\Pc\Desktop\FRST64.exe
2014-02-11 22:21 - 2014-02-11 22:21 - 00000466 _____ () C:\Windows\SysWOW64\defogger_disable.log
2014-02-11 22:21 - 2014-02-11 22:21 - 00000000 _____ () C:\Users\Pc\defogger_reenable
2014-02-11 22:20 - 2014-02-11 22:20 - 00050477 _____ () C:\Users\Pc\Desktop\Defogger.exe
2014-02-11 21:23 - 2014-02-11 22:00 - 00000000 ____D () C:\ProgramData\SecTaskMan
2014-02-11 21:22 - 2014-02-11 21:23 - 00000000 ____D () C:\Program Files (x86)\Security Task Manager
2014-02-11 21:19 - 2014-02-11 21:20 - 02365840 _____ () C:\Users\Pc\Downloads\SecurityTaskManager_Setup.exe
2014-02-11 21:03 - 2014-02-11 21:03 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\TestApp
2014-02-11 20:58 - 2014-02-11 20:58 - 00001121 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-02-11 20:57 - 2014-02-11 20:57 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Pc\Downloads\mbam-setup-1.75.0.1300(1).exe
2014-02-11 18:03 - 2011-09-01 11:39 - 02189264 _____ (Threat Expert Ltd.) C:\Windows\PCTBDCore.dll
2014-02-11 18:03 - 2011-09-01 11:39 - 01533904 _____ (Threat Expert Ltd.) C:\Windows\PCTBDRes.dll
2014-02-11 18:03 - 2011-09-01 11:39 - 00149456 _____ (PC Tools) C:\Windows\SGDetectionTool.dll
2014-02-11 18:03 - 2011-09-01 11:38 - 00767952 _____ () C:\Windows\BDTSupport.dll
2014-02-11 18:03 - 2011-01-06 10:54 - 00002125 _____ () C:\Windows\UDB.zip
2014-02-11 18:03 - 2010-08-20 09:50 - 00000882 _____ () C:\Windows\RegSDImport.xml
2014-02-11 18:03 - 2010-01-22 08:44 - 00000879 _____ () C:\Windows\RegISSImport.xml
2014-02-11 18:03 - 2008-11-26 11:08 - 00000131 _____ () C:\Windows\IDB.zip
2014-02-11 17:54 - 2014-02-11 21:51 - 00000000 ____D () C:\Program Files (x86)\PC Tools Security
2014-02-11 17:54 - 2014-02-11 18:16 - 00141312 _____ (PC Tools) C:\Windows\system32\Drivers\pctwfpfilter64.sys
2014-02-11 17:54 - 2014-02-11 17:55 - 02514894 _____ () C:\Windows\system32\Drivers\Cat.DB
2014-02-11 17:54 - 2014-02-11 17:54 - 00002072 _____ () C:\Users\Public\Desktop\Spyware Doctor.lnk
2014-02-11 17:54 - 2011-08-23 11:45 - 00360696 _____ (PC Tools) C:\Windows\system32\Drivers\PCTCore64.sys
2014-02-11 17:54 - 2011-08-18 09:31 - 00228392 _____ (PC Tools) C:\Windows\system32\Drivers\PCTSD64.sys
2014-02-11 17:54 - 2011-07-19 09:23 - 00092896 _____ (PC Tools) C:\Windows\system32\Drivers\pctplsg64.sys
2014-02-11 17:54 - 2011-07-19 09:18 - 00336512 _____ (PC Tools) C:\Windows\system32\Drivers\pctgntdi64.sys
2014-02-11 17:54 - 2010-07-16 14:53 - 00816016 _____ (PC Tools) C:\Windows\system32\Drivers\pctEFA64.sys
2014-02-11 17:54 - 2010-06-29 10:35 - 00452872 _____ (PC Tools) C:\Windows\system32\Drivers\pctDS64.sys
2014-02-11 17:50 - 2014-02-11 17:54 - 00000000 ____D () C:\ProgramData\PC Tools
2014-02-11 17:50 - 2014-02-11 17:50 - 00507360 _____ () C:\Users\Pc\Desktop\sdsetup_2011.exe
2014-02-11 16:55 - 2014-02-11 21:33 - 00035740 _____ () C:\Windows\PFRO.log
2014-02-11 16:54 - 2014-02-11 16:54 - 00000000 ____D () C:\ProgramData\SMR410
2014-02-11 16:50 - 2014-02-11 17:34 - 00000000 ____D () C:\Users\Pc\AppData\Local\NPE
2014-02-11 16:38 - 2014-02-11 16:38 - 00000000 ____D () C:\Windows\System32\Tasks\Norton Internet Security
2014-02-11 16:37 - 2014-02-11 16:37 - 00177752 _____ (Symantec Corporation) C:\Windows\system32\Drivers\SYMEVENT64x86.SYS
2014-02-11 16:37 - 2014-02-11 16:37 - 00008222 _____ () C:\Windows\system32\Drivers\SYMEVENT64x86.CAT
2014-02-11 16:37 - 2014-02-11 16:37 - 00003234 _____ () C:\Windows\System32\Tasks\Norton WSC Integration
2014-02-11 16:37 - 2014-02-11 16:37 - 00002585 _____ () C:\Users\Public\Desktop\Norton Internet Security.lnk
2014-02-11 16:37 - 2014-02-11 16:37 - 00000000 ____D () C:\Program Files\Common Files\Symantec Shared
2014-02-11 16:35 - 2014-02-11 21:35 - 00000280 _____ () C:\Windows\Tasks\Digital Sites.job
2014-02-11 16:35 - 2014-02-11 21:23 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\DigitalSites
2014-02-11 16:35 - 2014-02-11 16:35 - 00003208 _____ () C:\Windows\System32\Tasks\Digital Sites
2014-02-11 16:35 - 2014-02-11 16:35 - 00000000 ____D () C:\Windows\system32\Drivers\NISx64
2014-02-11 16:35 - 2014-02-11 16:35 - 00000000 ____D () C:\Program Files (x86)\Norton Internet Security
2014-02-11 16:30 - 2013-12-18 21:09 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-02-11 16:30 - 2013-12-18 21:04 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-02-11 16:30 - 2013-12-18 21:04 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-02-11 16:30 - 2013-12-18 21:03 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-02-11 16:29 - 2014-02-11 16:30 - 00005327 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-02-11 16:27 - 2014-02-11 16:32 - 223165336 ____N (Symantec Corporation) C:\Users\Pc\Downloads\NIS_21.1.0.18_SYMTB_TMD_MRFTT_820_10131.exe
2014-02-11 16:19 - 2014-02-11 21:45 - 00000280 _____ () C:\Windows\setupact.log
2014-02-11 16:19 - 2014-02-11 16:19 - 00000000 _____ () C:\Windows\setuperr.log
2014-02-11 15:59 - 2014-02-11 15:59 - 00003582 _____ () C:\Windows\System32\Tasks\PileFile reminder
2014-02-11 15:59 - 2014-02-11 15:59 - 00003160 _____ () C:\Windows\System32\Tasks\PileFile logon
2014-02-11 15:59 - 2014-02-11 15:59 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Oxy
2014-02-11 15:34 - 2014-02-11 15:34 - 00000000 _RSHD () C:\Users\Pc\cc4j5zs76kd2kj
2014-02-04 16:14 - 2013-09-29 23:55 - 00043810 _____ () C:\Users\Pc\AppData\Roaming\poclbm130302.cl
2014-02-04 16:14 - 2013-06-12 15:15 - 00119888 _____ (Open Source Software community LGPL) C:\Users\Pc\AppData\Roaming\pthreadGC2.dll
2014-02-04 16:14 - 2013-06-12 15:15 - 00100864 _____ () C:\Users\Pc\AppData\Roaming\zlib1.dll
2014-02-04 15:05 - 2014-02-11 21:23 - 00000000 _RSHD () C:\Users\Pc\aoajz
2014-02-04 13:49 - 2014-02-04 13:49 - 00347816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\MicrosoftFixit.WinSecurity.FISC.37314945131128502.8.1.Run.exe
2014-02-04 13:45 - 2014-02-04 13:45 - 00000134 _____ () C:\Users\Pc\Desktop\Microsoft Fix*it.url
2014-02-04 13:42 - 2014-02-04 13:42 - 00347816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\MicrosoftFixit.WindowsFirewall.RNP.Run.exe
2014-02-04 13:11 - 2014-02-04 13:11 - 00001613 _____ () C:\Users\Public\Desktop\Play League of Legends.lnk
2014-02-04 13:09 - 2014-02-04 13:12 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Riot Games
2014-02-04 13:07 - 2014-02-04 13:08 - 34888568 _____ (Riot Games) C:\Users\Pc\Downloads\LeagueofLegends_EUW_Installer_06_12_13.exe
2014-02-04 12:20 - 2014-02-04 12:20 - 00001024 _____ () C:\Windows\SysWOW64\.rnd
2014-02-04 12:08 - 2014-02-11 21:23 - 00000000 _RSHD () C:\Users\Pc\xripb
2014-02-02 13:32 - 2014-02-02 13:32 - 00000000 ___SH () C:\Users\Pc\AppData\Local\LumaEmu
2014-02-02 13:28 - 2014-02-02 13:28 - 00000000 ____D () C:\Users\Pc\Desktop\RustClient_v19.12.2013
2014-02-02 13:20 - 2014-02-02 13:21 - 06499816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\vcredist_x86.exe
2014-01-29 14:14 - 2014-01-29 14:14 - 00000631 _____ () C:\Windows\system32\InstallUtil.InstallLog
2014-01-21 10:23 - 2014-02-04 12:20 - 00000000 ____D () C:\Users\Pc\AppData\Local\CyberGhost
2014-01-21 10:22 - 2014-01-21 10:27 - 00000000 ____D () C:\Program Files\CyberGhost 5
2014-01-21 10:22 - 2014-01-21 10:23 - 00000000 ____D () C:\Program Files\TAP-Windows
2014-01-21 10:22 - 2014-01-21 10:22 - 00001736 _____ () C:\Users\Pc\Desktop\CyberGhost 5.lnk
2014-01-21 10:21 - 2014-01-21 10:21 - 08566128 _____ (CyberGhost S.R.L. ) C:\Users\Pc\Downloads\CG_5.0.9.8chip.de.exe
2014-01-15 13:29 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-01-15 13:29 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-01-15 13:29 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-01-15 13:29 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-01-15 13:29 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-01-15 13:29 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-01-15 13:29 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-01-15 13:29 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-01-15 13:29 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

==================== One Month Modified Files and Folders =======

2014-02-11 22:27 - 2014-02-11 22:27 - 00000000 ____D () C:\Users\Pc\Desktop\Dokus
2014-02-11 22:27 - 2014-02-11 22:24 - 00031586 _____ () C:\Users\Pc\Desktop\FRST.txt
2014-02-11 22:27 - 2014-02-11 22:23 - 00000000 ____D () C:\FRST
2014-02-11 22:23 - 2014-02-11 22:22 - 02151424 _____ (Farbar) C:\Users\Pc\Desktop\FRST64.exe
2014-02-11 22:21 - 2014-02-11 22:21 - 00000466 _____ () C:\Windows\SysWOW64\defogger_disable.log
2014-02-11 22:21 - 2014-02-11 22:21 - 00000000 _____ () C:\Users\Pc\defogger_reenable
2014-02-11 22:21 - 2012-10-18 00:39 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-02-11 22:21 - 2012-09-28 18:04 - 00000000 ____D () C:\Users\Pc
2014-02-11 22:20 - 2014-02-11 22:20 - 00050477 _____ () C:\Users\Pc\Desktop\Defogger.exe
2014-02-11 22:00 - 2014-02-11 21:23 - 00000000 ____D () C:\ProgramData\SecTaskMan
2014-02-11 21:59 - 2013-10-05 14:34 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-02-11 21:51 - 2014-02-11 17:54 - 00000000 ____D () C:\Program Files (x86)\PC Tools Security
2014-02-11 21:45 - 2014-02-11 16:19 - 00000280 _____ () C:\Windows\setupact.log
2014-02-11 21:36 - 2011-05-15 23:01 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-02-11 21:35 - 2014-02-11 16:35 - 00000280 _____ () C:\Windows\Tasks\Digital Sites.job
2014-02-11 21:35 - 2013-05-21 18:33 - 00000274 _____ () C:\Windows\Tasks\DSite.job
2014-02-11 21:34 - 2012-10-18 00:39 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-02-11 21:34 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-11 21:33 - 2014-02-11 16:55 - 00035740 _____ () C:\Windows\PFRO.log
2014-02-11 21:31 - 2009-07-14 05:45 - 00010784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-11 21:31 - 2009-07-14 05:45 - 00010784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-11 21:23 - 2014-02-11 21:22 - 00000000 ____D () C:\Program Files (x86)\Security Task Manager
2014-02-11 21:23 - 2014-02-11 16:35 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\DigitalSites
2014-02-11 21:23 - 2014-02-04 15:05 - 00000000 _RSHD () C:\Users\Pc\aoajz
2014-02-11 21:23 - 2014-02-04 12:08 - 00000000 _RSHD () C:\Users\Pc\xripb
2014-02-11 21:23 - 2013-12-31 15:25 - 00000000 ____D () C:\ProgramData\FuNDeaulls
2014-02-11 21:23 - 2013-12-31 15:25 - 00000000 ____D () C:\ProgramData\50Coeuupons
2014-02-11 21:23 - 2013-10-11 13:19 - 00000000 ____D () C:\Program Files (x86)\Unitech LLC
2014-02-11 21:20 - 2014-02-11 21:19 - 02365840 _____ () C:\Users\Pc\Downloads\SecurityTaskManager_Setup.exe
2014-02-11 21:03 - 2014-02-11 21:03 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\TestApp
2014-02-11 20:58 - 2014-02-11 20:58 - 00001121 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-02-11 20:58 - 2013-08-20 16:44 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-02-11 20:57 - 2014-02-11 20:57 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Pc\Downloads\mbam-setup-1.75.0.1300(1).exe
2014-02-11 20:02 - 2012-12-07 23:10 - 00000000 ____D () C:\Users\Pc\AppData\Local\Pokki
2014-02-11 18:16 - 2014-02-11 17:54 - 00141312 _____ (PC Tools) C:\Windows\system32\Drivers\pctwfpfilter64.sys
2014-02-11 17:55 - 2014-02-11 17:54 - 02514894 _____ () C:\Windows\system32\Drivers\Cat.DB
2014-02-11 17:54 - 2014-02-11 17:54 - 00002072 _____ () C:\Users\Public\Desktop\Spyware Doctor.lnk
2014-02-11 17:54 - 2014-02-11 17:50 - 00000000 ____D () C:\ProgramData\PC Tools
2014-02-11 17:50 - 2014-02-11 17:50 - 00507360 _____ () C:\Users\Pc\Desktop\sdsetup_2011.exe
2014-02-11 17:34 - 2014-02-11 16:50 - 00000000 ____D () C:\Users\Pc\AppData\Local\NPE
2014-02-11 16:55 - 2012-12-20 15:52 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-02-11 16:54 - 2014-02-11 16:54 - 00000000 ____D () C:\ProgramData\SMR410
2014-02-11 16:51 - 2012-10-18 00:43 - 00000000 ____D () C:\ProgramData\Norton
2014-02-11 16:38 - 2014-02-11 16:38 - 00000000 ____D () C:\Windows\System32\Tasks\Norton Internet Security
2014-02-11 16:37 - 2014-02-11 16:37 - 00177752 _____ (Symantec Corporation) C:\Windows\system32\Drivers\SYMEVENT64x86.SYS
2014-02-11 16:37 - 2014-02-11 16:37 - 00008222 _____ () C:\Windows\system32\Drivers\SYMEVENT64x86.CAT
2014-02-11 16:37 - 2014-02-11 16:37 - 00003234 _____ () C:\Windows\System32\Tasks\Norton WSC Integration
2014-02-11 16:37 - 2014-02-11 16:37 - 00002585 _____ () C:\Users\Public\Desktop\Norton Internet Security.lnk
2014-02-11 16:37 - 2014-02-11 16:37 - 00000000 ____D () C:\Program Files\Common Files\Symantec Shared
2014-02-11 16:35 - 2014-02-11 16:35 - 00003208 _____ () C:\Windows\System32\Tasks\Digital Sites
2014-02-11 16:35 - 2014-02-11 16:35 - 00000000 ____D () C:\Windows\system32\Drivers\NISx64
2014-02-11 16:35 - 2014-02-11 16:35 - 00000000 ____D () C:\Program Files (x86)\Norton Internet Security
2014-02-11 16:35 - 2013-07-29 11:35 - 00000196 _____ () C:\Users\Pc\AppData\Roaming\WB.CFG
2014-02-11 16:32 - 2014-02-11 16:27 - 223165336 ____N (Symantec Corporation) C:\Users\Pc\Downloads\NIS_21.1.0.18_SYMTB_TMD_MRFTT_820_10131.exe
2014-02-11 16:32 - 2013-10-20 11:29 - 00000000 ____D () C:\ProgramData\Oracle
2014-02-11 16:30 - 2014-02-11 16:29 - 00005327 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-02-11 16:30 - 2013-07-20 17:55 - 00000000 ____D () C:\Program Files (x86)\Java
2014-02-11 16:19 - 2014-02-11 16:19 - 00000000 _____ () C:\Windows\setuperr.log
2014-02-11 16:17 - 2011-05-10 01:27 - 01478483 _____ () C:\Windows\WindowsUpdate.log
2014-02-11 16:03 - 2013-02-23 20:05 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-02-11 16:03 - 2012-11-10 17:56 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\DAEMON Tools Lite
2014-02-11 16:03 - 2012-11-02 19:39 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\uTorrent
2014-02-11 16:03 - 2012-10-26 14:14 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\TS3Client
2014-02-11 16:03 - 2012-10-20 13:46 - 00000000 ____D () C:\Users\Pc\AppData\Local\CrashDumps
2014-02-11 16:03 - 2012-10-18 15:02 - 00000000 ____D () C:\Windows\Minidump
2014-02-11 15:59 - 2014-02-11 15:59 - 00003582 _____ () C:\Windows\System32\Tasks\PileFile reminder
2014-02-11 15:59 - 2014-02-11 15:59 - 00003160 _____ () C:\Windows\System32\Tasks\PileFile logon
2014-02-11 15:59 - 2014-02-11 15:59 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Oxy
2014-02-11 15:34 - 2014-02-11 15:34 - 00000000 _RSHD () C:\Users\Pc\cc4j5zs76kd2kj
2014-02-11 15:34 - 2012-09-28 18:06 - 00000000 ___RD () C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-02-11 15:33 - 2012-10-20 20:58 - 00000000 ____D () C:\Users\Pc\AppData\Local\PMB Files
2014-02-11 15:33 - 2012-10-20 20:58 - 00000000 ____D () C:\ProgramData\PMB Files
2014-02-11 15:20 - 2012-10-26 13:15 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Skype
2014-02-10 18:30 - 2009-07-14 11:54 - 00710502 _____ () C:\Windows\system32\perfh007.dat
2014-02-10 18:30 - 2009-07-14 11:54 - 00154832 _____ () C:\Windows\system32\perfc007.dat
2014-02-10 18:30 - 2009-07-14 06:13 - 01651686 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-07 17:18 - 2013-09-14 20:24 - 00000424 _____ () C:\Users\Pc\Desktop\Accounts.txt
2014-02-07 14:59 - 2013-10-05 14:34 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-02-07 14:59 - 2012-12-10 18:25 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-02-07 14:59 - 2012-12-10 18:25 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-02-05 12:36 - 2013-12-28 11:49 - 00291128 _____ () C:\Windows\SysWOW64\PnkBstrB.xtr
2014-02-05 12:36 - 2013-08-18 17:42 - 00291128 _____ () C:\Windows\SysWOW64\PnkBstrB.exe
2014-02-04 15:46 - 2013-08-18 17:42 - 00291128 _____ () C:\Windows\SysWOW64\PnkBstrB.ex0
2014-02-04 15:25 - 2013-12-28 14:47 - 00000000 ____D () C:\ProgramData\YoutubeAdblocker
2014-02-04 15:25 - 2013-12-28 14:47 - 00000000 ____D () C:\ProgramData\surf aand kEEp
2014-02-04 15:25 - 2013-12-28 14:47 - 00000000 ____D () C:\Program Files (x86)\surf aand kEEp
2014-02-04 13:49 - 2014-02-04 13:49 - 00347816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\MicrosoftFixit.WinSecurity.FISC.37314945131128502.8.1.Run.exe
2014-02-04 13:45 - 2014-02-04 13:45 - 00000134 _____ () C:\Users\Pc\Desktop\Microsoft Fix*it.url
2014-02-04 13:42 - 2014-02-04 13:42 - 00347816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\MicrosoftFixit.WindowsFirewall.RNP.Run.exe
2014-02-04 13:12 - 2014-02-04 13:09 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Riot Games
2014-02-04 13:11 - 2014-02-04 13:11 - 00001613 _____ () C:\Users\Public\Desktop\Play League of Legends.lnk
2014-02-04 13:11 - 2012-10-28 14:16 - 00000000 __SHD () C:\Windows\SysWOW64\AI_RecycleBin
2014-02-04 13:08 - 2014-02-04 13:07 - 34888568 _____ (Riot Games) C:\Users\Pc\Downloads\LeagueofLegends_EUW_Installer_06_12_13.exe
2014-02-04 12:20 - 2014-02-04 12:20 - 00001024 _____ () C:\Windows\SysWOW64\.rnd
2014-02-04 12:20 - 2014-01-21 10:23 - 00000000 ____D () C:\Users\Pc\AppData\Local\CyberGhost
2014-02-02 13:32 - 2014-02-02 13:32 - 00000000 ___SH () C:\Users\Pc\AppData\Local\LumaEmu
2014-02-02 13:28 - 2014-02-02 13:28 - 00000000 ____D () C:\Users\Pc\Desktop\RustClient_v19.12.2013
2014-02-02 13:27 - 2013-02-05 20:06 - 00000000 ____D () C:\Users\Pc\Desktop\Spiele
2014-02-02 13:21 - 2014-02-02 13:20 - 06499816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\vcredist_x86.exe
2014-02-02 13:21 - 2013-08-18 17:43 - 00000000 ____D () C:\ProgramData\Package Cache
2014-02-01 11:35 - 2013-06-17 13:35 - 00000005 _____ () C:\Users\Pc\AppData\Roaming\WBPU-TTL.DAT
2014-01-29 14:14 - 2014-01-29 14:14 - 00000631 _____ () C:\Windows\system32\InstallUtil.InstallLog
2014-01-26 16:16 - 2012-10-17 23:45 - 00000000 ____D () C:\Users\Pc\AppData\Local\Adobe
2014-01-25 14:59 - 2012-10-17 23:53 - 00003906 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{9DE29845-AC8C-4418-B415-05000DEA2E9F}
2014-01-24 22:17 - 2013-08-18 17:42 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2014-01-24 22:12 - 2013-12-27 22:18 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ubisoft
2014-01-24 22:12 - 2013-12-27 22:18 - 00000000 ____D () C:\Users\Pc\AppData\Local\Deployment
2014-01-23 21:18 - 2013-02-25 14:23 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Spotify
2014-01-23 21:01 - 2013-02-25 14:24 - 00000000 ____D () C:\Users\Pc\AppData\Local\Spotify
2014-01-23 17:26 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-01-21 10:27 - 2014-01-21 10:22 - 00000000 ____D () C:\Program Files\CyberGhost 5
2014-01-21 10:23 - 2014-01-21 10:22 - 00000000 ____D () C:\Program Files\TAP-Windows
2014-01-21 10:22 - 2014-01-21 10:22 - 00001736 _____ () C:\Users\Pc\Desktop\CyberGhost 5.lnk
2014-01-21 10:21 - 2014-01-21 10:21 - 08566128 _____ (CyberGhost S.R.L. ) C:\Users\Pc\Downloads\CG_5.0.9.8chip.de.exe
2014-01-21 09:51 - 2013-12-28 14:48 - 00000000 ____D () C:\Program Files (x86)\GS-Enabler
2014-01-17 13:57 - 2009-07-14 05:45 - 00321600 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-01-16 14:30 - 2013-08-14 22:07 - 00000000 ____D () C:\Windows\system32\MRT
2014-01-16 14:24 - 2012-10-18 05:30 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

Files to move or delete:
====================
C:\ProgramData\cefbaeacdccceasacfsfdsf.exe
C:\ProgramData\libnspr4.dll


Some content of TEMP:
====================
C:\Users\Pc\AppData\Local\Temp\27132-673656-spyware-doctor.exe
C:\Users\Pc\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-02-11 14:00

==================== End Of Log ============================
         

--- --- ---




Ich habe zu viele Zeichen benutzt, weshalb ich die Log von Malwarebyte und Gmer.txt nicht reinstellen kann.

Ich habe dein Thema in Arbeit und melde mich so schnell als möglich mit weiteren Anweisungen.

Bitte beachte, dass alle meine Antworten zuerst von einem Ausbilder freigegeben werden müssen, bevor ich diese hier posten darf. Dies garantiert, dass Du Hilfe von einem ausgebildeten Helfer bekommst.

Ich bedanke mich für deine Geduld

Vielen Dank. Da jemand nun geantwortet hat, werde ich jetzt auch noch die anderen Logs reinstellen.

Gmer.txt

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-02-12 09:15:52
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-1 Hitachi_HUA721010KLA330 rev.GKAOAB0A 931,51GB
Running: pn49km1w.exe; Driver: C:\Users\Pc\AppData\Local\Temp\pgldapog.sys


---- User code sections - GMER 2.1 ----

.text    C:\Windows\SysWOW64\svchost.exe[1064] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                  00000000759e1465 2 bytes [9E, 75]
.text    C:\Windows\SysWOW64\svchost.exe[1064] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                 00000000759e14bb 2 bytes [9E, 75]
.text    ...                                                                                                                                                            * 2
.text    C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe[2152] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                           00000000759e1465 2 bytes [9E, 75]
.text    C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe[2152] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                          00000000759e14bb 2 bytes [9E, 75]
.text    ...                                                                                                                                                            * 2
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraMD.exe[2468] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                  00000000759e1465 2 bytes [9E, 75]
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraMD.exe[2468] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                 00000000759e14bb 2 bytes [9E, 75]
.text    ...                                                                                                                                                            * 2
.text    C:\Program Files (x86)\PC Tools Security\BDT\FGuard.exe[2876] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                          00000000759e1465 2 bytes [9E, 75]
.text    C:\Program Files (x86)\PC Tools Security\BDT\FGuard.exe[2876] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                         00000000759e14bb 2 bytes [9E, 75]
.text    ...                                                                                                                                                            * 2
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe[680] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69                                         00000000759e1465 2 bytes [9E, 75]
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe[680] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155                                        00000000759e14bb 2 bytes [9E, 75]
.text    ...                                                                                                                                                            * 2
.text    C:\Program Files (x86)\PC Tools Security\BDT\BDTUpdateService.exe[2616] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                00000000759e1465 2 bytes [9E, 75]
.text    C:\Program Files (x86)\PC Tools Security\BDT\BDTUpdateService.exe[2616] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                               00000000759e14bb 2 bytes [9E, 75]
.text    ...                                                                                                                                                            * 2
.text    C:\Windows\SysWOW64\PnkBstrA.exe[2716] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 322                                                                        0000000074611a22 2 bytes [61, 74]
.text    C:\Windows\SysWOW64\PnkBstrA.exe[2716] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 496                                                                        0000000074611ad0 2 bytes [61, 74]
.text    C:\Windows\SysWOW64\PnkBstrA.exe[2716] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 552                                                                        0000000074611b08 2 bytes [61, 74]
.text    C:\Windows\SysWOW64\PnkBstrA.exe[2716] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 730                                                                        0000000074611bba 2 bytes [61, 74]
.text    C:\Windows\SysWOW64\PnkBstrA.exe[2716] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 762                                                                        0000000074611bda 2 bytes [61, 74]
.text    C:\Windows\SysWOW64\PnkBstrA.exe[2716] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                 00000000759e1465 2 bytes [9E, 75]
.text    C:\Windows\SysWOW64\PnkBstrA.exe[2716] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                00000000759e14bb 2 bytes [9E, 75]
.text    ...                                                                                                                                                            * 2
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtWaitForSingleObject                                             000000007751f8bc 5 bytes JMP 0000000176de0000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtReadFile                                                        000000007751f8f0 5 bytes JMP 00000001770c0000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtWriteFile                                                       000000007751f928 5 bytes JMP 00000001770e0000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtClose                                                           000000007751f9e0 5 bytes JMP 0000000177040000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtQueryObject                                                     000000007751f9f8 5 bytes JMP 0000000176ae0000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtQueryInformationFile                                            000000007751fa10 5 bytes JMP 0000000177060000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtOpenKey                                                         000000007751fa28 5 bytes JMP 0000000176c60000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtEnumerateValueKey                                               000000007751fa40 5 bytes JMP 0000000176d00000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtQueryKey                                                        000000007751fa90 5 bytes JMP 0000000176c20000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtQueryValueKey                                                   000000007751faa8 5 bytes JMP 0000000176be0000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtQueryInformationProcess                                         000000007751fad8 5 bytes JMP 0000000176a60000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtCreateKey                                                       000000007751fb40 5 bytes JMP 0000000176d80000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile                                              000000007751fc38 5 bytes JMP 0000000177080000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtMapViewOfSection                                                000000007751fc50 5 bytes JMP 0000000176f80000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtUnmapViewOfSection                                              000000007751fc80 5 bytes JMP 0000000176f40000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtEnumerateKey                                                    000000007751fd4c 5 bytes JMP 0000000176d20000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile                                                        000000007751fd64 5 bytes JMP 00000001774f0000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtQueryDirectoryFile                                              000000007751fd98 5 bytes JMP 0000000176ea0000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtOpenSection                                                     000000007751fdc8 5 bytes JMP 0000000177000000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtFsControlFile                                                   000000007751fdf8 5 bytes JMP 0000000176e20000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtDuplicateObject                                                 000000007751fe44 5 bytes JMP 0000000176f20000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtQueryAttributesFile                                             000000007751fe5c 5 bytes JMP 0000000176fc0000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtQueryVolumeInformationFile                                      000000007751ff8c 2 bytes JMP 0000000176ee0000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtQueryVolumeInformationFile + 3                                  000000007751ff8f 2 bytes [9C, FF]
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtCreateSection                                                   000000007751ffa4 2 bytes JMP 0000000177020000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtCreateSection + 3                                               000000007751ffa7 2 bytes [B0, FF]
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtFlushBuffersFile                                                000000007751ffbc 2 bytes JMP 0000000176e40000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtFlushBuffersFile + 3                                            000000007751ffbf 2 bytes [92, FF]
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtQuerySection                                                    0000000077520050 5 bytes JMP 0000000176f60000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile                                                      00000000775200b4 5 bytes JMP 00000001774d0000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtWaitForMultipleObjects                                          0000000077520148 5 bytes JMP 0000000176dc0000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey                                                     00000000775201c4 5 bytes JMP 0000000176b40000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtAccessCheck                                                     0000000077520228 5 bytes JMP 0000000176a20000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtDeleteFile                                                      00000000775209e4 5 bytes JMP 00000001770a0000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtDeleteKey                                                       00000000775209fc 5 bytes JMP 0000000176d60000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey                                                  0000000077520a44 5 bytes JMP 0000000176d40000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtExtendSection                                                   0000000077520b1c 5 bytes JMP 0000000176da0000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtFlushKey                                                        0000000077520b80 5 bytes JMP 0000000176ce0000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtFlushVirtualMemory                                              0000000077520bb4 5 bytes JMP 0000000176fe0000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtLoadKey                                                         0000000077520e0c 5 bytes JMP 0000000176cc0000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtLoadKey2                                                        0000000077520e24 5 bytes JMP 0000000176ca0000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtLockFile                                                        0000000077520e54 5 bytes JMP 0000000176e80000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtNotifyChangeDirectoryFile                                       0000000077520f58 5 bytes JMP 0000000176e00000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtNotifyChangeKey                                                 0000000077520f70 5 bytes JMP 0000000176c80000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtOpenKeyEx                                                       0000000077521018 5 bytes JMP 0000000176c40000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtQueryFullAttributesFile                                         000000007752133c 5 bytes JMP 0000000176f00000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtQueryMultipleValueKey                                           000000007752147c 5 bytes JMP 0000000176c00000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtQuerySecurityObject                                             0000000077521528 5 bytes JMP 0000000176a40000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtRenameKey                                                       0000000077521718 5 bytes JMP 0000000176b00000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtReplaceKey                                                      0000000077521748 5 bytes JMP 0000000176bc0000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtRestoreKey                                                      00000000775217e0 5 bytes JMP 0000000176ba0000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtSaveKey                                                         0000000077521874 5 bytes JMP 0000000176b80000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationKey                                               0000000077521a58 5 bytes JMP 0000000176b60000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtSetSecurityObject                                               0000000077521b9c 5 bytes JMP 0000000176fa0000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtSetVolumeInformationFile                                        0000000077521c9c 5 bytes JMP 0000000176ec0000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtUnloadKey                                                       0000000077521e70 5 bytes JMP 0000000176b20000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtUnlockFile                                                      0000000077521eb8 5 bytes JMP 0000000176e60000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!RtlQueryInformationActivationContext                              000000007753ba2c 5 bytes JMP 0000000176ac0000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                                        000000007753c4dd 5 bytes JMP 0000000176aa0000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll                                                      0000000077541287 5 bytes JMP 0000000176a80000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\syswow64\kernel32.dll!CreateProcessW                                                 000000007575103d 5 bytes JMP 00000001756f0000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\syswow64\kernel32.dll!CreateProcessA                                                 0000000075751072 5 bytes JMP 0000000175710000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\syswow64\kernel32.dll!CreateActCtxW                                                  00000000757591e7 5 bytes JMP 0000000175730000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\syswow64\kernel32.dll!WinExec                                                        00000000757d2c51 5 bytes JMP 00000001755d0000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\syswow64\ADVAPI32.dll!CreateProcessAsUserW                                           00000000763ec532 5 bytes JMP 00000001763d0000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\syswow64\ADVAPI32.dll!EncryptFileW                                                   00000000764228f8 5 bytes JMP 00000001763b0000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\syswow64\ADVAPI32.dll!DecryptFileW                                                   0000000076422947 5 bytes JMP 0000000176390000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\syswow64\ole32.dll!CoRegisterClassObject                                             0000000075f921e1 5 bytes JMP 0000000175f70000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\syswow64\ole32.dll!CoGetClassObject                                                  0000000075fb54ad 5 bytes JMP 0000000175ed0000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                                  0000000075fc9d0b 5 bytes JMP 0000000175f10000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\syswow64\ole32.dll!CoCreateInstanceEx                                                0000000075fc9d4e 5 bytes JMP 0000000175ef0000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\syswow64\ole32.dll!CoRevokeClassObject                                               000000007600eacf 5 bytes JMP 0000000175f50000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\syswow64\ole32.dll!CoFreeUnusedLibraries                                             0000000076010cc2 5 bytes JMP 0000000175f30000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\syswow64\ole32.dll!CoRegisterSurrogate                                               00000000760609bf 5 bytes JMP 0000000175eb0000
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69                                         00000000759e1465 2 bytes [9E, 75]
.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155                                        00000000759e14bb 2 bytes [9E, 75]
.text    ...                                                                                                                                                            * 2

---- Trace I/O - GMER 2.1 ----

Trace    ntoskrnl.exe CLASSPNP.SYS disk.sys PCTCore64.sys ACPI.sys >>UNKNOWN [0xfffffa8007a16d90]<< sfsync04.sys ataport.SYS pciide.sys PCIIDEX.SYS hal.dll atapi.sys   fffffa8007a16d90
Trace    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8007a2c790]                                                                                                fffffa8007a2c790
Trace    3 CLASSPNP.SYS[fffff88001c0143f] -> nt!IofCallDriver -> [0xfffffa800799a940]                                                                                   fffffa800799a940
Trace    5 PCTCore64.sys[fffff88001287a40] -> nt!IofCallDriver -> [0xfffffa800798d9b0]                                                                                  fffffa800798d9b0
Trace    7 ACPI.sys[fffff88000f177a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP1T0L0-1[0xfffffa8006ab3680]                                                          fffffa8006ab3680
Trace    \Driver\atapi[0xfffffa8006adf3a0] -> IRP_MJ_INTERNAL_DEVICE_CONTROL -> 0xfffffa8007a16d90                                                                      fffffa8007a16d90

---- Threads - GMER 2.1 ----

Thread   C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe [2216:4772]                                                                                           000000000066ca30
Thread   C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe [2216:4776]                                                                                           000000000066c3c0
Thread   C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe [2216:4780]                                                                                           000000000066c3c0
Thread   C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe [2216:4784]                                                                                           000000000066c3c0
Thread   C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe [2216:4788]                                                                                           000000000066c3c0
Thread   C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe [2216:4760]                                                                                           000000000066c3c0
Thread   C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe [2216:4796]                                                                                           000000000066c3c0
Thread   C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe [2216:4800]                                                                                           000000000066c3c0
Thread   C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe [2216:4812]                                                                                           000000000066c3c0
---- Processes - GMER 2.1 ----

Library  
:\{9019ACD6-BC11-4308-8C49-92E0601DF38D}\temp\2216\bxsdk32.dll (*** suspicious ***) @ C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe [2216]         0000000010000000
Library  C:\Windows\Microsoft.NET\Framework\v2.0.50727\miner.dll (*** suspicious ***) @ C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe [2216]                 0000000013900000
Library  C:\Windows\Microsoft.NET\Framework\v2.0.50727\usft_ext.dll (*** suspicious ***) @ C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe [2216]              0000000011000000
Library  C:\Windows\Microsoft.NET\Framework\v2.0.50727\coinutil.dll (*** suspicious ***) @ C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe [2216]              0000000013800000
Library  C:\Windows\Microsoft.NET\Framework\v2.0.50727\MPIR.dll (*** suspicious ***) @ C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe [2216]                  0000000013000000

---- Registry - GMER 2.1 ----

Reg      HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\001fcf206b16                                                                                    
Reg      HKLM\SYSTEM\CurrentControlSet\services\LanmanWorkstation\Linkage@Export                                                                                        ????FA?????????????????????????????????????????????????????????????????{??????????????????????-AC58-425A-A466-AA544D7B3A97}"?"??? ???????|???????????u?:????????????&????????????????????????????????2?????e??????T??????????????d??????????????????????????????????????? ???????|?????????????:????????????&????????????????????8??? ??????????????????????????????????????wvmbus.inf_amd64_neutral_f6b968c04185b840???.NT??????????????????????????????????????????????????????i??????????????? ???????n??????????????????????????&????????????????????4??????? ?????????????????????0????????????&???????????????????????? ?????????????????????0????????????????????? ???????????????????j?0????????????????????? ???????? ????????????0????????????&???????????????????????? ?????????????????????0?????????????????????????E??? ???????????????????j?0????????????????????????????? ?????????????????????0????????????&????????????????????-??? ?????????????????????0????????????????????????????? ?????????????????????0???????????????????????????????
Reg      HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\001fcf206b16 (not active ControlSet)                                                                

---- EOF - GMER 2.1 ----
         

Malwarebyte

 Malwarebytes Anti-Malware  (Test) 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2014.02.11.08

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.16476
Pc :: PC-PC [Administrator]

Schutz: Aktiviert

11.02.2014 21:03:15
mbam-log-2014-02-11 (21-03-15).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 250063
Laufzeit: 18 Minute(n), 36 Sekunde(n)

Infizierte Speicherprozesse: 1
C:\Users\Pc\AppData\Local\Temp\ba58Installer.exe (PUP.Optional.Vittalia) -> 2284 -> Löschen bei Neustart.

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 64
HKCR\CLSID\{A257D1AE-C8F9-32E7-03CF-8F68563FB5A4} (PUP.Optional.MultiPlug.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A257D1AE-C8F9-32E7-03CF-8F68563FB5A4} (PUP.Optional.MultiPlug.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{A257D1AE-C8F9-32E7-03CF-8F68563FB5A4} (PUP.Optional.MultiPlug.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\CLSID\{4CEECF2F-7433-3E1D-4954-FE2A3682FC20} (PUP.Optional.MultiPlug.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4CEECF2F-7433-3E1D-4954-FE2A3682FC20} (PUP.Optional.MultiPlug.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{4CEECF2F-7433-3E1D-4954-FE2A3682FC20} (PUP.Optional.MultiPlug.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\AppID\{1FAEE6D5-34F4-42AA-8025-3FD8F3EC4634} (PUP.Optional.Wajam.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\AppID\{35C1605E-438B-4D64-AAB1-8885F097A9B1} (PUP.Optional.BabylonToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\TypeLib\{35C1605E-438B-4D64-AAB1-8885F097A9B1} (PUP.Optional.BabylonToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\AppID\{562B9316-C08A-444A-9482-62080DD851AE} (PUP.Optional.SpeedAnalysis3.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\AppID\{685F23D9-FCFD-475C-B56A-362645945C5A} (PUP.Optional.iVIDI.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17} (PUP.Optional.Wajam.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\CLSID\{291BCCC1-6890-484a-89D3-318C928DAC1B} (PUP.Optional.BabylonToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\esrv.BabylonESrvc.1 (PUP.Optional.BabylonToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\esrv.BabylonESrvc (PUP.Optional.BabylonToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\CLSID\{5D64294B-1341-4FE7-B6D8-7C36828D4DD5} (PUP.Optional.Wajam.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\wajam.WajamDownloader.1 (PUP.Optional.Wajam.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\wajam.WajamDownloader (PUP.Optional.Wajam.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\CLSID\{B8276A94-891D-453C-9FF3-715C042A2575} (PUP.Optional.BabylonToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\b (PUP.Optional.BabylonToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\Typelib\{6E8BF012-2C85-4834-B10A-1B31AF173D70} (PUP.Optional.BabylonToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\Interface\{44C3C1DB-2127-433C-98EC-4C9412B5FC3A} (PUP.Optional.BabylonToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\{77D46E27-0E41-4478-87A6-AABE6FBCF252} (PUP.Optional.GreatSaver.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68B81CCD-A80C-4060-8947-5AE69ED01199} (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8375D9C8-634F-4ECB-8CF5-C7416BA5D542} (PUP.Optional.BabylonToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E6B969FB-6D33-48d2-9061-8BBD4899EB08} (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF987D06-1DCF-7B36-5B43-13BC8699C44C} (PUP.Optional.MultiPlug.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DSite (PUP.Optional.DigitalSites.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\esrv.ividiESrvc (PUP.Optional.iVIDI.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\esrv.ividiESrvc.1 (PUP.Optional.iVIDI.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\ividi.ividiappCore (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\ividi.ividiappCore.1 (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\AppID\priam_bho.DLL (PUP.Optional.Wajam.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\BabylonToolbar (PUP.Optional.BabylonToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\SmartbarBackup (PUP.Optional.SmartBar) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\SmartbarLog (PUP.Optional.SmartBar) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\DEALPLY (PUP.Optional.DealPly.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Unitech LLC\ividi (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\Software\1ClickDownload (PUP.Optional.1ClickDownload.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\Software\delta LTD (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\Software\Iminent (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\Software\iVIDI Plugin (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\Software\BabSolution\Updater (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\Software\Google\Chrome\Extensions\amfclgbdpgndipgoegfpkkgobahigbcl (PUP.Optional.SmartBar) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\SWEETIM (PUP.Optional.SweetIM.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\WAJAM (PUP.Optional.Wajam.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\BabylonToolbar (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\DEALPLY (PUP.Optional.DealPly.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Delta\delta\Instl (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Google\chrome\Extensions\kpdhgpkkloealnjnmepfhanpcleldbef (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Unitech LLC\ividi (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Vittalia\AxtanInstaller (PUP.Optional.BundleInstaller.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\Software\Iminent (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\SWEETIM (PUP.Optional.SweetIM.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\CLSID\{211B330A-499B-415E-B1F1-B7132A8751D2} (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\CLSID\{D18734A5-B131-4335-A3E0-15FF90AC90EE} (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\i (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\TypeLib\{905E34C2-F4EB-49BE-A36B-47692CF957A8} (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ividi (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\CLSID\{8B8B2E80-1444-451D-AC8E-EB9A847F3887} (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\ividi.ividiHlpr.1 (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\ividi.ividiHlpr (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{8B8B2E80-1444-451D-AC8E-EB9A847F3887} (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{8B8B2E80-1444-451D-AC8E-EB9A847F3887} (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 9
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run|22857 (Spyware.Zbot.ED) -> Daten: c:\progra~3\msxcjos.exe -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Wcenter (Trojan.Agent) -> Daten: C:\Users\Pc\AppData\Roaming\Microsoft\Wcenter11.exe -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\DealPly|Partner (PUP.Optional.DealPly.A) -> Daten: iron -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer|NoFolderOptions (Hijack.FolderOptions) -> Daten: 1 -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\Software\Mozilla\Firefox\Extensions|{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2} (PUP.Optional.Wajam.A) -> Daten: C:\Program Files (x86)\Wajam\Firefox\{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2}.xpi -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\Software\SweetIM|simapp_id (PUP.Optional.SweetIM.A) -> Daten: 11111111 -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\Software\Wajam|affiliate_id (PUP.Optional.Wajam.A) -> Daten: 6447 -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\DealPly|ChromeCrxPath (PUP.Optional.DealPly.A) -> Daten: C:\Program Files (x86)\DealPly\DealPly.crx -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\Software\SweetIM|simapp_id (PUP.Optional.SweetIM.A) -> Daten: 11111111 -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateiobjekte der Registrierung: 2
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main|Start Page (PUP.Optional.Conduit.A) -> Bösartig: (hxxp://search.conduit.com/?ctid=CT3312375&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=2&UP=SP09C9C74C-9231-4E89-8648-D5B7D174D75E) Gut: (hxxp://www.google.com) -> Erfolgreich ersetzt und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System|DisableTaskMgr (PUM.Hijack.TaskManager) -> Bösartig: (1) Gut: (0) -> Erfolgreich ersetzt und in Quarantäne gestellt.

Infizierte Verzeichnisse: 19
C:\Users\Pc\AppData\Roaming\Unitech LLC (PUP.Optional.Unitech.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Pc\AppData\Roaming\DigitalSites\UpdateProc (PUP.Optional.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Pc\Documents\PCSpeedUp (PUP.Optional.PCSpeedUp.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Pc\Documents\PCSpeedUp\RestorePoints (PUP.Optional.PCSpeedUp.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Pc\Documents\PCSpeedUp\ScanResults (PUP.Optional.PCSpeedUp.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Pc\AppData\Roaming\File Scout (PUP.Optional.FileScout.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\LyricsFinder (PUP.Optional.AddLyrics.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\LyricsMonkey (PUP.Optional.LyricsMonkey.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\LyricsMonkey\FF (PUP.Optional.LyricsMonkey.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\LyricsMonkey\FF\chrome (PUP.Optional.LyricsMonkey.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\LyricsMonkey\FF\chrome\content (PUP.Optional.LyricsMonkey.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Mysearchdial (PUP.Optional.MySearchDial.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wajam (PUP.Optional.Wajam.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Unitech LLC\ividi (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Unitech LLC\ividi\1.8.23.0 (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Unitech LLC\ividi\1.8.23.0\bh (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpdhgpkkloealnjnmepfhanpcleldbef (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpdhgpkkloealnjnmepfhanpcleldbef\1.0_1 (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\YoutubeAdblocker (PUP.Optional.Multiplug) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateien: 105
C:\Users\Pc\AppData\Local\Temp\ba58Installer.exe (PUP.Optional.Vittalia) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\msxcjos.exe (Spyware.Zbot.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\50Coeuupons\gKoa.dll (PUP.Optional.MultiPlug.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\FuNDeaulls\DD2qL.dll (PUP.Optional.MultiPlug.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\trz15FC.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\trz16DA.tmp (Trojan.ExploitDrop.BV) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\trz1DE9.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\trz25E6.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\trz2DE3.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\trz2E12.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\trz35DF.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\trz360F.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\trz3E0C.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\trz4608.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\trz4E24.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\trz5611.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\trz5E0E.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\trz603.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\trz660A.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\trz6E07.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\trz7613.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\trz7E10.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\trz861C.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\trz8E19.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\trz9615.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\trz9E31.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\trzA62E.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\trzAE2A.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\trzB637.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\trzBE24.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\trzC630.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\trzCE1D.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\trzD619.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\trzDE16.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\trzE00.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\trzE613.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\trzE7BF.tmp (Trojan.ExploitDrop.BV) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\trzEE00.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\trzFE7.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\50Coeuupons\gKoa.exe (PUP.Optional.MultiPlug.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\50Coeuupons\gKoa.x64.dll (PUP.Optional.MultiPlug.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\FuNDeaulls\DD2qL.x64.dll (PUP.Optional.MultiPlug.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\InstallMate\{FA676CA0-EE7A-4B03-A9E8-A65821844E56}\Custom.dll (PUP.Optional.InstalleRex) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Pc\AppData\Roaming\libcurl-4.dll (Trojan.Miner) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Pc\AppData\Roaming\DSite\UpdateProc\UpdateTask.exe (PUP.Optional.DigitalSites.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Pc\AppData\Local\Temp\instloffer.exe (PUP.Optional.Vittalia) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Pc\msntoz.exe (Spyware.Zbot.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Pc\aoajz\vfYREdWoH.exe (Misused.Legit.AI) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Pc\Downloads\Blade_.exe (PUP.Optional.ToolBarInstaller.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Pc\Downloads\Europa Universalis IV-FLT.exe (PUP.Optional.InstalleRex) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Pc\Downloads\LOL Replay provided through GetNow.exe (PUP.Optional.LiveSoftAction.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Pc\Downloads\Lord_of_the_Rings-Battle_for_Middle-Earth_II_secure.exe (PUP.Optional.Topmedia) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Pc\Downloads\My flower collection(1).rar (Hacktool.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Pc\Downloads\My flower collection.rar (Hacktool.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Pc\Downloads\Rust_ESP_GOD_SPAWN_Hack_Downloader.exe (PUP.Optional.FilePile.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Pc\Downloads\Rust_hack steam undetected by VAC.zip (Spyware.Zbot.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Pc\Downloads\SoftonicDownloader_for_instagram-downloader.exe (PUP.Optional.Softonic.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Pc\Downloads\SoftonicDownloader_fuer_pc-tools-spyware-doctor-mit-antivirus-2011.exe (PUP.Optional.Softonic.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Pc\Downloads\SoftonicDownloader_fuer_rome-total-war-barbarian-invasion.exe (PUP.Optional.Softonic.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Pc\Downloads\SoftonicDownloader_per_yu-gi-oh-online-3.exe (PUP.Optional.Softonic.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Pc\Downloads\swords and sandals 3 multiplae ultratus setup.exe (PUP.Optional.AdBundle) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Pc\Downloads\YTDSetup_3.9.3.exe (PUP.Optional.MyEmoticons.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Pc\xripb\UPlCliaaJ.exe (Misused.Legit.AI) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\875b1.msi (PUP.Optional.SmartBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Microsoft.NET\Framework\v2.0.50727\miner.exe (Trojan.Dropper.SFX) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Pc\AppData\Roaming\Unitech LLC\sqlite3.dll (PUP.Optional.Unitech.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Pc\AppData\Roaming\Microsoft\Wcenter11.exe (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Pc\AppData\Roaming\DigitalSites\UpdateProc\UpdateTask.exe (PUP.Optional.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Pc\AppData\Roaming\DigitalSites\UpdateProc\config.dat (PUP.Optional.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Pc\AppData\Roaming\DigitalSites\UpdateProc\info.dat (PUP.Optional.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Pc\AppData\Roaming\DigitalSites\UpdateProc\STTL.DAT (PUP.Optional.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Pc\AppData\Roaming\DigitalSites\UpdateProc\TTL.DAT (PUP.Optional.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Pc\AppData\Roaming\phatk121016.cl (Malware.Trace) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Pc\AppData\Roaming\scrypt130511.cl (Malware.Trace) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Pc\AppData\Local\mysearchdial_speedial_v9.0.2.crx (PUP.Optional.MySearchDial.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Pc\Documents\PCSpeedUp\App.log (PUP.Optional.PCSpeedUp.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Pc\AppData\Roaming\File Scout\uninst.exe (PUP.Optional.FileScout.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\LyricsMonkey\chrome.manifest (PUP.Optional.LyricsMonkey.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\LyricsMonkey\FF\chrome.manifest (PUP.Optional.LyricsMonkey.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\LyricsMonkey\FF\install.rdf (PUP.Optional.LyricsMonkey.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\LyricsMonkey\FF\chrome\content\icon.png (PUP.Optional.LyricsMonkey.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\LyricsMonkey\FF\chrome\content\overlay.xul (PUP.Optional.LyricsMonkey.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Mysearchdial\uninst.dat (PUP.Optional.MySearchDial.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wajam\uninstall.lnk (PUP.Optional.Wajam.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Unitech LLC\ividi\1.8.23.0\ividi.crx (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Unitech LLC\ividi\1.8.23.0\ividiApp.dll (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Unitech LLC\ividi\1.8.23.0\ividiEng.dll (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Unitech LLC\ividi\1.8.23.0\ividisrv.exe (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Unitech LLC\ividi\1.8.23.0\uninstall.exe (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Unitech LLC\ividi\1.8.23.0\bh\ividi.dll (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpdhgpkkloealnjnmepfhanpcleldbef\1.0_1\appCntrl.js (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpdhgpkkloealnjnmepfhanpcleldbef\1.0_1\bg.html (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpdhgpkkloealnjnmepfhanpcleldbef\1.0_1\bg.js (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpdhgpkkloealnjnmepfhanpcleldbef\1.0_1\CrmAdpt.dll (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpdhgpkkloealnjnmepfhanpcleldbef\1.0_1\ct.js (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpdhgpkkloealnjnmepfhanpcleldbef\1.0_1\CTB.dll (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpdhgpkkloealnjnmepfhanpcleldbef\1.0_1\dpk.js (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpdhgpkkloealnjnmepfhanpcleldbef\1.0_1\hprtkMsg.htm (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpdhgpkkloealnjnmepfhanpcleldbef\1.0_1\hprtkMsg.js (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpdhgpkkloealnjnmepfhanpcleldbef\1.0_1\json2.min.js (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpdhgpkkloealnjnmepfhanpcleldbef\1.0_1\logo.png (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpdhgpkkloealnjnmepfhanpcleldbef\1.0_1\manifest.json (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpdhgpkkloealnjnmepfhanpcleldbef\1.0_1\pref.json (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\YoutubeAdblocker\3ooCV2jP.dat (PUP.Optional.Multiplug) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\YoutubeAdblocker\3ooCV2jP.tlb (PUP.Optional.Multiplug) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
         

protection log

2014/02/11 20:59:27 +0100	PC-PC	Pc	MESSAGE	Starting protection
2014/02/11 20:59:27 +0100	PC-PC	Pc	MESSAGE	Protection started successfully
2014/02/11 20:59:27 +0100	PC-PC	Pc	MESSAGE	Starting IP protection
2014/02/11 20:59:39 +0100	PC-PC	Pc	MESSAGE	IP Protection started successfully
2014/02/11 20:59:47 +0100	PC-PC	Pc	IP-BLOCK	37.221.163.19 (Type: outgoing, Port: 49302, Process: cvtres.exe)
2014/02/11 20:59:47 +0100	PC-PC	Pc	IP-BLOCK	37.221.163.19 (Type: incoming, Port: 28769, Process: svchost.exe)
2014/02/11 20:59:47 +0100	PC-PC	Pc	IP-BLOCK	37.221.163.19 (Type: incoming, Port: 49302, Process: svchost.exe)
2014/02/11 20:59:56 +0100	PC-PC	Pc	IP-BLOCK	37.221.163.19 (Type: incoming, Port: 49302, Process: svchost.exe)
2014/02/11 20:59:56 +0100	PC-PC	Pc	IP-BLOCK	37.221.163.19 (Type: outgoing, Port: 50335, Process: cvtres.exe)
2014/02/11 20:59:56 +0100	PC-PC	Pc	IP-BLOCK	37.221.163.19 (Type: incoming, Port: 49302, Process: svchost.exe)
2014/02/11 20:59:56 +0100	PC-PC	Pc	IP-BLOCK	37.221.163.19 (Type: outgoing, Port: 50336, Process: cvtres.exe)
2014/02/11 20:59:56 +0100	PC-PC	Pc	IP-BLOCK	37.221.163.19 (Type: incoming, Port: 49302, Process: svchost.exe)
2014/02/11 21:00:00 +0100	PC-PC	Pc	MESSAGE	Starting database refresh
2014/02/11 21:00:00 +0100	PC-PC	Pc	MESSAGE	Stopping IP protection
2014/02/11 21:00:02 +0100	PC-PC	Pc	MESSAGE	IP Protection stopped successfully
2014/02/11 21:00:07 +0100	PC-PC	Pc	MESSAGE	Database refreshed successfully
2014/02/11 21:00:07 +0100	PC-PC	Pc	MESSAGE	Starting IP protection
2014/02/11 21:00:09 +0100	PC-PC	Pc	MESSAGE	IP Protection started successfully
2014/02/11 21:01:11 +0100	PC-PC	Pc	IP-BLOCK	37.221.163.19 (Type: outgoing, Port: 50343, Process: cvtres.exe)
2014/02/11 21:01:12 +0100	PC-PC	Pc	IP-BLOCK	37.221.163.19 (Type: outgoing, Port: 50373, Process: cvtres.exe)
2014/02/11 21:01:12 +0100	PC-PC	Pc	IP-BLOCK	37.221.163.19 (Type: outgoing, Port: 50381, Process: cvtres.exe)
2014/02/11 21:01:20 +0100	PC-PC	Pc	IP-BLOCK	37.221.163.19 (Type: outgoing, Port: 50385, Process: cvtres.exe)
2014/02/11 21:01:36 +0100	PC-PC	Pc	IP-BLOCK	37.221.163.19 (Type: outgoing, Port: 50396, Process: cvtres.exe)
2014/02/11 21:02:08 +0100	PC-PC	Pc	IP-BLOCK	37.221.163.19 (Type: outgoing, Port: 50405, Process: cvtres.exe)
2014/02/11 21:03:03 +0100	PC-PC	Pc	MESSAGE	Executing scheduled update:  Daily
2014/02/11 21:03:08 +0100	PC-PC	Pc	MESSAGE	Database already up-to-date
2014/02/11 21:03:12 +0100	PC-PC	Pc	IP-BLOCK	37.221.163.19 (Type: outgoing, Port: 50413, Process: cvtres.exe)
2014/02/11 21:05:22 +0100	PC-PC	Pc	IP-BLOCK	37.221.163.19 (Type: outgoing, Port: 50425, Process: cvtres.exe)
2014/02/11 21:06:11 +0100	PC-PC	Pc	IP-BLOCK	37.221.163.19 (Type: incoming, Port: 49302, Process: svchost.exe)
2014/02/11 21:06:59 +0100	PC-PC	Pc	IP-BLOCK	37.221.163.19 (Type: incoming, Port: 50343, Process: svchost.exe)
2014/02/11 21:08:44 +0100	PC-PC	Pc	IP-BLOCK	37.221.163.19 (Type: outgoing, Port: 50446, Process: cvtres.exe)
2014/02/11 21:11:54 +0100	PC-PC	Pc	DETECTION	C:\ProgramData\msxcjos.exe	Spyware.Zbot.ED	QUARANTINE
2014/02/11 21:12:07 +0100	PC-PC	Pc	IP-BLOCK	37.221.163.19 (Type: outgoing, Port: 50474, Process: cvtres.exe)
2014/02/11 21:12:07 +0100	PC-PC	Pc	IP-BLOCK	37.221.163.19 (Type: incoming, Port: 49302, Process: svchost.exe)
2014/02/11 21:12:56 +0100	PC-PC	Pc	IP-BLOCK	37.221.163.19 (Type: incoming, Port: 50343, Process: svchost.exe)
2014/02/11 21:15:23 +0100	PC-PC	Pc	IP-BLOCK	37.221.163.19 (Type: outgoing, Port: 50480, Process: cvtres.exe)
2014/02/11 21:18:46 +0100	PC-PC	Pc	IP-BLOCK	37.221.163.19 (Type: outgoing, Port: 50507, Process: cvtres.exe)
2014/02/11 21:22:03 +0100	PC-PC	Pc	IP-BLOCK	37.221.163.19 (Type: outgoing, Port: 50523, Process: cvtres.exe)
2014/02/11 21:25:27 +0100	PC-PC	Pc	IP-BLOCK	37.221.163.19 (Type: outgoing, Port: 50535, Process: cvtres.exe)
2014/02/11 21:28:40 +0100	PC-PC	Pc	IP-BLOCK	37.221.163.19 (Type: outgoing, Port: 50550, Process: cvtres.exe)
2014/02/11 21:31:09 +0100	PC-PC	Pc	DETECTION	C:\ProgramData\msxcjos.exe	Spyware.Zbot.ED	QUARANTINE
2014/02/11 21:35:58 +0100	PC-PC	Pc	MESSAGE	Starting protection
2014/02/11 21:35:58 +0100	PC-PC	Pc	MESSAGE	Protection started successfully
2014/02/11 21:35:58 +0100	PC-PC	Pc	MESSAGE	Starting IP protection
2014/02/11 21:35:59 +0100	PC-PC	Pc	MESSAGE	IP Protection started successfully
2014/02/11 21:38:57 +0100	PC-PC	Pc	IP-BLOCK	37.221.163.19 (Type: outgoing, Port: 49180, Process: cvtres.exe)
2014/02/11 21:38:57 +0100	PC-PC	Pc	IP-BLOCK	37.221.163.19 (Type: outgoing, Port: 49181, Process: cvtres.exe)
2014/02/11 21:39:05 +0100	PC-PC	Pc	IP-BLOCK	37.221.163.19 (Type: outgoing, Port: 49182, Process: cvtres.exe)
2014/02/11 21:39:13 +0100	PC-PC	Pc	IP-BLOCK	37.221.163.19 (Type: outgoing, Port: 49183, Process: cvtres.exe)
2014/02/11 21:39:30 +0100	PC-PC	Pc	IP-BLOCK	37.221.163.19 (Type: outgoing, Port: 49184, Process: cvtres.exe)
2014/02/11 21:40:59 +0100	PC-PC	Pc	IP-BLOCK	37.221.163.19 (Type: outgoing, Port: 49215, Process: cvtres.exe)
2014/02/11 21:43:09 +0100	PC-PC	Pc	IP-BLOCK	37.221.163.19 (Type: outgoing, Port: 49250, Process: cvtres.exe)
2014/02/11 21:45:27 +0100	PC-PC	Pc	DETECTION	C:\Users\Pc\Downloads\installer_spyware_doctor_9_0_0_2308_Deutsch.exe	PUP.Optional.Vittalia	QUARANTINE
2014/02/11 21:46:16 +0100	PC-PC	Pc	DETECTION	c:\users\pc\downloads\installer_spyware_doctor_9_0_0_2308_deutsch.exe	PUP.Optional.Vittalia	QUARANTINE
2014/02/11 21:46:16 +0100	PC-PC	Pc	ERROR	Quarantine failed:  SDKQuarantine failed with error code 2
2014/02/11 21:46:24 +0100	PC-PC	Pc	DETECTION	c:\users\pc\downloads\installer_spyware_doctor_9_0_0_2308_deutsch.exe	PUP.Optional.Vittalia	QUARANTINE
2014/02/11 21:46:24 +0100	PC-PC	Pc	ERROR	Quarantine failed:  SDKQuarantine failed with error code 2
2014/02/11 21:46:30 +0100	PC-PC	Pc	IP-BLOCK	37.221.163.19 (Type: outgoing, Port: 49273, Process: cvtres.exe)
2014/02/11 21:47:20 +0100	PC-PC	Pc	DETECTION	c:\users\pc\downloads\installer_spyware_doctor_9_0_0_2308_deutsch.exe	PUP.Optional.Vittalia	QUARANTINE
2014/02/11 21:47:20 +0100	PC-PC	Pc	ERROR	Quarantine failed:  SDKQuarantine failed with error code 2
2014/02/11 21:48:30 +0100	PC-PC	Pc	DETECTION	c:\users\pc\downloads\installer_spyware_doctor_9_0_0_2308_deutsch.exe	PUP.Optional.Vittalia	QUARANTINE
2014/02/11 21:48:31 +0100	PC-PC	Pc	ERROR	Quarantine failed:  SDKQuarantine failed with error code 2
2014/02/11 21:49:51 +0100	PC-PC	Pc	IP-BLOCK	37.221.163.19 (Type: outgoing, Port: 49302, Process: cvtres.exe)
2014/02/11 22:06:12 +0100	PC-PC	Pc	DETECTION	C:\Users\Pc\Desktop\Downloads\Cracks\win 7\Wat\RemoveWAT.2.2.7.0 softwarespro.com\RemoveWAT.2.2.7.0.exe	HackTool.Wpakill	QUARANTINE
2014/02/11 22:06:29 +0100	PC-PC	Pc	IP-BLOCK	37.221.163.19 (Type: outgoing, Port: 49434, Process: cvtres.exe)
2014/02/11 22:08:40 +0100	PC-PC	Pc	DETECTION	C:\Users\Pc\Desktop\Downloads\Cracks\win 7\Wat\RemoveWAT.2.2.7.0 softwarespro.com\RemoveWAT.2.2.7.0.exe	HackTool.Wpakill	QUARANTINE
2014/02/11 22:09:23 +0100	PC-PC	Pc	DETECTION	C:\Users\Pc\Desktop\Downloads\Cracks\win 7\Wat\RemoveWAT.2.2.7.0 softwarespro.com\RemoveWAT.2.2.7.0.exe	HackTool.Wpakill	QUARANTINE
2014/02/11 22:09:49 +0100	PC-PC	Pc	IP-BLOCK	37.221.163.19 (Type: outgoing, Port: 49455, Process: cvtres.exe)
2014/02/11 22:13:10 +0100	PC-PC	Pc	IP-BLOCK	37.221.163.19 (Type: outgoing, Port: 49524, Process: cvtres.exe)
2014/02/11 22:16:30 +0100	PC-PC	Pc	IP-BLOCK	37.221.163.19 (Type: outgoing, Port: 49610, Process: cvtres.exe)
2014/02/11 22:19:51 +0100	PC-PC	Pc	IP-BLOCK	37.221.163.19 (Type: outgoing, Port: 49708, Process: cvtres.exe)
2014/02/11 22:23:11 +0100	PC-PC	Pc	IP-BLOCK	37.221.163.19 (Type: outgoing, Port: 49726, Process: cvtres.exe)
2014/02/11 22:26:32 +0100	PC-PC	Pc	IP-BLOCK	37.221.163.19 (Type: outgoing, Port: 49732, Process: cvtres.exe)
2014/02/11 22:29:53 +0100	PC-PC	Pc	IP-BLOCK	37.221.163.19 (Type: outgoing, Port: 49739, Process: cvtres.exe)
2014/02/11 22:33:14 +0100	PC-PC	Pc	IP-BLOCK	37.221.163.19 (Type: outgoing, Port: 49743, Process: cvtres.exe)
2014/02/11 22:34:34 +0100	PC-PC	Pc	MESSAGE	Stopping protection
2014/02/11 22:34:34 +0100	PC-PC	Pc	MESSAGE	Protection stopped successfully
2014/02/11 22:34:34 +0100	PC-PC	Pc	MESSAGE	Stopping IP protection
2014/02/11 22:34:35 +0100	PC-PC	Pc	MESSAGE	IP Protection stopped successfully
2014/02/11 22:34:36 +0100	PC-PC	Pc	MESSAGE	Protection stopped
         

Lesestoff:
Banking-Trojaner
Wenn du mit diesem Computer beispielsweise Onlinebanking machst, dann solltest du zumindest dein Passwort von deiner Bank ändern lassen, wenn du ein ansonsten sicheres Verfahren wie beispielsweise "chip-TAN-comfort" nutzt. Hast du noch alte TAN-Bögen auf Papierbasis? Dann ist es höchste Zeit dich bei deiner Bank zu melden und notfalls das Konto temporär sperren zu lassen. Der Sperrnotruf 116 116 von www.sperr-notruf.de kann Tag und Nacht dafür benutzt werden.

Schritt 1
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

cmd: type "C:\Users\Pc\cc4j5zs76kd2kj\92050.vbs"
         

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

• Starte nun FRST erneut und klicke den Entfernen Button.
• Das Tool erstellt eine Fixlog.txt.
• Poste mir deren Inhalt.

Schritt 2
Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

• WICHTIG: Speichere Combofix auf deinem Desktop.
• Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
• Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
• Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
• Wenn Combofix fertig ist, wird es ein Logfile erstellen.
• Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

Schritt 3
Downloade dir bitte Farbar Service Scanner

• Starte das Tool mit Doppelklick auf die FSS.exe
• Gehe sicher, dass folgende Optionen angehakt sind.
  • Internet Services
  • Windows Firewall
  • System Restore
  • Security Center/Action Center
  • Windows Update
  • Windows Defender
  • Other Services
• Klicke auf Scan.
• Wenn das Tool fertig ist, wird es eine FSS.txt in dem Verzeichnis erstellen, wo das Tool gelaufen ist.

Poste bitte den Inhalt hier.

Poste folgende Logfiles in deiner nächsten Antwort:

• FRST-Fix
• Combofix-Scan
• FSS-Scan

Ich hatte Probleme bei Combofix. Immer wenn 50% erreicht wurden, erhielt ich einen Bluescreen und der Pc wurde neu gestartet. Also habe ich die Anwendung im abgesicherten Modus gestartet und dann ging es auch.

Folgendes hat sich verbessert:
-Taskmanager lässt sich nun starten
-Sicherheitscenter bleibt aktiviert
-Cvtres.exe stellt keine Verbindung mehr auf Websiten her
-Läuft Spürbar schneller

Folgende Probleme bestehen noch:
-Windows Defender lässt sich weiterhin nicht starten
-hohe CPU Auslastung wenn es anspruchsvoller wird, z.B wenn ich youtube öffne, wo man Flash benutzt. Der Browser hängt sich auf und möchte anschließend ein Skript beenden.
-svchost.exe hat permanent 150.000 K und Firefox 250.000 K. Ob das unnormal ist, weiß ich nicht.

Nun die Logs:

Fixlog

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 10-02-2014 01
Ran by Pc at 2014-02-12 18:54:45 Run:1
Running from C:\Users\Pc\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
cmd: type "C:\Users\Pc\cc4j5zs76kd2kj\92050.vbs"
         
*****************


=========  type "C:\Users\Pc\cc4j5zs76kd2kj\92050.vbs" =========

const Hidden = 0
const WaitOnReturn = true
File ="C:\Users\Pc\cc4j5zs76kd2kj\87080.cmd"
set WshShell = CreateObject("WScript.Shell")
WshShell.Run file, Hidden, WaitOnReturn
wscript.quit
========= End of CMD: =========


==== End of Fixlog ====
         

Combofix

ComboFix 14-02-12.01 - Pc 12.02.2014  19:47:01.1.6 - x64 MINIMAL
Microsoft Windows 7 Enterprise   6.1.7601.1.1252.49.1031.18.8174.7341 [GMT 1:00]
ausgeführt von:: c:\users\Pc\Desktop\ComboFix.exe
AV: Norton Internet Security *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
SP: Norton Internet Security *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\CFLog
c:\cflog\EPLog.txt
C:\install.exe
c:\program files (x86)\VLC Media Player DB Toolbar Toolbar\tbHElper.dll
c:\programdata\cefbaeacdccceac.cfg
c:\programdata\cefbaeacdccceasacfsfdsf.exe
c:\programdata\libnspr4.dll
c:\users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj
c:\users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj\1.0\background.html
c:\users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj\1.0\content.js
c:\users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj\1.0\lsdb.js
c:\users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj\1.0\manifest.json
c:\users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj\1.0\nTLmEXxb3b.js
c:\users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai
c:\users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai\2.7\background.html
c:\users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai\2.7\content.js
c:\users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai\2.7\lsdb.js
c:\users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai\2.7\manifest.json
c:\users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai\2.7\nAt4RipyWxL.js
c:\users\ASPNET\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj
c:\users\ASPNET\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj\1.0\background.html
c:\users\ASPNET\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj\1.0\content.js
c:\users\ASPNET\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj\1.0\lsdb.js
c:\users\ASPNET\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj\1.0\manifest.json
c:\users\ASPNET\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj\1.0\nTLmEXxb3b.js
c:\users\ASPNET\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai
c:\users\ASPNET\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai\2.7\background.html
c:\users\ASPNET\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai\2.7\content.js
c:\users\ASPNET\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai\2.7\lsdb.js
c:\users\ASPNET\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai\2.7\manifest.json
c:\users\ASPNET\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai\2.7\nAt4RipyWxL.js
c:\users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj
c:\users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj\1.0\background.html
c:\users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj\1.0\content.js
c:\users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj\1.0\lsdb.js
c:\users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj\1.0\manifest.json
c:\users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj\1.0\nTLmEXxb3b.js
c:\users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai
c:\users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai\2.7\background.html
c:\users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai\2.7\content.js
c:\users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai\2.7\lsdb.js
c:\users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai\2.7\manifest.json
c:\users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai\2.7\nAt4RipyWxL.js
c:\users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj
c:\users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj\1.0\background.html
c:\users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj\1.0\content.js
c:\users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj\1.0\lsdb.js
c:\users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj\1.0\manifest.json
c:\users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj\1.0\nTLmEXxb3b.js
c:\users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai
c:\users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai\2.7\background.html
c:\users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai\2.7\content.js
c:\users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai\2.7\lsdb.js
c:\users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai\2.7\manifest.json
c:\users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai\2.7\nAt4RipyWxL.js
c:\users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\eimkiigpdkahjnigfhahhebfencphpll
c:\users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\eimkiigpdkahjnigfhahhebfencphpll\2.2\background.html
c:\users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\eimkiigpdkahjnigfhahhebfencphpll\2.2\content.js
c:\users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\eimkiigpdkahjnigfhahhebfencphpll\2.2\E4Apsx8.js
c:\users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\eimkiigpdkahjnigfhahhebfencphpll\2.2\lsdb.js
c:\users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\eimkiigpdkahjnigfhahhebfencphpll\2.2\manifest.json
c:\users\Pc\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_eimkiigpdkahjnigfhahhebfencphpll_0.localstorage
c:\users\Pc\AppData\Local\Google\Chrome\User Data\Default\Preferences
c:\users\Pc\AppData\Roaming\Microsoft\Wcenter42.exe
c:\users\Pc\AppData\Roaming\Microsoft\Wcenter9.exe
c:\users\Pc\AppData\Roaming\poclbm130302.cl
c:\windows\SysWow64\frapsvid.dll
c:\windows\SysWow64\SET7022.tmp
.
.
(((((((((((((((((((((((   Dateien erstellt von 2014-01-12 bis 2014-02-12  ))))))))))))))))))))))))))))))
.
.
2014-02-12 18:59 . 2014-02-12 18:59	--------	d-----w-	c:\users\hedev\AppData\Local\temp
2014-02-12 18:59 . 2014-02-12 18:59	--------	d-----w-	c:\users\Default\AppData\Local\temp
2014-02-12 13:12 . 2014-02-12 13:12	--------	d-----w-	c:\program files (x86)\DLLSuite
2014-02-12 12:51 . 2014-02-12 12:51	--------	d-----w-	c:\users\Pc\AppData\Roaming\DriverCure
2014-02-12 12:51 . 2014-02-12 12:51	--------	d-----w-	c:\users\Pc\AppData\Roaming\ParetoLogic
2014-02-12 12:51 . 2014-02-12 12:51	--------	d-----w-	c:\program files (x86)\Common Files\ParetoLogic
2014-02-12 12:51 . 2014-02-12 12:51	--------	d-----w-	c:\programdata\ParetoLogic
2014-02-12 12:51 . 2014-02-12 12:51	--------	d-----w-	c:\program files (x86)\ParetoLogic
2014-02-11 21:23 . 2014-02-12 17:54	--------	d-----w-	C:\FRST
2014-02-11 20:23 . 2014-02-11 21:00	--------	d-----w-	c:\programdata\SecTaskMan
2014-02-11 20:22 . 2014-02-11 20:23	--------	d-----w-	c:\program files (x86)\Security Task Manager
2014-02-11 20:03 . 2014-02-11 20:03	--------	d-----w-	c:\users\Pc\AppData\Roaming\TestApp
2014-02-11 16:50 . 2014-02-11 16:54	--------	d-----w-	c:\programdata\PC Tools
2014-02-11 15:54 . 2014-02-11 15:54	--------	d-----w-	c:\programdata\SMR410
2014-02-11 15:50 . 2014-02-11 16:34	--------	d-----w-	c:\users\Pc\AppData\Local\NPE
2014-02-11 15:35 . 2014-02-12 18:44	--------	d-----w-	c:\program files (x86)\Norton Internet Security
2014-02-11 15:35 . 2014-02-11 20:23	--------	d-----w-	c:\users\Pc\AppData\Roaming\DigitalSites
2014-02-11 15:34 . 2014-02-11 15:34	--------	d-s---w-	c:\windows\SysWow64\Microsoft
2014-02-11 15:30 . 2013-12-18 20:09	96168	----a-w-	c:\windows\SysWow64\WindowsAccessBridge-32.dll
2014-02-11 14:59 . 2014-02-11 14:59	--------	d-----w-	c:\users\Pc\AppData\Roaming\Oxy
2014-02-11 14:34 . 2014-02-11 14:34	--------	d-sh--r-	c:\users\Pc\cc4j5zs76kd2kj
2014-02-04 15:14 . 2013-06-12 14:15	119888	----a-w-	c:\users\Pc\AppData\Roaming\pthreadGC2.dll
2014-02-04 15:14 . 2013-06-12 14:15	100864	----a-w-	c:\users\Pc\AppData\Roaming\zlib1.dll
2014-02-04 14:05 . 2014-02-11 20:23	--------	d-sh--r-	c:\users\Pc\aoajz
2014-02-04 12:09 . 2014-02-04 12:12	--------	d-----w-	c:\users\Pc\AppData\Roaming\Riot Games
2014-02-04 11:08 . 2014-02-11 20:23	--------	d-sh--r-	c:\users\Pc\xripb
2014-01-31 09:18 . 2013-12-04 03:28	10315576	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{BA7BA143-B6AE-460D-B6C1-7DFC7B384AA7}\mpengine.dll
2014-01-21 09:23 . 2014-02-04 11:20	--------	d-----w-	c:\users\Pc\AppData\Local\CyberGhost
2014-01-21 09:22 . 2014-01-21 09:23	--------	d-----w-	c:\program files\TAP-Windows
2014-01-21 09:22 . 2014-01-21 09:27	--------	d-----w-	c:\program files\CyberGhost 5
2014-01-15 12:29 . 2013-11-27 01:41	343040	----a-w-	c:\windows\system32\drivers\usbhub.sys
2014-01-15 12:29 . 2013-11-27 01:41	99840	----a-w-	c:\windows\system32\drivers\usbccgp.sys
2014-01-15 12:29 . 2013-11-27 01:41	53248	----a-w-	c:\windows\system32\drivers\usbehci.sys
2014-01-15 12:29 . 2013-11-27 01:41	325120	----a-w-	c:\windows\system32\drivers\usbport.sys
2014-01-15 12:29 . 2013-11-27 01:41	25600	----a-w-	c:\windows\system32\drivers\usbohci.sys
2014-01-15 12:29 . 2013-11-27 01:41	30720	----a-w-	c:\windows\system32\drivers\usbuhci.sys
2014-01-15 12:29 . 2013-11-27 01:41	7808	----a-w-	c:\windows\system32\drivers\usbd.sys
2014-01-15 12:29 . 2013-11-26 10:32	3156480	----a-w-	c:\windows\system32\win32k.sys
2014-01-15 12:29 . 2013-11-26 11:40	376768	----a-w-	c:\windows\system32\drivers\netio.sys
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-02-12 07:31 . 2012-10-19 16:25	419840	----a-w-	c:\windows\system32\systemcpl.dll
2014-02-12 07:31 . 2012-10-19 16:25	14848	----a-w-	c:\windows\system32\slwga.dll
2014-02-12 07:31 . 2012-10-19 16:25	13824	----a-w-	c:\windows\SysWow64\slwga.dll
2014-02-12 07:31 . 2012-10-19 16:25	1008640	----a-w-	c:\windows\system32\user32.dll
2014-02-12 07:31 . 2012-10-19 16:25	833024	----a-w-	c:\windows\SysWow64\user32.dll
2014-02-07 13:59 . 2012-12-10 17:25	71048	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-02-07 13:59 . 2012-12-10 17:25	692616	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2014-02-05 11:36 . 2013-12-28 10:49	291128	----a-w-	c:\windows\SysWow64\PnkBstrB.xtr
2014-02-05 11:36 . 2013-08-18 16:42	291128	----a-w-	c:\windows\SysWow64\PnkBstrB.exe
2014-02-04 14:46 . 2013-08-18 16:42	291128	----a-w-	c:\windows\SysWow64\PnkBstrB.ex0
2014-01-24 21:17 . 2013-08-18 16:42	76888	----a-w-	c:\windows\SysWow64\PnkBstrA.exe
2014-01-16 13:24 . 2012-10-18 04:30	86054176	----a-w-	c:\windows\system32\MRT.exe
2013-12-30 13:47 . 2013-12-30 13:47	283064	----a-w-	c:\windows\system32\drivers\dtsoftbus01.sys
2013-12-18 05:13 . 2012-11-06 16:48	270496	------w-	c:\windows\system32\MpSigStub.exe
2013-12-06 22:07 . 2013-12-06 22:07	78432	----a-w-	c:\windows\system32\atimpc64.dll
2013-12-06 22:07 . 2013-12-06 22:07	78432	----a-w-	c:\windows\system32\amdpcom64.dll
2013-12-06 22:07 . 2013-12-06 22:07	71704	----a-w-	c:\windows\SysWow64\atimpc32.dll
2013-12-06 22:07 . 2013-12-06 22:07	71704	----a-w-	c:\windows\SysWow64\amdpcom32.dll
2013-12-06 22:04 . 2011-05-25 20:07	143304	----a-w-	c:\windows\system32\atiuxp64.dll
2013-12-06 22:03 . 2013-12-06 22:03	126336	----a-w-	c:\windows\SysWow64\atiuxpag.dll
2013-12-06 22:03 . 2011-07-08 02:46	115512	----a-w-	c:\windows\system32\atiu9p64.dll
2013-12-06 22:02 . 2011-07-08 02:45	98496	----a-w-	c:\windows\SysWow64\atiu9pag.dll
2013-12-06 22:01 . 2011-07-08 03:28	1318552	----a-w-	c:\windows\system32\aticfx64.dll
2013-12-06 22:01 . 2011-07-08 03:29	1100216	----a-w-	c:\windows\SysWow64\aticfx32.dll
2013-12-06 22:00 . 2011-07-08 03:10	9753752	----a-w-	c:\windows\system32\atidxx64.dll
2013-12-06 21:59 . 2013-12-06 21:59	8406024	----a-w-	c:\windows\SysWow64\atidxx32.dll
2013-12-06 21:59 . 2011-07-08 02:55	8287008	----a-w-	c:\windows\SysWow64\atiumdva.dll
2013-12-06 21:58 . 2011-07-08 03:00	6630232	----a-w-	c:\windows\SysWow64\atiumdag.dll
2013-12-06 21:57 . 2013-12-06 21:57	8927704	----a-w-	c:\windows\system32\atiumd6a.dll
2013-12-06 21:56 . 2013-12-06 21:56	7751920	----a-w-	c:\windows\system32\atiumd64.dll
2013-12-06 21:52 . 2013-12-06 21:52	13207552	----a-w-	c:\windows\system32\drivers\atikmdag.sys
2013-12-06 21:38 . 2013-12-06 21:38	230912	----a-w-	c:\windows\system32\clinfo.exe
2013-12-06 21:38 . 2013-12-06 21:38	1187342	----a-w-	c:\windows\system32\amdocl_as64.exe
2013-12-06 21:38 . 2013-12-06 21:38	1061902	----a-w-	c:\windows\system32\amdocl_ld64.exe
2013-12-06 21:38 . 2013-12-06 21:38	995342	----a-w-	c:\windows\SysWow64\amdocl_as32.exe
2013-12-06 21:38 . 2013-12-06 21:38	798734	----a-w-	c:\windows\SysWow64\amdocl_ld32.exe
2013-12-06 21:38 . 2013-12-06 21:38	99840	----a-w-	c:\windows\system32\OpenVideo64.dll
2013-12-06 21:38 . 2013-12-06 21:38	83968	----a-w-	c:\windows\SysWow64\OpenVideo.dll
2013-12-06 21:38 . 2013-12-06 21:38	86528	----a-w-	c:\windows\system32\OVDecode64.dll
2013-12-06 21:38 . 2013-12-06 21:38	73728	----a-w-	c:\windows\SysWow64\OVDecode.dll
2013-12-06 21:37 . 2013-12-06 21:37	29382144	----a-w-	c:\windows\system32\amdocl64.dll
2013-12-06 21:35 . 2013-12-06 21:35	24860160	----a-w-	c:\windows\SysWow64\amdocl.dll
2013-12-06 21:33 . 2013-12-06 21:33	63488	----a-w-	c:\windows\system32\OpenCL.dll
2013-12-06 21:33 . 2013-12-06 21:33	57344	----a-w-	c:\windows\SysWow64\OpenCL.dll
2013-12-06 21:26 . 2013-12-06 21:26	129536	----a-w-	c:\windows\system32\coinst_13.251.dll
2013-12-06 21:16 . 2013-12-06 21:16	26352128	----a-w-	c:\windows\system32\atio6axx.dll
2013-12-06 21:13 . 2013-12-06 21:13	368640	----a-w-	c:\windows\system32\atiapfxx.exe
2013-12-06 21:12 . 2013-12-06 21:12	62464	----a-w-	c:\windows\system32\aticalrt64.dll
2013-12-06 21:12 . 2013-12-06 21:12	52224	----a-w-	c:\windows\SysWow64\aticalrt.dll
2013-12-06 21:12 . 2013-12-06 21:12	55808	----a-w-	c:\windows\system32\aticalcl64.dll
2013-12-06 21:12 . 2013-12-06 21:12	49152	----a-w-	c:\windows\SysWow64\aticalcl.dll
2013-12-06 21:12 . 2013-12-06 21:12	15716352	----a-w-	c:\windows\system32\aticaldd64.dll
2013-12-06 21:09 . 2013-12-06 21:09	14302208	----a-w-	c:\windows\SysWow64\aticaldd.dll
2013-12-06 20:58 . 2013-12-06 20:58	22157824	----a-w-	c:\windows\SysWow64\atioglxx.dll
2013-12-06 20:53 . 2013-12-06 20:53	442368	----a-w-	c:\windows\system32\atidemgy.dll
2013-12-06 20:53 . 2013-12-06 20:53	31232	----a-w-	c:\windows\system32\atimuixx.dll
2013-12-06 20:53 . 2013-12-06 20:53	588288	----a-w-	c:\windows\system32\atieclxx.exe
2013-12-06 20:52 . 2013-12-06 20:52	239616	----a-w-	c:\windows\system32\atiesrxx.exe
2013-12-06 20:50 . 2013-12-06 20:50	190976	----a-w-	c:\windows\system32\atitmm64.dll
2013-12-06 20:22 . 2013-12-06 20:22	1144320	----a-w-	c:\windows\system32\atiadlxx.dll
2013-12-06 20:22 . 2013-12-06 20:22	825344	----a-w-	c:\windows\SysWow64\atiadlxy.dll
2013-12-06 20:22 . 2013-12-06 20:22	74752	----a-w-	c:\windows\system32\atig6pxx.dll
2013-12-06 20:22 . 2013-12-06 20:22	69632	----a-w-	c:\windows\SysWow64\atiglpxx.dll
2013-12-06 20:22 . 2013-12-06 20:22	69632	----a-w-	c:\windows\system32\atiglpxx.dll
2013-12-06 20:22 . 2013-12-06 20:22	100352	----a-w-	c:\windows\system32\atig6txx.dll
2013-12-06 20:21 . 2013-12-06 20:21	96768	----a-w-	c:\windows\SysWow64\atigktxx.dll
2013-12-06 20:21 . 2013-12-06 20:21	626176	----a-w-	c:\windows\system32\drivers\atikmpag.sys
2013-12-06 20:18 . 2013-12-06 20:18	43520	----a-w-	c:\windows\system32\drivers\ati2erec.dll
2013-12-06 15:49 . 2013-12-06 15:49	51200	----a-w-	c:\windows\system32\kdbsdk64.dll
2013-12-06 15:44 . 2013-12-06 15:44	38912	----a-w-	c:\windows\SysWow64\kdbsdk32.dll
2013-11-26 11:54 . 2013-12-11 23:02	23183360	----a-w-	c:\windows\system32\mshtml.dll
2013-11-26 10:19 . 2013-12-11 23:02	2724864	----a-w-	c:\windows\system32\mshtml.tlb
2013-11-26 10:18 . 2013-12-11 23:02	4096	----a-w-	c:\windows\system32\ieetwcollectorres.dll
2013-11-26 09:48 . 2013-12-11 23:02	66048	----a-w-	c:\windows\system32\iesetup.dll
2013-11-26 09:46 . 2013-12-11 23:02	48640	----a-w-	c:\windows\system32\ieetwproxystub.dll
2013-11-26 09:41 . 2013-12-11 23:02	2764288	----a-w-	c:\windows\system32\iertutil.dll
2013-11-26 09:29 . 2013-12-11 23:02	53760	----a-w-	c:\windows\system32\jsproxy.dll
2013-11-26 09:27 . 2013-12-11 23:02	33792	----a-w-	c:\windows\system32\iernonce.dll
2013-11-26 09:23 . 2013-12-11 23:02	2724864	----a-w-	c:\windows\SysWow64\mshtml.tlb
2013-11-26 09:21 . 2013-12-11 23:02	574976	----a-w-	c:\windows\system32\ieui.dll
2013-11-26 09:18 . 2013-12-11 23:02	139264	----a-w-	c:\windows\system32\ieUnatt.exe
2013-11-26 09:18 . 2013-12-11 23:02	111616	----a-w-	c:\windows\system32\ieetwcollector.exe
2013-11-26 09:16 . 2013-12-11 23:02	708608	----a-w-	c:\windows\system32\jscript9diag.dll
2013-11-26 08:57 . 2013-12-11 23:02	218624	----a-w-	c:\windows\system32\ie4uinit.exe
2013-11-26 08:35 . 2013-12-11 23:02	5769216	----a-w-	c:\windows\system32\jscript9.dll
2013-11-26 08:28 . 2013-12-11 23:02	553472	----a-w-	c:\windows\SysWow64\jscript9diag.dll
2013-11-26 08:16 . 2013-12-11 23:02	4243968	----a-w-	c:\windows\SysWow64\jscript9.dll
2013-11-26 08:02 . 2013-12-11 23:02	1995264	----a-w-	c:\windows\system32\inetcpl.cpl
2013-11-26 07:48 . 2013-12-11 23:02	12996608	----a-w-	c:\windows\system32\ieframe.dll
2013-11-26 07:32 . 2013-12-11 23:02	1928192	----a-w-	c:\windows\SysWow64\inetcpl.cpl
2013-11-26 07:07 . 2013-12-11 23:02	2334208	----a-w-	c:\windows\system32\wininet.dll
2013-11-26 06:40 . 2013-12-11 23:02	1395200	----a-w-	c:\windows\system32\urlmon.dll
2013-11-26 06:34 . 2013-12-11 23:02	817664	----a-w-	c:\windows\system32\ieapfltr.dll
2013-11-26 06:33 . 2013-12-11 23:02	1820160	----a-w-	c:\windows\SysWow64\wininet.dll
2013-11-23 18:26 . 2013-12-11 14:34	417792	----a-w-	c:\windows\SysWow64\WMPhoto.dll
2013-11-23 17:47 . 2013-12-11 14:34	465920	----a-w-	c:\windows\system32\WMPhoto.dll
2013-11-19 21:07 . 2013-11-19 21:07	940032	----a-w-	c:\windows\system32\MsSpellCheckingFacility.exe
2013-11-19 21:07 . 2013-11-19 21:07	194048	----a-w-	c:\windows\SysWow64\elshyph.dll
2013-11-19 21:07 . 2013-11-19 21:07	942592	----a-w-	c:\windows\system32\jsIntl.dll
2013-11-19 21:07 . 2013-11-19 21:07	86016	----a-w-	c:\windows\SysWow64\iesysprep.dll
2010-11-05 01:58	32768	--sh--w-	c:\windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[7] 2010-11-20 . FE70103391A64039A921DBFFF9C7AB1B . 1008128 . . [6.1.7601.17514] .. c:\windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll
[7] 2009-07-14 . 72D7B3EA16946E8F0CF7458150031CC6 . 1008640 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll
[-] 2014-02-12 . 2C353B6CE0C8D03225CAA2AF33B68D79 . 1008640 . . [6.1.7601.17514] .. c:\windows\system32\user32.dll
.
[-] 2014-02-12 . 861C4346F9281DC0380DE72C8D55D6BE . 833024 . . [6.1.7601.17514] .. c:\windows\SysWOW64\user32.dll
[7] 2010-11-20 . 5E0DB2D8B2750543CD2EBB9EA8E6CDD3 . 833024 . . [6.1.7601.17514] .. c:\windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll
[7] 2009-07-14 . E8B0FFC209E504CB7E79FC24E6C085F0 . 833024 . . [6.1.7600.16385] .. c:\windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HydraVisionMDEngine"="c:\program files (x86)\ATI Technologies\HydraVision\HydraMD.exe" [2011-07-07 569344]
"HydraVisionDesktopManager"="c:\program files (x86)\ATI Technologies\HydraVision\HydraDM.exe" [2011-07-07 393216]
"Load"="c:\users\Pc\AppData\Roaming\vbc.exe" [2010-11-05 1169224]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-11-17 113288]
"Cpu Level Up help"="c:\program files\ASUS\Ai Suite\CpuLevelUpHelp.exe" [2009-12-28 887936]
"Turbo Key"="c:\program files\ASUS\Turbo Key\TurboKey.exe" [2009-11-24 1874432]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
"PCTools FGuard"="c:\program files (x86)\PC Tools Security\BDT\FGuard.exe" [2011-09-01 247760]
.
c:\users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
start.lnk - c:\users\Pc\cc4j5zs76kd2kj\92050.vbs [2014-2-11 190]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableLUA"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"TaskbarNoNotification"= 0 (0x0)
"HideSCAHealth"= 0 (0x0)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"TaskbarNoNotification"= 0 (0x0)
.
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"TaskbarNoNotification"= 0 (0x0)
"HideSCAHealth"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
R1 AsUpIO;AsUpIO;SysWow64\drivers\AsUpIO.sys;SysWow64\drivers\AsUpIO.sys [x]
R1 PCTSD;PC Tools Spyware Doctor Driver;c:\windows\system32\Drivers\PCTSD64.sys;c:\windows\SYSNATIVE\Drivers\PCTSD64.sys [x]
R2 acedrv11;acedrv11;c:\windows\system32\drivers\acedrv11.sys;c:\windows\SYSNATIVE\drivers\acedrv11.sys [x]
R2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
R2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
R2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [x]
R2 AMD_RAIDXpert;AMD RAIDXpert;c:\program files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe;c:\program files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe [x]
R2 AODDriver4.2.0;AODDriver4.2.0;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [x]
R2 AsSysCtrlService;ASUS System Control Service;c:\program files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe;c:\program files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [x]
R2 Browser Defender Update Service;Browser Defender Update Service;c:\program files (x86)\PC Tools Security\BDT\BDTUpdateService.exe;c:\program files (x86)\PC Tools Security\BDT\BDTUpdateService.exe [x]
R2 CGVPNCliService;CyberGhost 5 Client Service;c:\program files\CyberGhost 5\Service.exe;c:\program files\CyberGhost 5\Service.exe [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 e81a9dc1;GS-Supporter;c:\windows\system32\rundll32.exe;c:\windows\SYSNATIVE\rundll32.exe [x]
R2 HiPatchService;Hi-Rez Studios Authenticate and Update Service;c:\program files (x86)\Hi-Rez Studios\HiPatchService.exe;c:\program files (x86)\Hi-Rez Studios\HiPatchService.exe [x]
R2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [x]
R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [x]
R2 RtNdPt60;Realtek NDIS Protocol Driver;c:\windows\system32\DRIVERS\RtNdPt60.sys;c:\windows\SYSNATIVE\DRIVERS\RtNdPt60.sys [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
R2 vToolbarUpdater15.0.0;vToolbarUpdater15.0.0;c:\program files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.0.0\ToolbarUpdater.exe;c:\program files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.0.0\ToolbarUpdater.exe [x]
R3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys;c:\windows\SYSNATIVE\DRIVERS\amdiox64.sys [x]
R3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\Drivers\ssadadb.sys;c:\windows\SYSNATIVE\Drivers\ssadadb.sys [x]
R3 ArcService;Arc Service;c:\users\Pc\Desktop\ArcService.exe;c:\users\Pc\Desktop\ArcService.exe [x]
R3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\DRIVERS\asmthub3.sys;c:\windows\SYSNATIVE\DRIVERS\asmthub3.sys [x]
R3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys;c:\windows\SYSNATIVE\DRIVERS\asmtxhci.sys [x]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]
R3 cpudrv64;cpudrv64;c:\program files (x86)\SystemRequirementsLab\cpudrv64.sys;c:\program files (x86)\SystemRequirementsLab\cpudrv64.sys [x]
R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys;c:\windows\SYSNATIVE\drivers\EagleX64.sys [x]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [x]
R3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys;c:\windows\SYSNATIVE\DRIVERS\ggflt.sys [x]
R3 hxctlflt;hxctlflt;c:\windows\system32\Drivers\hxctlflt.sys;c:\windows\SYSNATIVE\Drivers\hxctlflt.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
R3 netr7364;RT73 USB Extensible Wireless LAN Card Driver;c:\windows\system32\DRIVERS\netr7364.sys;c:\windows\SYSNATIVE\DRIVERS\netr7364.sys [x]
R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des;c:\windows\SYSNATIVE\GameMon.des [x]
R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3hub.sys [x]
R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3xhc.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
R3 RTL85n64;Realtek 8180/8185 Extensible 802.11-Drahtlosgerätetreiber;c:\windows\system32\DRIVERS\RTL85n64.sys;c:\windows\SYSNATIVE\DRIVERS\RTL85n64.sys [x]
R3 RTTEAMPT;Realtek Teaming Protocol Driver (NDIS 6.2);c:\windows\system32\DRIVERS\RtTeam60.sys;c:\windows\SYSNATIVE\DRIVERS\RtTeam60.sys [x]
R3 RTVLANPT;Realtek Vlan Protocol Driver (NDIS 6.2);c:\windows\system32\DRIVERS\RtVlan620.sys;c:\windows\SYSNATIVE\DRIVERS\RtVlan620.sys [x]
R3 sdAuxService;PC Tools Auxiliary Service;c:\program files (x86)\PC Tools Security\pctsAuxs.exe;c:\program files (x86)\PC Tools Security\pctsAuxs.exe [x]
R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssadbus.sys [x]
R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys;c:\windows\SYSNATIVE\DRIVERS\ssadmdfl.sys [x]
R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssadmdm.sys [x]
R3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);c:\windows\system32\DRIVERS\ssadserd.sys;c:\windows\SYSNATIVE\DRIVERS\ssadserd.sys [x]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys;c:\windows\SYSNATIVE\drivers\synth3dvsc.sys [x]
R3 tap0901t;TAP-Win32 Adapter V9 (Tunngle);c:\windows\system32\DRIVERS\tap0901t.sys;c:\windows\SYSNATIVE\DRIVERS\tap0901t.sys [x]
R3 TEAM;Realtek Virtual Miniport Driver for Teaming (NDIS 6.2);c:\windows\system32\DRIVERS\RtTeam60.sys;c:\windows\SYSNATIVE\DRIVERS\RtTeam60.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys;c:\windows\SYSNATIVE\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys;c:\windows\SYSNATIVE\drivers\rdvgkmd.sys [x]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys;c:\windows\SYSNATIVE\drivers\viahduaa.sys [x]
R3 X6va011;X6va011;c:\windows\SysWOW64\Drivers\X6va011;c:\windows\SysWOW64\Drivers\X6va011 [x]
R3 X6va012;X6va012;c:\windows\SysWOW64\Drivers\X6va012;c:\windows\SysWOW64\Drivers\X6va012 [x]
R3 X6va013;X6va013;c:\windows\SysWOW64\Drivers\X6va013;c:\windows\SysWOW64\Drivers\X6va013 [x]
R3 X6va015;X6va015;c:\windows\SysWOW64\Drivers\X6va015;c:\windows\SysWOW64\Drivers\X6va015 [x]
R3 xhunter1;xhunter1;c:\windows\xhunter1.sys;c:\windows\xhunter1.sys [x]
R4 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\3.8.130\McCHSvc.exe;c:\program files\McAfee Security Scan\3.8.130\McCHSvc.exe [x]
R4 Sony PC Companion;Sony PC Companion;c:\program files (x86)\Sony\Sony PC Companion\PCCService.exe;c:\program files (x86)\Sony\Sony PC Companion\PCCService.exe [x]
R4 TunngleService;TunngleService;c:\program files (x86)\Tunngle\TnglCtrl.exe;c:\program files (x86)\Tunngle\TnglCtrl.exe [x]
S0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore64.sys;c:\windows\SYSNATIVE\drivers\PCTCore64.sys [x]
S0 pctDS;PC Tools Data Store;c:\windows\system32\drivers\pctDS64.sys;c:\windows\SYSNATIVE\drivers\pctDS64.sys [x]
S0 pctEFA;PC Tools Extended File Attributes;c:\windows\system32\drivers\pctEFA64.sys;c:\windows\SYSNATIVE\drivers\pctEFA64.sys [x]
S0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);c:\windows\System32\drivers\sfdrv01a.sys;c:\windows\SYSNATIVE\drivers\sfdrv01a.sys [x]
S1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx64.sys;c:\windows\SYSNATIVE\drivers\avgtpx64.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]
S4 SymDS;Symantec Data Store;c:\windows\system32\drivers\NISx64\1501000.012\SYMDS64.SYS;c:\windows\SYSNATIVE\drivers\NISx64\1501000.012\SYMDS64.SYS [x]
S4 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NISx64\1501000.012\SYMEFA64.SYS;c:\windows\SYSNATIVE\drivers\NISx64\1501000.012\SYMEFA64.SYS [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
Akamai	REG_MULTI_SZ   	Akamai
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-12-05 15:20	1210320	----a-w-	c:\program files (x86)\Google\Chrome\Application\31.0.1650.63\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2014-02-12 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-05 13:59]
.
2014-02-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-10-17 23:39]
.
2014-02-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-10-17 23:39]
.
2014-02-12 c:\windows\Tasks\ParetoLogic Registration3.job
- c:\windows\system32\rundll32.exe [2009-07-13 01:14]
.
2014-02-12 c:\windows\Tasks\ParetoLogic Update Version3.job
- c:\program files (x86)\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe [2011-03-29 23:51]
.
2014-02-12 c:\windows\Tasks\PC Health Advisor Defrag.job
- c:\program files (x86)\ParetoLogic\PCHA\PCHA.exe [2011-03-29 23:17]
.
2014-02-12 c:\windows\Tasks\PC Health Advisor.job
- c:\program files (x86)\ParetoLogic\PCHA\PCHA.exe [2011-03-29 23:17]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_B]
@="{6D4133E5-0742-4ADC-8A8C-9303440F7190}"
[HKEY_CLASSES_ROOT\CLSID\{6D4133E5-0742-4ADC-8A8C-9303440F7190}]
2011-04-11 03:35	220160	----a-w-	c:\program files (x86)\ASUS\ASUS WebStorage\3.0.94.193\AsusWSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_O]
@="{64174815-8D98-4CE6-8646-4C039977D808}"
[HKEY_CLASSES_ROOT\CLSID\{64174815-8D98-4CE6-8646-4C039977D808}]
2011-04-11 03:35	220160	----a-w-	c:\program files (x86)\ASUS\ASUS WebStorage\3.0.94.193\AsusWSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]
2013-12-06 14:47	778704	----a-w-	c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2013-12-06 14:47	778704	----a-w-	c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2013-12-06 14:47	778704	----a-w-	c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedViewOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}]
2013-12-06 14:47	778704	----a-w-	c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]
2013-12-06 14:47	778704	----a-w-	c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]
2013-12-06 14:47	778704	----a-w-	c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-12-20 167960]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-12-20 391704]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-12-20 418328]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2011-12-12 7560296]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = <local>
uSearchAssistant = hxxp://www.google.com
IE: Mit Mipony herunterladen - file://c:\program files (x86)\MiPony\Browser\IEContext.htm
LSP: c:\program files (x86)\Common Files\PC Tools\Lsp\PCTLsp.dll
Trusted Zone: aeriagames.com
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
TCP: DhcpNameServer = 192.168.2.1
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - 
FF - ProfilePath - c:\users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
FF - ExtSQL: 2013-12-18 17:14; {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}; c:\users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF - user.js: extensions.ividi.tlbrSrchUrl - hxxp://search.ividi.org/?src=tbsp&id=2895594900000000000000240103dca8&affilt=3&q=
FF - user.js: extensions.ividi.id - 2895594900000000000000240103dca8
FF - user.js: extensions.ividi.appId - {685F23D9-FCFD-475C-B56A-362645945C5A}
FF - user.js: extensions.ividi.instlDay - 15989
FF - user.js: extensions.ividi.vrsn - 1.8.23.0
FF - user.js: extensions.ividi.vrsni - 1.8.23.0
FF - user.js: extensions.ividi.vrsnTs - 1.8.23.014:19
FF - user.js: extensions.ividi.prtnrId - ividi
FF - user.js: extensions.ividi.prdct - ividi
FF - user.js: extensions.ividi.aflt - 3
FF - user.js: extensions.ividi.smplGrp - none
FF - user.js: extensions.ividi.tlbrId - base
FF - user.js: extensions.ividi.instlRef - 
FF - user.js: extensions.ividi.dfltLng - 
FF - user.js: extensions.ividi.excTlbr - true
FF - user.js: extensions.ividi.ffxUnstlRst - false
FF - user.js: extensions.ividi.admin - false
FF - user.js: extensions.ividi.autoRvrt - false
FF - user.js: extensions.ividi.rvrt - false
FF - user.js: extensions.ividi.newTab - false
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKCU-Run-Akamai NetSession Interface - c:\users\Pc\AppData\Local\Akamai\netsession_win.exe
Wow6432Node-HKCU-Run-Wcenter - c:\users\Pc\AppData\Roaming\Microsoft\Wcenter9.exe
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
BHO-{4CEECF2F-7433-3E1D-4954-FE2A3682FC20} - c:\programdata\FuNDeaulls\DD2qL.x64.dll
BHO-{A257D1AE-C8F9-32E7-03CF-8F68563FB5A4} - c:\programdata\50Coeuupons\gKoa.x64.dll
AddRemove-BabylonToolbar - c:\program files (x86)\BabylonToolbar\BabylonToolbar\1.8.3.8\uninstall.exe
AddRemove-BattleForGraxia - c:\users\Pc\Desktop\uninstall.exe
AddRemove-Roma Surrectum Deutsch 1.1.0.5 - c:\program files (x86)\Activision\Rome - Total War\Mods\Uninstall.exe
AddRemove-Roma Surrectum II - c:\program files (x86)\Activision\Rome - Total War\Mods\uninst.exe
AddRemove-SearchProtect - c:\progra~2\SearchProtect\Main\bin\uninstall.exe
AddRemove-Special Force 2 Beta_is1 - c:\program files (x86)\SpecialForce2Beta\unins000.exe
AddRemove-YTKaraoke@DacSoft.org - c:\program files (x86)\YTKaraoke\uninstall.exe
AddRemove-{478472F9-9E09-492A-BDAB-42EE595EF1AD} - c:\programdata\FuNDeaulls\DD2qL.exe
AddRemove-{4820778D-AB0D-6D18-C316-52A6A0E1D507} - c:\programdata\YoutubeAdblocker\TWJ1VQCit.exe
AddRemove-{5F189DF5-2D05-472B-9091-84D9848AE48B}{e81a9dc1} - c:\progra~2\GS-ENA~1\Browsafe.dll
AddRemove-{74A84478-70A5-4F7A-966C-FA2771FF91A5}_is1 - c:\users\Pc\Desktop\Downloads\Cracks\Die Gilde\Die Gilde 2 - King Edition\unins000.exe
AddRemove-{A35CA8FF-CB7D-8361-1CB9-83219CD11C78} - c:\programdata\surf aand kEEp\3Lwcvkkk.exe
AddRemove-3942161475.portal.qtrax.com - c:\program files (x86)\Microsoft Silverlight\5.1.20513.0\Silverlight.Configuration.exe
AddRemove-ExpressFiles - c:\program files (x86)\ExpressFiles\uninstall.exe
AddRemove-Qtrax Connection Manager - c:\users\Pc\Qtrax\Player\uninstallnotification.exe
AddRemove-{56837588-F559-40CF-91D9-D439D405FB28} - c:\users\Pc\AppData\Local\Temp\Download_B1D1\Rust_ESP_GOD_SPAWN_Hack_Downloader.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\Akamai]
"ServiceDll"="c:\program files (x86)\common files\akamai/netsession_win_8fa3539.dll"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\X6va011]
"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va011"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\X6va012]
"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va012"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\X6va013]
"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va013"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\X6va015]
"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va015"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-3424378060-3098743664-1317459497-1000\Software\SecuROM\License information*]
"datasecu"=hex:43,48,2f,01,a8,3f,a0,25,9e,c0,d9,1e,5e,c3,db,5d,ba,eb,05,e2,2e,
   74,eb,bc,e8,2e,42,2e,69,b5,96,e7,8d,49,8b,bc,8b,14,15,6d,cb,54,62,ae,12,f4,\
"rkeysecu"=hex:29,23,be,84,e1,6c,d6,ae,52,90,49,f1,f1,bb,e9,eb
.
[HKEY_USERS\S-1-5-21-3424378060-3098743664-1317459497-1000_Classes\CLSID]
@DACL=(02 0000)
.
[HKEY_USERS\S-1-5-21-3424378060-3098743664-1317459497-1000_Classes\CLSID\{A75BE48D-BF58-4A8B-B96C-F9A09DFB9844}]
@DACL=(02 0000)
@="Pokki"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_44_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_44_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_44_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_44_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_44.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_44.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_44.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_44.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-02-12  20:03:01
ComboFix-quarantined-files.txt  2014-02-12 19:03
.
Vor Suchlauf: 22 Verzeichnis(se), 271.743.991.808 Bytes frei
Nach Suchlauf: 26 Verzeichnis(se), 273.505.619.968 Bytes frei
.
- - End Of File - - 830E141AC8CF0E9AC9EBF08F048DC385
A36C5E4F47E84449FF07ED3517B43A31
         

und FSS

Farbar Service Scanner Version: 02-02-2014
Ran by Pc (administrator) on 12-02-2014 at 20:14:06
Running from "C:\Users\Pc\Desktop"
Microsoft Windows 7 Enterprise  Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============
mpsdrv Service is not running. Checking service configuration:
The start type of mpsdrv service is OK.
The ImagePath of mpsdrv service is OK.

MpsSvc Service is not running. Checking service configuration:
The start type of MpsSvc service is set to Disabled. The default start type is Auto.
The ImagePath of MpsSvc service is OK.
The ServiceDll of MpsSvc service is OK.


Firewall Disabled Policy: 
==================


System Restore:
============

System Restore Disabled Policy: 
========================


Action Center:
============


Windows Update:
============

Windows Autoupdate Disabled Policy: 
============================


Windows Defender:
==============

Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll => MD5 is legit
C:\Windows\System32\drivers\afd.sys => MD5 is legit
C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\System32\dnsrslvr.dll => MD5 is legit
C:\Windows\System32\mpssvc.dll => MD5 is legit
C:\Windows\System32\bfe.dll => MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\SDRSVC.dll => MD5 is legit
C:\Windows\System32\vssvc.exe => MD5 is legit
C:\Windows\System32\wscsvc.dll => MD5 is legit
C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\System32\wuaueng.dll => MD5 is legit
C:\Windows\System32\qmgr.dll => MD5 is legit
C:\Windows\System32\es.dll => MD5 is legit
C:\Windows\System32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\System32\ipnathlp.dll => MD5 is legit
C:\Windows\System32\iphlpsvc.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit


**** End of log ****
         

Trotzdem Dankeschön! Immerhin sind viele der Fehler nun verschwunden.

Mir ist gerade auch aufgefallen, das svchost.exe laut Taskmanager 15 Mal geöffnet ist. Das kann doch nicht normal sein oder?

Trotzdem Dankeschön! Immerhin sind viele der Fehler nun verschwunden.

Wir sind auch noch nicht fertig, du hast schon einiges an Malware/Adware gesammelt. Um die Fehler kümmere ich im weiteren Verlauf der Bereinigung .



Schritt 1
Combofix-Skript

WARNUNG für die MITLESER:
Folgendes ComboFix Skript ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!

• Lösche die vorhandene Combofix.exe von deinem Desktop und lade das Programm von folgenden Download-Spiegel neu herunter: Link
• Speichere es erneut auf dem Desktop (nicht woanders hin, das ist wichtig)!
• Drücke die Windows + R Taste --> notepad (hinein schreiben) --> OK
• Kopiere nun den Text aus der folgenden Codebox komplett in das leere Textdokument.
  

  Folder::
  c:\users\Pc\cc4j5zs76kd2kj
  c:\users\Pc\aoajz
  c:\users\Pc\xripb
  
  File::
  c:\users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk
  c:\users\Pc\AppData\Roaming\vbc.exe
  
  Reg::
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "Load"=-
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\MpsSvc]
  "Start"=dword:00000002
           

• Speichere dies als CFScript.txt auf deinem Desktop.
• Wichtig: Stelle deine Anti Viren Software temporär ab. Dies kann ComboFix nämlich bei der Arbeit behindern.
  Danach wieder anstellen nicht vergessen!
• Schließe alle laufenden Programme damit ComboFix ungehindert arbeiten kann.
• Ziehe CFScript.txt in die ComboFix.exe wie in diesem Bild:
  
  
• Mache nichts am Computer, bewege nicht die Maus über das ComboFix-Fenster oder klicke in dieses hinein. Dies kann dazu führen, dass ComboFix sich aufhängt.
• Wenn ComboFix fertig ist wird es ein Log erstellen: C:\ComboFix.txt
  Bitte füge es hier als Antwort (in CODE-Tags mit dem #-Button des Editors) ein.

Hinweis:
Suspect:: und Collect::
Falls im Skript diese Anweisungen enthalten sind, sollen Dateien zur Analyse eingeschickt werden. Es erscheint eine Message-Box, nachdem Combofix fertig ist. Klicke OK und folge den Aufforderungen/Anweisungen, um die Dateien hochzuladen. Teile mir unbedingt mit, ob der Upload geklappt hat!

Schritt 2
Downloade dir bitte TDSSKiller.exe und speichere diese Datei auf dem Desktop

• Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
• Drücke Start Scan
  
• Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
  TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
  Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt

Poste den Inhalt bitte in jedem Fall hier in deinen Thread.

Schritt 3
Bitte lasse die Datei aus der Code-Box bei Virustotal überprüfen.

• Klicke auf Wählen Sie eine
• Kopiere nun folgendes in die Suchleiste
  

  C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
           

• und klicke auf Öffnen.
• Klicke auf Scannen!.
• Warte bitte bis die Datei vollständig hochgeladen wurde. Solltest Du folgende Meldung bekommen
  
  klicke auf Neu analysieren.
• Warte bis dir das Analysedatum angezeigt wird und der Scan abgeschlossen ist.
• Kopiere den Link aus deiner Adresszeile und poste ihn hier.

Schritt 4
Starte noch einmal FRST.

• Ändere keine der Voreinstellungen und drücke auf Scan.
• Wenn der Scan abgeschlossen ist, wird ein neues Logfile FRST.txt erstellt und auf dem Desktop gespeichert.
• Poste den Inhalt dieses Logfiles bitte hier in deinen Thread.

Poste folgende Logfiles in deiner nächsten Antwort:

• Combofix-Fix
• TDSSKiller-Scan
• FRST-Scan

FRST-log


FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-02-2014 01
Ran by Pc (administrator) on PC-PC on 13-02-2014 14:50:23
Running from C:\Users\Pc\Desktop
Windows 7 Enterprise Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(AMD) C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe
() C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler.exe
(APN LLC.) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraMD.exe
(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe
(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraMD64.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(ASUSTeK Computer Inc.) C:\Program Files\ASUS\Turbo Key\TurboKey.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(APN) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe
() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\system32\taskmgr.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7560296 2011-12-12] (Realtek Semiconductor)
HKLM-x32\...\Run: [NUSB3MON] - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [Cpu Level Up help] - C:\Program Files\ASUS\Ai Suite\CpuLevelUpHelp.exe [887936 2009-12-28] ()
HKLM-x32\...\Run: [Turbo Key] - C:\Program Files\ASUS\Turbo Key\TurboKey.exe [1874432 2009-11-24] (ASUSTeK Computer Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-09] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [ApnTBMon] - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1778640 2013-12-20] (APN)
HKLM-x32\...\Run: [VNT] - C:\Program Files (x86)\VNT\vntldr.exe [202192 2013-12-20] (APN LLC.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [TaskbarNoNotification] 0
HKLM\...\Policies\Explorer: [HideSCAHealth] 0
HKU\.DEFAULT\...\Policies\Explorer: [TaskbarNoNotification] 0
HKU\.DEFAULT\...\Policies\Explorer: [HideSCAHealth] 0
HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Run: [HydraVisionMDEngine] - C:\Program Files (x86)\ATI Technologies\HydraVision\HydraMD.exe [569344 2011-07-07] (AMD)
HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Run: [HydraVisionDesktopManager] - C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe [393216 2011-07-07] (AMD)
HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Policies\Explorer: [TaskbarNoNotification] 0

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xEA5B1E2628BDCD01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM-x32 - DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 
SearchScopes: HKCU - DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/Results.aspx?ctid=CT3312375&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=2&UP=SP09C9C74C-9231-4E89-8648-D5B7D174D75E&q={searchTerms}
SearchScopes: HKCU - ToolbarSearchProviderProgress {96bd48dd-741b-41ae-ac4a-aff96ba00f7e}
SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=QuickObrw&dpid=QuickObrw&co=DE&userid=f0e6090c-d942-4ce4-94f4-095b9a73bb7a&searchtype=ds&q={searchTerms}&installDate=07/04/2013
SearchScopes: HKCU - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/Results.aspx?ctid=CT3312375&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=2&UP=SP09C9C74C-9231-4E89-8648-D5B7D174D75E&q={searchTerms}
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www.holasearch.com/?q={searchTerms}&babsrc=SP_ss&mntrId=289500240103DCA8&affID=121963&tsp=4980
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 
BHO: Avira SearchFree Toolbar - {41564952-412D-5637-4300-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport_x64.dll (APN LLC.)
BHO: FuNDeaulls - {4CEECF2F-7433-3E1D-4954-FE2A3682FC20} - C:\ProgramData\FuNDeaulls\DD2qL.x64.dll No File
BHO: 50Coeuupons - {A257D1AE-C8F9-32E7-03CF-8F68563FB5A4} - C:\ProgramData\50Coeuupons\gKoa.x64.dll No File
BHO-x32: Avira SearchFree Toolbar - {41564952-412D-5637-4300-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport.dll (APN LLC.)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Avira SearchFree Toolbar - {41564952-412D-5637-4300-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport_x64.dll (APN LLC.)
Toolbar: HKLM-x32 - Avira SearchFree Toolbar - {41564952-412D-5637-4300-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport.dll (APN LLC.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
DPF: HKLM-x32 {E6F480FC-BD44-4CBA-B74A-89AF7842937D} hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.5.1.0.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler-x32: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\15.0.0\ViProtocol.dll No File
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566
FF user.js: detected! => C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\user.js
FF NewTab: hxxp://search.conduit.com/?ctid=CT3312375&octid=EB_ORIGINAL_CTID&SearchSource=69&CUI=&SSPV=EB_SSPV&Lay=1&UM=2&UP=SP09C9C74C-9231-4E89-8648-D5B7D174D75E
FF Homepage: hxxp://www.google.de/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_44.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_44.dll ()
FF Plugin-x32: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin - C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\15.0.0\\npsitesafety.dll No File
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.130\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @soe.sony.com/installer,version=1.0.3 - C:\Users\Pc\AppData\LocalLow\Sony Online Entertainment\npsoe.dll ()
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin HKCU: pokki.com/PokkiDownloadHelper - C:\Users\Pc\AppData\Local\Pokki\Download Helper\npPokkiDownloadHelper.1.2.0.78.dll (Pokki)
FF Plugin HKCU: thehappycloud.com/HappyCloudPlugin - C:\ProgramData\HappyCloud\Application\npHappyCloudPlugin.dll (The Happy Cloud)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\searchplugins\conduit-search.xml
FF SearchPlugin: C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\searchplugins\ividi.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Avira SearchFree Toolbar plus Web Protection - C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\Extensions\toolbar_AVIRA-V7C@apn.ask.com.xpi [2013-12-20]
FF Extension: Adblock Plus - C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-01-03]
FF HKLM\...\Firefox\Extensions: [{77BEC163-D389-42c1-91A4-C758846296A5}] - C:\Program Files\Video downloader\Firefox
FF HKCU\...\Firefox\Extensions: [lyricsmonkey@mendoni.net] - C:\Program Files (x86)\LyricsMonkey\FF\
FF HKCU\...\Firefox\Extensions: [YTKaraoke@DacSoft.org] - C:\Program Files (x86)\YTKaraoke\FF\

Chrome: 
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (Coupons Malibu) - C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\hnofepcmbghfcimfbjicplikedjcnalm [2013-09-03]
CHR Extension: (BargainJoy) - C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\khongjfjjmklggionajlpjcpmnppdace [2013-09-09]
CHR Extension: (Google Wallet) - C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-31]
CHR Extension: (50Coeuupons) - C:\ProgramData\cfcjpjohfcdpkpkiobmplajfgaafdgpb [2013-12-31]
CHR HKLM\...\Chrome\Extension: [bmobdmpfgfimbnmhhnkmmecdboblafdh] - C:\Users\Pc\AppData\Local\BazaarFriend.crx [2013-07-29]
CHR HKLM\...\Chrome\Extension: [hnofepcmbghfcimfbjicplikedjcnalm] - C:\Users\Pc\AppData\Local\CouponsMalibu.crx [2013-09-03]
CHR HKLM\...\Chrome\Extension: [khongjfjjmklggionajlpjcpmnppdace] - C:\Users\Pc\AppData\Local\BargainJoy.crx [2013-09-08]
CHR HKCU\...\Chrome\Extension: [bmobdmpfgfimbnmhhnkmmecdboblafdh] - C:\Users\Pc\AppData\Local\BazaarFriend.crx [2013-07-29]
CHR HKCU\...\Chrome\Extension: [hnofepcmbghfcimfbjicplikedjcnalm] - C:\Users\Pc\AppData\Local\CouponsMalibu.crx [2013-09-03]
CHR HKCU\...\Chrome\Extension: [khongjfjjmklggionajlpjcpmnppdace] - C:\Users\Pc\AppData\Local\BargainJoy.crx [2013-09-08]
CHR HKCU\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Users\Pc\AppData\Roaming\DVDVideoSoft\DVDVideoSoftBrowserExtension.crx [2012-11-09]
CHR HKLM-x32\...\Chrome\Extension: [bmobdmpfgfimbnmhhnkmmecdboblafdh] - C:\Users\Pc\AppData\Local\BazaarFriend.crx [2013-07-29]
CHR HKLM-x32\...\Chrome\Extension: [fmfnfnpmhcllokmkepffndflpnadjmma] - C:\Program Files (x86)\DealPly\DealPly.crx [2013-07-29]
CHR HKLM-x32\...\Chrome\Extension: [hnofepcmbghfcimfbjicplikedjcnalm] - C:\Users\Pc\AppData\Local\CouponsMalibu.crx [2013-09-03]
CHR HKLM-x32\...\Chrome\Extension: [jpmbfleldcgkldadpdinhjjopdfpjfjp] - C:\Users\Pc\AppData\Local\Wajam\Chrome\wajam.crx [2012-07-26]
CHR HKLM-x32\...\Chrome\Extension: [khialnikbocfgkohdegnebhmmaifoglp] - C:\Program Files (x86)\LyricsMonkey\Chrome.crx [2012-07-26]
CHR HKLM-x32\...\Chrome\Extension: [khongjfjjmklggionajlpjcpmnppdace] - C:\Users\Pc\AppData\Local\BargainJoy.crx [2013-09-08]
CHR HKLM-x32\...\Chrome\Extension: [lgnhgbflngpggpmpfdkhmhmfdophhepe] - C:\Program Files (x86)\YTKaraoke\Chrome.crx [2013-09-08]
CHR HKLM-x32\...\Chrome\Extension: [niapdbllcanepiiimjjndipklodoedlc] - C:\Program Files (x86)\Yontoo\YontooLayers.crx [2013-02-10]
CHR HKLM-x32\...\Chrome\Extension: [pcoohmdcpejoeggdnihdfhohjgdbllgm] - C:\ProgramData\AskPartnerNetwork\Toolbar\AVIRA-V7C\CRX\ToolbarCR.crx [2013-12-20]
CHR HKLM-x32\...\Chrome\Extension: [pggagllhehfjjfgnfnfkjedjlmbchamf] - C:\Users\Pc\AppData\Roaming\SeeSimilar\SeeSimilar.crx [2013-06-20]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

R2 Akamai; c:\program files (x86)\common files\akamai/netsession_win_8fa3539.dll [4569856 2013-07-01] (Akamai Technologies, Inc.)
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2013-12-06] (Advanced Micro Devices, Inc.)
R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [908856 2013-12-09] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-09] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-12-09] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1011768 2013-12-09] (Avira Operations GmbH & Co. KG)
R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2013-12-20] (APN LLC.)
R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [96896 2009-12-29] (ASUSTeK Computer Inc.)
S2 CGVPNCliService; C:\Program Files\CyberGhost 5\Service.exe [64112 2014-01-16] (CyberGhost S.R.L)
R2 ForceWare Intelligent Application Manager (IAM); C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe [496232 2010-01-21] ()
S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S4 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe [288776 2013-09-06] (McAfee, Inc.)
S3 npggsvc; C:\Windows\SysWOW64\GameMon.des [4521720 2012-09-26] (INCA Internet Co., Ltd.)
R2 nSvcIp; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe [209000 2010-01-21] ()
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2014-01-24] ()
S4 TunngleService; C:\Program Files (x86)\Tunngle\TnglCtrl.exe [745368 2012-11-26] (Tunngle.net GmbH)
S3 ArcService; C:\Users\Pc\Desktop\ArcService.exe [X]
S2 e81a9dc1; "C:\Windows\system32\rundll32.exe" "c:\progra~2\gs-ena~1\BrowsafeSvc.dll",service
S2 vToolbarUpdater15.0.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.0.0\ToolbarUpdater.exe [X]

==================== Drivers (Whitelisted) ====================

R2 AODDriver4.2.0; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [59648 2013-09-19] (Advanced Micro Devices)
R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2010-08-25] ()
R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [13368 2009-07-07] ()
S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [303616 2013-05-13] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-09] (Avira Operations GmbH & Co. KG)
R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [39768 2013-04-14] (AVG Technologies)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-09] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-12-09] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [84720 2013-12-09] (Avira Operations GmbH & Co. KG)
S3 cpudrv64; C:\Program Files (x86)\SystemRequirementsLab\cpudrv64.sys [17864 2011-06-02] ()
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2013-12-30] (Disc Soft Ltd)
R3 hxctlflt; C:\Windows\System32\Drivers\hxctlflt.sys [111104 2009-02-08] (Guillemot Corporation)
S2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [35328 2013-05-13] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-16] ()
S3 RT73; C:\Windows\System32\DRIVERS\Dr71WU.sys [610816 2008-01-16] (Ralink Technology, Corp.)
S3 RTL85n64; C:\Windows\System32\DRIVERS\RTL85n64.sys [378368 2009-06-10] (Realtek)
R0 sfdrv01; C:\Windows\System32\drivers\sfdrv01.sys [75384 2009-02-03] (Protection Technology (StarForce))
R0 sfdrv01a; C:\Windows\System32\drivers\sfdrv01a.sys [77432 2009-02-03] (Protection Technology (StarForce))
R0 sfsync04; C:\Windows\System32\drivers\sfsync04.sys [79800 2012-06-19] (Protection Technology (StarForce))
R0 sfvfs02; C:\Windows\System32\drivers\sfvfs02.sys [107384 2007-02-08] (Protection Technology (StarForce))
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [3552384 2009-04-22] ()
S3 tap0901t; C:\Windows\System32\DRIVERS\tap0901t.sys [31232 2009-09-16] (Tunngle.net)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
S3 X6va011; \??\C:\Windows\SysWOW64\Drivers\X6va011 [X]
S3 X6va012; \??\C:\Windows\SysWOW64\Drivers\X6va012 [X]
S3 X6va013; \??\C:\Windows\SysWOW64\Drivers\X6va013 [X]
S3 X6va015; \??\C:\Windows\SysWOW64\Drivers\X6va015 [X]
S3 xhunter1; \??\C:\Windows\xhunter1.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-02-13 14:50 - 2014-02-13 14:50 - 00022053 _____ () C:\Users\Pc\Desktop\FRST.txt
2014-02-13 14:50 - 2014-02-13 14:50 - 00000000 ____D () C:\Users\Pc\Desktop\FRST-OlderVersion
2014-02-13 14:36 - 2014-02-13 14:36 - 04102163 _____ () C:\Users\Pc\Downloads\tdsskiller.zip
2014-02-13 14:36 - 2014-02-10 23:37 - 04122976 _____ (Kaspersky Lab ZAO) C:\Users\Pc\Desktop\TDSSKiller.exe
2014-02-13 14:30 - 2014-02-13 14:30 - 00043125 _____ () C:\Users\Pc\Desktop\ComboFix.txt.txt
2014-02-13 14:29 - 2014-02-13 14:29 - 00043125 _____ () C:\ComboFix.txt
2014-02-13 13:51 - 2014-02-13 13:50 - 05180679 ____R (Swearware) C:\Users\Pc\Desktop\ComboFix.exe
2014-02-13 13:49 - 2014-02-13 13:50 - 05180679 _____ (Swearware) C:\Users\Pc\Downloads\ComboFix.exe
2014-02-12 22:27 - 2014-02-12 22:27 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Avira
2014-02-12 22:27 - 2014-02-12 22:27 - 00000000 ____D () C:\Users\Pc\AppData\Local\VNT
2014-02-12 22:26 - 2014-02-12 22:26 - 00000000 ____D () C:\ProgramData\AskPartnerNetwork
2014-02-12 22:26 - 2014-02-12 22:26 - 00000000 ____D () C:\ProgramData\APN
2014-02-12 22:26 - 2014-02-12 22:26 - 00000000 ____D () C:\Program Files (x86)\VNT
2014-02-12 22:26 - 2014-02-12 22:26 - 00000000 ____D () C:\Program Files (x86)\AskPartnerNetwork
2014-02-12 22:24 - 2014-02-12 22:24 - 00002078 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2014-02-12 22:23 - 2014-02-12 22:23 - 00000000 ____D () C:\ProgramData\Avira
2014-02-12 22:23 - 2014-02-12 22:23 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-02-12 22:23 - 2013-12-09 11:45 - 00131576 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-02-12 22:23 - 2013-12-09 11:45 - 00108440 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-02-12 22:23 - 2013-12-09 11:45 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-02-12 22:23 - 2013-12-09 11:45 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2014-02-12 22:05 - 2014-02-12 22:05 - 00264757 _____ () C:\Users\Pc\Downloads\FHSetup.exe
2014-02-12 22:05 - 2014-02-12 22:05 - 00001981 _____ () C:\Users\Pc\Desktop\Update Checker.lnk
2014-02-12 22:05 - 2014-02-12 22:05 - 00000000 ____D () C:\Program Files (x86)\FileHippo.com
2014-02-12 22:04 - 2014-02-12 22:08 - 139704984 _____ () C:\Users\Pc\Downloads\avira_ultimate_protection_suite_de.exe
2014-02-12 21:54 - 2014-02-12 21:54 - 00007674 _____ () C:\Users\Pc\AppData\Local\Resmon.ResmonCfg
2014-02-12 21:18 - 2014-02-13 14:17 - 00109188 _____ () C:\Windows\PFRO.log
2014-02-12 21:04 - 2013-12-21 10:53 - 00548864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-02-12 21:04 - 2013-12-21 09:56 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-02-12 21:03 - 2014-02-06 13:16 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-12 21:03 - 2014-02-06 12:30 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-12 21:03 - 2014-02-06 12:30 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-02-12 21:03 - 2014-02-06 12:12 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-12 21:03 - 2014-02-06 12:07 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-02-12 21:03 - 2014-02-06 12:06 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-02-12 21:03 - 2014-02-06 11:57 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-12 21:03 - 2014-02-06 11:56 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-02-12 21:03 - 2014-02-06 11:52 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-02-12 21:03 - 2014-02-06 11:49 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-12 21:03 - 2014-02-06 11:48 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-02-12 21:03 - 2014-02-06 11:48 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-02-12 21:03 - 2014-02-06 11:38 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-02-12 21:03 - 2014-02-06 11:32 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-02-12 21:03 - 2014-02-06 11:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-02-12 21:03 - 2014-02-06 11:17 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-02-12 21:03 - 2014-02-06 11:11 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-12 21:03 - 2014-02-06 11:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-02-12 21:03 - 2014-02-06 11:00 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-02-12 21:03 - 2014-02-06 10:57 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-02-12 21:03 - 2014-02-06 10:57 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-12 21:03 - 2014-02-06 10:52 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-02-12 21:03 - 2014-02-06 10:52 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-02-12 21:03 - 2014-02-06 10:50 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-12 21:03 - 2014-02-06 10:49 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-02-12 21:03 - 2014-02-06 10:47 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-02-12 21:03 - 2014-02-06 10:46 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-02-12 21:03 - 2014-02-06 10:25 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-02-12 21:03 - 2014-02-06 10:25 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-02-12 21:03 - 2014-02-06 10:24 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-12 21:03 - 2014-02-06 10:22 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-12 21:03 - 2014-02-06 10:13 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-02-12 21:03 - 2014-02-06 10:09 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-02-12 21:03 - 2014-02-06 10:03 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-02-12 21:03 - 2014-02-06 09:55 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-12 21:03 - 2014-02-06 09:41 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-02-12 21:03 - 2014-02-06 09:40 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-02-12 21:03 - 2014-02-06 09:36 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-02-12 21:03 - 2014-02-06 09:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-02-12 21:00 - 2014-02-13 14:17 - 00003808 _____ () C:\Windows\setupact.log
2014-02-12 21:00 - 2014-02-12 21:00 - 00000000 _____ () C:\Windows\setuperr.log
2014-02-12 20:57 - 2014-01-01 00:05 - 00420008 _____ () C:\Windows\SysWOW64\locale.nls
2014-02-12 20:57 - 2014-01-01 00:04 - 00420008 _____ () C:\Windows\system32\locale.nls
2014-02-12 20:57 - 2013-12-25 00:09 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-02-12 20:57 - 2013-12-24 23:48 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-02-12 20:57 - 2013-12-06 03:30 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-02-12 20:57 - 2013-12-06 03:30 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-02-12 20:57 - 2013-12-06 03:02 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-02-12 20:57 - 2013-12-06 03:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-02-12 20:57 - 2013-12-04 03:27 - 00488448 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll
2014-02-12 20:57 - 2013-12-04 03:27 - 00485888 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll
2014-02-12 20:57 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll
2014-02-12 20:57 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll
2014-02-12 20:57 - 2013-12-04 03:26 - 00528384 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll
2014-02-12 20:57 - 2013-12-04 03:16 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe
2014-02-12 20:57 - 2013-12-04 03:16 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe
2014-02-12 20:57 - 2013-12-04 03:16 - 00553984 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe
2014-02-12 20:57 - 2013-12-04 03:16 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe
2014-02-12 20:57 - 2013-12-04 03:03 - 00428032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc.dll
2014-02-12 20:57 - 2013-12-04 03:03 - 00423936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_isv.dll
2014-02-12 20:57 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp_isv.dll
2014-02-12 20:57 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp.dll
2014-02-12 20:57 - 2013-12-04 03:02 - 00390144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdrm.dll
2014-02-12 20:57 - 2013-12-04 02:54 - 00594944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_isv.exe
2014-02-12 20:57 - 2013-12-04 02:54 - 00572416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate.exe
2014-02-12 20:57 - 2013-12-04 02:54 - 00510976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp.exe
2014-02-12 20:57 - 2013-12-04 02:54 - 00508928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp_isv.exe
2014-02-12 20:57 - 2013-11-26 09:16 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2014-02-12 20:57 - 2013-11-22 23:48 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2014-02-12 19:44 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-02-12 19:44 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-02-12 19:44 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-02-12 19:44 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-02-12 19:44 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-02-12 19:44 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2014-02-12 19:44 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2014-02-12 19:44 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2014-02-12 19:36 - 2014-02-13 14:30 - 00000000 ____D () C:\Qoobox
2014-02-12 18:58 - 2014-02-13 14:16 - 00000000 ____D () C:\Windows\erdnt
2014-02-12 15:21 - 2014-02-12 16:05 - 1064637787 _____ () C:\Users\Pc\Downloads\Naruto2.1.rar
2014-02-12 14:12 - 2014-02-12 14:12 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dll Suite 2013
2014-02-12 14:12 - 2014-02-12 14:12 - 00000000 ____D () C:\Program Files (x86)\DLLSuite
2014-02-12 14:10 - 2014-02-12 14:11 - 16588429 _____ ( ) C:\Users\Pc\Downloads\DLLSuite_Setup.exe
2014-02-12 13:51 - 2014-02-12 19:01 - 00000436 _____ () C:\Windows\Tasks\ParetoLogic Update Version3.job
2014-02-12 13:51 - 2014-02-12 19:01 - 00000394 _____ () C:\Windows\Tasks\PC Health Advisor Defrag.job
2014-02-12 13:51 - 2014-02-12 19:01 - 00000376 _____ () C:\Windows\Tasks\PC Health Advisor.job
2014-02-12 13:51 - 2014-02-12 18:00 - 00000462 _____ () C:\Windows\Tasks\ParetoLogic Registration3.job
2014-02-12 13:51 - 2014-02-12 13:51 - 00003284 _____ () C:\Windows\System32\Tasks\PC Health Advisor
2014-02-12 13:51 - 2014-02-12 13:51 - 00003264 _____ () C:\Windows\System32\Tasks\PC Health Advisor Defrag
2014-02-12 13:51 - 2014-02-12 13:51 - 00003246 _____ () C:\Windows\System32\Tasks\ParetoLogic Update Version3
2014-02-12 13:51 - 2014-02-12 13:51 - 00003120 _____ () C:\Windows\System32\Tasks\ParetoLogic Registration3
2014-02-12 13:51 - 2014-02-12 13:51 - 00001109 _____ () C:\Users\Pc\Desktop\ParetoLogic PC Health Advisor.lnk
2014-02-12 13:51 - 2014-02-12 13:51 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\ParetoLogic
2014-02-12 13:51 - 2014-02-12 13:51 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ParetoLogic
2014-02-12 13:51 - 2014-02-12 13:51 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\DriverCure
2014-02-12 13:51 - 2014-02-12 13:51 - 00000000 ____D () C:\ProgramData\ParetoLogic
2014-02-12 13:51 - 2014-02-12 13:51 - 00000000 ____D () C:\Program Files (x86)\ParetoLogic
2014-02-12 13:47 - 2014-02-12 13:47 - 05249448 _____ (ParetoLogic Inc.) C:\Users\Pc\Downloads\ParetoLogic PC Health Advisor_de.exe
2014-02-12 12:30 - 2014-02-12 13:02 - 1312122312 _____ () C:\Users\Pc\Downloads\ACOK_1.11.rar
2014-02-12 12:27 - 2014-02-12 12:27 - 00001152 _____ () C:\Users\Pc\Desktop\Mount&Blade Warband.lnk
2014-02-12 12:03 - 2014-02-12 12:18 - 615004486 _____ () C:\Users\Pc\Downloads\mb_warband_setup_1158.exe
2014-02-12 11:22 - 2014-02-12 11:39 - 53254767 _____ () C:\Users\Pc\Downloads\LoLRADS_EUW_german.zip
2014-02-11 22:27 - 2014-02-13 13:49 - 00000000 ____D () C:\Users\Pc\Desktop\Dokus
2014-02-11 22:23 - 2014-02-13 14:50 - 00000000 ____D () C:\FRST
2014-02-11 22:22 - 2014-02-13 14:50 - 02152448 _____ (Farbar) C:\Users\Pc\Desktop\FRST64.exe
2014-02-11 22:21 - 2014-02-11 22:21 - 00000466 _____ () C:\Windows\SysWOW64\defogger_disable.log
2014-02-11 22:21 - 2014-02-11 22:21 - 00000000 _____ () C:\Users\Pc\defogger_reenable
2014-02-11 21:23 - 2014-02-11 22:00 - 00000000 ____D () C:\ProgramData\SecTaskMan
2014-02-11 21:22 - 2014-02-11 21:23 - 00000000 ____D () C:\Program Files (x86)\Security Task Manager
2014-02-11 21:19 - 2014-02-11 21:20 - 02365840 _____ () C:\Users\Pc\Downloads\SecurityTaskManager_Setup.exe
2014-02-11 21:03 - 2014-02-11 21:03 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\TestApp
2014-02-11 20:58 - 2014-02-11 20:58 - 00001121 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-02-11 20:57 - 2014-02-11 20:57 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Pc\Downloads\mbam-setup-1.75.0.1300(1).exe
2014-02-11 17:54 - 2014-02-12 21:06 - 02539172 _____ () C:\Windows\system32\Drivers\Cat.DB
2014-02-11 17:50 - 2014-02-12 20:59 - 00000000 ____D () C:\ProgramData\PC Tools
2014-02-11 16:54 - 2014-02-11 16:54 - 00000000 ____D () C:\ProgramData\SMR410
2014-02-11 16:50 - 2014-02-11 17:34 - 00000000 ____D () C:\Users\Pc\AppData\Local\NPE
2014-02-11 16:38 - 2014-02-11 16:38 - 00000000 ____D () C:\Windows\System32\Tasks\Norton Internet Security
2014-02-11 16:37 - 2014-02-11 16:37 - 00003234 _____ () C:\Windows\System32\Tasks\Norton WSC Integration
2014-02-11 16:35 - 2014-02-11 21:23 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\DigitalSites
2014-02-11 16:35 - 2014-02-11 16:35 - 00003208 _____ () C:\Windows\System32\Tasks\Digital Sites
2014-02-11 16:30 - 2013-12-18 21:09 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-02-11 16:30 - 2013-12-18 21:04 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-02-11 16:30 - 2013-12-18 21:04 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-02-11 16:30 - 2013-12-18 21:03 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-02-11 16:29 - 2014-02-11 16:30 - 00005327 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-02-11 16:27 - 2014-02-11 16:32 - 223165336 ____N (Symantec Corporation) C:\Users\Pc\Downloads\NIS_21.1.0.18_SYMTB_TMD_MRFTT_820_10131.exe
2014-02-11 15:59 - 2014-02-11 15:59 - 00003582 _____ () C:\Windows\System32\Tasks\PileFile reminder
2014-02-11 15:59 - 2014-02-11 15:59 - 00003160 _____ () C:\Windows\System32\Tasks\PileFile logon
2014-02-11 15:59 - 2014-02-11 15:59 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Oxy
2014-02-11 15:34 - 2014-02-11 15:34 - 00000000 _RSHD () C:\Users\Pc\cc4j5zs76kd2kj
2014-02-04 16:14 - 2013-06-12 15:15 - 00100864 _____ () C:\Users\Pc\AppData\Roaming\zlib1.dll
2014-02-04 15:05 - 2014-02-11 21:23 - 00000000 _RSHD () C:\Users\Pc\aoajz
2014-02-04 13:49 - 2014-02-04 13:49 - 00347816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\MicrosoftFixit.WinSecurity.FISC.37314945131128502.8.1.Run.exe
2014-02-04 13:42 - 2014-02-04 13:42 - 00347816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\MicrosoftFixit.WindowsFirewall.RNP.Run.exe
2014-02-04 13:11 - 2014-02-04 13:11 - 00001613 _____ () C:\Users\Public\Desktop\Play League of Legends.lnk
2014-02-04 13:09 - 2014-02-04 13:12 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Riot Games
2014-02-04 13:07 - 2014-02-04 13:08 - 34888568 _____ (Riot Games) C:\Users\Pc\Downloads\LeagueofLegends_EUW_Installer_06_12_13.exe
2014-02-04 12:20 - 2014-02-04 12:20 - 00001024 _____ () C:\Windows\SysWOW64\.rnd
2014-02-04 12:08 - 2014-02-11 21:23 - 00000000 _RSHD () C:\Users\Pc\xripb
2014-02-02 13:32 - 2014-02-02 13:32 - 00000000 ___SH () C:\Users\Pc\AppData\Local\LumaEmu
2014-02-02 13:28 - 2014-02-02 13:28 - 00000000 ____D () C:\Users\Pc\Desktop\RustClient_v19.12.2013
2014-02-02 13:20 - 2014-02-02 13:21 - 06499816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\vcredist_x86.exe
2014-01-29 14:14 - 2014-01-29 14:14 - 00000631 _____ () C:\Windows\system32\InstallUtil.InstallLog
2014-01-21 10:23 - 2014-02-04 12:20 - 00000000 ____D () C:\Users\Pc\AppData\Local\CyberGhost
2014-01-21 10:22 - 2014-01-21 10:27 - 00000000 ____D () C:\Program Files\CyberGhost 5
2014-01-21 10:22 - 2014-01-21 10:23 - 00000000 ____D () C:\Program Files\TAP-Windows
2014-01-21 10:22 - 2014-01-21 10:22 - 00001736 _____ () C:\Users\Pc\Desktop\CyberGhost 5.lnk
2014-01-21 10:21 - 2014-01-21 10:21 - 08566128 _____ (CyberGhost S.R.L. ) C:\Users\Pc\Downloads\CG_5.0.9.8chip.de.exe
2014-01-15 13:29 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-01-15 13:29 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-01-15 13:29 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-01-15 13:29 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-01-15 13:29 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-01-15 13:29 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-01-15 13:29 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-01-15 13:29 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-01-15 13:29 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

==================== One Month Modified Files and Folders =======

2014-02-13 14:50 - 2014-02-13 14:50 - 00022053 _____ () C:\Users\Pc\Desktop\FRST.txt
2014-02-13 14:50 - 2014-02-13 14:50 - 00000000 ____D () C:\Users\Pc\Desktop\FRST-OlderVersion
2014-02-13 14:50 - 2014-02-11 22:23 - 00000000 ____D () C:\FRST
2014-02-13 14:50 - 2014-02-11 22:22 - 02152448 _____ (Farbar) C:\Users\Pc\Desktop\FRST64.exe
2014-02-13 14:36 - 2014-02-13 14:36 - 04102163 _____ () C:\Users\Pc\Downloads\tdsskiller.zip
2014-02-13 14:30 - 2014-02-13 14:30 - 00043125 _____ () C:\Users\Pc\Desktop\ComboFix.txt.txt
2014-02-13 14:30 - 2014-02-12 19:36 - 00000000 ____D () C:\Qoobox
2014-02-13 14:29 - 2014-02-13 14:29 - 00043125 _____ () C:\ComboFix.txt
2014-02-13 14:21 - 2012-10-18 00:39 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-02-13 14:21 - 2011-05-15 23:01 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-02-13 14:18 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2014-02-13 14:17 - 2014-02-12 21:18 - 00109188 _____ () C:\Windows\PFRO.log
2014-02-13 14:17 - 2014-02-12 21:00 - 00003808 _____ () C:\Windows\setupact.log
2014-02-13 14:17 - 2012-10-18 00:39 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-02-13 14:17 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-13 14:16 - 2014-02-12 18:58 - 00000000 ____D () C:\Windows\erdnt
2014-02-13 14:16 - 2011-05-10 01:27 - 01970707 _____ () C:\Windows\WindowsUpdate.log
2014-02-13 14:15 - 2012-09-28 18:06 - 00000000 ___RD () C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-02-13 13:59 - 2013-10-05 14:34 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-02-13 13:50 - 2014-02-13 13:51 - 05180679 ____R (Swearware) C:\Users\Pc\Desktop\ComboFix.exe
2014-02-13 13:50 - 2014-02-13 13:49 - 05180679 _____ (Swearware) C:\Users\Pc\Downloads\ComboFix.exe
2014-02-13 13:49 - 2014-02-11 22:27 - 00000000 ____D () C:\Users\Pc\Desktop\Dokus
2014-02-12 23:12 - 2009-07-14 05:45 - 00010784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-12 23:12 - 2009-07-14 05:45 - 00010784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-12 22:27 - 2014-02-12 22:27 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Avira
2014-02-12 22:27 - 2014-02-12 22:27 - 00000000 ____D () C:\Users\Pc\AppData\Local\VNT
2014-02-12 22:26 - 2014-02-12 22:26 - 00000000 ____D () C:\ProgramData\AskPartnerNetwork
2014-02-12 22:26 - 2014-02-12 22:26 - 00000000 ____D () C:\ProgramData\APN
2014-02-12 22:26 - 2014-02-12 22:26 - 00000000 ____D () C:\Program Files (x86)\VNT
2014-02-12 22:26 - 2014-02-12 22:26 - 00000000 ____D () C:\Program Files (x86)\AskPartnerNetwork
2014-02-12 22:24 - 2014-02-12 22:24 - 00002078 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2014-02-12 22:23 - 2014-02-12 22:23 - 00000000 ____D () C:\ProgramData\Avira
2014-02-12 22:23 - 2014-02-12 22:23 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-02-12 22:08 - 2014-02-12 22:04 - 139704984 _____ () C:\Users\Pc\Downloads\avira_ultimate_protection_suite_de.exe
2014-02-12 22:05 - 2014-02-12 22:05 - 00264757 _____ () C:\Users\Pc\Downloads\FHSetup.exe
2014-02-12 22:05 - 2014-02-12 22:05 - 00001981 _____ () C:\Users\Pc\Desktop\Update Checker.lnk
2014-02-12 22:05 - 2014-02-12 22:05 - 00000000 ____D () C:\Program Files (x86)\FileHippo.com
2014-02-12 21:54 - 2014-02-12 21:54 - 00007674 _____ () C:\Users\Pc\AppData\Local\Resmon.ResmonCfg
2014-02-12 21:16 - 2013-08-14 22:07 - 00000000 ____D () C:\Windows\system32\MRT
2014-02-12 21:10 - 2012-10-18 05:30 - 88567024 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-02-12 21:07 - 2012-12-18 19:29 - 01625030 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-02-12 21:07 - 2009-07-14 11:54 - 00710502 _____ () C:\Windows\system32\perfh007.dat
2014-02-12 21:07 - 2009-07-14 11:54 - 00154832 _____ () C:\Windows\system32\perfc007.dat
2014-02-12 21:07 - 2009-07-14 06:13 - 01625030 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-12 21:06 - 2014-02-11 17:54 - 02539172 _____ () C:\Windows\system32\Drivers\Cat.DB
2014-02-12 21:00 - 2014-02-12 21:00 - 00000000 _____ () C:\Windows\setuperr.log
2014-02-12 20:59 - 2014-02-11 17:50 - 00000000 ____D () C:\ProgramData\PC Tools
2014-02-12 20:56 - 2013-10-05 14:34 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-02-12 20:56 - 2012-10-17 23:45 - 00000000 ____D () C:\Users\Pc\AppData\Local\Adobe
2014-02-12 20:55 - 2012-12-10 18:25 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-02-12 20:55 - 2012-12-10 18:25 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-02-12 20:52 - 2013-12-27 22:18 - 00000000 ____D () C:\Users\Pc\AppData\Local\Apps\2.0
2014-02-12 20:52 - 2012-10-20 13:46 - 00000000 ____D () C:\Users\Pc\AppData\Local\CrashDumps
2014-02-12 20:52 - 2012-10-18 15:02 - 00000000 ____D () C:\Windows\Minidump
2014-02-12 19:58 - 2013-04-04 22:02 - 00000000 ____D () C:\Program Files (x86)\VLC Media Player DB Toolbar Toolbar
2014-02-12 19:44 - 2012-10-18 00:43 - 00000000 ____D () C:\ProgramData\Norton
2014-02-12 19:01 - 2014-02-12 13:51 - 00000436 _____ () C:\Windows\Tasks\ParetoLogic Update Version3.job
2014-02-12 19:01 - 2014-02-12 13:51 - 00000394 _____ () C:\Windows\Tasks\PC Health Advisor Defrag.job
2014-02-12 19:01 - 2014-02-12 13:51 - 00000376 _____ () C:\Windows\Tasks\PC Health Advisor.job
2014-02-12 18:00 - 2014-02-12 13:51 - 00000462 _____ () C:\Windows\Tasks\ParetoLogic Registration3.job
2014-02-12 16:59 - 2013-04-07 21:02 - 00000000 ____D () C:\Users\Pc\Documents\Mount&Blade Warband Savegames
2014-02-12 16:05 - 2014-02-12 15:21 - 1064637787 _____ () C:\Users\Pc\Downloads\Naruto2.1.rar
2014-02-12 14:12 - 2014-02-12 14:12 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dll Suite 2013
2014-02-12 14:12 - 2014-02-12 14:12 - 00000000 ____D () C:\Program Files (x86)\DLLSuite
2014-02-12 14:11 - 2014-02-12 14:10 - 16588429 _____ ( ) C:\Users\Pc\Downloads\DLLSuite_Setup.exe
2014-02-12 13:51 - 2014-02-12 13:51 - 00003284 _____ () C:\Windows\System32\Tasks\PC Health Advisor
2014-02-12 13:51 - 2014-02-12 13:51 - 00003264 _____ () C:\Windows\System32\Tasks\PC Health Advisor Defrag
2014-02-12 13:51 - 2014-02-12 13:51 - 00003246 _____ () C:\Windows\System32\Tasks\ParetoLogic Update Version3
2014-02-12 13:51 - 2014-02-12 13:51 - 00003120 _____ () C:\Windows\System32\Tasks\ParetoLogic Registration3
2014-02-12 13:51 - 2014-02-12 13:51 - 00001109 _____ () C:\Users\Pc\Desktop\ParetoLogic PC Health Advisor.lnk
2014-02-12 13:51 - 2014-02-12 13:51 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\ParetoLogic
2014-02-12 13:51 - 2014-02-12 13:51 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ParetoLogic
2014-02-12 13:51 - 2014-02-12 13:51 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\DriverCure
2014-02-12 13:51 - 2014-02-12 13:51 - 00000000 ____D () C:\ProgramData\ParetoLogic
2014-02-12 13:51 - 2014-02-12 13:51 - 00000000 ____D () C:\Program Files (x86)\ParetoLogic
2014-02-12 13:47 - 2014-02-12 13:47 - 05249448 _____ (ParetoLogic Inc.) C:\Users\Pc\Downloads\ParetoLogic PC Health Advisor_de.exe
2014-02-12 13:02 - 2014-02-12 12:30 - 1312122312 _____ () C:\Users\Pc\Downloads\ACOK_1.11.rar
2014-02-12 12:27 - 2014-02-12 12:27 - 00001152 _____ () C:\Users\Pc\Desktop\Mount&Blade Warband.lnk
2014-02-12 12:24 - 2013-04-07 16:18 - 00000000 ____D () C:\Program Files (x86)\Mount&Blade Warband
2014-02-12 12:18 - 2014-02-12 12:03 - 615004486 _____ () C:\Users\Pc\Downloads\mb_warband_setup_1158.exe
2014-02-12 11:39 - 2014-02-12 11:22 - 53254767 _____ () C:\Users\Pc\Downloads\LoLRADS_EUW_german.zip
2014-02-12 11:02 - 2013-12-30 17:30 - 00000000 ____D () C:\Program Files (x86)\Supreme Commander 2
2014-02-12 08:37 - 2013-07-30 17:38 - 00000000 ____D () C:\Program Files (x86)\ExpressFiles
2014-02-12 08:31 - 2012-10-19 17:25 - 01008640 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll
2014-02-12 08:31 - 2012-10-19 17:25 - 00833024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user32.dll
2014-02-12 08:31 - 2012-10-19 17:25 - 00419840 _____ (Microsoft Corporation) C:\Windows\system32\systemcpl.dll
2014-02-12 08:31 - 2012-10-19 17:25 - 00014848 _____ (Microsoft Corporation) C:\Windows\system32\slwga.dll
2014-02-12 08:31 - 2012-10-19 17:25 - 00013824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\slwga.dll
2014-02-11 22:21 - 2014-02-11 22:21 - 00000466 _____ () C:\Windows\SysWOW64\defogger_disable.log
2014-02-11 22:21 - 2014-02-11 22:21 - 00000000 _____ () C:\Users\Pc\defogger_reenable
2014-02-11 22:21 - 2012-09-28 18:04 - 00000000 ____D () C:\Users\Pc
2014-02-11 22:00 - 2014-02-11 21:23 - 00000000 ____D () C:\ProgramData\SecTaskMan
2014-02-11 21:23 - 2014-02-11 21:22 - 00000000 ____D () C:\Program Files (x86)\Security Task Manager
2014-02-11 21:23 - 2014-02-11 16:35 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\DigitalSites
2014-02-11 21:23 - 2014-02-04 15:05 - 00000000 _RSHD () C:\Users\Pc\aoajz
2014-02-11 21:23 - 2014-02-04 12:08 - 00000000 _RSHD () C:\Users\Pc\xripb
2014-02-11 21:23 - 2013-12-31 15:25 - 00000000 ____D () C:\ProgramData\FuNDeaulls
2014-02-11 21:23 - 2013-12-31 15:25 - 00000000 ____D () C:\ProgramData\50Coeuupons
2014-02-11 21:23 - 2013-10-11 13:19 - 00000000 ____D () C:\Program Files (x86)\Unitech LLC
2014-02-11 21:20 - 2014-02-11 21:19 - 02365840 _____ () C:\Users\Pc\Downloads\SecurityTaskManager_Setup.exe
2014-02-11 21:03 - 2014-02-11 21:03 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\TestApp
2014-02-11 20:58 - 2014-02-11 20:58 - 00001121 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-02-11 20:58 - 2013-08-20 16:44 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-02-11 20:57 - 2014-02-11 20:57 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Pc\Downloads\mbam-setup-1.75.0.1300(1).exe
2014-02-11 20:02 - 2012-12-07 23:10 - 00000000 ____D () C:\Users\Pc\AppData\Local\Pokki
2014-02-11 17:34 - 2014-02-11 16:50 - 00000000 ____D () C:\Users\Pc\AppData\Local\NPE
2014-02-11 16:55 - 2012-12-20 15:52 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-02-11 16:54 - 2014-02-11 16:54 - 00000000 ____D () C:\ProgramData\SMR410
2014-02-11 16:38 - 2014-02-11 16:38 - 00000000 ____D () C:\Windows\System32\Tasks\Norton Internet Security
2014-02-11 16:37 - 2014-02-11 16:37 - 00003234 _____ () C:\Windows\System32\Tasks\Norton WSC Integration
2014-02-11 16:35 - 2014-02-11 16:35 - 00003208 _____ () C:\Windows\System32\Tasks\Digital Sites
2014-02-11 16:35 - 2013-07-29 11:35 - 00000196 _____ () C:\Users\Pc\AppData\Roaming\WB.CFG
2014-02-11 16:32 - 2014-02-11 16:27 - 223165336 ____N (Symantec Corporation) C:\Users\Pc\Downloads\NIS_21.1.0.18_SYMTB_TMD_MRFTT_820_10131.exe
2014-02-11 16:32 - 2013-10-20 11:29 - 00000000 ____D () C:\ProgramData\Oracle
2014-02-11 16:30 - 2014-02-11 16:29 - 00005327 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-02-11 16:30 - 2013-07-20 17:55 - 00000000 ____D () C:\Program Files (x86)\Java
2014-02-11 16:03 - 2013-02-23 20:05 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-02-11 16:03 - 2012-11-10 17:56 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\DAEMON Tools Lite
2014-02-11 16:03 - 2012-11-02 19:39 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\uTorrent
2014-02-11 16:03 - 2012-10-26 14:14 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\TS3Client
2014-02-11 15:59 - 2014-02-11 15:59 - 00003582 _____ () C:\Windows\System32\Tasks\PileFile reminder
2014-02-11 15:59 - 2014-02-11 15:59 - 00003160 _____ () C:\Windows\System32\Tasks\PileFile logon
2014-02-11 15:59 - 2014-02-11 15:59 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Oxy
2014-02-11 15:34 - 2014-02-11 15:34 - 00000000 _RSHD () C:\Users\Pc\cc4j5zs76kd2kj
2014-02-11 15:33 - 2012-10-20 20:58 - 00000000 ____D () C:\Users\Pc\AppData\Local\PMB Files
2014-02-11 15:33 - 2012-10-20 20:58 - 00000000 ____D () C:\ProgramData\PMB Files
2014-02-11 15:20 - 2012-10-26 13:15 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Skype
2014-02-10 23:37 - 2014-02-13 14:36 - 04122976 _____ (Kaspersky Lab ZAO) C:\Users\Pc\Desktop\TDSSKiller.exe
2014-02-07 17:18 - 2013-09-14 20:24 - 00000424 _____ () C:\Users\Pc\Desktop\Accounts.txt
2014-02-06 13:16 - 2014-02-12 21:03 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-06 12:30 - 2014-02-12 21:03 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-06 12:30 - 2014-02-12 21:03 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-02-06 12:12 - 2014-02-12 21:03 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-06 12:07 - 2014-02-12 21:03 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-02-06 12:06 - 2014-02-12 21:03 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-02-06 11:57 - 2014-02-12 21:03 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-06 11:56 - 2014-02-12 21:03 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-02-06 11:52 - 2014-02-12 21:03 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-02-06 11:49 - 2014-02-12 21:03 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-06 11:48 - 2014-02-12 21:03 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-02-06 11:48 - 2014-02-12 21:03 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-02-06 11:38 - 2014-02-12 21:03 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-02-06 11:32 - 2014-02-12 21:03 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-02-06 11:20 - 2014-02-12 21:03 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-02-06 11:17 - 2014-02-12 21:03 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-02-06 11:11 - 2014-02-12 21:03 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-06 11:01 - 2014-02-12 21:03 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-02-06 11:00 - 2014-02-12 21:03 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-02-06 10:57 - 2014-02-12 21:03 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-02-06 10:57 - 2014-02-12 21:03 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-06 10:52 - 2014-02-12 21:03 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-02-06 10:52 - 2014-02-12 21:03 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-02-06 10:50 - 2014-02-12 21:03 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-06 10:49 - 2014-02-12 21:03 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-02-06 10:47 - 2014-02-12 21:03 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-02-06 10:46 - 2014-02-12 21:03 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-02-06 10:25 - 2014-02-12 21:03 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-02-06 10:25 - 2014-02-12 21:03 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-02-06 10:24 - 2014-02-12 21:03 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-06 10:22 - 2014-02-12 21:03 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-06 10:13 - 2014-02-12 21:03 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-02-06 10:09 - 2014-02-12 21:03 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-02-06 10:03 - 2014-02-12 21:03 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-02-06 09:55 - 2014-02-12 21:03 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-06 09:41 - 2014-02-12 21:03 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-02-06 09:40 - 2014-02-12 21:03 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-02-06 09:36 - 2014-02-12 21:03 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-02-06 09:34 - 2014-02-12 21:03 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-02-05 12:36 - 2013-12-28 11:49 - 00291128 _____ () C:\Windows\SysWOW64\PnkBstrB.xtr
2014-02-05 12:36 - 2013-08-18 17:42 - 00291128 _____ () C:\Windows\SysWOW64\PnkBstrB.exe
2014-02-04 15:46 - 2013-08-18 17:42 - 00291128 _____ () C:\Windows\SysWOW64\PnkBstrB.ex0
2014-02-04 15:25 - 2013-12-28 14:47 - 00000000 ____D () C:\ProgramData\YoutubeAdblocker
2014-02-04 15:25 - 2013-12-28 14:47 - 00000000 ____D () C:\ProgramData\surf aand kEEp
2014-02-04 15:25 - 2013-12-28 14:47 - 00000000 ____D () C:\Program Files (x86)\surf aand kEEp
2014-02-04 13:49 - 2014-02-04 13:49 - 00347816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\MicrosoftFixit.WinSecurity.FISC.37314945131128502.8.1.Run.exe
2014-02-04 13:42 - 2014-02-04 13:42 - 00347816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\MicrosoftFixit.WindowsFirewall.RNP.Run.exe
2014-02-04 13:12 - 2014-02-04 13:09 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Riot Games
2014-02-04 13:11 - 2014-02-04 13:11 - 00001613 _____ () C:\Users\Public\Desktop\Play League of Legends.lnk
2014-02-04 13:11 - 2012-10-28 14:16 - 00000000 __SHD () C:\Windows\SysWOW64\AI_RecycleBin
2014-02-04 13:08 - 2014-02-04 13:07 - 34888568 _____ (Riot Games) C:\Users\Pc\Downloads\LeagueofLegends_EUW_Installer_06_12_13.exe
2014-02-04 12:20 - 2014-02-04 12:20 - 00001024 _____ () C:\Windows\SysWOW64\.rnd
2014-02-04 12:20 - 2014-01-21 10:23 - 00000000 ____D () C:\Users\Pc\AppData\Local\CyberGhost
2014-02-02 13:32 - 2014-02-02 13:32 - 00000000 ___SH () C:\Users\Pc\AppData\Local\LumaEmu
2014-02-02 13:28 - 2014-02-02 13:28 - 00000000 ____D () C:\Users\Pc\Desktop\RustClient_v19.12.2013
2014-02-02 13:27 - 2013-02-05 20:06 - 00000000 ____D () C:\Users\Pc\Desktop\Spiele
2014-02-02 13:21 - 2014-02-02 13:20 - 06499816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\vcredist_x86.exe
2014-02-02 13:21 - 2013-08-18 17:43 - 00000000 ____D () C:\ProgramData\Package Cache
2014-02-01 11:35 - 2013-06-17 13:35 - 00000005 _____ () C:\Users\Pc\AppData\Roaming\WBPU-TTL.DAT
2014-01-29 14:14 - 2014-01-29 14:14 - 00000631 _____ () C:\Windows\system32\InstallUtil.InstallLog
2014-01-25 14:59 - 2012-10-17 23:53 - 00003906 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{9DE29845-AC8C-4418-B415-05000DEA2E9F}
2014-01-24 22:17 - 2013-08-18 17:42 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2014-01-24 22:12 - 2013-12-27 22:18 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ubisoft
2014-01-24 22:12 - 2013-12-27 22:18 - 00000000 ____D () C:\Users\Pc\AppData\Local\Deployment
2014-01-23 21:18 - 2013-02-25 14:23 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Spotify
2014-01-23 21:01 - 2013-02-25 14:24 - 00000000 ____D () C:\Users\Pc\AppData\Local\Spotify
2014-01-23 17:26 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-01-21 10:27 - 2014-01-21 10:22 - 00000000 ____D () C:\Program Files\CyberGhost 5
2014-01-21 10:23 - 2014-01-21 10:22 - 00000000 ____D () C:\Program Files\TAP-Windows
2014-01-21 10:22 - 2014-01-21 10:22 - 00001736 _____ () C:\Users\Pc\Desktop\CyberGhost 5.lnk
2014-01-21 10:21 - 2014-01-21 10:21 - 08566128 _____ (CyberGhost S.R.L. ) C:\Users\Pc\Downloads\CG_5.0.9.8chip.de.exe
2014-01-21 09:51 - 2013-12-28 14:48 - 00000000 ____D () C:\Program Files (x86)\GS-Enabler
2014-01-17 13:57 - 2009-07-14 05:45 - 00321600 _____ () C:\Windows\system32\FNTCACHE.DAT

Some content of TEMP:
====================
C:\Users\Pc\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-02-11 14:00

==================== End Of Log ============================
         

--- --- ---

--- --- ---

TDSS Killer

14:36:53.0573 0x0a60  TDSS rootkit removing tool 3.0.0.23 Feb 10 2014 23:32:41
14:36:59.0508 0x0a60  ============================================================
14:36:59.0508 0x0a60  Current date / time: 2014/02/13 14:36:59.0508
14:36:59.0508 0x0a60  SystemInfo:
14:36:59.0509 0x0a60  
14:36:59.0509 0x0a60  OS Version: 6.1.7601 ServicePack: 1.0
14:36:59.0509 0x0a60  Product type: Workstation
14:36:59.0509 0x0a60  ComputerName: PC-PC
14:36:59.0509 0x0a60  UserName: Pc
14:36:59.0509 0x0a60  Windows directory: C:\Windows
14:36:59.0509 0x0a60  System windows directory: C:\Windows
14:36:59.0509 0x0a60  Running under WOW64
14:36:59.0509 0x0a60  Processor architecture: Intel x64
14:36:59.0509 0x0a60  Number of processors: 6
14:36:59.0509 0x0a60  Page size: 0x1000
14:36:59.0509 0x0a60  Boot type: Normal boot
14:36:59.0509 0x0a60  ============================================================
14:37:01.0406 0x0a60  KLMD registered as C:\Windows\system32\drivers\51328195.sys
14:37:01.0680 0x0a60  System UUID: {DEC507E8-EDE3-9F56-1156-8E1600A46CA9}
14:37:02.0858 0x0a60  Drive \Device\Harddisk0\DR0 - Size: 0xE8E0DB6000 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
14:37:02.0873 0x0a60  ============================================================
14:37:02.0873 0x0a60  \Device\Harddisk0\DR0:
14:37:02.0874 0x0a60  MBR partitions:
14:37:02.0874 0x0a60  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000
14:37:02.0874 0x0a60  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x746D4000
14:37:02.0874 0x0a60  ============================================================
14:37:02.0898 0x0a60  C: <-> \Device\Harddisk0\DR0\Partition2
14:37:02.0899 0x0a60  ============================================================
14:37:02.0899 0x0a60  Initialize success
14:37:02.0899 0x0a60  ============================================================
14:38:06.0932 0x09b4  ============================================================
14:38:06.0932 0x09b4  Scan started
14:38:06.0932 0x09b4  Mode: Manual; SigCheck; TDLFS; 
14:38:06.0932 0x09b4  ============================================================
14:38:06.0932 0x09b4  KSN ping started
14:38:20.0801 0x09b4  KSN ping finished: true
14:38:21.0705 0x09b4  ================ Scan system memory ========================
14:38:21.0705 0x09b4  System memory - ok
14:38:21.0705 0x09b4  ================ Scan services =============================
14:38:21.0893 0x09b4  [ A87D604AEA360176311474C87A63BB88, B1507868C382CD5D2DBC0D62114FCFBF7A780904A2E3CA7C7C1DD0844ADA9A8F ] 1394ohci        C:\Windows\system32\drivers\1394ohci.sys
14:38:22.0064 0x09b4  1394ohci - ok
14:38:22.0142 0x09b4  [ A3769020F7E8A70FD3E824C050F33306, BAAB18DD28C753EC90E9552BD5FFC316AD8815505A7998BCE51D21448B373D86 ] acedrv11        C:\Windows\system32\drivers\acedrv11.sys
14:38:22.0220 0x09b4  acedrv11 - ok
14:38:22.0267 0x09b4  [ D81D9E70B8A6DD14D42D7B4EFA65D5F2, FDAAB7E23012B4D31537C5BDEF245BB0A12FA060A072C250E21C68E18B22E002 ] ACPI            C:\Windows\system32\drivers\ACPI.sys
14:38:22.0314 0x09b4  ACPI - ok
14:38:22.0345 0x09b4  [ 99F8E788246D495CE3794D7E7821D2CA, F91615463270AD2601F882CAED43B88E7EDA115B9FD03FC56320E48119F15F76 ] AcpiPmi         C:\Windows\system32\drivers\acpipmi.sys
14:38:22.0407 0x09b4  AcpiPmi - ok
14:38:22.0532 0x09b4  [ ADDA5E1951B90D3D23C56D3CF0622ADC, E85E7BFD29F00ED34BF5BE8BD4DA93CBB14278E16809BB55406875F0DA88551E ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
14:38:22.0563 0x09b4  AdobeARMservice - ok
14:38:22.0735 0x09b4  [ C8C6C0D659734FDBF63F6F421A5416BC, 11C452D77D0A8A5E430D0D0C9949797FFC03D2E3DADB8FBB9B63EDA868AFF83C ] AdobeFlashPlayerUpdateSvc C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
14:38:22.0766 0x09b4  AdobeFlashPlayerUpdateSvc - ok
14:38:22.0813 0x09b4  [ 2F6B34B83843F0C5118B63AC634F5BF4, 43E3F5FBFB5D33981AC503DEE476868EC029815D459E7C36C4ABC2D2F75B5735 ] adp94xx         C:\Windows\system32\DRIVERS\adp94xx.sys
14:38:22.0891 0x09b4  adp94xx - ok
14:38:22.0938 0x09b4  [ 597F78224EE9224EA1A13D6350CED962, DA7FD99BE5E3B7B98605BF5C13BF3F1A286C0DE1240617570B46FE4605E59BDC ] adpahci         C:\Windows\system32\DRIVERS\adpahci.sys
14:38:22.0985 0x09b4  adpahci - ok
14:38:23.0031 0x09b4  [ E109549C90F62FB570B9540C4B148E54, E804563735153EA00A00641814244BC8A347B578E7D63A16F43FB17566EE5559 ] adpu320         C:\Windows\system32\DRIVERS\adpu320.sys
14:38:23.0063 0x09b4  adpu320 - ok
14:38:23.0109 0x09b4  [ 4B78B431F225FD8624C5655CB1DE7B61, 198A5AF2125C7C41F531A652D200C083A55A97DC541E3C0B5B253C7329949156 ] AeLookupSvc     C:\Windows\System32\aelupsvc.dll
14:38:23.0203 0x09b4  AeLookupSvc - ok
14:38:23.0265 0x09b4  [ 79059559E89D06E8B80CE2944BE20228, 6E041D2FED2D0C3D8E16E56CB61D3245F9144EA92F5BDC9A4AA30598D1C8E6EE ] AFD             C:\Windows\system32\drivers\afd.sys
14:38:23.0375 0x09b4  AFD - ok
14:38:23.0406 0x09b4  [ 608C14DBA7299D8CB6ED035A68A15799, 45360F89640BF1127C82A32393BD76205E4FA067889C40C491602F370C09282A ] agp440          C:\Windows\system32\drivers\agp440.sys
14:38:23.0437 0x09b4  agp440 - ok
14:38:23.0765 0x09b4  [ BBE9054FDADC8D49D29C5DA4FB84A803, 4315C1D7DBD35A80E25F15B45587AA76F6E9FCDC617B5ABF62301570771066AF ] Akamai          c:\program files (x86)\common files\akamai/netsession_win_8fa3539.dll
14:38:23.0765 0x09b4  Suspicious file ( Hidden ): c:\program files (x86)\common files\akamai/netsession_win_8fa3539.dll. md5: BBE9054FDADC8D49D29C5DA4FB84A803, sha256: 4315C1D7DBD35A80E25F15B45587AA76F6E9FCDC617B5ABF62301570771066AF
14:38:23.0780 0x09b4  Akamai - detected HiddenFile.Multi.Generic ( 1 )
14:38:24.0014 0x09b4  Akamai ( HiddenFile.Multi.Generic ) - warning
14:38:26.0853 0x09b4  [ 3290D6946B5E30E70414990574883DDB, 0E9294E1991572256B3CDA6B031DB9F39CA601385515EE59F1F601725B889663 ] ALG             C:\Windows\System32\alg.exe
14:38:26.0931 0x09b4  ALG - ok
14:38:26.0963 0x09b4  [ 5812713A477A3AD7363C7438CA2EE038, A7316299470D2E57A11499C752A711BF4A71EB11C9CBA731ED0945FF6A966721 ] aliide          C:\Windows\system32\drivers\aliide.sys
14:38:26.0994 0x09b4  aliide - ok
14:38:27.0087 0x09b4  [ 66B54471B5856E314947881E28263A6D, 2D60706B52A2CE98FF806337D62CD010C1DEB2AEDDF899C7B67173928B2D7C4C ] AMD External Events Utility C:\Windows\system32\atiesrxx.exe
14:38:27.0165 0x09b4  AMD External Events Utility - ok
14:38:27.0259 0x09b4  AMD FUEL Service - ok
14:38:27.0306 0x09b4  [ 1FF8B4431C353CE385C875F194924C0C, 3EA3A7F426B0FFC2461EDF4FDB4B58ACC9D0730EDA5B728D1EA1346EA0A02720 ] amdide          C:\Windows\system32\drivers\amdide.sys
14:38:27.0337 0x09b4  amdide - ok
14:38:27.0384 0x09b4  [ 6A2EEB0C4133B20773BB3DD0B7B377B4, E4CB35C6937C70A145A13E5AE5B34A271B49101DA623171ACBFDA8601E5A70EA ] amdiox64        C:\Windows\system32\DRIVERS\amdiox64.sys
14:38:27.0415 0x09b4  amdiox64 - ok
14:38:27.0446 0x09b4  [ 7024F087CFF1833A806193EF9D22CDA9, E7F27E488C38338388103D3B7EEDD61D05E14FB140992AEE6F492FFC821BF529 ] AmdK8           C:\Windows\system32\DRIVERS\amdk8.sys
14:38:27.0509 0x09b4  AmdK8 - ok
14:38:28.0320 0x09b4  [ FBB35875FEFE53D4280259842069ED72, B1A1B5799A6C50C244182CD201A1E9FCB7BE3B5ED4BB2E2E6BCF8E1BF53B75DB ] amdkmdag        C:\Windows\system32\DRIVERS\atikmdag.sys
14:38:29.0287 0x09b4  amdkmdag - ok
14:38:29.0427 0x09b4  [ A32BCAD9377E3B75D034CAFBA463A0AE, F504895D9C9CD1B4607806BCAF15A1CBFBAC2E5824903277A1350C9F35045602 ] amdkmdap        C:\Windows\system32\DRIVERS\atikmpag.sys
14:38:29.0521 0x09b4  amdkmdap - ok
14:38:29.0552 0x09b4  [ 1E56388B3FE0D031C44144EB8C4D6217, E88CA76FD47BA0EB427D59CB9BE040DE133D89D4E62D03A8D622624531D27487 ] AmdPPM          C:\Windows\system32\DRIVERS\amdppm.sys
14:38:29.0599 0x09b4  AmdPPM - ok
14:38:29.0646 0x09b4  [ D4121AE6D0C0E7E13AA221AA57EF2D49, 626F43C099BD197BE56648C367B711143C2BCCE96496BBDEF19F391D52FA01D0 ] amdsata         C:\Windows\system32\drivers\amdsata.sys
14:38:29.0693 0x09b4  amdsata - ok
14:38:29.0724 0x09b4  [ F67F933E79241ED32FF46A4F29B5120B, D6EF539058F159CC4DD14CA9B1FD924998FEAC9D325C823C7A2DD21FEF1DC1A8 ] amdsbs          C:\Windows\system32\DRIVERS\amdsbs.sys
14:38:29.0771 0x09b4  amdsbs - ok
14:38:29.0802 0x09b4  [ 540DAF1CEA6094886D72126FD7C33048, 296578572A93F5B74E1AD443E000B79DC99D1CBD25082E02704800F886A3065F ] amdxata         C:\Windows\system32\drivers\amdxata.sys
14:38:29.0817 0x09b4  amdxata - ok
14:38:29.0895 0x09b4  [ B9C95291F5EA1072CEC2BA690E07F29F, 1FC75E20B31680667A5FE4E0AB5ADD6CFE7016A3B9E975E92EAA192689684E54 ] AMD_RAIDXpert   C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe
14:38:29.0942 0x09b4  AMD_RAIDXpert - detected UnsignedFile.Multi.Generic ( 1 )
14:38:29.0942 0x09b4  AMD_RAIDXpert ( UnsignedFile.Multi.Generic ) - warning
14:38:32.0781 0x09b4  [ 4DE0D5D747A73797C95A97DCCE5018B5, 17EC669675C2E43515EFE2D8BCC9DDFFBE64F99EBFB9A6DAB429F65A2B504560 ] androidusb      C:\Windows\system32\Drivers\ssadadb.sys
14:38:32.0828 0x09b4  androidusb - ok
14:38:33.0047 0x09b4  [ 67402A0D0554DAF40E421DE34F5E295A, FDCE8B04DFABAC428636533F5A446C47607DC8F8DC04E3156450FBF0696B85AB ] AntiVirMailService C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe
14:38:33.0109 0x09b4  AntiVirMailService - ok
14:38:33.0187 0x09b4  [ FE79366FECD444A16CCA9979134DBEA8, 91D2301E35C89B9FAD5680124EA51DC346159DC78556ACCD935F9B236B9FDCBC ] AntiVirSchedulerService C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
14:38:33.0234 0x09b4  AntiVirSchedulerService - ok
14:38:33.0281 0x09b4  [ FDE9C7030FB1E9E2715E113EE6A10F90, 541F278D743C34C6D9940FC1250B90674EB88EC429D481012F27817DAB1B557A ] AntiVirService  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
14:38:33.0327 0x09b4  AntiVirService - ok
14:38:33.0405 0x09b4  [ 8D69B1551F51E18AE12E01DE6A2050EA, E1BF3E1AB82E90DC32811C934933D761340DAE44B7ACDF3B9C19725465BE3590 ] AntiVirWebService C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe
14:38:33.0483 0x09b4  AntiVirWebService - ok
14:38:33.0546 0x09b4  [ E8CCB797DAF80779C768BD3A9FC8FCAF, 781BD878CA34D8B6D2FE238439CD173E95449260428859BEA92866D41B1284F4 ] AODDriver4.2.0  C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys
14:38:33.0577 0x09b4  AODDriver4.2.0 - ok
14:38:33.0655 0x09b4  [ B342CD9AA44E4AE99E2368EBDBC2E17A, C3081358313A982F53CAD54C214AFECAD9660A59FB4A3DDFE068724E83041AF8 ] APNMCP          C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe
14:38:33.0686 0x09b4  APNMCP - ok
14:38:33.0733 0x09b4  [ 89A69C3F2F319B43379399547526D952, 8ABDB4B8E106F96EBBA0D4D04C4F432296516E107E7BA5644ED2E50CF9BB491A ] AppID           C:\Windows\system32\drivers\appid.sys
14:38:33.0842 0x09b4  AppID - ok
14:38:33.0873 0x09b4  [ 0BC381A15355A3982216F7172F545DE1, C33AF13CB218F7BF52E967452573DF2ADD20A95C6BF99229794FEF07C4BBE725 ] AppIDSvc        C:\Windows\System32\appidsvc.dll
14:38:33.0983 0x09b4  AppIDSvc - ok
14:38:34.0014 0x09b4  [ 9D2A2369AB4B08A4905FE72DB104498F, D6FA1705018BABABFA2362E05691A0D6408D14DE7B76129B16D0A1DAD6378E58 ] Appinfo         C:\Windows\System32\appinfo.dll
14:38:34.0061 0x09b4  Appinfo - ok
14:38:34.0107 0x09b4  [ 4ABA3E75A76195A3E38ED2766C962899, E2001ACD44DA270B8289DA362D26416676301773AB22616C211F31CF2E7869AA ] AppMgmt         C:\Windows\System32\appmgmts.dll
14:38:34.0170 0x09b4  AppMgmt - ok
14:38:34.0201 0x09b4  [ C484F8CEB1717C540242531DB7845C4E, C507CE26716EB923B864ED85E8FA0B24591E2784A2F4F0E78AEED7E9953311F6 ] arc             C:\Windows\system32\DRIVERS\arc.sys
14:38:34.0248 0x09b4  arc - ok
14:38:34.0263 0x09b4  [ 019AF6924AEFE7839F61C830227FE79C, 5926B9DDFC9198043CDD6EA0B384C83B001EC225A8125628C4A45A3E6C42C72A ] arcsas          C:\Windows\system32\DRIVERS\arcsas.sys
14:38:34.0310 0x09b4  arcsas - ok
14:38:34.0373 0x09b4  ArcService - ok
14:38:34.0482 0x09b4  [ FEF9DD9EA587F8886ADE43C1BEFBDAFE, DDE6F28B3F7F2ABBEE59D4864435108791631E9CB4CDFB1F178E5AA9859956D8 ] AsIO            C:\Windows\syswow64\drivers\AsIO.sys
14:38:34.0513 0x09b4  AsIO - ok
14:38:34.0575 0x09b4  [ 718692FFF22D6AF47EBA0A741A924921, 01E462C868B9DB635F8D0D6FCA1B312FF4C3BE8EE9E4103B4B0406329767D02D ] asmthub3        C:\Windows\system32\DRIVERS\asmthub3.sys
14:38:34.0653 0x09b4  asmthub3 - ok
14:38:34.0716 0x09b4  [ BAD70A5AC534C108F680A33C654BC626, 994FC917A2C737EAAD5A5F98056D56800AD8C0F3B43C7227B9888DE4DC3428CE ] asmtxhci        C:\Windows\system32\DRIVERS\asmtxhci.sys
14:38:34.0778 0x09b4  asmtxhci - ok
14:38:34.0919 0x09b4  [ 108FB6DDB69E537A2EA53F425363FAE5, B12A9F5338D39805E08A44A335FF7AA77F2266F535A2F5C8412CC746C75E5B1D ] aspnet_state    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
14:38:34.0965 0x09b4  aspnet_state - ok
14:38:35.0043 0x09b4  [ 954FFBFF05B0B60EB63B52AF561436C4, 40228A2B688E827815B5A567584FCF99BF661696DB8CC8BB455393B3CEE35094 ] AsSysCtrlService C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe
14:38:35.0075 0x09b4  AsSysCtrlService - ok
14:38:35.0090 0x09b4  [ 26D66E32E78D3059715B3A17BC679CD9, 5039CB81CE0829C5F3DED16A4005FEB10141C6C9B473CC319E81BAF6D1DA33E3 ] AsUpIO          C:\Windows\syswow64\drivers\AsUpIO.sys
14:38:35.0121 0x09b4  AsUpIO - ok
14:38:35.0153 0x09b4  [ 769765CE2CC62867468CEA93969B2242, 0D8F19D49869DF93A3876B4C2E249D12E83F9CE11DAE8917D368E292043D4D26 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys
14:38:35.0246 0x09b4  AsyncMac - ok
14:38:35.0277 0x09b4  [ 02062C0B390B7729EDC9E69C680A6F3C, 0261683C6DC2706DCE491A1CDC954AC9C9E649376EC30760BB4E225E18DC5273 ] atapi           C:\Windows\system32\drivers\atapi.sys
14:38:35.0309 0x09b4  atapi - ok
14:38:35.0355 0x09b4  [ 770A3B0D78232B0C1054495392A1FBA3, 733BB08BAFE42E848F3A3CDFD80A2C37DB829CAD2E18B3D6299FDEE6EF30C9CD ] AtiHDAudioService C:\Windows\system32\drivers\AtihdW76.sys
14:38:35.0418 0x09b4  AtiHDAudioService - ok
14:38:35.0449 0x09b4  [ C07A040D6B5A42DD41EE386CF90974C8, 8D47815F99C79B795504C3172B5FBBDBA6AFACC004B17AA3954A06BE713FACAE ] AtiPcie         C:\Windows\system32\DRIVERS\AtiPcie.sys
14:38:35.0465 0x09b4  AtiPcie - ok
14:38:35.0543 0x09b4  [ 4AEF9EC86818375495FB78CA58DF4E18, 0565888F798FAB86091E7A7D8E1D583DF3CC5756A12ACF04987C67C14E360DFB ] atksgt          C:\Windows\system32\DRIVERS\atksgt.sys
14:38:35.0589 0x09b4  atksgt - detected UnsignedFile.Multi.Generic ( 1 )
14:38:35.0589 0x09b4  atksgt ( UnsignedFile.Multi.Generic ) - warning
14:38:38.0725 0x09b4  [ F23FEF6D569FCE88671949894A8BECF1, FCE7B156ED663471CF9A736915F00302E93B50FC647563D235313A37FCE8F0F6 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
14:38:38.0850 0x09b4  AudioEndpointBuilder - ok
14:38:38.0881 0x09b4  [ F23FEF6D569FCE88671949894A8BECF1, FCE7B156ED663471CF9A736915F00302E93B50FC647563D235313A37FCE8F0F6 ] AudioSrv        C:\Windows\System32\Audiosrv.dll
14:38:39.0006 0x09b4  AudioSrv - ok
14:38:39.0084 0x09b4  [ 7806BFCD1D7FA5EC23F7324D4EAFD25B, 4EDFD9DE520728AF6578BED0054ED6A4976A7F020F3329EA6681D6E361D9DB2D ] avgntflt        C:\Windows\system32\DRIVERS\avgntflt.sys
14:38:39.0115 0x09b4  avgntflt - ok
14:38:39.0162 0x09b4  [ 4A175D2D30D31F7DF46F09B9A108E089, 6167D4E319B47C9759231EDEDF7F4199196CCDD332E8DB2137872FB15699B9F8 ] avgtp           C:\Windows\system32\drivers\avgtpx64.sys
14:38:39.0193 0x09b4  avgtp - ok
14:38:39.0240 0x09b4  [ C3A58DBD18786C338126D30BF8C33D72, 4DF4D37AB5139548C2DA4B4C8D6B933A7F4ED001BCA089EFBC8C57EEDE8785A6 ] avipbb          C:\Windows\system32\DRIVERS\avipbb.sys
14:38:39.0271 0x09b4  avipbb - ok
14:38:39.0302 0x09b4  [ 390184FAD8FCC1B6DA25AEBAE928C3B6, 537B0E0FAE080B55D70E990BBA0F7F22903CA340F6A42039BAD617A8ECF59119 ] avkmgr          C:\Windows\system32\DRIVERS\avkmgr.sys
14:38:39.0318 0x09b4  avkmgr - ok
14:38:39.0349 0x09b4  [ 3DE0EBA0BF4771C897F544CBF7CB8973, 6A032503561414EDCE0D123947AECACBAFE4BBF7D9849BA2DF010E28235973AB ] avnetflt        C:\Windows\system32\DRIVERS\avnetflt.sys
14:38:39.0380 0x09b4  avnetflt - ok
14:38:39.0427 0x09b4  [ A6BF31A71B409DFA8CAC83159E1E2AFF, CBB83F73FFD3C3FB4F96605067739F8F7A4A40B2B05417FA49E575E95628753F ] AxInstSV        C:\Windows\System32\AxInstSV.dll
14:38:39.0521 0x09b4  AxInstSV - ok
14:38:39.0567 0x09b4  [ 3E5B191307609F7514148C6832BB0842, DE011CB7AA4A2405FAF21575182E0793A1D83DFFC44E9A7864D59F3D51D8D580 ] b06bdrv         C:\Windows\system32\DRIVERS\bxvbda.sys
14:38:39.0661 0x09b4  b06bdrv - ok
14:38:39.0692 0x09b4  [ B5ACE6968304A3900EEB1EBFD9622DF2, 1DAA118D8CA3F97B34DF3D3CDA1C78EAB2ED225699FEABE89D331AE0CB7679FA ] b57nd60a        C:\Windows\system32\DRIVERS\b57nd60a.sys
14:38:39.0770 0x09b4  b57nd60a - ok
14:38:39.0817 0x09b4  [ FDE360167101B4E45A96F939F388AEB0, 8D1457E866BBD645C4B9710DFBFF93405CC1193BF9AE42326F2382500B713B82 ] BDESVC          C:\Windows\System32\bdesvc.dll
14:38:39.0879 0x09b4  BDESVC - ok
14:38:39.0895 0x09b4  [ 16A47CE2DECC9B099349A5F840654746, 77C008AEDB07FAC66413841D65C952DDB56FE7DCA5E9EF9C8F4130336B838024 ] Beep            C:\Windows\system32\drivers\Beep.sys
14:38:39.0989 0x09b4  Beep - ok
14:38:40.0082 0x09b4  [ 82974D6A2FD19445CC5171FC378668A4, 075D25F47C0D2277E40AF8615571DAA5EB16B1824563632A9A7EC62505C29A4A ] BFE             C:\Windows\System32\bfe.dll
14:38:40.0160 0x09b4  BFE - ok
14:38:40.0238 0x09b4  [ 1EA7969E3271CBC59E1730697DC74682, D511A34D63A6E0E6E7D1879068E2CD3D87ABEAF4936B2EA8CDDAD9F79D60FA04 ] BITS            C:\Windows\system32\qmgr.dll
14:38:40.0379 0x09b4  BITS - ok
14:38:40.0410 0x09b4  [ 61583EE3C3A17003C4ACD0475646B4D3, 17E4BECC309C450E7E44F59A9C0BBC24D21BDC66DFBA65B8F198A00BB47A9811 ] blbdrive        C:\Windows\system32\DRIVERS\blbdrive.sys
14:38:40.0472 0x09b4  blbdrive - ok
14:38:40.0488 0x09b4  [ 6C02A83164F5CC0A262F4199F0871CF5, AD4632A6A203CB40970D848315D8ADB9C898349E20D8DF4107C2AE2703A2CF28 ] bowser          C:\Windows\system32\DRIVERS\bowser.sys
14:38:40.0535 0x09b4  bowser - ok
14:38:40.0566 0x09b4  [ F09EEE9EDC320B5E1501F749FDE686C8, 66691114C42E12F4CC6DC4078D4D2FA4029759ACDAF1B59D17383487180E84E3 ] BrFiltLo        C:\Windows\system32\DRIVERS\BrFiltLo.sys
14:38:40.0628 0x09b4  BrFiltLo - ok
14:38:40.0659 0x09b4  [ B114D3098E9BDB8BEA8B053685831BE6, 0ED23C1897F35FA00B9C2848DE4ED200E18688AA7825674888054BBC3A3EB92C ] BrFiltUp        C:\Windows\system32\DRIVERS\BrFiltUp.sys
14:38:40.0691 0x09b4  BrFiltUp - ok
14:38:40.0722 0x09b4  [ 5C2F352A4E961D72518261257AAE204B, 9EE1001E1D46A414A7A86FE1DBBE232203E26F54D9EF43ED31ED8EACD4D09853 ] BridgeMP        C:\Windows\system32\DRIVERS\bridge.sys
14:38:40.0815 0x09b4  BridgeMP - ok
14:38:40.0847 0x09b4  [ 05F5A0D14A2EE1D8255C2AA0E9E8E694, 40011138869F5496A3E78D38C9900B466B6F3877526AC22952DCD528173F4645 ] Browser         C:\Windows\System32\browser.dll
14:38:40.0878 0x09b4  Browser - ok
14:38:40.0909 0x09b4  [ 43BEA8D483BF1870F018E2D02E06A5BD, 4E6F5A5FD8C796A110B0DC9FF29E31EA78C04518FC1C840EF61BABD58AB10272 ] Brserid         C:\Windows\System32\Drivers\Brserid.sys
14:38:40.0987 0x09b4  Brserid - ok
14:38:41.0018 0x09b4  [ A6ECA2151B08A09CACECA35C07F05B42, E2875BB7768ABAF38C3377007AA0A3C281503474D1831E396FB6599721586B0C ] BrSerWdm        C:\Windows\System32\Drivers\BrSerWdm.sys
14:38:41.0081 0x09b4  BrSerWdm - ok
14:38:41.0096 0x09b4  [ B79968002C277E869CF38BD22CD61524, 50631836502237AF4893ECDCEA43B9031C3DE97433F594D46AF7C3C77F331983 ] BrUsbMdm        C:\Windows\System32\Drivers\BrUsbMdm.sys
14:38:41.0143 0x09b4  BrUsbMdm - ok
14:38:41.0174 0x09b4  [ A87528880231C54E75EA7A44943B38BF, 4C8BBB29FDA76A96840AA47A8613C15D4466F9273A13941C19507008629709C9 ] BrUsbSer        C:\Windows\System32\Drivers\BrUsbSer.sys
14:38:41.0205 0x09b4  BrUsbSer - ok
14:38:41.0252 0x09b4  [ CF98190A94F62E405C8CB255018B2315, E1B2540023C4FE9FD588E4B6AE6347DFA565EB3898F21E5360882BF3E8B5E781 ] BthEnum         C:\Windows\system32\DRIVERS\BthEnum.sys
14:38:41.0315 0x09b4  BthEnum - ok
14:38:41.0330 0x09b4  [ 9DA669F11D1F894AB4EB69BF546A42E8, B498B8B6CEF957B73179D1ADAF084BBB57BB3735D810F9BE2C7B1D58A4FD25A4 ] BTHMODEM        C:\Windows\system32\DRIVERS\bthmodem.sys
14:38:41.0393 0x09b4  BTHMODEM - ok
14:38:41.0439 0x09b4  [ 02DD601B708DD0667E1331FA8518E9FF, 7DE6CC4DBB621CD03B01D9CE6CF66EAFE31D39030A391562CD0E278E1D70ADE1 ] BthPan          C:\Windows\system32\DRIVERS\bthpan.sys
14:38:41.0486 0x09b4  BthPan - ok
14:38:41.0549 0x09b4  [ 738D0E9272F59EB7A1449C3EC118E6C4, FE3D32C2A5E4DC21376A0F89C0B2EE024ECF1A3FB99213CC9BBC986ADF7AF080 ] BTHPORT         C:\Windows\system32\Drivers\BTHport.sys
14:38:41.0642 0x09b4  BTHPORT - ok
14:38:41.0689 0x09b4  [ 95F9C2976059462CBBF227F7AAB10DE9, 2797AE919FF7606B070FB039CECDB0707CD2131DCAC09C5DF14F443D881C9F34 ] bthserv         C:\Windows\system32\bthserv.dll
14:38:41.0798 0x09b4  bthserv - ok
14:38:41.0829 0x09b4  [ F188B7394D81010767B6DF3178519A37, 576304E92FD94908F093A6AB5F4D328F25829BE32EC3CA0D29EBFDF5DE83539B ] BTHUSB          C:\Windows\system32\Drivers\BTHUSB.sys
14:38:41.0876 0x09b4  BTHUSB - ok
14:38:41.0892 0x09b4  catchme - ok
14:38:41.0923 0x09b4  [ B8BD2BB284668C84865658C77574381A, 6C55BA288B626DF172FDFEA0BD7027FAEBA1F44EF20AB55160D7C7DC6E717D65 ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys
14:38:42.0017 0x09b4  cdfs - ok
14:38:42.0079 0x09b4  [ F036CE71586E93D94DAB220D7BDF4416, BD07AAD9E20CEAF9FC84E4977C55EA2C45604A2C682AC70B9B9A2199B6713D5B ] cdrom           C:\Windows\system32\DRIVERS\cdrom.sys
14:38:42.0141 0x09b4  cdrom - ok
14:38:42.0188 0x09b4  [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] CertPropSvc     C:\Windows\System32\certprop.dll
14:38:42.0282 0x09b4  CertPropSvc - ok
14:38:42.0407 0x09b4  [ 7B4AA3F4435950130BC0D9AC6F32DF36, 72EA4DC369145F00F45CC3D0BD3821DBBF0B46E59CDC7FE5C0E2C829C603BB8F ] CGVPNCliService C:\Program Files\CyberGhost 5\Service.exe
14:38:42.0422 0x09b4  CGVPNCliService - ok
14:38:42.0469 0x09b4  [ D7CD5C4E1B71FA62050515314CFB52CF, 513B5A849899F379F0BC6AB3A8A05C3493C2393C95F036612B96EC6E252E1C64 ] circlass        C:\Windows\system32\DRIVERS\circlass.sys
14:38:42.0516 0x09b4  circlass - ok
14:38:42.0563 0x09b4  [ FE1EC06F2253F691FE36217C592A0206, B9F122DB5E665ECDF29A5CB8BB6B531236F31A54A95769D6C5C1924C87FE70CE ] CLFS            C:\Windows\system32\CLFS.sys
14:38:42.0609 0x09b4  CLFS - ok
14:38:42.0656 0x09b4  [ D88040F816FDA31C3B466F0FA0918F29, 39D3630E623DA25B8444B6D3AAAB16B98E7E289C5619E19A85D47B74C71449F3 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
14:38:42.0687 0x09b4  clr_optimization_v2.0.50727_32 - ok
14:38:42.0719 0x09b4  [ D1CEEA2B47CB998321C579651CE3E4F8, 654013B8FD229A50017B08DEC6CA19C7DDA8CE0771260E057A92625201D539B1 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
14:38:42.0765 0x09b4  clr_optimization_v2.0.50727_64 - ok
14:38:42.0843 0x09b4  [ 6D7C8A951AF6AD6835C029B3CB88D333, 66F3D79887B2449B4C6912D1A258D1A96056888F51A8AA24FEDF37942AD5BDBB ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
14:38:42.0875 0x09b4  clr_optimization_v4.0.30319_32 - ok
14:38:42.0937 0x09b4  [ 86329C35FF23CFEF0FB6C0023BA06BCE, D915CE7AD564F97A1C3B047D5248B7EF67ADDC59687FBC90F1776C21DAA0D3FD ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
14:38:42.0984 0x09b4  clr_optimization_v4.0.30319_64 - ok
14:38:43.0015 0x09b4  [ 0840155D0BDDF1190F84A663C284BD33, 696039FA63CFEB33487FAA8FD7BBDB220141E9C6E529355D768DFC87999A9C3A ] CmBatt          C:\Windows\system32\DRIVERS\CmBatt.sys
14:38:43.0062 0x09b4  CmBatt - ok
14:38:43.0109 0x09b4  [ E19D3F095812725D88F9001985B94EDD, 46243C5CCC4981CAC6FA6452FFCEC33329BF172448F1852D52592C9342E0E18B ] cmdide          C:\Windows\system32\drivers\cmdide.sys
14:38:43.0140 0x09b4  cmdide - ok
14:38:43.0218 0x09b4  [ EBF28856F69CF094A902F884CF989706, AD6C9F0BC20AA49EEE5478DA0F856F0EA2B414B63208C5FFB03C9D7F5B59765F ] CNG             C:\Windows\system32\Drivers\cng.sys
14:38:43.0280 0x09b4  CNG - ok
14:38:43.0296 0x09b4  [ 102DE219C3F61415F964C88E9085AD14, CD74CB703381F1382C32CF892FF2F908F4C9412E1BC77234F8FEA5D4666E1BF1 ] Compbatt        C:\Windows\system32\DRIVERS\compbatt.sys
14:38:43.0327 0x09b4  Compbatt - ok
14:38:43.0374 0x09b4  [ 03EDB043586CCEBA243D689BDDA370A8, 0E4523AA332E242D5C2C61C5717DBA5AB6E42DADB5A7E512505FC2B6CC224959 ] CompositeBus    C:\Windows\system32\drivers\CompositeBus.sys
14:38:43.0436 0x09b4  CompositeBus - ok
14:38:43.0452 0x09b4  COMSysApp - ok
14:38:43.0577 0x09b4  [ 3CA734CE373E5675FBC15CA2C45228E5, A6C6E9FABDE5EA18D266DB71C0CC6B51D682116D1898CCB4E9BA730F15C44B32 ] cpudrv64        C:\Program Files (x86)\SystemRequirementsLab\cpudrv64.sys
14:38:43.0608 0x09b4  cpudrv64 - ok
14:38:43.0639 0x09b4  [ 1C827878A998C18847245FE1F34EE597, 41EF7443D8B2733AA35CAC64B4F5F74FAC8BB0DA7D3936B69EC38E2DC3972E60 ] crcdisk         C:\Windows\system32\DRIVERS\crcdisk.sys
14:38:43.0670 0x09b4  crcdisk - ok
14:38:43.0717 0x09b4  [ 6B400F211BEE880A37A1ED0368776BF4, 2F27C6FA96A1C8CBDA467846DA57E63949A7EA37DB094B13397DDD30114295BD ] CryptSvc        C:\Windows\system32\cryptsvc.dll
14:38:43.0764 0x09b4  CryptSvc - ok
14:38:43.0826 0x09b4  [ 54DA3DFD29ED9F1619B6F53F3CE55E49, 9177C6907A983296BF188892A894B668A09FFA058FD56B50FE12940D54B0FA5E ] CSC             C:\Windows\system32\drivers\csc.sys
14:38:43.0904 0x09b4  CSC - ok
14:38:43.0982 0x09b4  [ 3AB183AB4D2C79DCF459CD2C1266B043, 72B0187EBA9DC74E61EC5CB3DC24058DDB768843E865801894AAEAA211610C56 ] CscService      C:\Windows\System32\cscsvc.dll
14:38:44.0076 0x09b4  CscService - ok
14:38:44.0154 0x09b4  [ 5C627D1B1138676C0A7AB2C2C190D123, C5003F2C912C5CA990E634818D3B4FD72F871900AF2948BD6C4D6400B354B401 ] DcomLaunch      C:\Windows\system32\rpcss.dll
14:38:44.0279 0x09b4  DcomLaunch - ok
14:38:44.0310 0x09b4  [ 3CEC7631A84943677AA8FA8EE5B6B43D, 32061DAC9ED6C1EBA3B367B18D0E965AEEC2DF635DCF794EC39D086D32503AC5 ] defragsvc       C:\Windows\System32\defragsvc.dll
14:38:44.0435 0x09b4  defragsvc - ok
14:38:44.0497 0x09b4  [ 9BB2EF44EAA163B29C4A4587887A0FE4, 03667BC3EA5003F4236929C10F23D8F108AFCB29DB5559E751FB26DFB318636F ] DfsC            C:\Windows\system32\Drivers\dfsc.sys
14:38:44.0575 0x09b4  DfsC - ok
14:38:44.0622 0x09b4  [ 43D808F5D9E1A18E5EEB5EBC83969E4E, C10D1155D71EABE4ED44C656A8F13078A8A4E850C4A8FBB92D52D173430972B8 ] Dhcp            C:\Windows\system32\dhcpcore.dll
14:38:44.0684 0x09b4  Dhcp - ok
14:38:44.0700 0x09b4  [ 13096B05847EC78F0977F2C0F79E9AB3, 1E44981B684F3E56F5D2439BB7FA78BD1BC876BB2265AE089AEC68F241B05B26 ] discache        C:\Windows\system32\drivers\discache.sys
14:38:44.0840 0x09b4  discache - ok
14:38:44.0934 0x09b4  [ 9819EEE8B5EA3784EC4AF3B137A5244C, 571BC886E87C888DA96282E381A746D273B58B9074E84D4CA91275E26056D427 ] Disk            C:\Windows\system32\DRIVERS\disk.sys
14:38:44.0965 0x09b4  Disk - ok
14:38:45.0012 0x09b4  [ 16835866AAA693C7D7FCEBA8FFF706E4, 15891558F7C1F2BB57A98769601D447ED0D952354A8BB347312D034DC03E0242 ] Dnscache        C:\Windows\System32\dnsrslvr.dll
14:38:45.0059 0x09b4  Dnscache - ok
14:38:45.0105 0x09b4  [ B1FB3DDCA0FDF408750D5843591AFBC6, AB6AD9C5E7BA2E3646D0115B67C4800D1CB43B4B12716397657C7ADEEE807304 ] dot3svc         C:\Windows\System32\dot3svc.dll
14:38:45.0230 0x09b4  dot3svc - ok
14:38:45.0293 0x09b4  [ B26F4F737E8F9DF4F31AF6CF31D05820, 394BBBED4EC7FAD4110F62A43BFE0801D4AC56FFAC6C741C69407B26402311C7 ] DPS             C:\Windows\system32\dps.dll
14:38:45.0386 0x09b4  DPS - ok
14:38:45.0433 0x09b4  [ 9B19F34400D24DF84C858A421C205754, 967AF267B4124BADA8F507CEBF25F2192D146A4D63BE71B45BFC03C5DA7F21A7 ] drmkaud         C:\Windows\system32\drivers\drmkaud.sys
14:38:45.0480 0x09b4  drmkaud - ok
14:38:45.0542 0x09b4  [ 6A0E850DDCB136AA3D2FB7234382DF12, C01863E95F45E1B74AC65C9CD12C8DC769299218255B3C94E3EBF58C4D79FEF3 ] dtsoftbus01     C:\Windows\system32\DRIVERS\dtsoftbus01.sys
14:38:45.0573 0x09b4  dtsoftbus01 - ok
14:38:45.0683 0x09b4  [ 88612F1CE3BF42256913BF6E61C70D52, 7CF190F83FA8F15C33008EB381D3E345CEF37CBC046227DED26B36799EF4D9A7 ] DXGKrnl         C:\Windows\System32\drivers\dxgkrnl.sys
14:38:45.0776 0x09b4  DXGKrnl - ok
14:38:45.0807 0x09b4  [ DD81D91FF3B0763C392422865C9AC12E, F5691B8F200E3196E6808E932630E862F8F26F31CD949981373F23C9D87DB8B9 ] e81a9dc1        C:\Windows\system32\rundll32.exe
14:38:45.0854 0x09b4  e81a9dc1 - ok
14:38:45.0885 0x09b4  EagleX64 - ok
14:38:45.0932 0x09b4  [ E2DDA8726DA9CB5B2C4000C9018A9633, 0C967DBC3636A76A696997192A158AA92A1AF19F01E3C66D5BF91818A8FAEA76 ] EapHost         C:\Windows\System32\eapsvc.dll
14:38:46.0026 0x09b4  EapHost - ok
14:38:46.0244 0x09b4  [ DC5D737F51BE844D8C82C695EB17372F, 6D4022D9A46EDE89CEF0FAEADCC94C903234DFC460C0180D24FF9E38E8853017 ] ebdrv           C:\Windows\system32\DRIVERS\evbda.sys
14:38:46.0541 0x09b4  ebdrv - ok
14:38:46.0572 0x09b4  [ 4D71227301DD8D09097B9E4CC6527E5A, 193D47ADCB722B581CC0F29B794AB3E455B6E9BEA367CE9A5216A09E055B7F1E ] EFS             C:\Windows\System32\lsass.exe
14:38:46.0619 0x09b4  EFS - ok
14:38:46.0681 0x09b4  [ C4002B6B41975F057D98C439030CEA07, 3D2484FBB832EFB90504DD406ED1CF3065139B1FE1646471811F3A5679EF75F1 ] ehRecvr         C:\Windows\ehome\ehRecvr.exe
14:38:46.0790 0x09b4  ehRecvr - ok
14:38:46.0821 0x09b4  [ 4705E8EF9934482C5BB488CE28AFC681, 359E9EC5693CE0BE89082E1D5D8F5C5439A5B985010FF0CB45C11E3CFE30637D ] ehSched         C:\Windows\ehome\ehsched.exe
14:38:46.0884 0x09b4  ehSched - ok
14:38:46.0931 0x09b4  [ A05FC7ECA0966EBB70E4D17B855A853B, 16A0C8138A3BBD8BE2658261131F9777940CFB1431018A10710E5C1A88AB70EA ] ElbyCDIO        C:\Windows\system32\Drivers\ElbyCDIO.sys
14:38:46.0962 0x09b4  ElbyCDIO - ok
14:38:47.0024 0x09b4  [ 0E5DA5369A0FCAEA12456DD852545184, 9A64AC5396F978C3B92794EDCE84DCA938E4662868250F8C18FA7C2C172233F8 ] elxstor         C:\Windows\system32\DRIVERS\elxstor.sys
14:38:47.0102 0x09b4  elxstor - ok
14:38:47.0133 0x09b4  [ 34A3C54752046E79A126E15C51DB409B, 7D5B5E150C7C73666F99CBAFF759029716C86F16B927E0078D77F8A696616D75 ] ErrDev          C:\Windows\system32\drivers\errdev.sys
14:38:47.0180 0x09b4  ErrDev - ok
14:38:47.0243 0x09b4  [ 4166F82BE4D24938977DD1746BE9B8A0, 24121751B7306225AD1C808442D7B030DEF377E9316AA0A3C5C7460E87317881 ] EventSystem     C:\Windows\system32\es.dll
14:38:47.0352 0x09b4  EventSystem - ok
14:38:47.0383 0x09b4  [ A510C654EC00C1E9BDD91EEB3A59823B, 76CD277730F7B08D375770CD373D786160F34D1481AF0536BA1A5D2727E255F5 ] exfat           C:\Windows\system32\drivers\exfat.sys
14:38:47.0492 0x09b4  exfat - ok
14:38:47.0523 0x09b4  [ 0ADC83218B66A6DB380C330836F3E36D, 798D6F83B5DBCC1656595E0A96CF12087FCCBE19D1982890D0CE5F629B328B29 ] fastfat         C:\Windows\system32\drivers\fastfat.sys
14:38:47.0633 0x09b4  fastfat - ok
14:38:47.0711 0x09b4  [ DBEFD454F8318A0EF691FDD2EAAB44EB, 7F52AE222FF28503B6FC4A5852BD0CAEAF187BE69AF4B577D3DE474C24366099 ] Fax             C:\Windows\system32\fxssvc.exe
14:38:47.0804 0x09b4  Fax - ok
14:38:47.0835 0x09b4  [ D765D19CD8EF61F650C384F62FAC00AB, 9F0A483A043D3BA873232AD3BA5F7BF9173832550A27AF3E8BD433905BD2A0EE ] fdc             C:\Windows\system32\DRIVERS\fdc.sys
14:38:47.0867 0x09b4  fdc - ok
14:38:47.0882 0x09b4  [ 0438CAB2E03F4FB61455A7956026FE86, 6D4DDC2973DB25CE0C7646BC85EFBCC004EBE35EA683F62162AE317C6F1D8DFE ] fdPHost         C:\Windows\system32\fdPHost.dll
14:38:47.0991 0x09b4  fdPHost - ok
14:38:48.0007 0x09b4  [ 802496CB59A30349F9A6DD22D6947644, 52D59D3D628D5661F83F090F33F744F6916E0CC1F76E5A33983E06EB66AE19F8 ] FDResPub        C:\Windows\system32\fdrespub.dll
14:38:48.0101 0x09b4  FDResPub - ok
14:38:48.0132 0x09b4  [ 655661BE46B5F5F3FD454E2C3095B930, 549C8E2A2A37757E560D55FFA6BFDD838205F17E40561E67F0124C934272CD1A ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys
14:38:48.0163 0x09b4  FileInfo - ok
14:38:48.0179 0x09b4  [ 5F671AB5BC87EEA04EC38A6CD5962A47, 6B61D3363FF3F9C439BD51102C284972EAE96ACC0683B9DC7E12D25D0ADC51B6 ] Filetrace       C:\Windows\system32\drivers\filetrace.sys
14:38:48.0272 0x09b4  Filetrace - ok
14:38:48.0272 0x09b4  [ C172A0F53008EAEB8EA33FE10E177AF5, 9175A95B323696D1B35C9EFEB7790DD64E6EE0B7021E6C18E2F81009B169D77B ] flpydisk        C:\Windows\system32\DRIVERS\flpydisk.sys
14:38:48.0319 0x09b4  flpydisk - ok
14:38:48.0335 0x09b4  [ DA6B67270FD9DB3697B20FCE94950741, F621A4462C9F2904063578C427FAF22D7D66AE9967605C11C798099817CE5331 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys
14:38:48.0381 0x09b4  FltMgr - ok
14:38:48.0491 0x09b4  [ C4C183E6551084039EC862DA1C945E3D, 0874A2ACDD24D64965AA9A76E9C818E216880AE4C9A2E07ED932EE404585CEE6 ] FontCache       C:\Windows\system32\FntCache.dll
14:38:48.0615 0x09b4  FontCache - ok
14:38:48.0662 0x09b4  [ A8B7F3818AB65695E3A0BB3279F6DCE6, 89FCF10F599767E67A1E011753E34DA44EAA311F105DBF69549009ED932A60F0 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
14:38:48.0693 0x09b4  FontCache3.0.0.0 - ok
14:38:48.0787 0x09b4  [ 76FCBFD0C78DE110468B356F85EC6DB3, 38C71EF8C194982CA352D5B30F78F6FE6C2BC4CD3B8C318A90139332AEBEE073 ] ForceWare Intelligent Application Manager (IAM) C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
14:38:48.0834 0x09b4  ForceWare Intelligent Application Manager (IAM) - ok
14:38:48.0849 0x09b4  [ D43703496149971890703B4B1B723EAC, F06397B2EDCA61629249D2EF1CBB7827A8BEAB8488246BD85EF6AE1363C0DA6E ] FsDepends       C:\Windows\system32\drivers\FsDepends.sys
14:38:48.0896 0x09b4  FsDepends - ok
14:38:48.0927 0x09b4  [ 6BD9295CC032DD3077C671FCCF579A7B, 83622FBB0CB923798E7E584BF53CAAF75B8C016E3FF7F0FA35880FF34D1DFE33 ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys
14:38:48.0943 0x09b4  Fs_Rec - ok
14:38:49.0005 0x09b4  [ 8F6322049018354F45F05A2FD2D4E5E0, 73BF0FB4EBD7887E992DDEBB79E906958D6678F8D1107E8C368F5A0514D80359 ] fvevol          C:\Windows\system32\DRIVERS\fvevol.sys
14:38:49.0037 0x09b4  fvevol - ok
14:38:49.0068 0x09b4  [ 8C778D335C9D272CFD3298AB02ABE3B6, 85F0B13926B0F693FA9E70AA58DE47100E4B6F893772EBE4300C37D9A36E6005 ] gagp30kx        C:\Windows\system32\DRIVERS\gagp30kx.sys
14:38:49.0115 0x09b4  gagp30kx - ok
14:38:49.0161 0x09b4  [ 16C2A6BCDDA8952C2035DEC861492A19, 9023CD3A2C1009786A48EF7FBCC97ED1724C836279424A4D465CCE1AFA2DBDDA ] ggflt           C:\Windows\system32\DRIVERS\ggflt.sys
14:38:49.0193 0x09b4  ggflt - ok
14:38:49.0208 0x09b4  [ 6B503DF845EABF3457E49FBBDA26C10E, A1553E3822EDEA26D8E67FCC7F9EA40DFBED49EC92FD5674AAF938F2D58CF964 ] ggsemc          C:\Windows\system32\DRIVERS\ggsemc.sys
14:38:49.0239 0x09b4  ggsemc - ok
14:38:49.0317 0x09b4  [ 277BBC7E1AA1EE957F573A10ECA7EF3A, 2EE60B924E583E847CC24E78B401EF95C69DB777A5B74E1EC963E18D47B94D24 ] gpsvc           C:\Windows\System32\gpsvc.dll
14:38:49.0473 0x09b4  gpsvc - ok
14:38:49.0583 0x09b4  [ F02A533F517EB38333CB12A9E8963773, 1F72CD1CF660766FA8F912E40B7323A0192A300B376186C10F6803DC5EFE28DF ] gupdate         C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
14:38:49.0614 0x09b4  gupdate - ok
14:38:49.0629 0x09b4  [ F02A533F517EB38333CB12A9E8963773, 1F72CD1CF660766FA8F912E40B7323A0192A300B376186C10F6803DC5EFE28DF ] gupdatem        C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
14:38:49.0661 0x09b4  gupdatem - ok
14:38:49.0707 0x09b4  [ 5D4BC124FAAE6730AC002CDB67BF1A1C, 00294F4DC7D17F6DD2A22B9C3299BED40146BA45C972367154D20DB502472551 ] gusvc           C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
14:38:49.0754 0x09b4  gusvc - ok
14:38:49.0785 0x09b4  [ F2523EF6460FC42405B12248338AB2F0, B2F3DE8DE1F512D871BC2BC2E8D0E33AB03335BFBC07627C5F88B65024928E19 ] hcw85cir        C:\Windows\system32\drivers\hcw85cir.sys
14:38:49.0832 0x09b4  hcw85cir - ok
14:38:49.0895 0x09b4  [ 975761C778E33CD22498059B91E7373A, 8304E15FBE6876BE57263A03621365DA8C88005EAC532A770303C06799D915D9 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
14:38:49.0973 0x09b4  HdAudAddService - ok
14:38:50.0035 0x09b4  [ 97BFED39B6B79EB12CDDBFEED51F56BB, 3CF981D668FB2381E52AF2E51E296C6CFB47B0D62249645278479D0111A47955 ] HDAudBus        C:\Windows\system32\drivers\HDAudBus.sys
14:38:50.0082 0x09b4  HDAudBus - ok
14:38:50.0113 0x09b4  [ 78E86380454A7B10A5EB255DC44A355F, 11F3ED7ACFFA3024B9BD504F81AC39F5B4CED5A8A425E8BADF7132EFEDB9BD64 ] HidBatt         C:\Windows\system32\DRIVERS\HidBatt.sys
14:38:50.0144 0x09b4  HidBatt - ok
14:38:50.0160 0x09b4  [ 7FD2A313F7AFE5C4DAB14798C48DD104, 94CBFD4506CBDE4162CEB3367BAB042D19ACA6785954DC0B554D4164B9FCD0D4 ] HidBth          C:\Windows\system32\DRIVERS\hidbth.sys
14:38:50.0222 0x09b4  HidBth - ok
14:38:50.0238 0x09b4  [ 0A77D29F311B88CFAE3B13F9C1A73825, 8615DC6CEFB591505CE16E054A71A4F371B827DDFD5E980777AB4233DCFDA01D ] HidIr           C:\Windows\system32\DRIVERS\hidir.sys
14:38:50.0285 0x09b4  HidIr - ok
14:38:50.0331 0x09b4  [ BD9EB3958F213F96B97B1D897DEE006D, 4D01CBF898B528B3A4E5A683DF2177300AFABD7D4CB51F1A7891B1B545499631 ] hidserv         C:\Windows\System32\hidserv.dll
14:38:50.0409 0x09b4  hidserv - ok
14:38:50.0456 0x09b4  [ 9592090A7E2B61CD582B612B6DF70536, FD11D5E02C32D658B28FCC35688AB66CCB5D3A0A0D74C82AE0F0B6C67B568A0F ] HidUsb          C:\Windows\system32\drivers\hidusb.sys
14:38:50.0487 0x09b4  HidUsb - ok
14:38:50.0565 0x09b4  [ B30B655AF441263BF2F4FE9B623EFD1E, 46C412F4066FAD8500A9184CA30401366A360A0C0A4AAFAAC1645EA74DD21E98 ] HiPatchService  C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe
14:38:50.0581 0x09b4  HiPatchService - detected UnsignedFile.Multi.Generic ( 1 )
14:38:50.0581 0x09b4  HiPatchService ( UnsignedFile.Multi.Generic ) - warning
14:38:53.0483 0x09b4  [ 387E72E739E15E3D37907A86D9FF98E2, 9935BE2E58788E79328293AF2F202CB0F6042441B176F75ACC5AEA93C8E05531 ] hkmsvc          C:\Windows\system32\kmsvc.dll
14:38:53.0576 0x09b4  hkmsvc - ok
14:38:53.0623 0x09b4  [ EFDFB3DD38A4376F93E7985173813ABD, 70402FA73A5A2A8BB557AAC8F531E373077D28DE5F40A1F3F14B940BE01CD2E1 ] HomeGroupListener C:\Windows\system32\ListSvc.dll
14:38:53.0685 0x09b4  HomeGroupListener - ok
14:38:53.0748 0x09b4  [ 908ACB1F594274965A53926B10C81E89, 7D34A742AC486294D82676F8465A3EF26C8AC3317C32B63F62031CB007CFC208 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
14:38:53.0795 0x09b4  HomeGroupProvider - ok
14:38:53.0841 0x09b4  [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC, E9E6A1665740CFBC2DD321010007EF42ABA2102AEB9772EE8AA3354664B1E205 ] HpSAMD          C:\Windows\system32\drivers\HpSAMD.sys
14:38:53.0873 0x09b4  HpSAMD - ok
14:38:53.0982 0x09b4  [ 0EA7DE1ACB728DD5A369FD742D6EEE28, 21C489412EB33A12B22290EB701C19BA57006E8702E76F730954F0784DDE9779 ] HTTP            C:\Windows\system32\drivers\HTTP.sys
14:38:54.0153 0x09b4  HTTP - ok
14:38:54.0185 0x09b4  [ A5462BD6884960C9DC85ED49D34FF392, 53E65841AF5B06A2844D0BB6FC4DD3923A323FFA0E4BFC89B3B5CAFB592A3D53 ] hwpolicy        C:\Windows\system32\drivers\hwpolicy.sys
14:38:54.0200 0x09b4  hwpolicy - ok
14:38:54.0263 0x09b4  [ 4B7423FCC37664954460AC3E71752B62, D334D1C72691C1BF24A4D8133F61AD51B058A080F4501F05F12C673DCFE081F9 ] hxctlflt        C:\Windows\system32\Drivers\hxctlflt.sys
14:38:54.0309 0x09b4  hxctlflt - ok
14:38:54.0372 0x09b4  [ FA55C73D4AFFA7EE23AC4BE53B4592D3, 65CDDC62B89A60E942C5642C9D8B539EFB69DA8069B4A2E54978154B314531CD ] i8042prt        C:\Windows\system32\DRIVERS\i8042prt.sys
14:38:54.0403 0x09b4  i8042prt - ok
14:38:54.0465 0x09b4  [ AAAF44DB3BD0B9D1FB6969B23ECC8366, 805AA4A9464002D1AB3832E4106B2AAA1331F4281367E75956062AAE99699385 ] iaStorV         C:\Windows\system32\drivers\iaStorV.sys
14:38:54.0528 0x09b4  iaStorV - ok
14:38:54.0637 0x09b4  [ 1CF03C69B49ACB70C722DF92755C0C8C, C227850C133F29BB9DED91A26A22AE077FD69629CEF35B67D305F016C4BDAA81 ] IDriverT        C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
14:38:54.0653 0x09b4  IDriverT - detected UnsignedFile.Multi.Generic ( 1 )
14:38:54.0653 0x09b4  IDriverT ( UnsignedFile.Multi.Generic ) - warning
14:38:57.0585 0x09b4  [ 5988FC40F8DB5B0739CD1E3A5D0D78BD, 2B9512324DBA4A97F6AC34E8067EE08E3B6874CD60F6CB4209AFC22A34D2BE99 ] idsvc           C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
14:38:57.0695 0x09b4  idsvc - ok
14:38:57.0726 0x09b4  IEEtwCollectorService - ok
14:38:58.0490 0x09b4  [ 8CB8667F5A3B5515F2585F3254F3AAF7, 068E3E513AFF0ADAAB5EB5C019F13DD6D0BF4E8D69B98CFFCBA0368E04674CA8 ] igfx            C:\Windows\system32\DRIVERS\igdkmd64.sys
14:38:59.0457 0x09b4  igfx - ok
14:38:59.0504 0x09b4  [ 5C18831C61933628F5BB0EA2675B9D21, 5CD9DE2F8C0256623A417B5C55BF55BB2562BD7AB2C3C83BB3D9886C2FBDA4E4 ] iirsp           C:\Windows\system32\DRIVERS\iirsp.sys
14:38:59.0535 0x09b4  iirsp - ok
14:38:59.0629 0x09b4  [ 344789398EC3EE5A4E00C52B31847946, 3DA5F08E4B46F4E63456AA588D49E39A6A09A97D0509880C00F327623DB6122D ] IKEEXT          C:\Windows\System32\ikeext.dll
14:38:59.0738 0x09b4  IKEEXT - ok
14:39:00.0081 0x09b4  [ 150AC23F21DBDBF8488408BA944B0D65, 77A3A0FB5208AA061224CFACC4D136A260132CC4BA01D105AE1532B749968708 ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHD64.sys
14:39:00.0393 0x09b4  IntcAzAudAddService - ok
14:39:00.0440 0x09b4  [ F00F20E70C6EC3AA366910083A0518AA, E2F3E9FFD82C802C8BAC309893A3664ACF16A279959C0FDECCA64C3D3C60FD22 ] intelide        C:\Windows\system32\drivers\intelide.sys
14:39:00.0456 0x09b4  intelide - ok
14:39:00.0471 0x09b4  [ ADA036632C664CAA754079041CF1F8C1, F2386CC09AC6DE4C54189154F7D91C1DB7AA120B13FAE8BA5B579ACF99FCC610 ] intelppm        C:\Windows\system32\DRIVERS\intelppm.sys
14:39:00.0534 0x09b4  intelppm - ok
14:39:00.0565 0x09b4  [ 098A91C54546A3B878DAD6A7E90A455B, 044CCE2A0DF56EBE1EFD99B4F6F0A5B9EE12498CA358CF4B2E3A1CFD872823AA ] IPBusEnum       C:\Windows\system32\ipbusenum.dll
14:39:00.0674 0x09b4  IPBusEnum - ok
14:39:00.0721 0x09b4  [ C9F0E1BD74365A8771590E9008D22AB6, 728BC5A6AAE499FDC50EB01577AF16D83C2A9F3B09936DD2A89C01E074BA8E51 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys
14:39:00.0815 0x09b4  IpFilterDriver - ok
14:39:00.0877 0x09b4  [ 08C2957BB30058E663720C5606885653, E13EDF6701512E2A9977A531454932CA5023087CB50E1D2F416B8BCDD92B67BE ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll
14:39:00.0939 0x09b4  iphlpsvc - ok
14:39:00.0986 0x09b4  [ 0FC1AEA580957AA8817B8F305D18CA3A, 7161E4DE91AAFC3FA8BF24FAE4636390C2627DB931505247C0D52C75A31473D9 ] IPMIDRV         C:\Windows\system32\drivers\IPMIDrv.sys
14:39:01.0017 0x09b4  IPMIDRV - ok
14:39:01.0049 0x09b4  [ AF9B39A7E7B6CAA203B3862582E9F2D0, 67128BE7EADBE6BD0205B050F96E268948E8660C4BAB259FB0BE03935153D04E ] IPNAT           C:\Windows\system32\drivers\ipnat.sys
14:39:01.0142 0x09b4  IPNAT - ok
14:39:01.0189 0x09b4  [ 3ABF5E7213EB28966D55D58B515D5CE9, A352BCC5B6B9A28805B15CAFB235676F1FAFF0D2394F88C03089EB157D6188AE ] IRENUM          C:\Windows\system32\drivers\irenum.sys
14:39:01.0236 0x09b4  IRENUM - ok
14:39:01.0283 0x09b4  [ 2F7B28DC3E1183E5EB418DF55C204F38, D40410A760965925D6F10959B2043F7BD4F68EAFCF5E743AF11AD860BD136548 ] isapnp          C:\Windows\system32\drivers\isapnp.sys
14:39:01.0314 0x09b4  isapnp - ok
14:39:01.0361 0x09b4  [ D931D7309DEB2317035B07C9F9E6B0BD, 13AD84172ED8C6153F8A98499C01733B74E48464CE07D099508E38D409913ED3 ] iScsiPrt        C:\Windows\system32\drivers\msiscsi.sys
14:39:01.0423 0x09b4  iScsiPrt - ok
14:39:01.0454 0x09b4  [ BC02336F1CBA7DCC7D1213BB588A68A5, 450C5BAD54CCE2AFCDFF1B6E7F8E1A8446D9D3255DF9D36C29A8F848048AAD93 ] kbdclass        C:\Windows\system32\DRIVERS\kbdclass.sys
14:39:01.0485 0x09b4  kbdclass - ok
14:39:01.0532 0x09b4  [ 0705EFF5B42A9DB58548EEC3B26BB484, 86C6824ED7ED6FA8F306DB6319A0FD688AA91295AE571262F9D8E96A32225E99 ] kbdhid          C:\Windows\system32\drivers\kbdhid.sys
14:39:01.0579 0x09b4  kbdhid - ok
14:39:01.0610 0x09b4  [ 4D71227301DD8D09097B9E4CC6527E5A, 193D47ADCB722B581CC0F29B794AB3E455B6E9BEA367CE9A5216A09E055B7F1E ] KeyIso          C:\Windows\system32\lsass.exe
14:39:01.0641 0x09b4  KeyIso - ok
14:39:01.0673 0x09b4  [ 8F489706472F7E9A06BAAA198703FA64, F020406690FB38EABD82D63B91D33039CC93ED52A5497AE12BAF475F22D0B08A ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys
14:39:01.0704 0x09b4  KSecDD - ok
14:39:01.0719 0x09b4  [ 868A2CAAB12EFC7A021682BCA0EEC54C, 12C4925B5B3D6EA7B6410C01F33158C6EAB50CBD6AF445F8B04ED9899720C2DD ] KSecPkg         C:\Windows\system32\Drivers\ksecpkg.sys
14:39:01.0751 0x09b4  KSecPkg - ok
14:39:01.0766 0x09b4  [ 6869281E78CB31A43E969F06B57347C4, 866A23E69B32A78D378D6CB3B3DA3695FFDFF0FEC3C9F68C8C3F988DF417044B ] ksthunk         C:\Windows\system32\drivers\ksthunk.sys
14:39:01.0860 0x09b4  ksthunk - ok
14:39:01.0922 0x09b4  [ 6AB66E16AA859232F64DEB66887A8C9C, 5F2B579BEA8098A2994B0DECECDAE7B396E7B5DC5F09645737B9F28BEEA77FFF ] KtmRm           C:\Windows\system32\msdtckrm.dll
14:39:02.0047 0x09b4  KtmRm - ok
14:39:02.0078 0x09b4  [ 2AC603C3188C704CFCE353659AA7AD71, 0DAC2E8858221145FA35883BAE0D6484E60EB624158DE9F063FF209951CD1CDF ] L1E             C:\Windows\system32\DRIVERS\L1E62x64.sys
14:39:02.0125 0x09b4  L1E - ok
14:39:02.0187 0x09b4  [ D9F42719019740BAA6D1C6D536CBDAA6, 8757599D0AE5302C4CE50861BEBA3A8DD14D7B0DBD916FD5404133688CDFCC40 ] LanmanServer    C:\Windows\System32\srvsvc.dll
14:39:02.0297 0x09b4  LanmanServer - ok
14:39:02.0343 0x09b4  [ 851A1382EED3E3A7476DB004F4EE3E1A, B1C67F47DD594D092E6E258F01DF5E7150227CE3131A908A244DEE9F8A1FABF9 ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
14:39:02.0421 0x09b4  LanmanWorkstation - ok
14:39:02.0468 0x09b4  [ B658B7076B1ACAA5876524595630F183, 3B800B81D0966C2B988857847F35FCA5BB446B368063B10094FB4483A1508B8E ] lirsgt          C:\Windows\system32\DRIVERS\lirsgt.sys
14:39:02.0499 0x09b4  lirsgt - detected UnsignedFile.Multi.Generic ( 1 )
14:39:02.0499 0x09b4  lirsgt ( UnsignedFile.Multi.Generic ) - warning
14:39:05.0339 0x09b4  [ 1538831CF8AD2979A04C423779465827, E1729B0CC4CEEE494A0B8817A8E98FF232E3A32FB023566EF0BC71A090262C0C ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys
14:39:05.0432 0x09b4  lltdio - ok
14:39:05.0463 0x09b4  [ C1185803384AB3FEED115F79F109427F, 0414FE73532DCAB17E906438A14711E928CECCD5F579255410C62984DD652700 ] lltdsvc         C:\Windows\System32\lltdsvc.dll
14:39:05.0588 0x09b4  lltdsvc - ok
14:39:05.0619 0x09b4  [ F993A32249B66C9D622EA5592A8B76B8, EE64672A990C6145DC5601E2B8CDBE089272A72732F59AF9865DCBA8B1717E70 ] lmhosts         C:\Windows\System32\lmhsvc.dll
14:39:05.0697 0x09b4  lmhosts - ok
14:39:05.0760 0x09b4  [ 1A93E54EB0ECE102495A51266DCDB6A6, DB6AA86AA36C3A7988BE96E87B5D3251BE7617C54EE8F894D9DC2E267FE3255B ] LSI_FC          C:\Windows\system32\DRIVERS\lsi_fc.sys
14:39:05.0807 0x09b4  LSI_FC - ok
14:39:05.0822 0x09b4  [ 1047184A9FDC8BDBFF857175875EE810, F2251EDB7736A26D388A0C5CC2FE5FB9C5E109CBB1E3800993554CB21D81AE4B ] LSI_SAS         C:\Windows\system32\DRIVERS\lsi_sas.sys
14:39:05.0869 0x09b4  LSI_SAS - ok
14:39:05.0885 0x09b4  [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93, 88D5740A4E9CC3FA80FA18035DAB441BDC5A039622D666BFDAA525CC9686BD06 ] LSI_SAS2        C:\Windows\system32\DRIVERS\lsi_sas2.sys
14:39:05.0916 0x09b4  LSI_SAS2 - ok
14:39:05.0947 0x09b4  [ 0504EACAFF0D3C8AED161C4B0D369D4A, 4D272237C189646F5C80822FD3CBA7C2728E482E2DAAF7A09C8AEF811C89C54D ] LSI_SCSI        C:\Windows\system32\DRIVERS\lsi_scsi.sys
14:39:05.0978 0x09b4  LSI_SCSI - ok
14:39:06.0009 0x09b4  [ 43D0F98E1D56CCDDB0D5254CFF7B356E, 5BA498183B5C4996C694CB0A9A6B66CE6C7A460F6C91BEB9F305486FCC3B7B22 ] luafv           C:\Windows\system32\drivers\luafv.sys
14:39:06.0103 0x09b4  luafv - ok
14:39:06.0150 0x09b4  [ 0BB97D43299910CBFBA59C461B99B910, 27C22D9D9EE8A410D7396960DA93E9E260D4DCDD38DCE06E85E45C5E24C067DE ] MBAMProtector   C:\Windows\system32\drivers\mbam.sys
14:39:06.0181 0x09b4  MBAMProtector - ok
14:39:06.0243 0x09b4  [ 65085456FD9A74D7F1A999520C299ECB, EA564BC913EF1B8A4CAA9242FC70F525B68CF1F3CA462F63B0B7215B93FE8530 ] MBAMScheduler   C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
14:39:06.0290 0x09b4  MBAMScheduler - ok
14:39:06.0353 0x09b4  [ E0D7732F2D2E24B2DB3F67B6750295B8, AA5CA86AF1ACEC900F60339016B3DC55472DB40ADB99186005A7ABE67B7D66FC ] MBAMService     C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
14:39:06.0415 0x09b4  MBAMService - ok
14:39:06.0540 0x09b4  [ 968BFF74AEB683C962960ECE0CAE4135, 3E08B39DE27FE27A27BD3E81486F0FCA1947D4B50BFE0167A0C27CE48DD56793 ] McComponentHostService C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe
14:39:06.0587 0x09b4  McComponentHostService - ok
14:39:06.0633 0x09b4  [ 0BE09CD858ABF9DF6ED259D57A1A1663, 2FD28889B93C8E801F74C1D0769673A461671E0189D0A22C94509E3F0EEB7428 ] Mcx2Svc         C:\Windows\system32\Mcx2Svc.dll
14:39:06.0696 0x09b4  Mcx2Svc - ok
14:39:06.0727 0x09b4  [ A55805F747C6EDB6A9080D7C633BD0F4, 2DA0E83BF3C8ADEF6F551B6CC1C0A3F6149CDBE6EC60413BA1767C4DE425A728 ] megasas         C:\Windows\system32\DRIVERS\megasas.sys
14:39:06.0758 0x09b4  megasas - ok
14:39:06.0789 0x09b4  [ BAF74CE0072480C3B6B7C13B2A94D6B3, 85CBB4949C090A904464F79713A3418338753D20D7FB811E68F287FDAC1DD834 ] MegaSR          C:\Windows\system32\DRIVERS\MegaSR.sys
14:39:06.0836 0x09b4  MegaSR - ok
14:39:06.0883 0x09b4  [ A6518DCC42F7A6E999BB3BEA8FD87567, 8A9AE992F93F37E0723761EA271A7E1AA8172702C471041A17324474FC96B9BC ] MEIx64          C:\Windows\system32\DRIVERS\HECIx64.sys
14:39:06.0914 0x09b4  MEIx64 - ok
14:39:06.0945 0x09b4  [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] MMCSS           C:\Windows\system32\mmcss.dll
14:39:07.0039 0x09b4  MMCSS - ok
14:39:07.0070 0x09b4  [ 800BA92F7010378B09F9ED9270F07137, 94F9AF9E1BE80AE6AC39A2A74EF9FAB115DCAACC011D07DFA8D6A1DDC8A93342 ] Modem           C:\Windows\system32\drivers\modem.sys
14:39:07.0148 0x09b4  Modem - ok
14:39:07.0195 0x09b4  [ B03D591DC7DA45ECE20B3B467E6AADAA, 701FB0CAD8138C58507BE28845D3E24CE269A040737C29885944A0D851238732 ] monitor         C:\Windows\system32\DRIVERS\monitor.sys
14:39:07.0242 0x09b4  monitor - ok
14:39:07.0289 0x09b4  [ 7D27EA49F3C1F687D357E77A470AEA99, 7FE7CAF95959F127C6D932C01D539C06D80273C49A09761F6E8331C05B1A7EE7 ] mouclass        C:\Windows\system32\drivers\mouclass.sys
14:39:07.0335 0x09b4  mouclass - ok
14:39:07.0367 0x09b4  [ D3BF052C40B0C4166D9FD86A4288C1E6, 5E65264354CD94E844BF1838CA1B8E49080EFA34605A32CF2F6A47A2B97FC183 ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys
14:39:07.0413 0x09b4  mouhid - ok
14:39:07.0476 0x09b4  [ 32E7A3D591D671A6DF2DB515A5CBE0FA, 47CED0B9067AE8BF5EEF60B17ADEE5906BEDCC56E4CB460B7BFBC12BB9A69E63 ] mountmgr        C:\Windows\system32\drivers\mountmgr.sys
14:39:07.0507 0x09b4  mountmgr - ok
14:39:07.0585 0x09b4  [ 3B9398E0146855B1DC0E3D9769C80F01, DF69DB5CA30A5577648635C27DD468AF98515D07DF379B3FFDCC6B40744EDE66 ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
14:39:07.0632 0x09b4  MozillaMaintenance - ok
14:39:07.0663 0x09b4  [ A44B420D30BD56E145D6A2BC8768EC58, B1E4DCA5A1008FA7A0492DC091FB2B820406AE13FD3D44F124E89B1037AF09B8 ] mpio            C:\Windows\system32\drivers\mpio.sys
14:39:07.0710 0x09b4  mpio - ok
14:39:07.0757 0x09b4  [ 6C38C9E45AE0EA2FA5E551F2ED5E978F, 5A3FA2F110029CB4CC4384998EDB59203FDD65EC45E01B897FB684F8956EAD20 ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys
14:39:07.0850 0x09b4  mpsdrv - ok
14:39:07.0959 0x09b4  [ 54FFC9C8898113ACE189D4AA7199D2C1, 65F585C87F3F710FD5793FDFA96B740AD8D4317B0C120F4435CCF777300EA4F2 ] MpsSvc          C:\Windows\system32\mpssvc.dll
14:39:08.0100 0x09b4  MpsSvc - ok
14:39:08.0147 0x09b4  [ 1A4F75E63C9FB84B85DFFC6B63FD5404, 01AFA6DBB4CDE55FE4EA05BBE8F753A4266F8D072EA1EE01DB79F5126780C21F ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys
14:39:08.0193 0x09b4  MRxDAV - ok
14:39:08.0240 0x09b4  [ A5D9106A73DC88564C825D317CAC68AC, 0457B2AEA4E05A91D0E43F317894A614434D8CEBE35020785387F307E231FBE4 ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys
14:39:08.0287 0x09b4  mrxsmb - ok
14:39:08.0334 0x09b4  [ D711B3C1D5F42C0C2415687BE09FC163, 9B3013AC60BD2D0FF52086658BA5FF486ADE15954A552D7DD590580E8BAE3EFF ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys
14:39:08.0412 0x09b4  mrxsmb10 - ok
14:39:08.0443 0x09b4  [ 9423E9D355C8D303E76B8CFBD8A5C30C, 220B33F120C2DD937FE4D5664F4B581DC0ACF78D62EB56B7720888F67B9644CC ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys
14:39:08.0474 0x09b4  mrxsmb20 - ok
14:39:08.0521 0x09b4  [ C25F0BAFA182CBCA2DD3C851C2E75796, 643E158A0948DF331807AEAA391F23960362E46C0A0CF6D22A99020EAE7B10F8 ] msahci          C:\Windows\system32\drivers\msahci.sys
14:39:08.0552 0x09b4  msahci - ok
14:39:08.0568 0x09b4  [ DB801A638D011B9633829EB6F663C900, B34FD33A215ACCF2905F4B7D061686CDB1CB9C652147AF56AE14686C1F6E3C74 ] msdsm           C:\Windows\system32\drivers\msdsm.sys
14:39:08.0615 0x09b4  msdsm - ok
14:39:08.0646 0x09b4  [ DE0ECE52236CFA3ED2DBFC03F28253A8, 2FBBEC4CACB5161F68D7C2935852A5888945CA0F107CF8A1C01F4528CE407DE3 ] MSDTC           C:\Windows\System32\msdtc.exe
14:39:08.0693 0x09b4  MSDTC - ok
14:39:08.0724 0x09b4  [ AA3FB40E17CE1388FA1BEDAB50EA8F96, 69F93E15536644C8FD679A20190CFE577F4985D3B1B4A4AA250A168615AE1E99 ] Msfs            C:\Windows\system32\drivers\Msfs.sys
14:39:08.0802 0x09b4  Msfs - ok
14:39:08.0817 0x09b4  [ F9D215A46A8B9753F61767FA72A20326, 6F76642B45E0A7EF6BCAB8B37D55CCE2EAA310ED07B76D43FCB88987C2174141 ] mshidkmdf       C:\Windows\System32\drivers\mshidkmdf.sys
14:39:08.0911 0x09b4  mshidkmdf - ok
14:39:08.0942 0x09b4  [ D916874BBD4F8B07BFB7FA9B3CCAE29D, B229DA150713DEDBC4F05386C9D9DC3BC095A74F44F3081E88311AB73BC992A1 ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys
14:39:08.0973 0x09b4  msisadrv - ok
14:39:09.0020 0x09b4  [ 808E98FF49B155C522E6400953177B08, F873F5BFF0984C5165DF67E92874D3F6EB8D86F9B5AD17013A0091CA33A1A3D5 ] MSiSCSI         C:\Windows\system32\iscsiexe.dll
14:39:09.0129 0x09b4  MSiSCSI - ok
14:39:09.0145 0x09b4  msiserver - ok
14:39:09.0176 0x09b4  [ 49CCF2C4FEA34FFAD8B1B59D49439366, E5752EA57C7BDAD5F53E3BC441A415E909AC602CAE56234684FB8789A20396C7 ] MSKSSRV         C:\Windows\system32\drivers\MSKSSRV.sys
14:39:09.0270 0x09b4  MSKSSRV - ok
14:39:09.0301 0x09b4  [ BDD71ACE35A232104DDD349EE70E1AB3, 27464A66868513BE6A01B75D7FC5B0D6B71842E4E20CE3F76B15C071A0618BBB ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys
14:39:09.0379 0x09b4  MSPCLOCK - ok
14:39:09.0395 0x09b4  [ 4ED981241DB27C3383D72092B618A1D0, E12F121E641249DB3491141851B59E1496F4413EDF58E863388F1C229838DFCC ] MSPQM           C:\Windows\system32\drivers\MSPQM.sys
14:39:09.0488 0x09b4  MSPQM - ok
14:39:09.0535 0x09b4  [ 759A9EEB0FA9ED79DA1FB7D4EF78866D, 64E3BC613EC4872B1B344CBF71EE15BE195592E3244C1EE099C6F8B95A40F133 ] MsRPC           C:\Windows\system32\drivers\MsRPC.sys
14:39:09.0582 0x09b4  MsRPC - ok
14:39:09.0613 0x09b4  [ 0EED230E37515A0EAEE3C2E1BC97B288, B1D8F8A75006B6E99214CA36D27A8594EF8D952F315BEB201E9BAC9DE3E64D42 ] mssmbios        C:\Windows\system32\drivers\mssmbios.sys
14:39:09.0629 0x09b4  mssmbios - ok
14:39:09.0644 0x09b4  [ 2E66F9ECB30B4221A318C92AC2250779, DF175E1AB6962303E57F26DAE5C5C1E40B8640333F3E352A64F6A5F1301586CD ] MSTEE           C:\Windows\system32\drivers\MSTEE.sys
14:39:09.0738 0x09b4  MSTEE - ok
14:39:09.0753 0x09b4  [ 7EA404308934E675BFFDE8EDF0757BCD, 306CD02D89CFCFE576242360ED5F9EEEDCAFC43CD43B7D2977AE960F9AEC3232 ] MTConfig        C:\Windows\system32\DRIVERS\MTConfig.sys
14:39:09.0800 0x09b4  MTConfig - ok
14:39:09.0847 0x09b4  [ 19B006B181E3875FD254F7B67ACF1E7C, 1D68D19522E71F16B8B50F8CCFBC9D884CF2DAC40CC409BD5A40A4D4223ABC61 ] MTsensor        C:\Windows\system32\DRIVERS\ASACPI.sys
14:39:09.0863 0x09b4  MTsensor - ok
14:39:09.0894 0x09b4  [ F9A18612FD3526FE473C1BDA678D61C8, 32F7975B5BAA447917F832D9E3499B4B6D3E90D73F478375D0B70B36C524693A ] Mup             C:\Windows\system32\Drivers\mup.sys
14:39:09.0909 0x09b4  Mup - ok
14:39:09.0987 0x09b4  [ 582AC6D9873E31DFA28A4547270862DD, BD540499F74E8F59A020D935D18E36A3A97C1A6EC59C8208436469A31B16B260 ] napagent        C:\Windows\system32\qagentRT.dll
14:39:10.0097 0x09b4  napagent - ok
14:39:10.0159 0x09b4  [ 1EA3749C4114DB3E3161156FFFFA6B33, 54C2E77BCE1037711A11313AC25B8706109098C10A31AA03AEB7A185E97800D7 ] NativeWifiP     C:\Windows\system32\DRIVERS\nwifi.sys
14:39:10.0284 0x09b4  NativeWifiP - ok
14:39:10.0455 0x09b4  [ 760E38053BF56E501D562B70AD796B88, F856E81A975D44F8684A6F2466549CEEDFAEB3950191698555A93A1206E0A42D ] NDIS            C:\Windows\system32\drivers\ndis.sys
14:39:10.0533 0x09b4  NDIS - ok
14:39:10.0565 0x09b4  [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC, D7E5446E83909AE25506BB98FBDD878A529C87963E3C1125C4ABAB25823572BC ] NdisCap         C:\Windows\system32\DRIVERS\ndiscap.sys
14:39:10.0658 0x09b4  NdisCap - ok
14:39:10.0689 0x09b4  [ 30639C932D9FEF22B31268FE25A1B6E5, 32873D95339600F6EEFA51847D12C563FF01F320DC59055B242FA2887C99F9D6 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys
14:39:10.0783 0x09b4  NdisTapi - ok
14:39:10.0830 0x09b4  [ 136185F9FB2CC61E573E676AA5402356, BA3AD0A33416DA913B4242C6BE8C3E5812AD2B20BA6C11DD3094F2E8EB56E683 ] Ndisuio         C:\Windows\system32\DRIVERS\ndisuio.sys
14:39:10.0908 0x09b4  Ndisuio - ok
14:39:10.0955 0x09b4  [ 53F7305169863F0A2BDDC49E116C2E11, 881E9346D3C02405B7850ADC37E720990712EC9C666A0CE96E252A487FD2CE77 ] NdisWan         C:\Windows\system32\DRIVERS\ndiswan.sys
14:39:11.0064 0x09b4  NdisWan - ok
14:39:11.0095 0x09b4  [ 015C0D8E0E0421B4CFD48CFFE2825879, 4242E2D42CCFC859B2C0275C5331798BC0BDA68E51CF4650B6E64B1332071023 ] NDProxy         C:\Windows\system32\drivers\NDProxy.sys
14:39:11.0204 0x09b4  NDProxy - ok
14:39:11.0329 0x09b4  [ B90E093E7A7250906F1054418B5339C0, F9A0BAC5B4B29F14B5CACA1047F8928A495EFD56E485492BF71C856B296476D6 ] Nero BackItUp Scheduler 4.0 C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
14:39:11.0438 0x09b4  Nero BackItUp Scheduler 4.0 - ok
14:39:11.0454 0x09b4  [ 86743D9F5D2B1048062B14B1D84501C4, DBF6D6A60AB774FCB0F464FF2D285A7521D0A24006687B243AB46B17D8032062 ] NetBIOS         C:\Windows\system32\DRIVERS\netbios.sys
14:39:11.0547 0x09b4  NetBIOS - ok
14:39:11.0579 0x09b4  [ 09594D1089C523423B32A4229263F068, 7426A9B8BA27D3225928DDEFBD399650ABB90798212F56B7D12158AC22CCCE37 ] NetBT           C:\Windows\system32\DRIVERS\netbt.sys
14:39:11.0688 0x09b4  NetBT - ok
14:39:11.0703 0x09b4  [ 4D71227301DD8D09097B9E4CC6527E5A, 193D47ADCB722B581CC0F29B794AB3E455B6E9BEA367CE9A5216A09E055B7F1E ] Netlogon        C:\Windows\system32\lsass.exe
14:39:11.0735 0x09b4  Netlogon - ok
14:39:11.0766 0x09b4  [ 847D3AE376C0817161A14A82C8922A9E, 37AE692B3481323134125EF58F2C3CBC20177371AF2F5874F53DD32A827CB936 ] Netman          C:\Windows\System32\netman.dll
14:39:11.0875 0x09b4  Netman - ok
14:39:11.0937 0x09b4  [ 5243CFC2E7161C91C2B355240035B9E4, CFD77485A9D7BC47F3A9C53D73B2AE2D5D04B90ED38628F3124EA569F4DE969E ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
14:39:12.0000 0x09b4  NetMsmqActivator - ok
14:39:12.0031 0x09b4  [ 5243CFC2E7161C91C2B355240035B9E4, CFD77485A9D7BC47F3A9C53D73B2AE2D5D04B90ED38628F3124EA569F4DE969E ] NetPipeActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
14:39:12.0078 0x09b4  NetPipeActivator - ok
14:39:12.0109 0x09b4  [ 5F28111C648F1E24F7DBC87CDEB091B8, 2E8645285921EDB98BB2173E11E57459C888D52E80D85791D169C869DE8813B9 ] netprofm        C:\Windows\System32\netprofm.dll
14:39:12.0234 0x09b4  netprofm - ok
14:39:12.0327 0x09b4  [ F3A1D8B7317939813568992D1BFDDE37, 816829E4B8DF5C6A2B09685ED45E844D8DE2C2721C90490A2957227025D057A0 ] netr7364        C:\Windows\system32\DRIVERS\netr7364.sys
14:39:12.0390 0x09b4  netr7364 - ok
14:39:12.0421 0x09b4  [ 5243CFC2E7161C91C2B355240035B9E4, CFD77485A9D7BC47F3A9C53D73B2AE2D5D04B90ED38628F3124EA569F4DE969E ] NetTcpActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
14:39:12.0452 0x09b4  NetTcpActivator - ok
14:39:12.0468 0x09b4  [ 5243CFC2E7161C91C2B355240035B9E4, CFD77485A9D7BC47F3A9C53D73B2AE2D5D04B90ED38628F3124EA569F4DE969E ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
14:39:12.0499 0x09b4  NetTcpPortSharing - ok
14:39:12.0546 0x09b4  [ 77889813BE4D166CDAB78DDBA990DA92, 2EF531AE502B943632EEC66A309A8BFCDD36120A5E1473F4AAF3C2393AD0E6A3 ] nfrd960         C:\Windows\system32\DRIVERS\nfrd960.sys
14:39:12.0577 0x09b4  nfrd960 - ok
14:39:12.0639 0x09b4  [ 8AD77806D336673F270DB31645267293, E23F324913554A23CD043DD27D4305AF62F48C0561A0FC7B7811E55B74B1BE79 ] NlaSvc          C:\Windows\System32\nlasvc.dll
14:39:12.0702 0x09b4  NlaSvc - ok
14:39:12.0733 0x09b4  [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7, D8957EF7060A69DBB3CD6B2C45B1E4143592AB8D018471E17AC04668157DC67F ] Npfs            C:\Windows\system32\drivers\Npfs.sys
14:39:12.0827 0x09b4  Npfs - ok
14:39:12.0842 0x09b4  npggsvc - ok
14:39:12.0873 0x09b4  [ D54BFDF3E0C953F823B3D0BFE4732528, 497A1DCC5646EC22119273216DF10D5442D16F83E4363770F507518CF6EAA53A ] nsi             C:\Windows\system32\nsisvc.dll
14:39:12.0967 0x09b4  nsi - ok
14:39:12.0983 0x09b4  [ E7F5AE18AF4168178A642A9247C63001, 133023B7E4BA8049C4CAED3282BDD25571D1CC25FAC3B820C7F981D292689D76 ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys
14:39:13.0076 0x09b4  nsiproxy - ok
14:39:13.0139 0x09b4  [ 13C0D9CBA38FFA6D0C9E721B5E7212A0, 41F38AA6111FCE5D0CF63E7CC289645C7B51BCD353690700B8ECBFC03CF51FA9 ] nSvcIp          C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
14:39:13.0170 0x09b4  nSvcIp - ok
14:39:13.0295 0x09b4  [ B98F8C6E31CD07B2E6F71F7F648E38C0, 2FEA100B80680FBBF644CB6763738804155DF1E94A6542CAE2B2786D770D554E ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys
14:39:13.0419 0x09b4  Ntfs - ok
14:39:13.0435 0x09b4  [ 9899284589F75FA8724FF3D16AED75C1, 181188599FD5D4DE33B97010D9E0CAEABAB9A3EF50712FE7F9AA0735CD0666D6 ] Null            C:\Windows\system32\drivers\Null.sys
14:39:13.0513 0x09b4  Null - ok
14:39:13.0560 0x09b4  [ 0EBC9D13CD96C15B1B18D8678A609E4B, B10896DE16B0C102DFB3E73A6C11A1982C5B428015DAE1F8776BCEF94A0F75C6 ] nusb3hub        C:\Windows\system32\DRIVERS\nusb3hub.sys
14:39:13.0591 0x09b4  nusb3hub - ok
14:39:13.0622 0x09b4  [ 7BDEC000D56D485021D9C1E63C2F81CA, 7F1303FD0371AF8715BFC38433B730C797170AEF10C7DB845B7B547DA8DBB5D5 ] nusb3xhc        C:\Windows\system32\DRIVERS\nusb3xhc.sys
14:39:13.0669 0x09b4  nusb3xhc - ok
14:39:13.0731 0x09b4  [ A85B4F2EF3A7304A5399EF0526423040, E45854691BA6AE36E53C2922CC93FF13DC2D84CBE7FE13A2F0B1CE1C16D1D158 ] NVENETFD        C:\Windows\system32\DRIVERS\nvm62x64.sys
14:39:13.0809 0x09b4  NVENETFD - ok
14:39:13.0856 0x09b4  [ F2662FDC20518EE8A8EED4F61BA42349, 4E8810345AA7D878DC21AE0A2E6ED201FC90EE112D6D13961A8D697A98716B3F ] NVHDA           C:\Windows\system32\drivers\nvhda64v.sys
14:39:13.0887 0x09b4  NVHDA - ok
14:39:14.0714 0x09b4  [ A963C2C276A97B088DED5D7A83BE8052, 1D3A238380C33D0668970C72B0AF842050AE9A12865D117FEDA1E2F6F7BFC715 ] nvlddmkm        C:\Windows\system32\DRIVERS\nvlddmkm.sys
14:39:15.0603 0x09b4  nvlddmkm - ok
14:39:15.0681 0x09b4  [ BD25E03EAD63AC3365F25175B4DBD56A, 503AB5D064672E1F1A56BBF1339909BDE641ADAA05C6FA6794ED7E045C557062 ] NVNET           C:\Windows\system32\DRIVERS\nvmf6264.sys
14:39:15.0744 0x09b4  NVNET - ok
14:39:15.0791 0x09b4  [ 0A92CB65770442ED0DC44834632F66AD, 581327F07A68DBD5CC749214BE5F1211FC2CE41C7A4F0656B680AFB51A35ACE7 ] nvraid          C:\Windows\system32\drivers\nvraid.sys
14:39:15.0837 0x09b4  nvraid - ok
14:39:15.0869 0x09b4  [ DAB0E87525C10052BF65F06152F37E4A, AD9BFF0D5FD3FFB95C758B478E1F6A9FE45E7B37AEC71EB5070D292FEAAEDF37 ] nvstor          C:\Windows\system32\drivers\nvstor.sys
14:39:15.0900 0x09b4  nvstor - ok
14:39:15.0931 0x09b4  [ 71B6ECD3C56FBF12FB1968DA3953B703, 47E39FBC336C9BFC159AA0FF9D8DEE950724ABB782102858E397A7EF87112584 ] nvstor64        C:\Windows\system32\DRIVERS\nvstor64.sys
14:39:15.0978 0x09b4  nvstor64 - ok
14:39:16.0087 0x09b4  [ DD9D86051B8F7669AABF693530F380FE, 22AE65C82F29330DAD1856857AC0458347CACE445E2088D6ABEB74BA24C1F528 ] NVSvc           C:\Windows\system32\nvvsvc.exe
14:39:16.0165 0x09b4  NVSvc - ok
14:39:16.0196 0x09b4  [ 270D7CD42D6E3979F6DD0146650F0E05, 752489E54C9004EDCBE1F1F208FFD864DA5C83E59A2DDE6B3E0D63ECA996F76F ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys
14:39:16.0227 0x09b4  nv_agp - ok
14:39:16.0274 0x09b4  [ 3589478E4B22CE21B41FA1BFC0B8B8A0, AD2469FC753FE552CB809FF405A9AB23E7561292FE89117E3B3B62057EFF0203 ] ohci1394        C:\Windows\system32\drivers\ohci1394.sys
14:39:16.0337 0x09b4  ohci1394 - ok
14:39:16.0383 0x09b4  [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] p2pimsvc        C:\Windows\system32\pnrpsvc.dll
14:39:16.0446 0x09b4  p2pimsvc - ok
14:39:16.0493 0x09b4  [ 927463ECB02179F88E4B9A17568C63C3, FEFD3447692C277D59EEC7BF218552C8BB6B8C98C26E973675549628408B94CE ] p2psvc          C:\Windows\system32\p2psvc.dll
14:39:16.0571 0x09b4  p2psvc - ok
14:39:16.0617 0x09b4  [ 0086431C29C35BE1DBC43F52CC273887, 0D116D49EF9ABB57DA005764F25E692622210627FC2048F06A989B12FA8D0A80 ] Parport         C:\Windows\system32\DRIVERS\parport.sys
14:39:16.0664 0x09b4  Parport - ok
14:39:16.0711 0x09b4  [ E9766131EEADE40A27DC27D2D68FBA9C, 63C295EC96DBD25F1A8B908295CCB86B54F2A77A02AAA11E5D9160C2C1A492B6 ] partmgr         C:\Windows\system32\drivers\partmgr.sys
14:39:16.0742 0x09b4  partmgr - ok
14:39:16.0773 0x09b4  [ 3AEAA8B561E63452C655DC0584922257, 04C072969B58657602EB0C21CEDF24FCEE14E61B90A0F758F93925EF2C9FC32D ] PcaSvc          C:\Windows\System32\pcasvc.dll
14:39:16.0836 0x09b4  PcaSvc - ok
14:39:16.0867 0x09b4  [ 94575C0571D1462A0F70BDE6BD6EE6B3, 7139BAC653EA94A3DD3821CAB35FC5E22F4CCA5ACC2BAABDAA27E4C3C8B27FC9 ] pci             C:\Windows\system32\drivers\pci.sys
14:39:16.0898 0x09b4  pci - ok
14:39:16.0929 0x09b4  [ B5B8B5EF2E5CB34DF8DCF8831E3534FA, F2A7CC645B96946CC65BF60E14E70DC09C848D27C7943CE5DEA0C01A6B863480 ] pciide          C:\Windows\system32\drivers\pciide.sys
14:39:16.0961 0x09b4  pciide - ok
14:39:16.0992 0x09b4  [ B2E81D4E87CE48589F98CB8C05B01F2F, 6763BEE7270A4873B3E131BFB92313E2750FCBD0AD73C23D1C4F98F7DF73DE14 ] pcmcia          C:\Windows\system32\DRIVERS\pcmcia.sys
14:39:17.0039 0x09b4  pcmcia - ok
14:39:17.0054 0x09b4  [ D6B9C2E1A11A3A4B26A182FFEF18F603, BBA5FE08B1DDD6243118E11358FD61B10E850F090F061711C3CB207CE5FBBD36 ] pcw             C:\Windows\system32\drivers\pcw.sys
14:39:17.0085 0x09b4  pcw - ok
14:39:17.0132 0x09b4  [ 68769C3356B3BE5D1C732C97B9A80D6E, FB2D61145980A2899D1B7729184C54070315B0E63C9A22400A76CCD39E00029C ] PEAUTH          C:\Windows\system32\drivers\peauth.sys
14:39:17.0288 0x09b4  PEAUTH - ok
14:39:17.0382 0x09b4  [ B9B0A4299DD2D76A4243F75FD54DC680, BBF62E9628131FA396EB08D63B76D2D5FBDD61339E92B759125A066470D1C039 ] PeerDistSvc     C:\Windows\system32\peerdistsvc.dll
14:39:17.0522 0x09b4  PeerDistSvc - ok
14:39:17.0600 0x09b4  [ E495E408C93141E8FC72DC0C6046DDFA, 489B957DADA0DC128A09468F1AD082DCC657E86053208EA06A12937BE86FB919 ] PerfHost        C:\Windows\SysWow64\perfhost.exe
14:39:17.0647 0x09b4  PerfHost - ok
14:39:17.0772 0x09b4  [ C7CF6A6E137463219E1259E3F0F0DD6C, 08D7244F52AA17DD669AA6F77C291DAC88E7B2D1887DE422509C1F83EC85F3DD ] pla             C:\Windows\system32\pla.dll
14:39:17.0990 0x09b4  pla - ok
14:39:18.0037 0x09b4  [ 25FBDEF06C4D92815B353F6E792C8129, 57D9764AE6BCE33B242C399CDFC10DD405975BD6411CA8C75FBCD06EEB8442A9 ] PlugPlay        C:\Windows\system32\umpnpmgr.dll
14:39:18.0115 0x09b4  PlugPlay - ok
14:39:18.0146 0x09b4  PnkBstrA - ok
14:39:18.0162 0x09b4  [ 7195581CEC9BB7D12ABE54036ACC2E38, 9C4E5D6EA984148F2663DC529083408B2248DFF6DAAC85D9195F80A722782315 ] PNRPAutoReg     C:\Windows\system32\pnrpauto.dll
14:39:18.0224 0x09b4  PNRPAutoReg - ok
14:39:18.0255 0x09b4  [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] PNRPsvc         C:\Windows\system32\pnrpsvc.dll
14:39:18.0302 0x09b4  PNRPsvc - ok
14:39:18.0349 0x09b4  [ 4F15D75ADF6156BF56ECED6D4A55C389, 2ADA3EA69A5D7EC2A4D2DD89178DB94EAFDDF95F07B0070D654D9F7A5C12A044 ] PolicyAgent     C:\Windows\System32\ipsecsvc.dll
14:39:18.0474 0x09b4  PolicyAgent - ok
14:39:18.0521 0x09b4  [ 6BA9D927DDED70BD1A9CADED45F8B184, 66203CE70A5EDE053929A940F38924C6792239CCCE10DD2C1D90D5B4D6748B55 ] Power           C:\Windows\system32\umpo.dll
14:39:18.0614 0x09b4  Power - ok
14:39:18.0677 0x09b4  [ F92A2C41117A11A00BE01CA01A7FCDE9, 38ADC6052696D110CA5F393BC586791920663F5DA66934C2A824DDA9CD89C763 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys
14:39:18.0786 0x09b4  PptpMiniport - ok
14:39:18.0801 0x09b4  [ 0D922E23C041EFB1C3FAC2A6F943C9BF, 855418A6A58DCAFB181A1A68613B3E203AFB0A9B3D9D26D0C521F9F613B4EAD5 ] Processor       C:\Windows\system32\DRIVERS\processr.sys
14:39:18.0848 0x09b4  Processor - ok
14:39:18.0895 0x09b4  [ 53E83F1F6CF9D62F32801CF66D8352A8, 1225FED810BE8E0729EEAE5B340035CCBB9BACD3EF247834400F9B72D05ACE48 ] ProfSvc         C:\Windows\system32\profsvc.dll
14:39:18.0942 0x09b4  ProfSvc - ok
14:39:18.0973 0x09b4  [ 4D71227301DD8D09097B9E4CC6527E5A, 193D47ADCB722B581CC0F29B794AB3E455B6E9BEA367CE9A5216A09E055B7F1E ] ProtectedStorage C:\Windows\system32\lsass.exe
14:39:19.0004 0x09b4  ProtectedStorage - ok
14:39:19.0051 0x09b4  [ 0557CF5A2556BD58E26384169D72438D, F6F83A616B1F1C6C0DF6D2EC2513E6C23FD4FAA6D36518B8676C619AB74957B4 ] Psched          C:\Windows\system32\DRIVERS\pacer.sys
14:39:19.0145 0x09b4  Psched - ok
14:39:19.0285 0x09b4  [ A53A15A11EBFD21077463EE2C7AFEEF0, 6002B012A75045DEA62640A864A8721EADE2F8B65BEB5F5BA76D8CD819774489 ] ql2300          C:\Windows\system32\DRIVERS\ql2300.sys
14:39:19.0410 0x09b4  ql2300 - ok
14:39:19.0425 0x09b4  [ 4F6D12B51DE1AAEFF7DC58C4D75423C8, FB6ABAB741CED66A79E31A45111649F2FA3E26CEE77209B5296F789F6F7D08DE ] ql40xx          C:\Windows\system32\DRIVERS\ql40xx.sys
14:39:19.0472 0x09b4  ql40xx - ok
14:39:19.0503 0x09b4  [ 906191634E99AEA92C4816150BDA3732, A0305436384104C3B559F9C73902DA19B96B518413379E397C5CDAB0B2B9418F ] QWAVE           C:\Windows\system32\qwave.dll
14:39:19.0566 0x09b4  QWAVE - ok
14:39:19.0597 0x09b4  [ 76707BB36430888D9CE9D705398ADB6C, 35C1D1D05F98AC29A33D3781F497A0B40A3CB9CDF25FE1F28F574E40DDF70535 ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys
14:39:19.0644 0x09b4  QWAVEdrv - ok
14:39:19.0659 0x09b4  [ 5A0DA8AD5762FA2D91678A8A01311704, 8A64EB5DBAB7048A9E42A21CEB62CCD5B007A80C199892D7F8C69B48E8A255EF ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys
14:39:19.0737 0x09b4  RasAcd - ok
14:39:19.0769 0x09b4  [ 7ECFF9B22276B73F43A99A15A6094E90, 62C70DA127F48F796F8897BBFA23AB6EB080CC923F0F091DFA384A93F5C90CA1 ] RasAgileVpn     C:\Windows\system32\DRIVERS\AgileVpn.sys
14:39:19.0862 0x09b4  RasAgileVpn - ok
14:39:19.0878 0x09b4  [ 8F26510C5383B8DBE976DE1CD00FC8C7, 60E618C010E8A723960636415573FA17EA0BBEF79647196B3BC0B8DEE680E090 ] RasAuto         C:\Windows\System32\rasauto.dll
14:39:19.0987 0x09b4  RasAuto - ok
14:39:20.0049 0x09b4  [ 471815800AE33E6F1C32FB1B97C490CA, 27307265F743DE3A3A3EC1B2C472A3D85FDD0AEC458E0B1177593141EE072698 ] Rasl2tp         C:\Windows\system32\DRIVERS\rasl2tp.sys
14:39:20.0143 0x09b4  Rasl2tp - ok
14:39:20.0205 0x09b4  [ EE867A0870FC9E4972BA9EAAD35651E2, 1B848D81705081FD2E18AC762DA7F51455657DAF860BF363DC15925A148BCADA ] RasMan          C:\Windows\System32\rasmans.dll
14:39:20.0315 0x09b4  RasMan - ok
14:39:20.0346 0x09b4  [ 855C9B1CD4756C5E9A2AA58A15F58C25, A514F8A9C304D54BDA8DC60F5A64259B057EC83A1CAAF6D2B58CFD55E9561F72 ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys
14:39:20.0455 0x09b4  RasPppoe - ok
14:39:20.0549 0x09b4  [ E8B1E447B008D07FF47D016C2B0EEECB, FEC789F82B912F3E14E49524D40FEAA4373B221156F14045E645D7C37859258C ] RasSstp         C:\Windows\system32\DRIVERS\rassstp.sys
14:39:20.0658 0x09b4  RasSstp - ok
14:39:20.0689 0x09b4  [ 77F665941019A1594D887A74F301FA2F, 1FDC6F6853400190C086042933F157814D915C54F26793CAD36CD2607D8810DA ] rdbss           C:\Windows\system32\DRIVERS\rdbss.sys
14:39:20.0798 0x09b4  rdbss - ok
14:39:20.0814 0x09b4  [ 302DA2A0539F2CF54D7C6CC30C1F2D8D, 1DF3501BBFFB56C3ECC39DBCC4287D3302216C2208CE22428B8C4967E5DE9D17 ] rdpbus          C:\Windows\system32\DRIVERS\rdpbus.sys
14:39:20.0861 0x09b4  rdpbus - ok
14:39:20.0892 0x09b4  [ CEA6CC257FC9B7715F1C2B4849286D24, A78144D18352EA802C39D9D42921CF97A3E0211766B2169B6755C6FC2D77A804 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys
14:39:20.0970 0x09b4  RDPCDD - ok
14:39:21.0017 0x09b4  [ 1B6163C503398B23FF8B939C67747683, 339A5AA7970FF34FAAB213B655860C5B0DEC5F983A4A11A088017D849F320ACE ] RDPDR           C:\Windows\system32\drivers\rdpdr.sys
14:39:21.0063 0x09b4  RDPDR - ok
14:39:21.0110 0x09b4  [ BB5971A4F00659529A5C44831AF22365, 9AAA5C0D448E821FD85589505D99DF7749715A046BBD211F139E4E652ADDE41F ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys
14:39:21.0204 0x09b4  RDPENCDD - ok
14:39:21.0219 0x09b4  [ 216F3FA57533D98E1F74DED70113177A, 60C126A1409D1E9C39F1C9E95F70115BF4AF07780AB499F6E10A612540F173F4 ] RDPREFMP        C:\Windows\system32\drivers\rdprefmp.sys
14:39:21.0297 0x09b4  RDPREFMP - ok
14:39:21.0344 0x09b4  [ 70CBA1A0C98600A2AA1863479B35CB90, 91A133297921B4955817176251AFC5283DA3C7D2099700C4C92ECC94DBE9A99E ] RdpVideoMiniport C:\Windows\system32\drivers\rdpvideominiport.sys
14:39:21.0391 0x09b4  RdpVideoMiniport - ok
14:39:21.0422 0x09b4  [ E61608AA35E98999AF9AAEEEA6114B0A, F754CDE89DC96786D2A3C4D19EE2AEF1008E634E4DE3C0CBF927436DE90C04A6 ] RDPWD           C:\Windows\system32\drivers\RDPWD.sys
14:39:21.0469 0x09b4  RDPWD - ok
14:39:21.0516 0x09b4  [ 34ED295FA0121C241BFEF24764FC4520, AAEE5F00CAA763A5BA51CF56BD7262C03409CD72BD5601490E3EC3FFF929BB5F ] rdyboost        C:\Windows\system32\drivers\rdyboost.sys
14:39:21.0563 0x09b4  rdyboost - ok
14:39:21.0594 0x09b4  [ 254FB7A22D74E5511C73A3F6D802F192, 3D0FB5840364200DE394F8CC28DA0E334C2B5FA8FF28A41656EE72287F3D3836 ] RemoteAccess    C:\Windows\System32\mprdim.dll
14:39:21.0703 0x09b4  RemoteAccess - ok
14:39:21.0734 0x09b4  [ E4D94F24081440B5FC5AA556C7C62702, 147CAA03568DC480F9506E30B84891AB7E433B5EBC05F34FF10F72B00E1C6B22 ] RemoteRegistry  C:\Windows\system32\regsvc.dll
14:39:21.0843 0x09b4  RemoteRegistry - ok
14:39:21.0906 0x09b4  [ 3DD798846E2C28102B922C56E71B7932, 30B111615D74CB2213997A5C08DD9C8613ADE441D9423CC1C49A753D13CE524D ] RFCOMM          C:\Windows\system32\DRIVERS\rfcomm.sys
14:39:21.0968 0x09b4  RFCOMM - ok
14:39:21.0999 0x09b4  [ E4DC58CF7B3EA515AE917FF0D402A7BB, 665B5CD9FE905B0EE3F59A7B1A94760F5393EBEE729877D8584349754C2867E8 ] RpcEptMapper    C:\Windows\System32\RpcEpMap.dll
14:39:22.0093 0x09b4  RpcEptMapper - ok
14:39:22.0124 0x09b4  [ D5BA242D4CF8E384DB90E6A8ED850B8C, CB4CB2608B5E31B55FB1A2CF4051E6D08A0C2A5FB231B2116F95938D7577334E ] RpcLocator      C:\Windows\system32\locator.exe
14:39:22.0171 0x09b4  RpcLocator - ok
14:39:22.0233 0x09b4  [ 5C627D1B1138676C0A7AB2C2C190D123, C5003F2C912C5CA990E634818D3B4FD72F871900AF2948BD6C4D6400B354B401 ] RpcSs           C:\Windows\system32\rpcss.dll
14:39:22.0343 0x09b4  RpcSs - ok
14:39:22.0389 0x09b4  [ DDC86E4F8E7456261E637E3552E804FF, D250C69CCC75F2D88E7E624FCC51300E75637333317D53908CCA7E0F117173DD ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys
14:39:22.0483 0x09b4  rspndr - ok
14:39:22.0561 0x09b4  [ 3B5809E9D3B8995FB65A82CB92745072, 6316AB7AD76B46AEF83E20FDF04BF2C592A7A9D43E9D618973D19CC2A9B81E8A ] RT73            C:\Windows\system32\DRIVERS\Dr71WU.sys
14:39:22.0639 0x09b4  RT73 - ok
14:39:22.0733 0x09b4  [ 8181B5E7BFC040E0B26349C73E719335, EBB244A7E8E2CDC51041B2C2A78DCB77324F9E3746942C84902FCD928ADED897 ] RTL8167         C:\Windows\system32\DRIVERS\Rt64win7.sys
14:39:22.0795 0x09b4  RTL8167 - ok
14:39:22.0873 0x09b4  [ 9269EF78A780A3161087DF1BEC117DC8, 4DABD74C2918213147B81FC5C26B2140D4FED0D8F741388A14393AD47D293632 ] RTL85n64        C:\Windows\system32\DRIVERS\RTL85n64.sys
14:39:22.0935 0x09b4  RTL85n64 - ok
14:39:22.0982 0x09b4  [ E16B7C030A05EF649B18FAB0A93D871F, 0F532D534A93D71650E2F7AF677419A6B38CE3142C98983565F1D759E544A4ED ] RtNdPt60        C:\Windows\system32\DRIVERS\RtNdPt60.sys
14:39:23.0013 0x09b4  RtNdPt60 - ok
14:39:23.0045 0x09b4  [ 1DE78F5008120CD79B34C12394DCD493, 58C59BEEE2F1C1C6CE810BA433C0D5789B4E6F218A074868137960663CB54802 ] RTTEAMPT        C:\Windows\system32\DRIVERS\RtTeam60.sys
14:39:23.0076 0x09b4  RTTEAMPT - ok
14:39:23.0107 0x09b4  [ ED0624ED83121E1BC141F49B1316CAA0, 322CA21FE679910827F39CFCD3511400CABDA1133F5E0B5031186C94741FAF1E ] RTVLANPT        C:\Windows\system32\DRIVERS\RtVlan620.sys
14:39:23.0138 0x09b4  RTVLANPT - ok
14:39:23.0185 0x09b4  [ E60C0A09F997826C7627B244195AB581, E8630ED74B38B98BF584E353D992C1311BC36AB7F20A1BB66C9CD65CE1E46F8D ] s3cap           C:\Windows\system32\drivers\vms3cap.sys
14:39:23.0232 0x09b4  s3cap - ok
14:39:23.0247 0x09b4  [ 4D71227301DD8D09097B9E4CC6527E5A, 193D47ADCB722B581CC0F29B794AB3E455B6E9BEA367CE9A5216A09E055B7F1E ] SamSs           C:\Windows\system32\lsass.exe
14:39:23.0279 0x09b4  SamSs - ok
14:39:23.0325 0x09b4  [ AC03AF3329579FFFB455AA2DAABBE22B, 7AD3B62ADFEC166F9E256F9FF8BAA0568B2ED7308142BF8F5269E6EAA5E0A656 ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys
14:39:23.0357 0x09b4  sbp2port - ok
14:39:23.0403 0x09b4  [ 9B7395789E3791A3B6D000FE6F8B131E, E5F067F3F212BF5481668BE1779CBEF053F511F8967589BE2E865ACB9A620024 ] SCardSvr        C:\Windows\System32\SCardSvr.dll
14:39:23.0513 0x09b4  SCardSvr - ok
14:39:23.0591 0x09b4  [ 3A09F31454DFEFBB124BAF378F90B636, ACDDD348CEE5147AD3A6EFE5A1C7576AC9CE699011F843BE93F800B1D2BD8F46 ] SCDEmu          C:\Windows\system32\drivers\SCDEmu.sys
14:39:23.0622 0x09b4  SCDEmu - ok
14:39:23.0669 0x09b4  [ 253F38D0D7074C02FF8DEB9836C97D2B, CB5CAFCB8628BB22877F74ACF1DED0BBAED8F4573A74DA7FE94BBBA584889116 ] scfilter        C:\Windows\system32\DRIVERS\scfilter.sys
14:39:23.0762 0x09b4  scfilter - ok
14:39:23.0856 0x09b4  [ 262F6592C3299C005FD6BEC90FC4463A, 54095E37F0B6CC677A3E9BDD40F4647C713273D197DB341063AA7F342A60C4A7 ] Schedule        C:\Windows\system32\schedsvc.dll
14:39:24.0027 0x09b4  Schedule - ok
14:39:24.0059 0x09b4  [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] SCPolicySvc     C:\Windows\System32\certprop.dll
14:39:24.0137 0x09b4  SCPolicySvc - ok
14:39:24.0183 0x09b4  [ 6EA4234DC55346E0709560FE7C2C1972, 64011E044C16E2F92689E5F7E4666A075E27BBFA61F3264E5D51CE1656C1D5B8 ] SDRSVC          C:\Windows\System32\SDRSVC.dll
14:39:24.0230 0x09b4  SDRSVC - ok
14:39:24.0261 0x09b4  [ 3EA8A16169C26AFBEB544E0E48421186, 34BBB0459C96B3DE94CCB0D73461562935C583D7BF93828DA4E20A6BC9B7301D ] secdrv          C:\Windows\system32\drivers\secdrv.sys
14:39:24.0371 0x09b4  secdrv - ok
14:39:24.0402 0x09b4  [ BC617A4E1B4FA8DF523A061739A0BD87, 10C4057F6B321EB5237FF619747B74F5401BC17D15A8C7060829E8204A2297F9 ] seclogon        C:\Windows\system32\seclogon.dll
14:39:24.0495 0x09b4  seclogon - ok
14:39:24.0527 0x09b4  [ C32AB8FA018EF34C0F113BD501436D21, E0EB8E80B51E45CA7EB061E705DA0BC07878759418A8519AE6E12326FE79E7C7 ] SENS            C:\Windows\system32\sens.dll
14:39:24.0605 0x09b4  SENS - ok
14:39:24.0620 0x09b4  [ 0336CFFAFAAB87A11541F1CF1594B2B2, 8B8A6A33E78A12FB05E29B2E2775850626574AFD2EF88748D65E690A07B10B8D ] SensrSvc        C:\Windows\system32\sensrsvc.dll
14:39:24.0683 0x09b4  SensrSvc - ok
14:39:24.0714 0x09b4  [ CB624C0035412AF0DEBEC78C41F5CA1B, A4D937F11E06CAE914347CA1362F4C98EC5EE0C0C80321E360EA1ABD6726F8D4 ] Serenum         C:\Windows\system32\DRIVERS\serenum.sys
14:39:24.0761 0x09b4  Serenum - ok
14:39:24.0776 0x09b4  [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6, 8F9776FB84C5D11068EAF1FF1D1A46466C655D64D256A8B1E31DC0C23B5DD22D ] Serial          C:\Windows\system32\DRIVERS\serial.sys
14:39:24.0839 0x09b4  Serial - ok
14:39:24.0885 0x09b4  [ 1C545A7D0691CC4A027396535691C3E3, 065C30BE598FF4DC55C37E0BBE0CEDF10A370AE2BF5404B42EBBB867A3FFED6D ] sermouse        C:\Windows\system32\DRIVERS\sermouse.sys
14:39:24.0917 0x09b4  sermouse - ok
14:39:24.0979 0x09b4  [ 0B6231BF38174A1628C4AC812CC75804, E569BF1F7F5689E2E917FA6516DB53388A5B8B1C6699DEE030147E853218811D ] SessionEnv      C:\Windows\system32\sessenv.dll
14:39:25.0073 0x09b4  SessionEnv - ok
14:39:25.0119 0x09b4  [ 4FCACE92BB0345D58BB96ADBD69F5237, 958067CFE2DC0BE0BC407E1309EE8859652A293F0F914DC7511B2F391FE8DF7F ] sfdrv01         C:\Windows\system32\drivers\sfdrv01.sys
14:39:25.0151 0x09b4  sfdrv01 - ok
14:39:25.0182 0x09b4  [ ADDC96399ACDF3C4DD690C74B835082E, 4CB28EE2B507C0F519C5DD529DEE2AD24DB123DE8BAE589351A11A33543E2616 ] sfdrv01a        C:\Windows\system32\drivers\sfdrv01a.sys
14:39:25.0213 0x09b4  sfdrv01a - ok
14:39:25.0244 0x09b4  [ A554811BCD09279536440C964AE35BBF, DA8F893722F803E189D7D4D6C6232ED34505B63A64ED3A0132A5BB7A2BABDE55 ] sffdisk         C:\Windows\system32\drivers\sffdisk.sys
14:39:25.0291 0x09b4  sffdisk - ok
14:39:25.0322 0x09b4  [ FF414F0BAEFEBA59BC6C04B3DB0B87BF, B81EF5D26AEB572CAB590F7AD7CA8C89F296420089EF5E6148E972F2DBCA1042 ] sffp_mmc        C:\Windows\system32\drivers\sffp_mmc.sys
14:39:25.0369 0x09b4  sffp_mmc - ok
14:39:25.0400 0x09b4  [ DD85B78243A19B59F0637DCF284DA63C, 6730D4F2BAE7E24615746ACC41B42D01DB6068D6504982008ADA1890DE900197 ] sffp_sd         C:\Windows\system32\drivers\sffp_sd.sys
14:39:25.0447 0x09b4  sffp_sd - ok
14:39:25.0463 0x09b4  [ 17F6BD95BF04B924F4C05CE78BEF8AE6, 68D38DC04349DA476B62F853B165EE6B6F42054BCAF2B8F615A6E6BAACD35EB4 ] sfhlp02         C:\Windows\system32\drivers\sfhlp02.sys
14:39:25.0494 0x09b4  sfhlp02 - ok
14:39:25.0509 0x09b4  [ A9D601643A1647211A1EE2EC4E433FF4, 7AC60B4AB48D4BBF1F9681C12EC2A75C72E6E12D30FABC564A24394310E9A5F9 ] sfloppy         C:\Windows\system32\DRIVERS\sfloppy.sys
14:39:25.0556 0x09b4  sfloppy - ok
14:39:25.0572 0x09b4  [ B02C284AAC97C61B707AD7400F36A067, 9235C5CD6BBC94A9CD516C523DDD5E34642198CF092C30914F6070C8B85BF45C ] sfsync04        C:\Windows\system32\drivers\sfsync04.sys
14:39:25.0603 0x09b4  sfsync04 - ok
14:39:25.0619 0x09b4  [ F3B72568A6FA36E5D63D30B8186D1C48, 8B6A7C8595182356F5B5B9F8DE4AC1F8926DBF0EEB68DA196FCF3512F1FD24FA ] sfvfs02         C:\Windows\system32\drivers\sfvfs02.sys
14:39:25.0650 0x09b4  sfvfs02 - ok
14:39:25.0712 0x09b4  [ B95F6501A2F8B2E78C697FEC401970CE, 758B73A32902299A313348CE7EC189B20EB4CB398D0180E4EE24B84DAD55F291 ] SharedAccess    C:\Windows\System32\ipnathlp.dll
14:39:25.0821 0x09b4  SharedAccess - ok
14:39:25.0853 0x09b4  [ AAF932B4011D14052955D4B212A4DA8D, 2A3BFD0FA9569288E91AE3E72CA1EC39E1450D01E6473CE51157E0F138257923 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
14:39:25.0946 0x09b4  ShellHWDetection - ok
14:39:25.0977 0x09b4  [ 843CAF1E5FDE1FFD5FF768F23A51E2E1, 89CA9F516E42A6B905474D738CDA2C121020A07DBD4E66CFE569DD77D79D7820 ] SiSRaid2        C:\Windows\system32\DRIVERS\SiSRaid2.sys
14:39:26.0009 0x09b4  SiSRaid2 - ok
14:39:26.0024 0x09b4  [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4, 87B85C66DF7EB6FDB8A2341D05FAA5261FF68A90CCFC63F0E4A03824F1E33E5E ] SiSRaid4        C:\Windows\system32\DRIVERS\sisraid4.sys
14:39:26.0071 0x09b4  SiSRaid4 - ok
14:39:26.0149 0x09b4  [ F5BBEDF602C310B00036EB2DBF4348A5, AC2712E639F0C54BCF00EB4E90E805335871EA27AE8A45DFC53EDF28822318C4 ] SkypeUpdate     C:\Program Files (x86)\Skype\Updater\Updater.exe
14:39:26.0180 0x09b4  SkypeUpdate - ok
14:39:26.0196 0x09b4  [ 548260A7B8654E024DC30BF8A7C5BAA4, 4A7E58331D7765A12F53DC2371739DC9A463940B13E16157CE10DB80E958D740 ] Smb             C:\Windows\system32\DRIVERS\smb.sys
14:39:26.0305 0x09b4  Smb - ok
14:39:26.0352 0x09b4  [ 6313F223E817CC09AA41811DAA7F541D, D787061043BEEDB9386B048CB9E680E6A88A1CBAE9BD4A8C0209155BFB76C630 ] SNMPTRAP        C:\Windows\System32\snmptrap.exe
14:39:26.0399 0x09b4  SNMPTRAP - ok
14:39:26.0664 0x09b4  [ BA2E864CDC01731A4F144019FB3BF598, BFBD8650C860C1F42DF4EFD610FF39773D2A30E30F4D26A88EC1797540B32A3B ] SNP2UVC         C:\Windows\system32\DRIVERS\snp2uvc.sys
14:39:26.0945 0x09b4  SNP2UVC - ok
14:39:27.0038 0x09b4  [ 3A4F2C0BB87A0895ABEBA341AA1E341B, 4DADEEF3C5D181502D6F4A00FBBF3B001FA626E49569FB330D7AE2955CC7DE08 ] Sony PC Companion C:\Program Files (x86)\Sony\Sony PC Companion\PCCService.exe
14:39:27.0085 0x09b4  Sony PC Companion - ok
14:39:27.0101 0x09b4  [ B9E31E5CACDFE584F34F730A677803F9, 21A5130BD00089C609522A372018A719F8E37103D2DD22C59EACB393BE35A063 ] spldr           C:\Windows\system32\drivers\spldr.sys
14:39:27.0132 0x09b4  spldr - ok
14:39:27.0194 0x09b4  [ 85DAA09A98C9286D4EA2BA8D0E644377, F9C324E2EF81193FE831C7EECC44A100CA06F82FA731BF555D9EA4D91DA13329 ] Spooler         C:\Windows\System32\spoolsv.exe
14:39:27.0272 0x09b4  Spooler - ok
14:39:27.0522 0x09b4  [ E17E0188BB90FAE42D83E98707EFA59C, FC075F7B39E86CC8EF6DA4E339FE946917E319C347AC70FB0C50AAF36F97E27F ] sppsvc          C:\Windows\system32\sppsvc.exe
14:39:27.0865 0x09b4  sppsvc - ok
14:39:27.0896 0x09b4  [ 93D7D61317F3D4BC4F4E9F8A96A7DE45, 36D48B23B8243BE5229707375FCD11C2DCAC96983199345365F065A0CBF33314 ] sppuinotify     C:\Windows\system32\sppuinotify.dll
14:39:27.0990 0x09b4  sppuinotify - ok
14:39:28.0052 0x09b4  [ 441FBA48BFF01FDB9D5969EBC1838F0B, 306128F1AD489F87161A089D1BDC1542A4CB742D91A0C12A7CD1863FDB8932C0 ] srv             C:\Windows\system32\DRIVERS\srv.sys
14:39:28.0115 0x09b4  srv - ok
14:39:28.0161 0x09b4  [ B4ADEBBF5E3677CCE9651E0F01F7CC28, 726DB2283113AB2A9681E8E9F61132303D6D86E9CD034C40EE4A8C9DB29E87F7 ] srv2            C:\Windows\system32\DRIVERS\srv2.sys
14:39:28.0224 0x09b4  srv2 - ok
14:39:28.0255 0x09b4  [ 27E461F0BE5BFF5FC737328F749538C3, AFA4704ED8FFC1A0BAB40DFB81D3AE3F3D933A3C9BF54DDAF39FF9AF3646D9E6 ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys
14:39:28.0317 0x09b4  srvnet - ok
14:39:28.0364 0x09b4  [ 8F8324ED1DE63FFC7B1A02CD2D963C72, E58603F81DEAFF1D45CB83FB6E625E6A13868741B833B1C9E60D672179D18EE0 ] ssadbus         C:\Windows\system32\DRIVERS\ssadbus.sys
14:39:28.0427 0x09b4  ssadbus - ok
14:39:28.0473 0x09b4  [ 58221EFCB74167B73667F0024C661CE0, D9B67A8897B4DC3E4729187F17ABEB4710CF57440D718E17ED828439198D34DB ] ssadmdfl        C:\Windows\system32\DRIVERS\ssadmdfl.sys
14:39:28.0505 0x09b4  ssadmdfl - ok
14:39:28.0551 0x09b4  [ 4DA7C71BFAC5AD71255B7E4CAB980163, 4CC0F9C8E96ECEF36EEB021E448A9734B63512D030516DC38B1A2EEAA1043AEC ] ssadmdm         C:\Windows\system32\DRIVERS\ssadmdm.sys
14:39:28.0614 0x09b4  ssadmdm - ok
14:39:28.0661 0x09b4  [ D33D1BD3EC0E766211A234F56A12726D, 53EEAA94865554F8422D111D717B548DF553B5B8647D2A45F3718BF4AEEBEC27 ] ssadserd        C:\Windows\system32\DRIVERS\ssadserd.sys
14:39:28.0707 0x09b4  ssadserd - ok
14:39:28.0739 0x09b4  [ 51B52FBD583CDE8AA9BA62B8B4298F33, 2E2403F8AA39E79D1281CA006B51B43139C32A5FDD64BD34DAA4B935338BD740 ] SSDPSRV         C:\Windows\System32\ssdpsrv.dll
14:39:28.0832 0x09b4  SSDPSRV - ok
14:39:28.0848 0x09b4  [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB, D21CDBC4C2AA0DB5B4455D5108B0CAF4282A2E664B9035708F212CC094569D9D ] SstpSvc         C:\Windows\system32\sstpsvc.dll
14:39:28.0941 0x09b4  SstpSvc - ok
14:39:29.0051 0x09b4  [ C3D855CC0A8E5E373FDFCF4F743C5C9D, 8DFDD2470DCCC63FCF1621B6B3A996285C75EE330BE8AC905B2176E5DE52C150 ] Steam Client Service C:\Program Files (x86)\Common Files\Steam\SteamService.exe
14:39:29.0129 0x09b4  Steam Client Service - ok
14:39:29.0207 0x09b4  [ A2ABC52CD8A5B60262B220A17A92EB31, 357A1E5E6151B92F49FB6493D38DC0D1D25E53BDB097F0E2494916EDFA57AA9D ] Stereo Service  C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
14:39:29.0253 0x09b4  Stereo Service - ok
14:39:29.0269 0x09b4  [ F3817967ED533D08327DC73BC4D5542A, 1B204454408A690C0A86447F3E4AA9E7C58A9CFB567C94C17C21920BA648B4D5 ] stexstor        C:\Windows\system32\DRIVERS\stexstor.sys
14:39:29.0300 0x09b4  stexstor - ok
14:39:29.0394 0x09b4  [ 8DD52E8E6128F4B2DA92CE27402871C1, 1101C38BE8FC383B5F2F9FA402F9652B23B88A764DE2B584DFE62B88B11DEF92 ] stisvc          C:\Windows\System32\wiaservc.dll
14:39:29.0487 0x09b4  stisvc - ok
14:39:29.0519 0x09b4  [ 7785DC213270D2FC066538DAF94087E7, F09CB2895241719CA5147B2EE9F7ECBD0303AFFB5CD896F06D4D29BAAAFC207B ] storflt         C:\Windows\system32\drivers\vmstorfl.sys
14:39:29.0550 0x09b4  storflt - ok
14:39:29.0565 0x09b4  [ C40841817EF57D491F22EB103DA587CC, 5FAA2DE43BADC16A898C0C290C44C41E4411D919A95FE8C6FF45EA7A34495079 ] StorSvc         C:\Windows\system32\storsvc.dll
14:39:29.0612 0x09b4  StorSvc - ok
14:39:29.0628 0x09b4  [ D34E4943D5AC096C8EDEEBFD80D76E23, 1DD7F6F97060B5F763A04ACA1F75E59DAB09EF824FD09B83FC3C192837D006DE ] storvsc         C:\Windows\system32\drivers\storvsc.sys
14:39:29.0659 0x09b4  storvsc - ok
14:39:29.0675 0x09b4  [ D01EC09B6711A5F8E7E6564A4D0FBC90, 3CB922291DBADC92B46B9E28CCB6810CD8CCDA3E74518EC9522B58B998E1F969 ] swenum          C:\Windows\system32\drivers\swenum.sys
14:39:29.0706 0x09b4  swenum - ok
14:39:29.0753 0x09b4  [ E08E46FDD841B7184194011CA1955A0B, 9C3725BB1F08F92744C980A22ED5C874007D3B5863C7E1F140F50061052AC418 ] swprv           C:\Windows\System32\swprv.dll
14:39:29.0893 0x09b4  swprv - ok
14:39:29.0924 0x09b4  Synth3dVsc - ok
14:39:30.0065 0x09b4  [ BF9CCC0BF39B418C8D0AE8B05CF95B7D, 3C13217548BE61F2BDB8BD41F77345CDDA1F97BF0AE17241C335B9807EB3DBB8 ] SysMain         C:\Windows\system32\sysmain.dll
14:39:30.0236 0x09b4  SysMain - ok
14:39:30.0283 0x09b4  [ E3C61FD7B7C2557E1F1B0B4CEC713585, 01F0E116606D185BF93B540868075BFB1A398197F6AABD994983DBFF56B3A8A0 ] TabletInputService C:\Windows\System32\TabSvc.dll
14:39:30.0345 0x09b4  TabletInputService - ok
14:39:30.0408 0x09b4  [ 3C32FF010F869BC184DF71290477384E, 55CFCEC7F026C6E2E96A2FBE846AB513BB12BB0348735274FE1B71AF019C837B ] tap0901         C:\Windows\system32\DRIVERS\tap0901.sys
14:39:30.0439 0x09b4  tap0901 - ok
14:39:30.0486 0x09b4  [ B08740047145B9BCE15BF75CA0F9718A, 3E2A8A5A2A4DC4D0F05E22EA2C0EBD85AA5C7C6854E873D53538D1F54B8F7C63 ] tap0901t        C:\Windows\system32\DRIVERS\tap0901t.sys
14:39:30.0517 0x09b4  tap0901t - detected UnsignedFile.Multi.Generic ( 1 )
14:39:30.0517 0x09b4  tap0901t ( UnsignedFile.Multi.Generic ) - warning
14:39:44.0385 0x09b4  [ 40F0849F65D13EE87B9A9AE3C1DD6823, E251A7EF3D0FD2973AF33A62FC457A7E8D5E8694208F811F52455F7C2426121F ] TapiSrv         C:\Windows\System32\tapisrv.dll
14:39:44.0495 0x09b4  TapiSrv - ok
14:39:44.0526 0x09b4  [ 1BE03AC720F4D302EA01D40F588162F6, AB644862BF1D2E824FD846180DEC4E2C0FAFCC517451486DE5A92E5E78A952E4 ] TBS             C:\Windows\System32\tbssvc.dll
14:39:44.0619 0x09b4  TBS - ok
14:39:44.0775 0x09b4  [ 40AF23633D197905F03AB5628C558C51, 644656A15236E964E4BE57B42225EAA5643C4CF1FFF6D306813A000716F9D72C ] Tcpip           C:\Windows\system32\drivers\tcpip.sys
14:39:44.0900 0x09b4  Tcpip - ok
14:39:45.0041 0x09b4  [ 40AF23633D197905F03AB5628C558C51, 644656A15236E964E4BE57B42225EAA5643C4CF1FFF6D306813A000716F9D72C ] TCPIP6          C:\Windows\system32\DRIVERS\tcpip.sys
14:39:45.0165 0x09b4  TCPIP6 - ok
14:39:45.0197 0x09b4  [ 1B16D0BD9841794A6E0CDE0CEF744ABC, 7EB8BA97339199EEE7F2B09DA2DA6279DA64A510D4598D42CF86415D67CD674C ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys
14:39:45.0243 0x09b4  tcpipreg - ok
14:39:45.0275 0x09b4  [ 3371D21011695B16333A3934340C4E7C, 7416F9BBFC1BA9D875EA7D1C7A0D912FC6977B49A865D67E3F9C4E18A965082D ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys
14:39:45.0321 0x09b4  TDPIPE - ok
14:39:45.0353 0x09b4  [ 51C5ECEB1CDEE2468A1748BE550CFBC8, 4E8F83877330B421F7B5D8393D34BC44C6450E69209DAA95B29CB298166A5DF9 ] TDTCP           C:\Windows\system32\drivers\tdtcp.sys
14:39:45.0399 0x09b4  TDTCP - ok
14:39:45.0431 0x09b4  [ DDAD5A7AB24D8B65F8D724F5C20FD806, B71F2967A4EE7395E4416C1526CB85368AEA988BDD1F2C9719C48B08FAFA9661 ] tdx             C:\Windows\system32\DRIVERS\tdx.sys
14:39:45.0524 0x09b4  tdx - ok
14:39:45.0540 0x09b4  [ 1DE78F5008120CD79B34C12394DCD493, 58C59BEEE2F1C1C6CE810BA433C0D5789B4E6F218A074868137960663CB54802 ] TEAM            C:\Windows\system32\DRIVERS\RtTeam60.sys
14:39:45.0555 0x09b4  TEAM - ok
14:39:45.0602 0x09b4  [ 561E7E1F06895D78DE991E01DD0FB6E5, 83BFA50A528762EC52A011302AC3874636FB7E26628CD7ACFBF2BDC9FAA8110D ] TermDD          C:\Windows\system32\drivers\termdd.sys
14:39:45.0633 0x09b4  TermDD - ok
14:39:45.0711 0x09b4  [ 2E648163254233755035B46DD7B89123, 6FA0D07CE18A3A69D82EE49D875F141E39406E92C34EAC76AC4EB052E6EBCBCD ] TermService     C:\Windows\System32\termsrv.dll
14:39:45.0852 0x09b4  TermService - ok
14:39:45.0883 0x09b4  [ F0344071948D1A1FA732231785A0664C, DB9886C2C858FAF45AEA15F8E42860343F73EB8685C53EC2E8CCC10586CB0832 ] Themes          C:\Windows\system32\themeservice.dll
14:39:45.0930 0x09b4  Themes - ok
14:39:45.0961 0x09b4  [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] THREADORDER     C:\Windows\system32\mmcss.dll
14:39:46.0039 0x09b4  THREADORDER - ok
14:39:46.0133 0x09b4  [ 7E7AFD841694F6AC397E99D75CEAD49D, DE87F203FD8E6BDCCFCA1860A85F283301A365846FB703D9BB86278D8AC96B07 ] TrkWks          C:\Windows\System32\trkwks.dll
14:39:46.0226 0x09b4  TrkWks - ok
14:39:46.0351 0x09b4  [ 773212B2AAA24C1E31F10246B15B276C, F2EF85F5ABA307976D9C649D710B408952089458DDE97D4DEF321DF14E46A046 ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
14:39:46.0445 0x09b4  TrustedInstaller - ok
14:39:46.0491 0x09b4  [ 4CE278FC9671BA81A138D70823FCAA09, CBE501436696E32A3701B9F377B823AC36647B6626595F76CC63E2396AD7D300 ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys
14:39:46.0523 0x09b4  tssecsrv - ok
14:39:46.0569 0x09b4  [ D11C783E3EF9A3C52C0EBE83CC5000E9, A136C355D4C8945729163D15801364A614E23217B15F9313C85BA45BB71A74EB ] TsUsbFlt        C:\Windows\system32\drivers\tsusbflt.sys
14:39:46.0616 0x09b4  TsUsbFlt - ok
14:39:46.0632 0x09b4  tsusbhub - ok
14:39:46.0694 0x09b4  [ 3566A8DAAFA27AF944F5D705EAA64894, AE9D8B648DA08AF667B9456C3FE315489859C157510A258559F18238F2CC92B8 ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys
14:39:46.0772 0x09b4  tunnel - ok
14:39:46.0866 0x09b4  [ 2FD0FE0A0C721C8E47C5A3AE16E519B1, C0DE61AF32F01CF9BDA3E325F5F15D249C0FA4BB5FF720ED1916214907B4AF55 ] TunngleService  C:\Program Files (x86)\Tunngle\TnglCtrl.exe
14:39:46.0975 0x09b4  TunngleService - detected UnsignedFile.Multi.Generic ( 1 )
14:39:46.0975 0x09b4  TunngleService ( UnsignedFile.Multi.Generic ) - warning
14:39:49.0814 0x09b4  [ B4DD609BD7E282BFC683CEC7EAAAAD67, EF131DB6F6411CAD36A989A421AF93F89DD61601AC524D2FF11C10FF6E3E9123 ] uagp35          C:\Windows\system32\DRIVERS\uagp35.sys
14:39:49.0861 0x09b4  uagp35 - ok
14:39:49.0924 0x09b4  [ FF4232A1A64012BAA1FD97C7B67DF593, D8591B4EB056899C7B604E4DD852D82D4D9809F508ABCED4A03E1BE6D5D456E3 ] udfs            C:\Windows\system32\DRIVERS\udfs.sys
14:39:50.0048 0x09b4  udfs - ok
14:39:50.0095 0x09b4  [ 3CBDEC8D06B9968ABA702EBA076364A1, B8DAB8AA804FC23021BFEBD7AE4D40FBE648D6C6BA21CC008E26D1C084972F9B ] UI0Detect       C:\Windows\system32\UI0Detect.exe
14:39:50.0142 0x09b4  UI0Detect - ok
14:39:50.0189 0x09b4  [ 4BFE1BC28391222894CBF1E7D0E42320, 5918B1ED2030600DF77BDACF1C808DF6EADDD8BF3E7003AF1D72050D8B102B3A ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys
14:39:50.0220 0x09b4  uliagpkx - ok
14:39:50.0267 0x09b4  [ DC54A574663A895C8763AF0FA1FF7561, 09A3F3597E91CBEB2F38E96E75134312B60CAE5574B2AD4606C2D3E992AEDDFE ] umbus           C:\Windows\system32\drivers\umbus.sys
14:39:50.0329 0x09b4  umbus - ok
14:39:50.0345 0x09b4  [ B2E8E8CB557B156DA5493BBDDCC1474D, F547509A08C0679ACB843E20C9C0CF51BED1B06530BBC529DFB0944504564A43 ] UmPass          C:\Windows\system32\DRIVERS\umpass.sys
14:39:50.0376 0x09b4  UmPass - ok
14:39:50.0423 0x09b4  [ A293DCD756D04D8492A750D03B9A297C, 203600ED0B7F8BA4C6D6F4ED810F4DF5AB70928B06EC4131C5D8ADF628444ED1 ] UmRdpService    C:\Windows\System32\umrdp.dll
14:39:50.0485 0x09b4  UmRdpService - ok
14:39:50.0532 0x09b4  [ D47EC6A8E81633DD18D2436B19BAF6DE, 0FB461E2D5E0B75BB5958F6362F4880BFA4C36AD930542609BCAF574941AA7AE ] upnphost        C:\Windows\System32\upnphost.dll
14:39:50.0657 0x09b4  upnphost - ok
14:39:50.0719 0x09b4  [ B0435098C81D04CAFFF80DDB746CD3A2, A17B207740382E38729571F0B0BC98FF874E856A7C7CE9EB930328A2AD88F52A ] usbaudio        C:\Windows\system32\drivers\usbaudio.sys
14:39:50.0782 0x09b4  usbaudio - ok
14:39:50.0828 0x09b4  [ DCA68B0943D6FA415F0C56C92158A83A, BEE5A5B33B22D1DF50B884D46D89FC3B8286EB16E38AD5A20F0A49E5C6766C57 ] usbccgp         C:\Windows\system32\DRIVERS\usbccgp.sys
14:39:50.0860 0x09b4  usbccgp - ok
14:39:50.0891 0x09b4  [ 80B0F7D5CCF86CEB5D402EAAF61FEC31, 140C62116A425DEAD25FE8D82DE283BC92C482A9F643658D512F9F67061F28AD ] usbcir          C:\Windows\system32\drivers\usbcir.sys
14:39:50.0938 0x09b4  usbcir - ok
14:39:50.0969 0x09b4  [ 18A85013A3E0F7E1755365D287443965, 811C5EDF38C765BCF71BCE25CB6626FF6988C3699F5EF1846240EA0052F34C33 ] usbehci         C:\Windows\system32\DRIVERS\usbehci.sys
14:39:51.0016 0x09b4  usbehci - ok
14:39:51.0078 0x09b4  [ 8D1196CFBB223621F2C67D45710F25BA, B5D7AFE51833B24FC9576F3AED3D8A2B290E5846060E73F9FFFAC1890A8B6003 ] usbhub          C:\Windows\system32\DRIVERS\usbhub.sys
14:39:51.0140 0x09b4  usbhub - ok
14:39:51.0187 0x09b4  [ 765A92D428A8DB88B960DA5A8D6089DC, 56DE8A2ED58E53B202C399CA7BACB1551136303C2EE0AB426BDBBF880E3C542C ] usbohci         C:\Windows\system32\DRIVERS\usbohci.sys
14:39:51.0218 0x09b4  usbohci - ok
14:39:51.0250 0x09b4  [ 73188F58FB384E75C4063D29413CEE3D, B485463933306036B1D490722CB1674DC85670753D79FA0EF7EBCA7BBAAD9F7C ] usbprint        C:\Windows\system32\DRIVERS\usbprint.sys
14:39:51.0296 0x09b4  usbprint - ok
14:39:51.0328 0x09b4  [ FED648B01349A3C8395A5169DB5FB7D6, DC4D7594C24ADD076927B9347F1B50B91CF03A4ABDB284248D5711D9C19DEB96 ] USBSTOR         C:\Windows\system32\DRIVERS\USBSTOR.SYS
14:39:51.0406 0x09b4  USBSTOR - ok
14:39:51.0468 0x09b4  [ DD253AFC3BC6CBA412342DE60C3647F3, 146F8613F1057AC054DC3593E84BC52899DA27EA33B0E72ACFB78C3699ADCDE7 ] usbuhci         C:\Windows\system32\drivers\usbuhci.sys
14:39:51.0484 0x09b4  usbuhci - ok
14:39:51.0562 0x09b4  [ 1F775DA4CF1A3A1834207E975A72E9D7, 6D3DE5BD3EF3A76E997E5BAF900C51D25308F5A9682D1F62017F577A24095B90 ] usbvideo        C:\Windows\System32\Drivers\usbvideo.sys
14:39:51.0624 0x09b4  usbvideo - ok
14:39:51.0655 0x09b4  [ EDBB23CBCF2CDF727D64FF9B51A6070E, 7202484C8E1BFB2AFD64D8C81668F3EDE0E3BF5EB27572877A0A7B337AE5AE42 ] UxSms           C:\Windows\System32\uxsms.dll
14:39:51.0733 0x09b4  UxSms - ok
14:39:51.0749 0x09b4  [ 4D71227301DD8D09097B9E4CC6527E5A, 193D47ADCB722B581CC0F29B794AB3E455B6E9BEA367CE9A5216A09E055B7F1E ] VaultSvc        C:\Windows\system32\lsass.exe
14:39:51.0780 0x09b4  VaultSvc - ok
14:39:51.0811 0x09b4  [ C5C876CCFC083FF3B128F933823E87BD, 6FE0FBB6C3207E09300E0789E2168F76668D87C317FE9F263E733827ADCFBE0D ] vdrvroot        C:\Windows\system32\drivers\vdrvroot.sys
14:39:51.0842 0x09b4  vdrvroot - ok
14:39:51.0920 0x09b4  [ 8D6B481601D01A456E75C3210F1830BE, A2CEF483F4231367138EEF7E67FD5BE5364FC0780C44CA1368E36CE4AA3D0633 ] vds             C:\Windows\System32\vds.exe
14:39:52.0061 0x09b4  vds - ok
14:39:52.0092 0x09b4  [ DA4DA3F5E02943C2DC8C6ED875DE68DD, EDE604536DB78C512D68C92B26DA77C8811AC109D1F0A473673F0A82D15A2838 ] vga             C:\Windows\system32\DRIVERS\vgapnp.sys
14:39:52.0123 0x09b4  vga - ok
14:39:52.0139 0x09b4  [ 53E92A310193CB3C03BEA963DE7D9CFC, 45898604375B42EB1246C17A22D91C2440F11C746FF6459AD38027C1BC2E3125 ] VgaSave         C:\Windows\System32\drivers\vga.sys
14:39:52.0232 0x09b4  VgaSave - ok
14:39:52.0248 0x09b4  VGPU - ok
14:39:52.0295 0x09b4  [ 2CE2DF28C83AEAF30084E1B1EB253CBB, D1946816A1CB89F825CBEA58F94A4C9D0CE7249355CD3915563F54054EE564BF ] vhdmp           C:\Windows\system32\drivers\vhdmp.sys
14:39:52.0357 0x09b4  vhdmp - ok
14:39:52.0466 0x09b4  [ BA1DA5CD689E9473D99731A2E1FF2FB5, 10DC100D4723058E6DBB26679E9DA4E46C90367D11C221636236300C2BB45CCD ] VIAHdAudAddService C:\Windows\system32\drivers\viahduaa.sys
14:39:52.0638 0x09b4  VIAHdAudAddService - ok
14:39:52.0685 0x09b4  [ E5689D93FFE4E5D66C0178761240DD54, 6D35CED80681B12AAF63BFA0DA1C386E71D3838839B68A686990AA8031949D27 ] viaide          C:\Windows\system32\drivers\viaide.sys
14:39:52.0716 0x09b4  viaide - ok
14:39:52.0763 0x09b4  [ 86EA3E79AE350FEA5331A1303054005F, 7E7D6027EB41E591633C7383A5D29A3BA8ECFC08C177D2BCF741EE27686B1691 ] vmbus           C:\Windows\system32\drivers\vmbus.sys
14:39:52.0794 0x09b4  vmbus - ok
14:39:52.0810 0x09b4  [ 7DE90B48F210D29649380545DB45A187, 09522F84285D62B961868DA98C40B82E746CA4D24A9780905673A2349D6B07F4 ] VMBusHID        C:\Windows\system32\drivers\VMBusHID.sys
14:39:52.0856 0x09b4  VMBusHID - ok
14:39:52.0888 0x09b4  [ D2AAFD421940F640B407AEFAAEBD91B0, 31EF342A60AF04F4108759A71F8FB7B8C8819216CF3D16A95B2BA0E33A8A9161 ] volmgr          C:\Windows\system32\drivers\volmgr.sys
14:39:52.0919 0x09b4  volmgr - ok
14:39:52.0981 0x09b4  [ A255814907C89BE58B79EF2F189B843B, 463DB771851352185B6AC323BD93B9084D47291E53C1F7B628B65D6918B2E28F ] volmgrx         C:\Windows\system32\drivers\volmgrx.sys
14:39:53.0028 0x09b4  volmgrx - ok
14:39:53.0059 0x09b4  [ 0D08D2F3B3FF84E433346669B5E0F639, 3D6716CEC95B8861A7CC5778E91F310528DC6BEE0E57A3C8757FC675154EBDEC ] volsnap         C:\Windows\system32\drivers\volsnap.sys
14:39:53.0090 0x09b4  volsnap - ok
14:39:53.0137 0x09b4  [ 5E2016EA6EBACA03C04FEAC5F330D997, 53106EB877459FE55A459111F7AB0EE320BB3B4C954D3DB6FA1642396001F2AC ] vsmraid         C:\Windows\system32\DRIVERS\vsmraid.sys
14:39:53.0184 0x09b4  vsmraid - ok
14:39:53.0324 0x09b4  [ B60BA0BC31B0CB414593E169F6F21CC2, 47B801E623254CF0202B3591CB5C019CABFB52F123C7D47E29D19B32F1F2B915 ] VSS             C:\Windows\system32\vssvc.exe
14:39:53.0527 0x09b4  VSS - ok
14:39:53.0558 0x09b4  vToolbarUpdater15.0.0 - ok
14:39:53.0590 0x09b4  [ 36D4720B72B5C5D9CB2B9C29E9DF67A1, 3254523C85C70EBA2DBAC05DB2DBA89EDF8E9195F390F7C21F96458FB6B2E3D7 ] vwifibus        C:\Windows\system32\DRIVERS\vwifibus.sys
14:39:53.0636 0x09b4  vwifibus - ok
14:39:53.0668 0x09b4  [ 6A3D66263414FF0D6FA754C646612F3F, 30F6BA594B0D3B94113064015A16D97811CD989DF1715CCE21CEAB9894C1B4FB ] vwififlt        C:\Windows\system32\DRIVERS\vwififlt.sys
14:39:53.0730 0x09b4  vwififlt - ok
14:39:53.0761 0x09b4  [ 6A638FC4BFDDC4D9B186C28C91BD1A01, 5521F1DC515586777EC4837E0AEAA3E613CC178AF1074031C4D0D0C695A93168 ] vwifimp         C:\Windows\system32\DRIVERS\vwifimp.sys
14:39:53.0824 0x09b4  vwifimp - ok
14:39:53.0917 0x09b4  [ 1C9D80CC3849B3788048078C26486E1A, 34A89F31E53F6B6C209B286F580CC2257AE6D057E4E20741F241C9C167947962 ] W32Time         C:\Windows\system32\w32time.dll
14:39:54.0026 0x09b4  W32Time - ok
14:39:54.0058 0x09b4  [ 4E9440F4F152A7B944CB1663D3935A3E, 8FE04EBD3BC612EE943A21A3E56F37E5C9B578CDACA6044048181DAD81816D53 ] WacomPen        C:\Windows\system32\DRIVERS\wacompen.sys
14:39:54.0120 0x09b4  WacomPen - ok
14:39:54.0167 0x09b4  [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] WANARP          C:\Windows\system32\DRIVERS\wanarp.sys
14:39:54.0260 0x09b4  WANARP - ok
14:39:54.0276 0x09b4  [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys
14:39:54.0354 0x09b4  Wanarpv6 - ok
14:39:54.0479 0x09b4  [ 78F4E7F5C56CB9716238EB57DA4B6A75, 46A4E78CE5F2A4B26F4E9C3FF04A99D9B727A82AC2E390A82A1611C3F6E0C9AF ] wbengine        C:\Windows\system32\wbengine.exe
14:39:54.0619 0x09b4  wbengine - ok
14:39:54.0697 0x09b4  [ 3AA101E8EDAB2DB4131333F4325C76A3, 4F7BD3DA5E58B18BFF106CFF7B45E75FD13EE556D433C695BA23EC80827E49DE ] WbioSrvc        C:\Windows\System32\wbiosrvc.dll
14:39:54.0775 0x09b4  WbioSrvc - ok
14:39:54.0838 0x09b4  [ 7368A2AFD46E5A4481D1DE9D14848EDD, 8039C478FC2D9F095F5883A4FA47F9E6EDF57CC88A4AA74F07C88445F90DED57 ] wcncsvc         C:\Windows\System32\wcncsvc.dll
14:39:54.0916 0x09b4  wcncsvc - ok
14:39:54.0931 0x09b4  [ 20F7441334B18CEE52027661DF4A6129, 7B8E0247234B740FED2BE9B833E9CE8DD7453340123AB43F6B495A7E6A27B0DD ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
14:39:54.0994 0x09b4  WcsPlugInService - ok
14:39:55.0025 0x09b4  [ 72889E16FF12BA0F235467D6091B17DC, F2FD0BBD075E33608D93F350D216F97442AB89ABD540513C2D568C78096E12A8 ] Wd              C:\Windows\system32\DRIVERS\wd.sys
14:39:55.0056 0x09b4  Wd - ok
14:39:55.0134 0x09b4  [ E2C933EDBC389386EBE6D2BA953F43D8, AF1DEADD5F1267CCEBD226E8EEB971D1946EA6A5A9645A36F5D111F758AF2F07 ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys
14:39:55.0212 0x09b4  Wdf01000 - ok
14:39:55.0243 0x09b4  [ BF1FC3F79B863C914687A737C2F3D681, B2DF47AC4931ACFB243775767B77065CC0D98778FC0243C793A3E219EB961209 ] WdiServiceHost  C:\Windows\system32\wdi.dll
14:39:55.0290 0x09b4  WdiServiceHost - ok
14:39:55.0306 0x09b4  [ BF1FC3F79B863C914687A737C2F3D681, B2DF47AC4931ACFB243775767B77065CC0D98778FC0243C793A3E219EB961209 ] WdiSystemHost   C:\Windows\system32\wdi.dll
14:39:55.0352 0x09b4  WdiSystemHost - ok
14:39:55.0415 0x09b4  [ 0EB0E5D22B1760F2DBCE632F2DD7A54D, B8A4CC62F88768947FB0A161CF9564DB28FD9C1C037B5475DF192982DE035C22 ] WebClient       C:\Windows\System32\webclnt.dll
14:39:55.0477 0x09b4  WebClient - ok
14:39:55.0508 0x09b4  [ C749025A679C5103E575E3B48E092C43, B71171D07EE7AB085A24BF3A1072FF2CE7EA021AAE695F6A90640E6EE8EB55C1 ] Wecsvc          C:\Windows\system32\wecsvc.dll
14:39:55.0633 0x09b4  Wecsvc - ok
14:39:55.0664 0x09b4  [ 7E591867422DC788B9E5BD337A669A08, 484E6BCCDF7ADCE9A1AACAD1BC7C7D7694B9E40FA90D94B14D80C607784F6C75 ] wercplsupport   C:\Windows\System32\wercplsupport.dll
14:39:55.0742 0x09b4  wercplsupport - ok
14:39:55.0758 0x09b4  [ 6D137963730144698CBD10F202E9F251, A9F522A125158D94F540544CCD4DBF47B9DCE2EA878C33675AFE40F80E8F4979 ] WerSvc          C:\Windows\System32\WerSvc.dll
14:39:55.0852 0x09b4  WerSvc - ok
14:39:55.0867 0x09b4  [ 611B23304BF067451A9FDEE01FBDD725, 0AF2734B978165FC6FD22B64862132CCE32528A21C698A49D176129446E099C8 ] WfpLwf          C:\Windows\system32\DRIVERS\wfplwf.sys
14:39:55.0945 0x09b4  WfpLwf - ok
14:39:55.0961 0x09b4  [ 05ECAEC3E4529A7153B3136CEB49F0EC, 9995CB2CEC70A633EA33CBB0DEAD2BB28CB67132B41E9444BDAB9E75744C9A50 ] WIMMount        C:\Windows\system32\drivers\wimmount.sys
14:39:55.0992 0x09b4  WIMMount - ok
14:39:56.0023 0x09b4  WinDefend - ok
14:39:56.0039 0x09b4  WinHttpAutoProxySvc - ok
14:39:56.0117 0x09b4  [ 19B07E7E8915D701225DA41CB3877306, D6555E8D276DBB11358246E0FE215F76F1FB358791C76B88D82C2A66A42DA19F ] Winmgmt         C:\Windows\system32\wbem\WMIsvc.dll
14:39:56.0226 0x09b4  Winmgmt - ok
14:39:56.0382 0x09b4  [ BCB1310604AA415C4508708975B3931E, 9D943F086D454345153A0DD426B4432532A44FD87950386B186E1CAD2AC70565 ] WinRM           C:\Windows\system32\WsmSvc.dll
14:39:56.0632 0x09b4  WinRM - ok
14:39:56.0725 0x09b4  [ FE88B288356E7B47B74B13372ADD906D, A16B166F6BB32EF9D2A142F27B9EC54CBC7B3AC915799783CF4C40E525BC9E03 ] WinUsb          C:\Windows\system32\DRIVERS\WinUsb.sys
14:39:56.0756 0x09b4  WinUsb - ok
14:39:56.0834 0x09b4  [ 4FADA86E62F18A1B2F42BA18AE24E6AA, CE1683386886BF34862681A46199EA7E7FB4232A186047DA7FBD8EC240AF6726 ] Wlansvc         C:\Windows\System32\wlansvc.dll
14:39:56.0944 0x09b4  Wlansvc - ok
14:39:57.0193 0x09b4  [ 357CABBF155AFD1D3926E62539D2A3A7, C43CFF84E7D930B4999DC061AB0766B57AAD7540B3E6EE54605B10ECE90825F5 ] wlidsvc         C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
14:39:57.0365 0x09b4  wlidsvc - ok
14:39:57.0412 0x09b4  [ F6FF8944478594D0E414D3F048F0D778, 6F75E0AE6127B33A92A88E59D4B048FD4C15F997807BE7BF0EFE76F95235B1D9 ] WmiAcpi         C:\Windows\system32\drivers\wmiacpi.sys
14:39:57.0458 0x09b4  WmiAcpi - ok
14:39:57.0490 0x09b4  [ 38B84C94C5A8AF291ADFEA478AE54F93, 1AC267AC73670BEA5F3785C9AD9DB146F8E993A862C843742B21FDB90D102B2A ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe
14:39:57.0552 0x09b4  wmiApSrv - ok
14:39:57.0568 0x09b4  WMPNetworkSvc - ok
14:39:57.0677 0x09b4  [ 83B6CA03C846FCD47F9883D77D1EB27B, 1616DBBC95085B6618B7F884383507E2A54D561A41288E79FA6DC99218C02802 ] WMZuneComm      C:\Program Files\Zune\WMZuneComm.exe
14:39:57.0724 0x09b4  WMZuneComm - ok
14:39:57.0755 0x09b4  [ 96C6E7100D724C69FCF9E7BF590D1DCA, 2E63C9B0893B4FC03B7A71BAEA6202D3D3DB1B52F3643467829B5A573FD7655B ] WPCSvc          C:\Windows\System32\wpcsvc.dll
14:39:57.0802 0x09b4  WPCSvc - ok
14:39:57.0848 0x09b4  [ 93221146D4EBBF314C29B23CD6CC391D, C0750858A65BF51E210CD244C825C121D67E025CD2D2455139991AAC289A90FE ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll
14:39:57.0895 0x09b4  WPDBusEnum - ok
14:39:57.0911 0x09b4  [ 6BCC1D7D2FD2453957C5479A32364E52, E48554D31FBDCF8F985C1C72524CAA9106F5B7CC2B79064F8F5E2562D517F090 ] ws2ifsl         C:\Windows\system32\drivers\ws2ifsl.sys
14:39:58.0004 0x09b4  ws2ifsl - ok
14:39:58.0036 0x09b4  [ E8B1FE6669397D1772D8196DF0E57A9E, 39FE0819360719F756BD31A1884A0508A1E2371ACC723E25E005CBEC0A7B02FA ] wscsvc          C:\Windows\system32\wscsvc.dll
14:39:58.0082 0x09b4  wscsvc - ok
14:39:58.0098 0x09b4  WSearch - ok
14:39:58.0285 0x09b4  [ D9EF901DCA379CFE914E9FA13B73B4C4, 3BE9693B7B2AFEE23D72AF5DA211379724D752F0EC18ACB7D3DE3DDFC5AE0004 ] wuauserv        C:\Windows\system32\wuaueng.dll
14:39:58.0457 0x09b4  wuauserv - ok
14:39:58.0504 0x09b4  [ AB886378EEB55C6C75B4F2D14B6C869F, D6C4602EB8F291DADEDF3CD211013D4AC752DDE7E799C2D8D74AA4F5477CAED6 ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys
14:39:58.0566 0x09b4  WudfPf - ok
14:39:58.0613 0x09b4  [ DDA4CAF29D8C0A297F886BFE561E6659, 94E5DD649B5D86FA1A7C7D30FCF9644D0EE048D312E626111458ADF66BFBE978 ] WUDFRd          C:\Windows\system32\DRIVERS\WUDFRd.sys
14:39:58.0675 0x09b4  WUDFRd - ok
14:39:58.0706 0x09b4  [ B20F051B03A966392364C83F009F7D17, 88ECEB55AE91F58F592B96EBC10B572747D5A2F9B7629E8F371761E4F7408A65 ] wudfsvc         C:\Windows\System32\WUDFSvc.dll
14:39:58.0753 0x09b4  wudfsvc - ok
14:39:58.0800 0x09b4  [ FE90B750AB808FB9DD8FBB428B5FF83B, 3F8F592EC813BE292D305A87C5BA852F8BC3D7CE610612D9871F209A17326AA8 ] WwanSvc         C:\Windows\System32\wwansvc.dll
14:39:58.0878 0x09b4  WwanSvc - ok
14:39:58.0940 0x09b4  X6va011 - ok
14:39:58.0972 0x09b4  X6va012 - ok
14:39:58.0987 0x09b4  X6va013 - ok
14:39:59.0018 0x09b4  X6va015 - ok
14:39:59.0018 0x09b4  xhunter1 - ok
14:39:59.0580 0x09b4  [ 67B787C34FB2888D01B130AE007042D8, E44878E53F265C89F271B08B81C129105E42D1C78C14467B2D96E28A9A428B1A ] ZuneNetworkSvc  C:\Program Files\Zune\ZuneNss.exe
14:40:00.0173 0x09b4  ZuneNetworkSvc - ok
14:40:00.0220 0x09b4  [ 4D89FC1C20CF655739EFAC5DA81A67BC, 788D0A5B9972ED6D80242C0C5E80AB0FAB44A708B896D5F724AC1559A291C8DD ] ZuneWlanCfgSvc  C:\Program Files\Zune\ZuneWlanCfgSvc.exe
14:40:00.0298 0x09b4  ZuneWlanCfgSvc - ok
14:40:00.0422 0x09b4  ================ Scan global ===============================
14:40:00.0454 0x09b4  [ BA0CD8C393E8C9F83354106093832C7B, 18D8A4780A2BAA6CEF7FBBBDA0EF6BF2DADF146E1E578A618DD5859E8ADBF1A8 ] C:\Windows\system32\basesrv.dll
14:40:00.0516 0x09b4  [ 88EDD0B34EED542745931E581AD21A32, DC2B93E1CEF5B0BCEE08D72669BB0F3AD0E8E6E75BDC08858407ED92F6FFA031 ] C:\Windows\system32\winsrv.dll
14:40:00.0547 0x09b4  [ 88EDD0B34EED542745931E581AD21A32, DC2B93E1CEF5B0BCEE08D72669BB0F3AD0E8E6E75BDC08858407ED92F6FFA031 ] C:\Windows\system32\winsrv.dll
14:40:00.0578 0x09b4  [ D6160F9D869BA3AF0B787F971DB56368, 0033E6212DD8683E4EE611B290931FDB227B4795F0B17C309DC686C696790529 ] C:\Windows\system32\sxssrv.dll
14:40:00.0610 0x09b4  [ 24ACB7E5BE595468E3B9AA488B9B4FCB, 63541E3432FCE953F266AE553E7A394978D6EE3DB52388D885F668CF42C5E7E2 ] C:\Windows\system32\services.exe
14:40:00.0641 0x09b4  [ Global ] - ok
14:40:00.0641 0x09b4  ================ Scan MBR ==================================
14:40:00.0656 0x09b4  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
14:40:00.0859 0x09b4  \Device\Harddisk0\DR0 - ok
14:40:00.0859 0x09b4  ================ Scan VBR ==================================
14:40:00.0875 0x09b4  [ 2ED5F64087D874D22C41BF932B0F9078 ] \Device\Harddisk0\DR0\Partition1
14:40:00.0890 0x09b4  \Device\Harddisk0\DR0\Partition1 - ok
14:40:00.0906 0x09b4  [ DA5FBF969D3027178E6997B09776F9D0 ] \Device\Harddisk0\DR0\Partition2
14:40:00.0937 0x09b4  \Device\Harddisk0\DR0\Partition2 - ok
14:40:01.0249 0x09b4  AV detected via SS2: Avira Desktop, C:\Program Files (x86)\Avira\AntiVir Desktop\wsctool.exe ( 14.0.2.234 ), 0x40000 ( disabled : updated )
14:40:01.0327 0x09b4  Win FW state via NFP2: enabled
14:40:04.0135 0x09b4  ============================================================
14:40:04.0135 0x09b4  Scan finished
14:40:04.0135 0x09b4  ============================================================
14:40:04.0151 0x0b18  Detected object count: 8
14:40:04.0151 0x0b18  Actual detected object count: 8
14:40:20.0827 0x0b18  Akamai ( HiddenFile.Multi.Generic ) - skipped by user
14:40:20.0827 0x0b18  Akamai ( HiddenFile.Multi.Generic ) - User select action: Skip 
14:40:20.0827 0x0b18  AMD_RAIDXpert ( UnsignedFile.Multi.Generic ) - skipped by user
14:40:20.0827 0x0b18  AMD_RAIDXpert ( UnsignedFile.Multi.Generic ) - User select action: Skip 
14:40:20.0843 0x0b18  atksgt ( UnsignedFile.Multi.Generic ) - skipped by user
14:40:20.0843 0x0b18  atksgt ( UnsignedFile.Multi.Generic ) - User select action: Skip 
14:40:20.0843 0x0b18  HiPatchService ( UnsignedFile.Multi.Generic ) - skipped by user
14:40:20.0843 0x0b18  HiPatchService ( UnsignedFile.Multi.Generic ) - User select action: Skip 
14:40:20.0843 0x0b18  IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user
14:40:20.0843 0x0b18  IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip 
14:40:20.0843 0x0b18  lirsgt ( UnsignedFile.Multi.Generic ) - skipped by user
14:40:20.0843 0x0b18  lirsgt ( UnsignedFile.Multi.Generic ) - User select action: Skip 
14:40:20.0843 0x0b18  tap0901t ( UnsignedFile.Multi.Generic ) - skipped by user
14:40:20.0843 0x0b18  tap0901t ( UnsignedFile.Multi.Generic ) - User select action: Skip 
14:40:20.0858 0x0b18  TunngleService ( UnsignedFile.Multi.Generic ) - skipped by user
14:40:20.0858 0x0b18  TunngleService ( UnsignedFile.Multi.Generic ) - User select action: Skip 
14:44:38.0551 0x1150  Deinitialize success
         

Combofix

ComboFix 14-02-12.01 - Pc 13.02.2014  14:00:53.2.6 - x64
Microsoft Windows 7 Enterprise   6.1.7601.1.1252.49.1031.18.8174.6283 [GMT 1:00]
ausgeführt von:: c:\users\Pc\Desktop\ComboFix.exe
Benutzte Befehlsschalter :: c:\users\Pc\Desktop\CFScript.txt
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk"
"c:\users\Pc\AppData\Roaming\vbc.exe"
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\END
c:\users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk
c:\users\Pc\AppData\Roaming\pthreadGC2.dll
c:\users\Pc\AppData\Roaming\vbc.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2014-01-13 bis 2014-02-13  ))))))))))))))))))))))))))))))
.
.
2014-02-13 13:16 . 2014-02-13 13:16	--------	d-----w-	c:\users\HomeGroupUser$\AppData\Local\temp
2014-02-13 13:16 . 2014-02-13 13:16	--------	d-----w-	c:\users\hedev\AppData\Local\temp
2014-02-13 13:16 . 2014-02-13 13:16	--------	d-----w-	c:\users\Gast\AppData\Local\temp
2014-02-13 13:16 . 2014-02-13 13:16	--------	d-----w-	c:\users\Default\AppData\Local\temp
2014-02-13 13:16 . 2014-02-13 13:16	--------	d-----w-	c:\users\ASPNET\AppData\Local\temp
2014-02-13 13:16 . 2014-02-13 13:16	--------	d-----w-	c:\users\Administrator\AppData\Local\temp
2014-02-12 21:27 . 2014-02-12 21:27	--------	d-----w-	c:\users\Pc\AppData\Roaming\Avira
2014-02-12 21:27 . 2014-02-12 21:27	--------	d-----w-	c:\users\Pc\AppData\Local\VNT
2014-02-12 21:26 . 2014-02-12 21:26	--------	d-----w-	c:\programdata\AskPartnerNetwork
2014-02-12 21:26 . 2014-02-12 21:26	--------	d-----w-	c:\program files (x86)\VNT
2014-02-12 21:26 . 2014-02-12 21:26	--------	d-----w-	c:\program files (x86)\AskPartnerNetwork
2014-02-12 21:26 . 2014-02-12 21:26	--------	d-----w-	c:\programdata\APN
2014-02-12 21:23 . 2013-12-09 10:45	84720	----a-w-	c:\windows\system32\drivers\avnetflt.sys
2014-02-12 21:23 . 2013-12-09 10:45	28600	----a-w-	c:\windows\system32\drivers\avkmgr.sys
2014-02-12 21:23 . 2013-12-09 10:45	131576	----a-w-	c:\windows\system32\drivers\avipbb.sys
2014-02-12 21:23 . 2013-12-09 10:45	108440	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2014-02-12 21:23 . 2014-02-12 21:23	--------	d-----w-	c:\programdata\Avira
2014-02-12 21:23 . 2014-02-12 21:23	--------	d-----w-	c:\program files (x86)\Avira
2014-02-12 21:05 . 2014-02-12 21:05	--------	d-----w-	c:\program files (x86)\FileHippo.com
2014-02-12 20:04 . 2013-12-21 09:53	548864	----a-w-	c:\windows\system32\vbscript.dll
2014-02-12 20:04 . 2013-12-21 08:56	454656	----a-w-	c:\windows\SysWow64\vbscript.dll
2014-02-12 19:57 . 2013-12-04 02:16	658432	----a-w-	c:\windows\system32\RMActivate_isv.exe
2014-02-12 13:12 . 2014-02-12 13:12	--------	d-----w-	c:\program files (x86)\DLLSuite
2014-02-12 12:51 . 2014-02-12 12:51	--------	d-----w-	c:\users\Pc\AppData\Roaming\DriverCure
2014-02-12 12:51 . 2014-02-12 12:51	--------	d-----w-	c:\users\Pc\AppData\Roaming\ParetoLogic
2014-02-12 12:51 . 2014-02-12 12:51	--------	d-----w-	c:\program files (x86)\Common Files\ParetoLogic
2014-02-12 12:51 . 2014-02-12 12:51	--------	d-----w-	c:\programdata\ParetoLogic
2014-02-12 12:51 . 2014-02-12 12:51	--------	d-----w-	c:\program files (x86)\ParetoLogic
2014-02-11 21:23 . 2014-02-12 17:54	--------	d-----w-	C:\FRST
2014-02-11 20:23 . 2014-02-11 21:00	--------	d-----w-	c:\programdata\SecTaskMan
2014-02-11 20:22 . 2014-02-11 20:23	--------	d-----w-	c:\program files (x86)\Security Task Manager
2014-02-11 20:03 . 2014-02-11 20:03	--------	d-----w-	c:\users\Pc\AppData\Roaming\TestApp
2014-02-11 16:50 . 2014-02-12 19:59	--------	d-----w-	c:\programdata\PC Tools
2014-02-11 15:54 . 2014-02-11 15:54	--------	d-----w-	c:\programdata\SMR410
2014-02-11 15:50 . 2014-02-11 16:34	--------	d-----w-	c:\users\Pc\AppData\Local\NPE
2014-02-11 15:35 . 2014-02-11 20:23	--------	d-----w-	c:\users\Pc\AppData\Roaming\DigitalSites
2014-02-11 15:34 . 2014-02-11 15:34	--------	d-s---w-	c:\windows\SysWow64\Microsoft
2014-02-11 15:30 . 2013-12-18 20:09	96168	----a-w-	c:\windows\SysWow64\WindowsAccessBridge-32.dll
2014-02-11 14:59 . 2014-02-11 14:59	--------	d-----w-	c:\users\Pc\AppData\Roaming\Oxy
2014-02-11 14:34 . 2014-02-11 14:34	--------	d-sh--r-	c:\users\Pc\cc4j5zs76kd2kj
2014-02-04 15:14 . 2013-06-12 14:15	100864	----a-w-	c:\users\Pc\AppData\Roaming\zlib1.dll
2014-02-04 14:05 . 2014-02-11 20:23	--------	d-sh--r-	c:\users\Pc\aoajz
2014-02-04 12:09 . 2014-02-04 12:12	--------	d-----w-	c:\users\Pc\AppData\Roaming\Riot Games
2014-02-04 11:08 . 2014-02-11 20:23	--------	d-sh--r-	c:\users\Pc\xripb
2014-01-21 09:23 . 2014-02-04 11:20	--------	d-----w-	c:\users\Pc\AppData\Local\CyberGhost
2014-01-21 09:22 . 2014-01-21 09:23	--------	d-----w-	c:\program files\TAP-Windows
2014-01-21 09:22 . 2014-01-21 09:27	--------	d-----w-	c:\program files\CyberGhost 5
2014-01-15 12:29 . 2013-11-27 01:41	343040	----a-w-	c:\windows\system32\drivers\usbhub.sys
2014-01-15 12:29 . 2013-11-27 01:41	99840	----a-w-	c:\windows\system32\drivers\usbccgp.sys
2014-01-15 12:29 . 2013-11-27 01:41	53248	----a-w-	c:\windows\system32\drivers\usbehci.sys
2014-01-15 12:29 . 2013-11-27 01:41	325120	----a-w-	c:\windows\system32\drivers\usbport.sys
2014-01-15 12:29 . 2013-11-27 01:41	25600	----a-w-	c:\windows\system32\drivers\usbohci.sys
2014-01-15 12:29 . 2013-11-27 01:41	30720	----a-w-	c:\windows\system32\drivers\usbuhci.sys
2014-01-15 12:29 . 2013-11-27 01:41	7808	----a-w-	c:\windows\system32\drivers\usbd.sys
2014-01-15 12:29 . 2013-11-26 10:32	3156480	----a-w-	c:\windows\system32\win32k.sys
2014-01-15 12:29 . 2013-11-26 11:40	376768	----a-w-	c:\windows\system32\drivers\netio.sys
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-02-12 20:10 . 2012-10-18 04:30	88567024	----a-w-	c:\windows\system32\MRT.exe
2014-02-12 19:55 . 2012-12-10 17:25	71048	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-02-12 19:55 . 2012-12-10 17:25	692616	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2014-02-12 07:31 . 2012-10-19 16:25	419840	----a-w-	c:\windows\system32\systemcpl.dll
2014-02-12 07:31 . 2012-10-19 16:25	14848	----a-w-	c:\windows\system32\slwga.dll
2014-02-12 07:31 . 2012-10-19 16:25	13824	----a-w-	c:\windows\SysWow64\slwga.dll
2014-02-12 07:31 . 2012-10-19 16:25	1008640	----a-w-	c:\windows\system32\user32.dll
2014-02-12 07:31 . 2012-10-19 16:25	833024	----a-w-	c:\windows\SysWow64\user32.dll
2014-02-05 11:36 . 2013-12-28 10:49	291128	----a-w-	c:\windows\SysWow64\PnkBstrB.xtr
2014-02-05 11:36 . 2013-08-18 16:42	291128	----a-w-	c:\windows\SysWow64\PnkBstrB.exe
2014-02-04 14:46 . 2013-08-18 16:42	291128	----a-w-	c:\windows\SysWow64\PnkBstrB.ex0
2014-01-24 21:17 . 2013-08-18 16:42	76888	----a-w-	c:\windows\SysWow64\PnkBstrA.exe
2013-12-30 13:47 . 2013-12-30 13:47	283064	----a-w-	c:\windows\system32\drivers\dtsoftbus01.sys
2013-12-18 05:13 . 2012-11-06 16:48	270496	------w-	c:\windows\system32\MpSigStub.exe
2013-12-06 22:07 . 2013-12-06 22:07	78432	----a-w-	c:\windows\system32\atimpc64.dll
2013-12-06 22:07 . 2013-12-06 22:07	78432	----a-w-	c:\windows\system32\amdpcom64.dll
2013-12-06 22:07 . 2013-12-06 22:07	71704	----a-w-	c:\windows\SysWow64\atimpc32.dll
2013-12-06 22:07 . 2013-12-06 22:07	71704	----a-w-	c:\windows\SysWow64\amdpcom32.dll
2013-12-06 22:04 . 2011-05-25 20:07	143304	----a-w-	c:\windows\system32\atiuxp64.dll
2013-12-06 22:03 . 2013-12-06 22:03	126336	----a-w-	c:\windows\SysWow64\atiuxpag.dll
2013-12-06 22:03 . 2011-07-08 02:46	115512	----a-w-	c:\windows\system32\atiu9p64.dll
2013-12-06 22:02 . 2011-07-08 02:45	98496	----a-w-	c:\windows\SysWow64\atiu9pag.dll
2013-12-06 22:01 . 2011-07-08 03:28	1318552	----a-w-	c:\windows\system32\aticfx64.dll
2013-12-06 22:01 . 2011-07-08 03:29	1100216	----a-w-	c:\windows\SysWow64\aticfx32.dll
2013-12-06 22:00 . 2011-07-08 03:10	9753752	----a-w-	c:\windows\system32\atidxx64.dll
2013-12-06 21:59 . 2013-12-06 21:59	8406024	----a-w-	c:\windows\SysWow64\atidxx32.dll
2013-12-06 21:59 . 2011-07-08 02:55	8287008	----a-w-	c:\windows\SysWow64\atiumdva.dll
2013-12-06 21:58 . 2011-07-08 03:00	6630232	----a-w-	c:\windows\SysWow64\atiumdag.dll
2013-12-06 21:57 . 2013-12-06 21:57	8927704	----a-w-	c:\windows\system32\atiumd6a.dll
2013-12-06 21:56 . 2013-12-06 21:56	7751920	----a-w-	c:\windows\system32\atiumd64.dll
2013-12-06 21:52 . 2013-12-06 21:52	13207552	----a-w-	c:\windows\system32\drivers\atikmdag.sys
2013-12-06 21:38 . 2013-12-06 21:38	230912	----a-w-	c:\windows\system32\clinfo.exe
2013-12-06 21:38 . 2013-12-06 21:38	1187342	----a-w-	c:\windows\system32\amdocl_as64.exe
2013-12-06 21:38 . 2013-12-06 21:38	1061902	----a-w-	c:\windows\system32\amdocl_ld64.exe
2013-12-06 21:38 . 2013-12-06 21:38	995342	----a-w-	c:\windows\SysWow64\amdocl_as32.exe
2013-12-06 21:38 . 2013-12-06 21:38	798734	----a-w-	c:\windows\SysWow64\amdocl_ld32.exe
2013-12-06 21:38 . 2013-12-06 21:38	99840	----a-w-	c:\windows\system32\OpenVideo64.dll
2013-12-06 21:38 . 2013-12-06 21:38	83968	----a-w-	c:\windows\SysWow64\OpenVideo.dll
2013-12-06 21:38 . 2013-12-06 21:38	86528	----a-w-	c:\windows\system32\OVDecode64.dll
2013-12-06 21:38 . 2013-12-06 21:38	73728	----a-w-	c:\windows\SysWow64\OVDecode.dll
2013-12-06 21:37 . 2013-12-06 21:37	29382144	----a-w-	c:\windows\system32\amdocl64.dll
2013-12-06 21:35 . 2013-12-06 21:35	24860160	----a-w-	c:\windows\SysWow64\amdocl.dll
2013-12-06 21:33 . 2013-12-06 21:33	63488	----a-w-	c:\windows\system32\OpenCL.dll
2013-12-06 21:33 . 2013-12-06 21:33	57344	----a-w-	c:\windows\SysWow64\OpenCL.dll
2013-12-06 21:26 . 2013-12-06 21:26	129536	----a-w-	c:\windows\system32\coinst_13.251.dll
2013-12-06 21:16 . 2013-12-06 21:16	26352128	----a-w-	c:\windows\system32\atio6axx.dll
2013-12-06 21:13 . 2013-12-06 21:13	368640	----a-w-	c:\windows\system32\atiapfxx.exe
2013-12-06 21:12 . 2013-12-06 21:12	62464	----a-w-	c:\windows\system32\aticalrt64.dll
2013-12-06 21:12 . 2013-12-06 21:12	52224	----a-w-	c:\windows\SysWow64\aticalrt.dll
2013-12-06 21:12 . 2013-12-06 21:12	55808	----a-w-	c:\windows\system32\aticalcl64.dll
2013-12-06 21:12 . 2013-12-06 21:12	49152	----a-w-	c:\windows\SysWow64\aticalcl.dll
2013-12-06 21:12 . 2013-12-06 21:12	15716352	----a-w-	c:\windows\system32\aticaldd64.dll
2013-12-06 21:09 . 2013-12-06 21:09	14302208	----a-w-	c:\windows\SysWow64\aticaldd.dll
2013-12-06 20:58 . 2013-12-06 20:58	22157824	----a-w-	c:\windows\SysWow64\atioglxx.dll
2013-12-06 20:53 . 2013-12-06 20:53	442368	----a-w-	c:\windows\system32\atidemgy.dll
2013-12-06 20:53 . 2013-12-06 20:53	31232	----a-w-	c:\windows\system32\atimuixx.dll
2013-12-06 20:53 . 2013-12-06 20:53	588288	----a-w-	c:\windows\system32\atieclxx.exe
2013-12-06 20:52 . 2013-12-06 20:52	239616	----a-w-	c:\windows\system32\atiesrxx.exe
2013-12-06 20:50 . 2013-12-06 20:50	190976	----a-w-	c:\windows\system32\atitmm64.dll
2013-12-06 20:22 . 2013-12-06 20:22	1144320	----a-w-	c:\windows\system32\atiadlxx.dll
2013-12-06 20:22 . 2013-12-06 20:22	825344	----a-w-	c:\windows\SysWow64\atiadlxy.dll
2013-12-06 20:22 . 2013-12-06 20:22	74752	----a-w-	c:\windows\system32\atig6pxx.dll
2013-12-06 20:22 . 2013-12-06 20:22	69632	----a-w-	c:\windows\SysWow64\atiglpxx.dll
2013-12-06 20:22 . 2013-12-06 20:22	69632	----a-w-	c:\windows\system32\atiglpxx.dll
2013-12-06 20:22 . 2013-12-06 20:22	100352	----a-w-	c:\windows\system32\atig6txx.dll
2013-12-06 20:21 . 2013-12-06 20:21	96768	----a-w-	c:\windows\SysWow64\atigktxx.dll
2013-12-06 20:21 . 2013-12-06 20:21	626176	----a-w-	c:\windows\system32\drivers\atikmpag.sys
2013-12-06 20:18 . 2013-12-06 20:18	43520	----a-w-	c:\windows\system32\drivers\ati2erec.dll
2013-12-06 15:49 . 2013-12-06 15:49	51200	----a-w-	c:\windows\system32\kdbsdk64.dll
2013-12-06 15:44 . 2013-12-06 15:44	38912	----a-w-	c:\windows\SysWow64\kdbsdk32.dll
2013-12-04 03:28 . 2014-02-13 12:43	10315576	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{CF91F9F6-1A6E-48C6-BC8A-0B4769C5A378}\mpengine.dll
2013-11-23 18:26 . 2013-12-11 14:34	417792	----a-w-	c:\windows\SysWow64\WMPhoto.dll
2013-11-23 17:47 . 2013-12-11 14:34	465920	----a-w-	c:\windows\system32\WMPhoto.dll
2013-11-19 21:07 . 2013-11-19 21:07	940032	----a-w-	c:\windows\system32\MsSpellCheckingFacility.exe
2013-11-19 21:07 . 2013-11-19 21:07	194048	----a-w-	c:\windows\SysWow64\elshyph.dll
2013-11-19 21:07 . 2013-11-19 21:07	942592	----a-w-	c:\windows\system32\jsIntl.dll
2013-11-19 21:07 . 2013-11-19 21:07	86016	----a-w-	c:\windows\SysWow64\iesysprep.dll
2013-11-19 21:07 . 2013-11-19 21:07	74240	----a-w-	c:\windows\SysWow64\SetIEInstalledDate.exe
2013-11-19 21:07 . 2013-11-19 21:07	71680	----a-w-	c:\windows\SysWow64\RegisterIEPKEYs.exe
2013-11-19 21:07 . 2013-11-19 21:07	645120	----a-w-	c:\windows\SysWow64\jsIntl.dll
2013-11-19 21:07 . 2013-11-19 21:07	62464	----a-w-	c:\windows\SysWow64\tdc.ocx
2013-11-19 21:07 . 2013-11-19 21:07	61952	----a-w-	c:\windows\SysWow64\MshtmlDac.dll
2013-11-19 21:07 . 2013-11-19 21:07	48640	----a-w-	c:\windows\SysWow64\mshtmler.dll
2013-11-19 21:07 . 2013-11-19 21:07	36352	----a-w-	c:\windows\SysWow64\imgutil.dll
2013-11-19 21:07 . 2013-11-19 21:07	34816	----a-w-	c:\windows\SysWow64\JavaScriptCollectionAgent.dll
2013-11-19 21:07 . 2013-11-19 21:07	337408	----a-w-	c:\windows\SysWow64\html.iec
2013-11-19 21:07 . 2013-11-19 21:07	24576	----a-w-	c:\windows\SysWow64\licmgr10.dll
2013-11-19 21:07 . 2013-11-19 21:07	235008	----a-w-	c:\windows\system32\elshyph.dll
2013-11-19 21:07 . 2013-11-19 21:07	182272	----a-w-	c:\windows\SysWow64\msls31.dll
2013-11-19 21:07 . 2013-11-19 21:07	151552	----a-w-	c:\windows\SysWow64\iexpress.exe
2013-11-19 21:07 . 2013-11-19 21:07	139264	----a-w-	c:\windows\SysWow64\wextract.exe
2013-11-19 21:07 . 2013-11-19 21:07	13312	----a-w-	c:\windows\SysWow64\mshta.exe
2013-11-19 21:07 . 2013-11-19 21:07	111616	----a-w-	c:\windows\SysWow64\IEAdvpack.dll
2013-11-19 21:07 . 2013-11-19 21:07	1051136	----a-w-	c:\windows\SysWow64\mshtmlmedia.dll
2013-11-19 21:07 . 2013-11-19 21:07	90112	----a-w-	c:\windows\system32\SetIEInstalledDate.exe
2013-11-19 21:07 . 2013-11-19 21:07	86016	----a-w-	c:\windows\system32\RegisterIEPKEYs.exe
2013-11-19 21:07 . 2013-11-19 21:07	84992	----a-w-	c:\windows\system32\mshtmled.dll
2013-11-19 21:07 . 2013-11-19 21:07	83968	----a-w-	c:\windows\system32\MshtmlDac.dll
2013-11-19 21:07 . 2013-11-19 21:07	81408	----a-w-	c:\windows\system32\icardie.dll
2013-11-19 21:07 . 2013-11-19 21:07	774144	----a-w-	c:\windows\system32\jscript.dll
2010-11-05 01:58	32768	--sh--w-	c:\windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2014-02-12 . 2C353B6CE0C8D03225CAA2AF33B68D79 . 1008640 . . [6.1.7601.17514] .. c:\windows\system32\user32.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{41564952-412D-5637-4300-7A786E7484D7}]
2013-12-20 21:02	12240	----a-w-	c:\program files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{41564952-412D-5637-4300-7A786E7484D7}"= "c:\program files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport.dll" [2013-12-20 12240]
.
[HKEY_CLASSES_ROOT\clsid\{41564952-412d-5637-4300-7a786e7484d7}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HydraVisionMDEngine"="c:\program files (x86)\ATI Technologies\HydraVision\HydraMD.exe" [2011-07-07 569344]
"HydraVisionDesktopManager"="c:\program files (x86)\ATI Technologies\HydraVision\HydraDM.exe" [2011-07-07 393216]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-11-17 113288]
"Cpu Level Up help"="c:\program files\ASUS\Ai Suite\CpuLevelUpHelp.exe" [2009-12-28 887936]
"Turbo Key"="c:\program files\ASUS\Turbo Key\TurboKey.exe" [2009-11-24 1874432]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2013-12-09 684600]
"ApnTBMon"="c:\program files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe" [2013-12-20 1778640]
"VNT"="c:\program files (x86)\VNT\vntldr.exe" [2013-12-20 202192]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableLUA"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"TaskbarNoNotification"= 0 (0x0)
"HideSCAHealth"= 0 (0x0)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"TaskbarNoNotification"= 0 (0x0)
.
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"TaskbarNoNotification"= 0 (0x0)
"HideSCAHealth"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
R2 CGVPNCliService;CyberGhost 5 Client Service;c:\program files\CyberGhost 5\Service.exe;c:\program files\CyberGhost 5\Service.exe [x]
R2 e81a9dc1;GS-Supporter;c:\windows\system32\rundll32.exe;c:\windows\SYSNATIVE\rundll32.exe [x]
R2 HiPatchService;Hi-Rez Studios Authenticate and Update Service;c:\program files (x86)\Hi-Rez Studios\HiPatchService.exe;c:\program files (x86)\Hi-Rez Studios\HiPatchService.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R2 vToolbarUpdater15.0.0;vToolbarUpdater15.0.0;c:\program files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.0.0\ToolbarUpdater.exe;c:\program files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.0.0\ToolbarUpdater.exe [x]
R3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys;c:\windows\SYSNATIVE\DRIVERS\amdiox64.sys [x]
R3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\Drivers\ssadadb.sys;c:\windows\SYSNATIVE\Drivers\ssadadb.sys [x]
R3 ArcService;Arc Service;c:\users\Pc\Desktop\ArcService.exe;c:\users\Pc\Desktop\ArcService.exe [x]
R3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\DRIVERS\asmthub3.sys;c:\windows\SYSNATIVE\DRIVERS\asmthub3.sys [x]
R3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys;c:\windows\SYSNATIVE\DRIVERS\asmtxhci.sys [x]
R3 cpudrv64;cpudrv64;c:\program files (x86)\SystemRequirementsLab\cpudrv64.sys;c:\program files (x86)\SystemRequirementsLab\cpudrv64.sys [x]
R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys;c:\windows\SYSNATIVE\drivers\EagleX64.sys [x]
R3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys;c:\windows\SYSNATIVE\DRIVERS\ggflt.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 netr7364;RT73 USB Extensible Wireless LAN Card Driver;c:\windows\system32\DRIVERS\netr7364.sys;c:\windows\SYSNATIVE\DRIVERS\netr7364.sys [x]
R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des;c:\windows\SYSNATIVE\GameMon.des [x]
R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3hub.sys [x]
R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3xhc.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 RTL85n64;Realtek 8180/8185 Extensible 802.11-Drahtlosgerätetreiber;c:\windows\system32\DRIVERS\RTL85n64.sys;c:\windows\SYSNATIVE\DRIVERS\RTL85n64.sys [x]
R3 RTTEAMPT;Realtek Teaming Protocol Driver (NDIS 6.2);c:\windows\system32\DRIVERS\RtTeam60.sys;c:\windows\SYSNATIVE\DRIVERS\RtTeam60.sys [x]
R3 RTVLANPT;Realtek Vlan Protocol Driver (NDIS 6.2);c:\windows\system32\DRIVERS\RtVlan620.sys;c:\windows\SYSNATIVE\DRIVERS\RtVlan620.sys [x]
R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssadbus.sys [x]
R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys;c:\windows\SYSNATIVE\DRIVERS\ssadmdfl.sys [x]
R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssadmdm.sys [x]
R3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);c:\windows\system32\DRIVERS\ssadserd.sys;c:\windows\SYSNATIVE\DRIVERS\ssadserd.sys [x]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys;c:\windows\SYSNATIVE\drivers\synth3dvsc.sys [x]
R3 tap0901t;TAP-Win32 Adapter V9 (Tunngle);c:\windows\system32\DRIVERS\tap0901t.sys;c:\windows\SYSNATIVE\DRIVERS\tap0901t.sys [x]
R3 TEAM;Realtek Virtual Miniport Driver for Teaming (NDIS 6.2);c:\windows\system32\DRIVERS\RtTeam60.sys;c:\windows\SYSNATIVE\DRIVERS\RtTeam60.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys;c:\windows\SYSNATIVE\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys;c:\windows\SYSNATIVE\drivers\rdvgkmd.sys [x]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys;c:\windows\SYSNATIVE\drivers\viahduaa.sys [x]
R3 X6va011;X6va011;c:\windows\SysWOW64\Drivers\X6va011;c:\windows\SysWOW64\Drivers\X6va011 [x]
R3 X6va012;X6va012;c:\windows\SysWOW64\Drivers\X6va012;c:\windows\SysWOW64\Drivers\X6va012 [x]
R3 X6va013;X6va013;c:\windows\SysWOW64\Drivers\X6va013;c:\windows\SysWOW64\Drivers\X6va013 [x]
R3 X6va015;X6va015;c:\windows\SysWOW64\Drivers\X6va015;c:\windows\SysWOW64\Drivers\X6va015 [x]
R3 xhunter1;xhunter1;c:\windows\xhunter1.sys;c:\windows\xhunter1.sys [x]
R4 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\3.8.130\McCHSvc.exe;c:\program files\McAfee Security Scan\3.8.130\McCHSvc.exe [x]
R4 Sony PC Companion;Sony PC Companion;c:\program files (x86)\Sony\Sony PC Companion\PCCService.exe;c:\program files (x86)\Sony\Sony PC Companion\PCCService.exe [x]
R4 TunngleService;TunngleService;c:\program files (x86)\Tunngle\TnglCtrl.exe;c:\program files (x86)\Tunngle\TnglCtrl.exe [x]
S0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);c:\windows\System32\drivers\sfdrv01a.sys;c:\windows\SYSNATIVE\drivers\sfdrv01a.sys [x]
S1 AsUpIO;AsUpIO;SysWow64\drivers\AsUpIO.sys;SysWow64\drivers\AsUpIO.sys [x]
S1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx64.sys;c:\windows\SYSNATIVE\drivers\avgtpx64.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]
S2 acedrv11;acedrv11;c:\windows\system32\drivers\acedrv11.sys;c:\windows\SYSNATIVE\drivers\acedrv11.sys [x]
S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [x]
S2 AMD_RAIDXpert;AMD RAIDXpert;c:\program files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe;c:\program files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe [x]
S2 AntiVirMailService;Avira Email-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\avmailc7.exe;c:\program files (x86)\Avira\AntiVir Desktop\avmailc7.exe [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 AntiVirWebService;Avira Browser-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\avwebg7.exe;c:\program files (x86)\Avira\AntiVir Desktop\avwebg7.exe [x]
S2 AODDriver4.2.0;AODDriver4.2.0;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [x]
S2 APNMCP;Ask Aktualisierungsdienst;c:\program files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe;c:\program files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [x]
S2 AsSysCtrlService;ASUS System Control Service;c:\program files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe;c:\program files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [x]
S2 avnetflt;avnetflt;c:\windows\system32\DRIVERS\avnetflt.sys;c:\windows\SYSNATIVE\DRIVERS\avnetflt.sys [x]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [x]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [x]
S2 RtNdPt60;Realtek NDIS Protocol Driver;c:\windows\system32\DRIVERS\RtNdPt60.sys;c:\windows\SYSNATIVE\DRIVERS\RtNdPt60.sys [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]
S3 hxctlflt;hxctlflt;c:\windows\system32\Drivers\hxctlflt.sys;c:\windows\SYSNATIVE\Drivers\hxctlflt.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
Akamai	REG_MULTI_SZ   	Akamai
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-12-05 15:20	1210320	----a-w-	c:\program files (x86)\Google\Chrome\Application\31.0.1650.63\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2014-02-13 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-05 19:55]
.
2014-02-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-10-17 23:39]
.
2014-02-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-10-17 23:39]
.
2014-02-12 c:\windows\Tasks\ParetoLogic Registration3.job
- c:\windows\system32\rundll32.exe [2009-07-13 01:14]
.
2014-02-12 c:\windows\Tasks\ParetoLogic Update Version3.job
- c:\program files (x86)\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe [2011-03-29 23:51]
.
2014-02-12 c:\windows\Tasks\PC Health Advisor Defrag.job
- c:\program files (x86)\ParetoLogic\PCHA\PCHA.exe [2011-03-29 23:17]
.
2014-02-12 c:\windows\Tasks\PC Health Advisor.job
- c:\program files (x86)\ParetoLogic\PCHA\PCHA.exe [2011-03-29 23:17]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{41564952-412D-5637-4300-7A786E7484D7}]
2013-12-20 21:02	13776	----a-w-	c:\program files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport_x64.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4CEECF2F-7433-3E1D-4954-FE2A3682FC20}]
c:\programdata\FuNDeaulls\DD2qL.x64.dll [BU]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A257D1AE-C8F9-32E7-03CF-8F68563FB5A4}]
c:\programdata\50Coeuupons\gKoa.x64.dll [BU]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{41564952-412D-5637-4300-7A786E7484D7}"= "c:\program files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport_x64.dll" [2013-12-20 13776]
.
[HKEY_CLASSES_ROOT\CLSID\{41564952-412D-5637-4300-7A786E7484D7}]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_B]
@="{6D4133E5-0742-4ADC-8A8C-9303440F7190}"
[HKEY_CLASSES_ROOT\CLSID\{6D4133E5-0742-4ADC-8A8C-9303440F7190}]
2011-04-11 03:35	220160	----a-w-	c:\program files (x86)\ASUS\ASUS WebStorage\3.0.94.193\AsusWSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_O]
@="{64174815-8D98-4CE6-8646-4C039977D808}"
[HKEY_CLASSES_ROOT\CLSID\{64174815-8D98-4CE6-8646-4C039977D808}]
2011-04-11 03:35	220160	----a-w-	c:\program files (x86)\ASUS\ASUS WebStorage\3.0.94.193\AsusWSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]
2013-12-06 14:47	778704	----a-w-	c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2013-12-06 14:47	778704	----a-w-	c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2013-12-06 14:47	778704	----a-w-	c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedViewOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}]
2013-12-06 14:47	778704	----a-w-	c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]
2013-12-06 14:47	778704	----a-w-	c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]
2013-12-06 14:47	778704	----a-w-	c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-12-20 167960]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-12-20 391704]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-12-20 418328]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2011-12-12 7560296]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = <local>
uSearchAssistant = hxxp://www.google.com
IE: Mit Mipony herunterladen - file://c:\program files (x86)\MiPony\Browser\IEContext.htm
Trusted Zone: aeriagames.com
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
TCP: DhcpNameServer = 192.168.2.1
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - 
FF - ProfilePath - c:\users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
FF - ExtSQL: 2013-12-18 17:14; {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}; c:\users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF - user.js: extensions.ividi.tlbrSrchUrl - hxxp://search.ividi.org/?src=tbsp&id=2895594900000000000000240103dca8&affilt=3&q=
FF - user.js: extensions.ividi.id - 2895594900000000000000240103dca8
FF - user.js: extensions.ividi.appId - {685F23D9-FCFD-475C-B56A-362645945C5A}
FF - user.js: extensions.ividi.instlDay - 15989
FF - user.js: extensions.ividi.vrsn - 1.8.23.0
FF - user.js: extensions.ividi.vrsni - 1.8.23.0
FF - user.js: extensions.ividi.vrsnTs - 1.8.23.014:19
FF - user.js: extensions.ividi.prtnrId - ividi
FF - user.js: extensions.ividi.prdct - ividi
FF - user.js: extensions.ividi.aflt - 3
FF - user.js: extensions.ividi.smplGrp - none
FF - user.js: extensions.ividi.tlbrId - base
FF - user.js: extensions.ividi.instlRef - 
FF - user.js: extensions.ividi.dfltLng - 
FF - user.js: extensions.ividi.excTlbr - true
FF - user.js: extensions.ividi.ffxUnstlRst - false
FF - user.js: extensions.ividi.admin - false
FF - user.js: extensions.ividi.autoRvrt - false
FF - user.js: extensions.ividi.rvrt - false
FF - user.js: extensions.ividi.newTab - false
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKCU-Run-Load - c:\users\Pc\AppData\Roaming\vbc.exe
AddRemove-BabylonToolbar - c:\program files (x86)\BabylonToolbar\BabylonToolbar\1.8.3.8\uninstall.exe
AddRemove-BattleForGraxia - c:\users\Pc\Desktop\uninstall.exe
AddRemove-Roma Surrectum Deutsch 1.1.0.5 - c:\program files (x86)\Activision\Rome - Total War\Mods\Uninstall.exe
AddRemove-Roma Surrectum II - c:\program files (x86)\Activision\Rome - Total War\Mods\uninst.exe
AddRemove-SearchProtect - c:\progra~2\SearchProtect\Main\bin\uninstall.exe
AddRemove-Special Force 2 Beta_is1 - c:\program files (x86)\SpecialForce2Beta\unins000.exe
AddRemove-YTKaraoke@DacSoft.org - c:\program files (x86)\YTKaraoke\uninstall.exe
AddRemove-{478472F9-9E09-492A-BDAB-42EE595EF1AD} - c:\programdata\FuNDeaulls\DD2qL.exe
AddRemove-{4820778D-AB0D-6D18-C316-52A6A0E1D507} - c:\programdata\YoutubeAdblocker\TWJ1VQCit.exe
AddRemove-{5F189DF5-2D05-472B-9091-84D9848AE48B}{e81a9dc1} - c:\progra~2\GS-ENA~1\Browsafe.dll
AddRemove-{74A84478-70A5-4F7A-966C-FA2771FF91A5}_is1 - c:\users\Pc\Desktop\Downloads\Cracks\Die Gilde\Die Gilde 2 - King Edition\unins000.exe
AddRemove-{A35CA8FF-CB7D-8361-1CB9-83219CD11C78} - c:\programdata\surf aand kEEp\3Lwcvkkk.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\Akamai]
"ServiceDll"="c:\program files (x86)\common files\akamai/netsession_win_8fa3539.dll"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\X6va011]
"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va011"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\X6va012]
"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va012"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\X6va013]
"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va013"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\X6va015]
"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va015"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-3424378060-3098743664-1317459497-1000\Software\SecuROM\License information*]
"datasecu"=hex:43,48,2f,01,a8,3f,a0,25,9e,c0,d9,1e,5e,c3,db,5d,ba,eb,05,e2,2e,
   74,eb,bc,e8,2e,42,2e,69,b5,96,e7,8d,49,8b,bc,8b,14,15,6d,cb,54,62,ae,12,f4,\
"rkeysecu"=hex:29,23,be,84,e1,6c,d6,ae,52,90,49,f1,f1,bb,e9,eb
.
[HKEY_USERS\S-1-5-21-3424378060-3098743664-1317459497-1000_Classes\CLSID]
@DACL=(02 0000)
.
[HKEY_USERS\S-1-5-21-3424378060-3098743664-1317459497-1000_Classes\CLSID\{A75BE48D-BF58-4A8B-B96C-F9A09DFB9844}]
@DACL=(02 0000)
@="Pokki"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_44_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_44_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_44_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_44_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_44.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_44.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_44.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_44.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\ASUS\EPU-4 Engine\FourEngine.exe
c:\program files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler.exe
c:\windows\SysWOW64\PnkBstrA.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2014-02-13  14:29:58 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2014-02-13 13:29
.
Vor Suchlauf: 25 Verzeichnis(se), 274.137.358.336 Bytes frei
Nach Suchlauf: 26 Verzeichnis(se), 273.541.971.968 Bytes frei
.
- - End Of File - - 19B7400F2714F0917436FB662D22E1B9
A36C5E4F47E84449FF07ED3517B43A31
         

Und das ist der Link: https://www.virustotal.com/de/file/b746362010a101cb5931bc066f0f4d3fc740c02a68c1f37fc3c8e6c87fd7cb1e/analysis/1392299159/

Schritt 1
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

2014-02-11 15:34 - 2014-02-11 15:34 - 00000000 _RSHD () C:\Users\Pc\cc4j5zs76kd2kj
2014-02-04 15:05 - 2014-02-11 21:23 - 00000000 _RSHD () C:\Users\Pc\aoajz
2014-02-04 12:08 - 2014-02-11 21:23 - 00000000 _RSHD () C:\Users\Pc\xripb
C:\Windows\Microsoft.NET\Framework\v2.0.50727\miner.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\usft_ext.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\coinutil.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\MPIR.dll
         

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

• Starte nun FRST erneut und klicke den Entfernen Button.
• Das Tool erstellt eine Fixlog.txt.
• Poste mir deren Inhalt.

Schritt 2
Bitte deinstalliere folgende Programme:

• Babylon Chrome Toolbar
• Babylon toolbar
• Bundled software uninstaller
• GS-Supporter 1.80
• McAfee Security Scan Plus
• Open It!
• QuickShare
• Search Protect
• SeeSimilar
• surf aand kEEp
• Yontoo 1.12.02
• YoutubeAdblocker
• Zip Opener Packages

Gehe dafür auf:

Windows XP: Start -> Systemsteuerung -> Kategorieansicht auswählen (falls nicht voreingestellt) -> Software
Windows Vista/7: Start -> Systemsteuerung -> Anzeige (oben-rechts) auf Kategorie stellen (falls nicht voreingestellt) -> Programme deinstallieren (Unterpunkt von Programme)
Windows 8: Suchen --> "Systemsteuerung" in das Suchfeld eingeben --> Systemsteuerung auswählen --> Programme deinstallieren (Unterpunkt von Programme)

und wähle die angegeben Programme aus. Drücke Entfernen (Windows XP) oder Deinstallieren (Windows Vista/7).

Schritt 3
Downloade Dir bitte AdwCleaner auf deinen Desktop.

• Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
• Starte die AdwCleaner.exe mit einem Doppelklick.
• Stimme den Nutzungsbedingungen zu.
• Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
  • "Tracing" Schlüssel löschen
  • Winsock Einstellungen zurücksetzen
  • Proxy Einstellungen zurücksetzen
  • Internet Explorer Richtlinien zurücksetzen
  • Chrome Richtlinien zurücksetzen
  • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
• Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
• Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
• Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Schritt 4

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

• Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
• Drücke eine beliebige Taste, um das Tool zu starten.
• Je nach System kann der Scan eine Weile dauern.
• Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
• Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

Schritt 5
Starte noch einmal FRST.

• Ändere keine der Voreinstellungen und drücke auf Scan.
• Wenn der Scan abgeschlossen ist, wird ein neues Logfile FRST.txt erstellt und auf dem Desktop gespeichert.
• Poste den Inhalt dieses Logfiles bitte hier in deinen Thread.

Poste folgende Logfiles in deiner nächsten Antwort:

• FRST-Fix
• AdwCleaner-Scan
• JRT-Scan
• FRST-Scan

Ich konnte nicht den GS-Supporter 1.80 und Quickshare löschen.
Ich habe gemerkt, das eine der svchost.exe Prozesse folgenden Pfad hat: C:\windows\sysWOW64\svchost.exe . Der Dienst ist Akamai NetSession Interface (Akamai)

Nun zu den Logs:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 13-02-2014 01
Ran by Pc at 2014-02-13 21:36:11 Run:2
Running from C:\Users\Pc\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
2014-02-11 15:34 - 2014-02-11 15:34 - 00000000 _RSHD () C:\Users\Pc\cc4j5zs76kd2kj
2014-02-04 15:05 - 2014-02-11 21:23 - 00000000 _RSHD () C:\Users\Pc\aoajz
2014-02-04 12:08 - 2014-02-11 21:23 - 00000000 _RSHD () C:\Users\Pc\xripb
C:\Windows\Microsoft.NET\Framework\v2.0.50727\miner.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\usft_ext.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\coinutil.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\MPIR.dll
         
*****************

C:\Users\Pc\cc4j5zs76kd2kj => Moved successfully.
C:\Users\Pc\aoajz => Moved successfully.
C:\Users\Pc\xripb => Moved successfully.
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\miner.dll" => File/Directory not found.
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\usft_ext.dll" => File/Directory not found.
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\coinutil.dll" => File/Directory not found.
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\MPIR.dll" => File/Directory not found.

==== End of Fixlog ====
         

# AdwCleaner v3.018 - Bericht erstellt am 13/02/2014 um 22:05:06
# Updated 28/01/2014 von Xplode
# Betriebssystem : Windows 7 Enterprise Service Pack 1 (64 bits)
# Benutzername : Pc - PC-PC
# Gestartet von : C:\Users\Pc\Desktop\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\Babylon
Ordner Gelöscht : C:\ProgramData\ParetoLogic
Ordner Gelöscht : C:\ProgramData\50Coeuupons
Ordner Gelöscht : C:\Program Files (x86)\BabylonToolbar
Ordner Gelöscht : C:\Program Files (x86)\Delta
Ordner Gelöscht : C:\Program Files (x86)\ExpressFiles
Ordner Gelöscht : C:\Program Files (x86)\Movie2KDownloader.com
Ordner Gelöscht : C:\Program Files (x86)\ParetoLogic
Ordner Gelöscht : C:\Program Files (x86)\Yontoo
Ordner Gelöscht : C:\Program Files (x86)\Common Files\DVDVideoSoft\TB
Ordner Gelöscht : C:\Program Files (x86)\Common Files\ParetoLogic
Ordner Gelöscht : C:\Windows\SysWOW64\Searchprotect
Ordner Gelöscht : C:\Users\Pc\AppData\Local\AVG Secure Search
Ordner Gelöscht : C:\Users\Pc\AppData\Local\PutLockerDownloader
Ordner Gelöscht : C:\Users\Pc\AppData\Local\Searchprotect
Ordner Gelöscht : C:\Users\Pc\AppData\Local\SwvUpdater
Ordner Gelöscht : C:\Users\Pc\AppData\Local\torch
Ordner Gelöscht : C:\Users\Pc\AppData\Local\Wajam
Ordner Gelöscht : C:\Users\Pc\AppData\LocalLow\BabylonToolbar
Ordner Gelöscht : C:\Users\Pc\AppData\LocalLow\Delta
Ordner Gelöscht : C:\Users\Pc\AppData\LocalLow\Smartbar
Ordner Gelöscht : C:\Users\Pc\AppData\LocalLow\Toolbar4
Ordner Gelöscht : C:\Users\Pc\AppData\Roaming\DriverCure
Ordner Gelöscht : C:\Users\Pc\AppData\Roaming\DSite
Ordner Gelöscht : C:\Users\Pc\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gelöscht : C:\Users\Pc\AppData\Roaming\ExpressFiles
Ordner Gelöscht : C:\Users\Pc\AppData\Roaming\ParetoLogic
Ordner Gelöscht : C:\Users\Pc\AppData\Roaming\SeeSimilar
Ordner Gelöscht : C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Movie2KDownloader.com
Ordner Gelöscht : C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ParetoLogic
Datei Gelöscht : C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Qtrax Player.lnk
Datei Gelöscht : C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\searchplugins\conduit-search.xml
Datei Gelöscht : C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\user.js
Datei Gelöscht : C:\Windows\System32\Tasks\Dealply
Datei Gelöscht : C:\Windows\System32\Tasks\DealPlyUpdate
Datei Gelöscht : C:\Windows\System32\Tasks\DSite
Datei Gelöscht : C:\Windows\System32\Tasks\EPUpdater
Datei Gelöscht : C:\Windows\Tasks\paretologic registration3.job
Datei Gelöscht : C:\Windows\System32\Tasks\paretologic registration3
Datei Gelöscht : C:\Windows\Tasks\paretologic update version3.job
Datei Gelöscht : C:\Windows\System32\Tasks\paretologic update version3
Datei Gelöscht : C:\Windows\Tasks\PC Health Advisor Defrag.job
Datei Gelöscht : C:\Windows\System32\Tasks\PC Health Advisor Defrag
Datei Gelöscht : C:\Windows\Tasks\PC Health Advisor.job
Datei Gelöscht : C:\Windows\System32\Tasks\PC Health Advisor

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Wert Gelöscht : [x64] HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{77BEC163-D389-42c1-91A4-C758846296A5}]
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\fmfnfnpmhcllokmkepffndflpnadjmma
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\khialnikbocfgkohdegnebhmmaifoglp
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\niapdbllcanepiiimjjndipklodoedlc
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\Extension.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\ScriptHost.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\TbCommonUtils.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\TbHelper.EXE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\YontooIEClient.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Applications\ilividsetup.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Babylon.dskBnd
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Babylon.dskBnd.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\bbylnApp.appCore
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\bbylnApp.appCore.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\escort.escortIEPane
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\escort.escortIEPane.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.bandobjectattribute
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.dockingpanel
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.iesmartbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.iesmartbarbandobject
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.smartbardisplaystate
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.smartbarmenuform
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Movie2KDownloader
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protocols\handler\viprotocol
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbCommonUtils.CommonUtils
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbCommonUtils.CommonUtils.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.TbDownloadManager
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.TbDownloadManager.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.TbPropertyManager
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.TbPropertyManager.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.TbRequest
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.TbRequest.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.TbTask
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.TbTask.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.ToolbarHelper
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.ToolbarHelper.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar3.ContextMenuNotifier
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar3.ContextMenuNotifier.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar3.CustomInternetSecurityImpl
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar3.CustomInternetSecurityImpl.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\YontooIEClient.Api
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\YontooIEClient.Api.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\YontooIEClient.Layers
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\YontooIEClient.Layers.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Movie2KDownloader_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Movie2KDownloader_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\privitizevpn_1_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\privitizevpn_1_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\privitizevpn_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\privitizevpn_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\QuickShare_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\QuickShare_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\wajamupdater_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\wajamupdater_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin
Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WajamUpdater
Schlüssel Gelöscht : HKCU\Software\59ed7dcb135e848
Schlüssel Gelöscht : HKCU\Software\cefbaeacdccceac
Schlüssel Gelöscht : HKCU\Software\cefbaeacdccceasacfsfdsf
Schlüssel Gelöscht : HKLM\SOFTWARE\59ed7dcb135e848
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\SMTTB2009.IEToolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\SMTTB2009.IEToolbar.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar3.SMTTB2009
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar3.SMTTB2009.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_instagram-downloader_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_instagram-downloader_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_per_yu-gi-oh-online-3_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_per_yu-gi-oh-online-3_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{39CB8175-E224-4446-8746-00566302DF8D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4CE516A7-F7AC-4628-B411-8F886DC5733E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{628F3201-34D0-49C0-BB9A-82A26AEFB291}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{8D5CFE57-B0FD-4396-97A2-DFD0B7DA935B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{B302A1BD-0157-49FA-90F1-4E94F22C7B4B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{02054E11-5113-4BE3-8153-AA8DFB5D3761}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1C950DE5-D31E-42FB-AFB9-91B0161633D8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{338B4DFE-2E2C-4338-9E41-E176D497299E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3BDF4CE9-E81D-432B-A55E-9F0570CE811F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{57CADC46-58FF-4105-B733-5A9F3FC9783C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{64697678-0000-0010-8000-00AA00389B71}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{7E84186E-B5DE-4226-8A66-6E49C6B511B4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{98889811-442D-49DD-99D7-DC866BE87DBC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{99066096-8989-4612-841F-621A01D54AD7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{9F34B17E-FF0D-4FAB-97C4-9713FEE79052}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A9A56B8E-2DEB-4ED3-BC92-1FA450BCE1A5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE338F6D-5A7C-4D1D-86E3-C618532079B5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{C339D489-FABC-41DD-B39D-276101667C70}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CA3EB689-8F09-4026-AA10-B9534C691CE0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D565B35E-B787-40FA-95E3-E3562F8FC1A0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D89031C2-10DA-4C90-9A62-FCED012BC46B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FE9271F2-6EFD-44B0-A826-84C829536E93}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FFB9ADCB-8C79-4C29-81D3-74D46A93D370}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{01221FCC-4BFB-461C-B08C-F6D2DF309921}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2A42D13C-D427-4787-821B-CF6973855778}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2DAC2231-CC35-482B-97C5-CED1D4185080}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3D8478AA-7B88-48A9-8BCB-B85D594411EC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3F1CD84C-04A3-4EA0-9EA1-7D134FD66C82}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3F83A9CA-B5F0-44EC-9357-35BB3E84B07F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{452AE416-9A97-44CA-93DA-D0F15C36254F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{45CDA4F7-594C-49A0-AAD1-8224517FE979}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{47E520EA-CAD2-4F51-8F30-613B3A1C33EB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4897BBA6-48D9-468C-8EFA-846275D7701B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4D5132DD-BB2B-4249-B5E0-D145A8C982E1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4D8ED2B3-DC62-43EC-ABA3-5B74F046B1BE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{57C91446-8D81-4156-A70E-624551442DE9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{706D4A4B-184A-4434-B331-296B07493D2D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{70AFB7B2-9FB5-4A70-905B-0E9576142E1D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{7AD65FD1-79E0-406D-B03C-DD7C14726D69}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{81E852CC-1FD5-4004-8761-79A48B975E29}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8BE10F21-185F-4CA0-B789-9921674C3993}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{94C0B25D-3359-4B10-B227-F96A77DB773F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{95B6A271-FEB4-4160-B0FF-44394C21C8DC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{97DD820D-2E20-40AD-B01E-6730B2FCE630}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B0B75FBA-7288-4FD3-A9EB-7EE27FA65599}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B173667F-8395-4317-8DD6-45AD1FE00047}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B177446D-54A4-4869-BABC-8566110B4BE0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B2CA345D-ADB8-4F5D-AC64-4AB34322F659}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B32672B3-F656-46E0-B584-FE61C0BB6037}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B9F43021-60D4-42A6-A065-9BA37F38AC47}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{BF921DD3-732A-4A11-933B-A5EA49F2FD2C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C2434722-5C85-4CA0-BA69-1B67E7AB3D68}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C2996524-2187-441F-A398-CD6CB6B3D020}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D83B296A-2FA6-425B-8AE8-A1F33D99FBD6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D9D1DFC5-502D-43E4-B1BB-4D0B7841489A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E047E227-5342-4D94-80F7-CFB154BF55BD}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E0B07188-A528-4F9E-B2F7-C7FDE8680AE4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E3F79BE9-24D4-4F4D-8C13-DF2C9899F82E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E67D5BC7-7129-493E-9281-F47BDAFACE4F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E77EEF95-3E83-4BB8-9C0D-4A5163774997}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F05B12E1-ADE8-4485-B45B-898748B53C37}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FD8F79A0-D2E2-4FA2-AEAF-393EAC8064F7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{2BF2028E-3F3C-4C05-AB45-B2F1DCFE0759}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{B87F8B63-7274-43FD-87FA-09D3B7496148}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{C4BAE205-5E02-4E32-876E-F34B4E2D000C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{DB538320-D3C5-433C-BCA9-C4081A054FCF}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4A99-B4B6-146BF802613B}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{98889811-442D-49DD-99D7-DC866BE87DBC}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2EECD738-5844-4A99-B4B6-146BF802613B}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98889811-442D-49DD-99D7-DC866BE87DBC}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{628F3201-34D0-49C0-BB9A-82A26AEFB291}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{64697678-0000-0010-8000-00AA00389B71}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{77BEC163-D389-42C1-91A4-C758846296A5}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{01221FCC-4BFB-461C-B08C-F6D2DF309921}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{045F91B3-695F-423A-98C7-8DE3C47AA020}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{1231839B-064E-4788-B865-465A1B5266FD}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{1348BD1B-C32A-41A7-9BD4-5377AA1AB925}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{2A42D13C-D427-4787-821B-CF6973855778}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{2DAC2231-CC35-482B-97C5-CED1D4185080}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{395AFE6E-8308-48DB-89BE-ED5F4AA3D3EC}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{3D8478AA-7B88-48A9-8BCB-B85D594411EC}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{3F1CD84C-04A3-4EA0-9EA1-7D134FD66C82}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{3F83A9CA-B5F0-44EC-9357-35BB3E84B07F}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{43969E3F-3E7C-4911-A8F1-79C6CA6AC731}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{43B390F0-6BA2-45CA-ABF2-5DB0CEE9B49D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{44C3C1DB-2127-433C-98EC-4C9412B5FC3A}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{452AE416-9A97-44CA-93DA-D0F15C36254F}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{45CDA4F7-594C-49A0-AAD1-8224517FE979}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{47E520EA-CAD2-4F51-8F30-613B3A1C33EB}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{4897BBA6-48D9-468C-8EFA-846275D7701B}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{4D5132DD-BB2B-4249-B5E0-D145A8C982E1}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{4D8ED2B3-DC62-43EC-ABA3-5B74F046B1BE}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{57C91446-8D81-4156-A70E-624551442DE9}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{706D4A4B-184A-4434-B331-296B07493D2D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{70AFB7B2-9FB5-4A70-905B-0E9576142E1D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{7AD65FD1-79E0-406D-B03C-DD7C14726D69}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{81E852CC-1FD5-4004-8761-79A48B975E29}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{8BE10F21-185F-4CA0-B789-9921674C3993}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{94C0B25D-3359-4B10-B227-F96A77DB773F}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{94CADA2E-1D3F-419F-8A3D-06C58EDF53C8}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{95B6A271-FEB4-4160-B0FF-44394C21C8DC}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{97DD820D-2E20-40AD-B01E-6730B2FCE630}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{9E52EB8B-8DD9-4605-AD36-D352BCD482F2}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{9EDC0C90-2B5B-4512-953E-35767BAD5C67}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A1440EC3-F0FA-407A-B811-DE6668C06D29}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A36867C6-302D-49FC-9D8E-1EB037B5F1AB}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{B0B75FBA-7288-4FD3-A9EB-7EE27FA65599}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{B173667F-8395-4317-8DD6-45AD1FE00047}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{B177446D-54A4-4869-BABC-8566110B4BE0}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{B2CA345D-ADB8-4F5D-AC64-4AB34322F659}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{B32672B3-F656-46E0-B584-FE61C0BB6037}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{B9A84AD0-5777-46FD-8B8F-1EBD06750FBC}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{B9F43021-60D4-42A6-A065-9BA37F38AC47}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{BF921DD3-732A-4A11-933B-A5EA49F2FD2C}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C1995F88-1C7F-40D7-B0FA-6F107F6308B8}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C2434722-5C85-4CA0-BA69-1B67E7AB3D68}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C2996524-2187-441F-A398-CD6CB6B3D020}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C815E3DA-0823-49B0-9270-D1771D58B317}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D83B296A-2FA6-425B-8AE8-A1F33D99FBD6}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D9D1DFC5-502D-43E4-B1BB-4D0B7841489A}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E047E227-5342-4D94-80F7-CFB154BF55BD}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E0B07188-A528-4F9E-B2F7-C7FDE8680AE4}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E3F79BE9-24D4-4F4D-8C13-DF2C9899F82E}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E4A994B0-5550-4680-A4C6-B9470B888069}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E67D5BC7-7129-493E-9281-F47BDAFACE4F}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E77EEF95-3E83-4BB8-9C0D-4A5163774997}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{F05B12E1-ADE8-4485-B45B-898748B53C37}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{FD8F79A0-D2E2-4FA2-AEAF-393EAC8064F7}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}
Schlüssel Gelöscht : HKCU\Software\APN PIP
Schlüssel Gelöscht : HKCU\Software\BI
Schlüssel Gelöscht : HKCU\Software\Delta
Schlüssel Gelöscht : HKCU\Software\dsiteproducts
Schlüssel Gelöscht : HKCU\Software\ExpressFiles
Schlüssel Gelöscht : HKCU\Software\filescout
Schlüssel Gelöscht : HKCU\Software\ParetoLogic
Schlüssel Gelöscht : HKCU\Software\PIP
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\Somoto Toolbar
Schlüssel Gelöscht : HKCU\Software\StartSearch
Schlüssel Gelöscht : HKLM\Software\Babylon
Schlüssel Gelöscht : HKLM\Software\DataMngr
Schlüssel Gelöscht : HKLM\Software\Delta
Schlüssel Gelöscht : HKLM\Software\ExpressFiles
Schlüssel Gelöscht : HKLM\Software\ParetoLogic
Schlüssel Gelöscht : HKLM\Software\PIP
Schlüssel Gelöscht : HKLM\Software\SearchProtect
Schlüssel Gelöscht : HKLM\Software\Video downloader
Schlüssel Gelöscht : HKLM\Software\Vittalia
Schlüssel Gelöscht : HKLM\Software\Wajam
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3CBF3EBB-235D-4c29-A68B-2BB1F428586E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\1ClickDownload
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchTheWebARP
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Video downloader
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{77BEC163-D389-42c1-91A4-C758846296A5}_is1

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.16518


-\\ Mozilla Firefox v26.0 (de)

[ Datei : C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\prefs.js ]

Zeile gelöscht : user_pref("browser.newtab.url", "hxxp://search.conduit.com/?ctid=CT3312375&octid=EB_ORIGINAL_CTID&SearchSource=69&CUI=&SSPV=EB_SSPV&Lay=1&UM=2&UP=SP09C9C74C-9231-4E89-8648-D5B7D174D75E");
Zeile gelöscht : user_pref("extensions.b_20JjldW7E.scode", "(function(){if(window.self.location.hostname.indexOf(\"acebook.co\")>-1){return};if(window.self.location.protocol.indexOf('hxxp')>-1 && window.self==window.t[...]
Zeile gelöscht : user_pref("extensions.p_8p2k.scode", "(function(){if(window.self.location.hostname.indexOf(\"acebook.co\")>-1){return};var _wlst={lsKey:\"ssjsmn2ja8ddw2a\",get:function(b,a){if(3<b)return a(!1);var d=[...]
Zeile gelöscht : user_pref("extensions.yaioi78idq.scode", "(function(){if(window.self.location.hostname.indexOf(\"acebook.co\")>-1){return};if(window.self==window.top){var script=document.createElement('script');scrip[...]
Zeile gelöscht : user_pref("extensions.zfhkTz8.scode", "(function(){if(window.self.location.hostname.indexOf(\"acebook.co\")>-1){return};var _wlst={lsKey:\"ssjsmn2ja8ddw2a\",get:function(b,a){if(3<b)return a(!1);var d[...]

*************************

AdwCleaner[R0].txt - [40189 octets] - [13/02/2014 21:51:58]
AdwCleaner[R1].txt - [40309 octets] - [13/02/2014 22:03:14]
AdwCleaner[S0].txt - [335 octets] - [13/02/2014 21:53:21]
AdwCleaner[S1].txt - [38887 octets] - [13/02/2014 22:05:06]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [38948 octets] ##########
         

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.1 (02.04.2014:1)
OS: Windows 7 Enterprise x64
Ran by Pc on 13.02.2014 at 22:16:46,04
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully deleted: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\apntbmon
Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchURL\\Default



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\qtrax
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\software\lyricsmonkey
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3424378060-3098743664-1317459497-1000\Software\sweetim
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3424378060-3098743664-1317459497-1000\Software\video downloader
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\LyricsMonkeyUpdater_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\LyricsMonkeyUpdater_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\LyricsPal_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\LyricsPal_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\pricepeep_130001_1001_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\pricepeep_130001_1001_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\LyricsMonkeyUpdater_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\LyricsMonkeyUpdater_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\LyricsPal_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\LyricsPal_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\pricepeep_130001_1001_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\pricepeep_130001_1001_RASMANCS



~~~ Files

Successfully deleted: [File] "C:\Users\Pc\appdata\locallow\microsoft\silverlight\outofbrowser\index\portal.qtrax.com"



~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\apn"
Successfully deleted: [Folder] "C:\ProgramData\youtubeadblocker"
Successfully deleted: [Folder] "C:\Users\Pc\AppData\Roaming\zip opener packages"
Successfully deleted: [Folder] "C:\Windows\syswow64\ai_recyclebin"
Successfully deleted: [Folder] "C:\Users\Pc\music\qtrax media library"



~~~ FireFox

Successfully deleted the following from C:\Users\Pc\AppData\Roaming\mozilla\firefox\profiles\hxtwke4k.default-1377615578566\prefs.js

user_pref("extensions.yaioi78idq.url", "hxxp://getjpi77.info/sync2/?q=hfZ9ofV9CShEAen0rja4rihTB6lKDzt4okmxtNtVh7n0rjrFrTs5rjr9pdaEtMFHhd9FrHwGrHaFrHr9qjkMDMlGojUMAe4Uojr8rHUEq
Emptied folder: C:\Users\Pc\AppData\Roaming\mozilla\firefox\profiles\hxtwke4k.default-1377615578566\minidumps [104 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 13.02.2014 at 22:29:38,32
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         

FRST Logfile:

FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-02-2014 01
Ran by Pc (administrator) on PC-PC on 13-02-2014 22:35:18
Running from C:\Users\Pc\Desktop
Windows 7 Enterprise Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(AMD) C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe
() C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler.exe
(APN LLC.) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraMD.exe
(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraMD64.exe
(ASUSTeK Computer Inc.) C:\Program Files\ASUS\Turbo Key\TurboKey.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe
(APN) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe
(Hi-Rez Studios) C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(CyberGhost S.R.L) C:\Program Files\CyberGhost 5\Service.exe
() C:\Windows\SysWOW64\WinMsgBalloonServer.exe
() C:\Windows\SysWOW64\WinMsgBalloonClient.exe
(Microsoft Corporation) C:\Windows\system32\AUDIODG.EXE
(Microsoft Corporation) C:\Windows\system32\msiexec.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7560296 2011-12-12] (Realtek Semiconductor)
HKLM-x32\...\Run: [NUSB3MON] - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [Cpu Level Up help] - C:\Program Files\ASUS\Ai Suite\CpuLevelUpHelp.exe [887936 2009-12-28] ()
HKLM-x32\...\Run: [Turbo Key] - C:\Program Files\ASUS\Turbo Key\TurboKey.exe [1874432 2009-11-24] (ASUSTeK Computer Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-09] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [VNT] - C:\Program Files (x86)\VNT\vntldr.exe [202192 2013-12-20] (APN LLC.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [TaskbarNoNotification] 0
HKLM\...\Policies\Explorer: [HideSCAHealth] 0
HKU\.DEFAULT\...\Policies\Explorer: [TaskbarNoNotification] 0
HKU\.DEFAULT\...\Policies\Explorer: [HideSCAHealth] 0
HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Run: [HydraVisionMDEngine] - C:\Program Files (x86)\ATI Technologies\HydraVision\HydraMD.exe [569344 2011-07-07] (AMD)
HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Run: [HydraVisionDesktopManager] - C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe [393216 2011-07-07] (AMD)
HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Policies\Explorer: [TaskbarNoNotification] 0

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xEA5B1E2628BDCD01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKCU - ToolbarSearchProviderProgress {96bd48dd-741b-41ae-ac4a-aff96ba00f7e}
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 
BHO: Avira SearchFree Toolbar - {41564952-412D-5637-4300-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport_x64.dll (APN LLC.)
BHO: FuNDeaulls - {4CEECF2F-7433-3E1D-4954-FE2A3682FC20} - C:\ProgramData\FuNDeaulls\DD2qL.x64.dll No File
BHO: 50Coeuupons - {A257D1AE-C8F9-32E7-03CF-8F68563FB5A4} - C:\ProgramData\50Coeuupons\gKoa.x64.dll No File
BHO-x32: Avira SearchFree Toolbar - {41564952-412D-5637-4300-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport.dll (APN LLC.)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Avira SearchFree Toolbar - {41564952-412D-5637-4300-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport_x64.dll (APN LLC.)
Toolbar: HKLM-x32 - Avira SearchFree Toolbar - {41564952-412D-5637-4300-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport.dll (APN LLC.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
DPF: HKLM-x32 {E6F480FC-BD44-4CBA-B74A-89AF7842937D} hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.5.1.0.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566
FF Homepage: hxxp://www.google.de/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_44.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_44.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @soe.sony.com/installer,version=1.0.3 - C:\Users\Pc\AppData\LocalLow\Sony Online Entertainment\npsoe.dll ()
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin HKCU: pokki.com/PokkiDownloadHelper - C:\Users\Pc\AppData\Local\Pokki\Download Helper\npPokkiDownloadHelper.1.2.0.78.dll (Pokki)
FF Plugin HKCU: thehappycloud.com/HappyCloudPlugin - C:\ProgramData\HappyCloud\Application\npHappyCloudPlugin.dll (The Happy Cloud)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\searchplugins\ividi.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Avira SearchFree Toolbar plus Web Protection - C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\Extensions\toolbar_AVIRA-V7C@apn.ask.com.xpi [2013-12-20]
FF Extension: Adblock Plus - C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-01-03]
FF HKCU\...\Firefox\Extensions: [lyricsmonkey@mendoni.net] - C:\Program Files (x86)\LyricsMonkey\FF\
FF HKCU\...\Firefox\Extensions: [YTKaraoke@DacSoft.org] - C:\Program Files (x86)\YTKaraoke\FF\

Chrome: 
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (Coupons Malibu) - C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\hnofepcmbghfcimfbjicplikedjcnalm [2013-09-03]
CHR Extension: (BargainJoy) - C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\khongjfjjmklggionajlpjcpmnppdace [2013-09-09]
CHR Extension: (Google Wallet) - C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-31]
CHR Extension: (50Coeuupons) - C:\ProgramData\cfcjpjohfcdpkpkiobmplajfgaafdgpb [2013-12-31]
CHR HKLM\...\Chrome\Extension: [bmobdmpfgfimbnmhhnkmmecdboblafdh] - C:\Users\Pc\AppData\Local\BazaarFriend.crx [2013-07-29]
CHR HKLM\...\Chrome\Extension: [hnofepcmbghfcimfbjicplikedjcnalm] - C:\Users\Pc\AppData\Local\CouponsMalibu.crx [2013-09-03]
CHR HKLM\...\Chrome\Extension: [khongjfjjmklggionajlpjcpmnppdace] - C:\Users\Pc\AppData\Local\BargainJoy.crx [2013-09-08]
CHR HKCU\...\Chrome\Extension: [bmobdmpfgfimbnmhhnkmmecdboblafdh] - C:\Users\Pc\AppData\Local\BazaarFriend.crx [2013-07-29]
CHR HKCU\...\Chrome\Extension: [hnofepcmbghfcimfbjicplikedjcnalm] - C:\Users\Pc\AppData\Local\CouponsMalibu.crx [2013-09-03]
CHR HKCU\...\Chrome\Extension: [khongjfjjmklggionajlpjcpmnppdace] - C:\Users\Pc\AppData\Local\BargainJoy.crx [2013-09-08]
CHR HKCU\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Users\Pc\AppData\Roaming\DVDVideoSoft\DVDVideoSoftBrowserExtension.crx [2012-11-09]
CHR HKLM-x32\...\Chrome\Extension: [bmobdmpfgfimbnmhhnkmmecdboblafdh] - C:\Users\Pc\AppData\Local\BazaarFriend.crx [2013-07-29]
CHR HKLM-x32\...\Chrome\Extension: [hnofepcmbghfcimfbjicplikedjcnalm] - C:\Users\Pc\AppData\Local\CouponsMalibu.crx [2013-09-03]
CHR HKLM-x32\...\Chrome\Extension: [khongjfjjmklggionajlpjcpmnppdace] - C:\Users\Pc\AppData\Local\BargainJoy.crx [2013-09-08]
CHR HKLM-x32\...\Chrome\Extension: [lgnhgbflngpggpmpfdkhmhmfdophhepe] - C:\Program Files (x86)\YTKaraoke\Chrome.crx [2013-09-08]
CHR HKLM-x32\...\Chrome\Extension: [pcoohmdcpejoeggdnihdfhohjgdbllgm] - C:\ProgramData\AskPartnerNetwork\Toolbar\AVIRA-V7C\CRX\ToolbarCR.crx [2013-12-20]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

R2 Akamai; c:\program files (x86)\common files\akamai/netsession_win_8fa3539.dll [4569856 2013-07-01] (Akamai Technologies, Inc.)
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2013-12-06] (Advanced Micro Devices, Inc.)
R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [908856 2013-12-09] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-09] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-12-09] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1011768 2013-12-09] (Avira Operations GmbH & Co. KG)
R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2013-12-20] (APN LLC.)
R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [96896 2009-12-29] (ASUSTeK Computer Inc.)
R2 CGVPNCliService; C:\Program Files\CyberGhost 5\Service.exe [64112 2014-01-16] (CyberGhost S.R.L)
R2 ForceWare Intelligent Application Manager (IAM); C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe [496232 2010-01-21] ()
S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 npggsvc; C:\Windows\SysWOW64\GameMon.des [4521720 2012-09-26] (INCA Internet Co., Ltd.)
R2 nSvcIp; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe [209000 2010-01-21] ()
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2014-01-24] ()
S4 TunngleService; C:\Program Files (x86)\Tunngle\TnglCtrl.exe [745368 2012-11-26] (Tunngle.net GmbH)
S3 ArcService; C:\Users\Pc\Desktop\ArcService.exe [X]
S2 e81a9dc1; "C:\Windows\system32\rundll32.exe" "c:\progra~2\gs-ena~1\BrowsafeSvc.dll",service
S2 vToolbarUpdater15.0.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.0.0\ToolbarUpdater.exe [X]

==================== Drivers (Whitelisted) ====================

R2 AODDriver4.2.0; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [59648 2013-09-19] (Advanced Micro Devices)
R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2010-08-25] ()
R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [13368 2009-07-07] ()
S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [303616 2013-05-13] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-09] (Avira Operations GmbH & Co. KG)
R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [39768 2013-04-14] (AVG Technologies)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-09] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-12-09] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [84720 2013-12-09] (Avira Operations GmbH & Co. KG)
S3 cpudrv64; C:\Program Files (x86)\SystemRequirementsLab\cpudrv64.sys [17864 2011-06-02] ()
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2013-12-30] (Disc Soft Ltd)
R3 hxctlflt; C:\Windows\System32\Drivers\hxctlflt.sys [111104 2009-02-08] (Guillemot Corporation)
S2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [35328 2013-05-13] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-16] ()
S3 RT73; C:\Windows\System32\DRIVERS\Dr71WU.sys [610816 2008-01-16] (Ralink Technology, Corp.)
S3 RTL85n64; C:\Windows\System32\DRIVERS\RTL85n64.sys [378368 2009-06-10] (Realtek)
R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
R0 sfdrv01; C:\Windows\System32\drivers\sfdrv01.sys [75384 2009-02-03] (Protection Technology (StarForce))
R0 sfdrv01a; C:\Windows\System32\drivers\sfdrv01a.sys [77432 2009-02-03] (Protection Technology (StarForce))
R0 sfsync04; C:\Windows\System32\drivers\sfsync04.sys [79800 2012-06-19] (Protection Technology (StarForce))
R0 sfvfs02; C:\Windows\System32\drivers\sfvfs02.sys [107384 2007-02-08] (Protection Technology (StarForce))
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [3552384 2009-04-22] ()
S3 tap0901t; C:\Windows\System32\DRIVERS\tap0901t.sys [31232 2009-09-16] (Tunngle.net)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
S3 X6va011; \??\C:\Windows\SysWOW64\Drivers\X6va011 [X]
S3 X6va012; \??\C:\Windows\SysWOW64\Drivers\X6va012 [X]
S3 X6va013; \??\C:\Windows\SysWOW64\Drivers\X6va013 [X]
S3 X6va015; \??\C:\Windows\SysWOW64\Drivers\X6va015 [X]
S3 xhunter1; \??\C:\Windows\xhunter1.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-02-13 22:35 - 2014-02-13 22:35 - 00019443 _____ () C:\Users\Pc\Desktop\FRST.txt
2014-02-13 22:29 - 2014-02-13 22:29 - 00003725 _____ () C:\Users\Pc\Desktop\JRT.txt
2014-02-13 22:16 - 2014-02-13 22:16 - 00000000 ____D () C:\Windows\ERUNT
2014-02-13 22:13 - 2014-02-13 22:13 - 01037530 _____ (Thisisu) C:\Users\Pc\Desktop\JRT.exe
2014-02-13 22:09 - 2014-02-13 22:09 - 00039497 _____ () C:\Users\Pc\Desktop\AdwCleaner[S1].txt
2014-02-13 21:51 - 2014-02-13 22:05 - 00000000 ____D () C:\AdwCleaner
2014-02-13 21:51 - 2014-02-13 21:51 - 01166132 _____ () C:\Users\Pc\Desktop\adwcleaner.exe
2014-02-13 21:35 - 2014-02-13 21:35 - 00000000 ____D () C:\Users\Pc\Desktop\FRST-OlderVersion
2014-02-13 21:19 - 2014-02-13 21:19 - 01243588 _____ () C:\Users\Pc\Downloads\ProcessExplorer.zip
2014-02-13 16:43 - 2014-02-13 16:43 - 00001613 _____ () C:\Users\Public\Desktop\Play League of Legends.lnk
2014-02-13 16:40 - 2014-02-13 16:41 - 34888568 _____ (Riot Games) C:\Users\Pc\Downloads\LeagueofLegends_EUW_Installer_06_12_13(1).exe
2014-02-13 16:40 - 2014-02-13 16:41 - 32229024 _____ (Riot Games) C:\Users\Pc\Downloads\LeagueofLegends_NA_Installer_05_07_13.exe
2014-02-13 15:18 - 2014-02-13 15:40 - 347645656 _____ () C:\Users\Pc\Downloads\2.0_Music.rar
2014-02-13 15:17 - 2014-02-13 15:17 - 03067492 _____ () C:\Users\Pc\Downloads\narutosource.rar
2014-02-13 15:16 - 2014-02-13 15:19 - 29934138 _____ () C:\Users\Pc\Downloads\narutowippatch.14.zip
2014-02-13 15:11 - 2014-02-13 15:43 - 760671830 _____ () C:\Users\Pc\Downloads\Narutowip2.rar
2014-02-13 14:36 - 2014-02-13 14:36 - 04102163 _____ () C:\Users\Pc\Downloads\tdsskiller.zip
2014-02-13 14:36 - 2014-02-10 23:37 - 04122976 _____ (Kaspersky Lab ZAO) C:\Users\Pc\Desktop\TDSSKiller.exe
2014-02-13 14:29 - 2014-02-13 14:29 - 00043125 _____ () C:\ComboFix.txt
2014-02-13 13:51 - 2014-02-13 13:50 - 05180679 ____R (Swearware) C:\Users\Pc\Desktop\ComboFix.exe
2014-02-13 13:49 - 2014-02-13 13:50 - 05180679 _____ (Swearware) C:\Users\Pc\Downloads\ComboFix.exe
2014-02-12 22:27 - 2014-02-12 22:27 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Avira
2014-02-12 22:27 - 2014-02-12 22:27 - 00000000 ____D () C:\Users\Pc\AppData\Local\VNT
2014-02-12 22:26 - 2014-02-12 22:26 - 00000000 ____D () C:\ProgramData\AskPartnerNetwork
2014-02-12 22:26 - 2014-02-12 22:26 - 00000000 ____D () C:\Program Files (x86)\VNT
2014-02-12 22:26 - 2014-02-12 22:26 - 00000000 ____D () C:\Program Files (x86)\AskPartnerNetwork
2014-02-12 22:24 - 2014-02-12 22:24 - 00002078 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2014-02-12 22:23 - 2014-02-12 22:23 - 00000000 ____D () C:\ProgramData\Avira
2014-02-12 22:23 - 2014-02-12 22:23 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-02-12 22:23 - 2013-12-09 11:45 - 00131576 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-02-12 22:23 - 2013-12-09 11:45 - 00108440 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-02-12 22:23 - 2013-12-09 11:45 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-02-12 22:23 - 2013-12-09 11:45 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2014-02-12 22:05 - 2014-02-12 22:05 - 00264757 _____ () C:\Users\Pc\Downloads\FHSetup.exe
2014-02-12 22:05 - 2014-02-12 22:05 - 00001981 _____ () C:\Users\Pc\Desktop\Update Checker.lnk
2014-02-12 22:05 - 2014-02-12 22:05 - 00000000 ____D () C:\Program Files (x86)\FileHippo.com
2014-02-12 22:04 - 2014-02-12 22:08 - 139704984 _____ () C:\Users\Pc\Downloads\avira_ultimate_protection_suite_de.exe
2014-02-12 21:54 - 2014-02-12 21:54 - 00007674 _____ () C:\Users\Pc\AppData\Local\Resmon.ResmonCfg
2014-02-12 21:18 - 2014-02-13 21:59 - 00110882 _____ () C:\Windows\PFRO.log
2014-02-12 21:04 - 2013-12-21 10:53 - 00548864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-02-12 21:04 - 2013-12-21 09:56 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-02-12 21:03 - 2014-02-06 13:16 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-12 21:03 - 2014-02-06 12:30 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-12 21:03 - 2014-02-06 12:30 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-02-12 21:03 - 2014-02-06 12:12 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-12 21:03 - 2014-02-06 12:07 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-02-12 21:03 - 2014-02-06 12:06 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-02-12 21:03 - 2014-02-06 11:57 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-12 21:03 - 2014-02-06 11:56 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-02-12 21:03 - 2014-02-06 11:52 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-02-12 21:03 - 2014-02-06 11:49 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-12 21:03 - 2014-02-06 11:48 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-02-12 21:03 - 2014-02-06 11:48 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-02-12 21:03 - 2014-02-06 11:38 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-02-12 21:03 - 2014-02-06 11:32 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-02-12 21:03 - 2014-02-06 11:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-02-12 21:03 - 2014-02-06 11:17 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-02-12 21:03 - 2014-02-06 11:11 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-12 21:03 - 2014-02-06 11:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-02-12 21:03 - 2014-02-06 11:00 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-02-12 21:03 - 2014-02-06 10:57 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-02-12 21:03 - 2014-02-06 10:57 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-12 21:03 - 2014-02-06 10:52 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-02-12 21:03 - 2014-02-06 10:52 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-02-12 21:03 - 2014-02-06 10:50 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-12 21:03 - 2014-02-06 10:49 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-02-12 21:03 - 2014-02-06 10:47 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-02-12 21:03 - 2014-02-06 10:46 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-02-12 21:03 - 2014-02-06 10:25 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-02-12 21:03 - 2014-02-06 10:25 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-02-12 21:03 - 2014-02-06 10:24 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-12 21:03 - 2014-02-06 10:22 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-12 21:03 - 2014-02-06 10:13 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-02-12 21:03 - 2014-02-06 10:09 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-02-12 21:03 - 2014-02-06 10:03 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-02-12 21:03 - 2014-02-06 09:55 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-12 21:03 - 2014-02-06 09:41 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-02-12 21:03 - 2014-02-06 09:40 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-02-12 21:03 - 2014-02-06 09:36 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-02-12 21:03 - 2014-02-06 09:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-02-12 21:00 - 2014-02-13 22:07 - 00017808 _____ () C:\Windows\setupact.log
2014-02-12 21:00 - 2014-02-12 21:00 - 00000000 _____ () C:\Windows\setuperr.log
2014-02-12 20:57 - 2014-01-01 00:05 - 00420008 _____ () C:\Windows\SysWOW64\locale.nls
2014-02-12 20:57 - 2014-01-01 00:04 - 00420008 _____ () C:\Windows\system32\locale.nls
2014-02-12 20:57 - 2013-12-25 00:09 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-02-12 20:57 - 2013-12-24 23:48 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-02-12 20:57 - 2013-12-06 03:30 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-02-12 20:57 - 2013-12-06 03:30 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-02-12 20:57 - 2013-12-06 03:02 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-02-12 20:57 - 2013-12-06 03:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-02-12 20:57 - 2013-12-04 03:27 - 00488448 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll
2014-02-12 20:57 - 2013-12-04 03:27 - 00485888 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll
2014-02-12 20:57 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll
2014-02-12 20:57 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll
2014-02-12 20:57 - 2013-12-04 03:26 - 00528384 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll
2014-02-12 20:57 - 2013-12-04 03:16 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe
2014-02-12 20:57 - 2013-12-04 03:16 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe
2014-02-12 20:57 - 2013-12-04 03:16 - 00553984 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe
2014-02-12 20:57 - 2013-12-04 03:16 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe
2014-02-12 20:57 - 2013-12-04 03:03 - 00428032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc.dll
2014-02-12 20:57 - 2013-12-04 03:03 - 00423936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_isv.dll
2014-02-12 20:57 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp_isv.dll
2014-02-12 20:57 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp.dll
2014-02-12 20:57 - 2013-12-04 03:02 - 00390144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdrm.dll
2014-02-12 20:57 - 2013-12-04 02:54 - 00594944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_isv.exe
2014-02-12 20:57 - 2013-12-04 02:54 - 00572416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate.exe
2014-02-12 20:57 - 2013-12-04 02:54 - 00510976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp.exe
2014-02-12 20:57 - 2013-12-04 02:54 - 00508928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp_isv.exe
2014-02-12 20:57 - 2013-11-26 09:16 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2014-02-12 20:57 - 2013-11-22 23:48 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2014-02-12 19:44 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-02-12 19:44 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-02-12 19:44 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-02-12 19:44 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-02-12 19:44 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-02-12 19:44 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2014-02-12 19:44 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2014-02-12 19:44 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2014-02-12 19:36 - 2014-02-13 14:30 - 00000000 ____D () C:\Qoobox
2014-02-12 18:58 - 2014-02-13 14:16 - 00000000 ____D () C:\Windows\erdnt
2014-02-12 15:21 - 2014-02-12 16:05 - 1064637787 _____ () C:\Users\Pc\Downloads\Naruto2.1.rar
2014-02-12 14:12 - 2014-02-12 14:12 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dll Suite 2013
2014-02-12 14:12 - 2014-02-12 14:12 - 00000000 ____D () C:\Program Files (x86)\DLLSuite
2014-02-12 14:10 - 2014-02-12 14:11 - 16588429 _____ ( ) C:\Users\Pc\Downloads\DLLSuite_Setup.exe
2014-02-12 13:51 - 2014-02-12 13:51 - 00001109 _____ () C:\Users\Pc\Desktop\ParetoLogic PC Health Advisor.lnk
2014-02-12 13:47 - 2014-02-12 13:47 - 05249448 _____ (ParetoLogic Inc.) C:\Users\Pc\Downloads\ParetoLogic PC Health Advisor_de.exe
2014-02-12 12:30 - 2014-02-12 13:02 - 1312122312 _____ () C:\Users\Pc\Downloads\ACOK_1.11.rar
2014-02-12 12:27 - 2014-02-12 12:27 - 00001152 _____ () C:\Users\Pc\Desktop\Mount&Blade Warband.lnk
2014-02-12 12:03 - 2014-02-12 12:18 - 615004486 _____ () C:\Users\Pc\Downloads\mb_warband_setup_1158.exe
2014-02-12 11:22 - 2014-02-12 11:39 - 53254767 _____ () C:\Users\Pc\Downloads\LoLRADS_EUW_german.zip
2014-02-11 22:27 - 2014-02-13 21:35 - 00000000 ____D () C:\Users\Pc\Desktop\Dokus
2014-02-11 22:23 - 2014-02-13 22:35 - 00000000 ____D () C:\FRST
2014-02-11 22:22 - 2014-02-13 21:35 - 02152960 _____ (Farbar) C:\Users\Pc\Desktop\FRST64.exe
2014-02-11 22:21 - 2014-02-11 22:21 - 00000466 _____ () C:\Windows\SysWOW64\defogger_disable.log
2014-02-11 22:21 - 2014-02-11 22:21 - 00000000 _____ () C:\Users\Pc\defogger_reenable
2014-02-11 21:23 - 2014-02-11 22:00 - 00000000 ____D () C:\ProgramData\SecTaskMan
2014-02-11 21:22 - 2014-02-11 21:23 - 00000000 ____D () C:\Program Files (x86)\Security Task Manager
2014-02-11 21:19 - 2014-02-11 21:20 - 02365840 _____ () C:\Users\Pc\Downloads\SecurityTaskManager_Setup.exe
2014-02-11 21:03 - 2014-02-11 21:03 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\TestApp
2014-02-11 20:58 - 2014-02-11 20:58 - 00001121 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-02-11 20:57 - 2014-02-11 20:57 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Pc\Downloads\mbam-setup-1.75.0.1300(1).exe
2014-02-11 17:54 - 2014-02-12 21:06 - 02539172 _____ () C:\Windows\system32\Drivers\Cat.DB
2014-02-11 17:50 - 2014-02-12 20:59 - 00000000 ____D () C:\ProgramData\PC Tools
2014-02-11 16:54 - 2014-02-11 16:54 - 00000000 ____D () C:\ProgramData\SMR410
2014-02-11 16:50 - 2014-02-11 17:34 - 00000000 ____D () C:\Users\Pc\AppData\Local\NPE
2014-02-11 16:38 - 2014-02-11 16:38 - 00000000 ____D () C:\Windows\System32\Tasks\Norton Internet Security
2014-02-11 16:37 - 2014-02-11 16:37 - 00003234 _____ () C:\Windows\System32\Tasks\Norton WSC Integration
2014-02-11 16:35 - 2014-02-11 21:23 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\DigitalSites
2014-02-11 16:35 - 2014-02-11 16:35 - 00003208 _____ () C:\Windows\System32\Tasks\Digital Sites
2014-02-11 16:30 - 2013-12-18 21:09 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-02-11 16:30 - 2013-12-18 21:04 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-02-11 16:30 - 2013-12-18 21:04 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-02-11 16:30 - 2013-12-18 21:03 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-02-11 16:29 - 2014-02-11 16:30 - 00005327 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-02-11 16:27 - 2014-02-11 16:32 - 223165336 ____N (Symantec Corporation) C:\Users\Pc\Downloads\NIS_21.1.0.18_SYMTB_TMD_MRFTT_820_10131.exe
2014-02-11 15:59 - 2014-02-11 15:59 - 00003582 _____ () C:\Windows\System32\Tasks\PileFile reminder
2014-02-11 15:59 - 2014-02-11 15:59 - 00003160 _____ () C:\Windows\System32\Tasks\PileFile logon
2014-02-11 15:59 - 2014-02-11 15:59 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Oxy
2014-02-04 16:14 - 2013-06-12 15:15 - 00100864 _____ () C:\Users\Pc\AppData\Roaming\zlib1.dll
2014-02-04 13:49 - 2014-02-04 13:49 - 00347816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\MicrosoftFixit.WinSecurity.FISC.37314945131128502.8.1.Run.exe
2014-02-04 13:42 - 2014-02-04 13:42 - 00347816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\MicrosoftFixit.WindowsFirewall.RNP.Run.exe
2014-02-04 13:09 - 2014-02-13 16:47 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Riot Games
2014-02-04 13:07 - 2014-02-04 13:08 - 34888568 _____ (Riot Games) C:\Users\Pc\Downloads\LeagueofLegends_EUW_Installer_06_12_13.exe
2014-02-04 12:20 - 2014-02-04 12:20 - 00001024 _____ () C:\Windows\SysWOW64\.rnd
2014-02-02 13:32 - 2014-02-02 13:32 - 00000000 ___SH () C:\Users\Pc\AppData\Local\LumaEmu
2014-02-02 13:28 - 2014-02-02 13:28 - 00000000 ____D () C:\Users\Pc\Desktop\RustClient_v19.12.2013
2014-02-02 13:20 - 2014-02-02 13:21 - 06499816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\vcredist_x86.exe
2014-01-29 14:14 - 2014-01-29 14:14 - 00000631 _____ () C:\Windows\system32\InstallUtil.InstallLog
2014-01-21 10:23 - 2014-02-04 12:20 - 00000000 ____D () C:\Users\Pc\AppData\Local\CyberGhost
2014-01-21 10:22 - 2014-01-21 10:27 - 00000000 ____D () C:\Program Files\CyberGhost 5
2014-01-21 10:22 - 2014-01-21 10:23 - 00000000 ____D () C:\Program Files\TAP-Windows
2014-01-21 10:22 - 2014-01-21 10:22 - 00001736 _____ () C:\Users\Pc\Desktop\CyberGhost 5.lnk
2014-01-21 10:21 - 2014-01-21 10:21 - 08566128 _____ (CyberGhost S.R.L. ) C:\Users\Pc\Downloads\CG_5.0.9.8chip.de.exe
2014-01-15 13:29 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-01-15 13:29 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-01-15 13:29 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-01-15 13:29 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-01-15 13:29 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-01-15 13:29 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-01-15 13:29 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-01-15 13:29 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-01-15 13:29 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

==================== One Month Modified Files and Folders =======

2014-02-13 22:35 - 2014-02-13 22:35 - 00019443 _____ () C:\Users\Pc\Desktop\FRST.txt
2014-02-13 22:35 - 2014-02-11 22:23 - 00000000 ____D () C:\FRST
2014-02-13 22:32 - 2013-12-27 22:18 - 00000000 ____D () C:\Users\Pc\AppData\Local\Apps\2.0
2014-02-13 22:29 - 2014-02-13 22:29 - 00003725 _____ () C:\Users\Pc\Desktop\JRT.txt
2014-02-13 22:21 - 2012-10-18 00:39 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-02-13 22:16 - 2014-02-13 22:16 - 00000000 ____D () C:\Windows\ERUNT
2014-02-13 22:13 - 2014-02-13 22:13 - 01037530 _____ (Thisisu) C:\Users\Pc\Desktop\JRT.exe
2014-02-13 22:13 - 2011-05-10 01:27 - 01991375 _____ () C:\Windows\WindowsUpdate.log
2014-02-13 22:11 - 2013-05-21 18:37 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Codec Pack Packages
2014-02-13 22:09 - 2014-02-13 22:09 - 00039497 _____ () C:\Users\Pc\Desktop\AdwCleaner[S1].txt
2014-02-13 22:08 - 2011-05-15 23:01 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-02-13 22:07 - 2014-02-12 21:00 - 00017808 _____ () C:\Windows\setupact.log
2014-02-13 22:07 - 2012-10-18 00:39 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-02-13 22:07 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-13 22:05 - 2014-02-13 21:51 - 00000000 ____D () C:\AdwCleaner
2014-02-13 22:04 - 2012-10-20 20:58 - 00000000 ____D () C:\Users\Pc\AppData\Local\PMB Files
2014-02-13 21:59 - 2014-02-12 21:18 - 00110882 _____ () C:\Windows\PFRO.log
2014-02-13 21:51 - 2014-02-13 21:51 - 01166132 _____ () C:\Users\Pc\Desktop\adwcleaner.exe
2014-02-13 21:36 - 2012-09-28 18:04 - 00000000 ____D () C:\Users\Pc
2014-02-13 21:35 - 2014-02-13 21:35 - 00000000 ____D () C:\Users\Pc\Desktop\FRST-OlderVersion
2014-02-13 21:35 - 2014-02-11 22:27 - 00000000 ____D () C:\Users\Pc\Desktop\Dokus
2014-02-13 21:35 - 2014-02-11 22:22 - 02152960 _____ (Farbar) C:\Users\Pc\Desktop\FRST64.exe
2014-02-13 21:19 - 2014-02-13 21:19 - 01243588 _____ () C:\Users\Pc\Downloads\ProcessExplorer.zip
2014-02-13 20:59 - 2013-10-05 14:34 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-02-13 19:45 - 2013-12-30 14:50 - 00000000 ____D () C:\Program Files (x86)\Wargame AirLand Battle
2014-02-13 19:44 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2014-02-13 16:47 - 2014-02-04 13:09 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Riot Games
2014-02-13 16:43 - 2014-02-13 16:43 - 00001613 _____ () C:\Users\Public\Desktop\Play League of Legends.lnk
2014-02-13 16:41 - 2014-02-13 16:40 - 34888568 _____ (Riot Games) C:\Users\Pc\Downloads\LeagueofLegends_EUW_Installer_06_12_13(1).exe
2014-02-13 16:41 - 2014-02-13 16:40 - 32229024 _____ (Riot Games) C:\Users\Pc\Downloads\LeagueofLegends_NA_Installer_05_07_13.exe
2014-02-13 15:43 - 2014-02-13 15:11 - 760671830 _____ () C:\Users\Pc\Downloads\Narutowip2.rar
2014-02-13 15:40 - 2014-02-13 15:18 - 347645656 _____ () C:\Users\Pc\Downloads\2.0_Music.rar
2014-02-13 15:19 - 2014-02-13 15:16 - 29934138 _____ () C:\Users\Pc\Downloads\narutowippatch.14.zip
2014-02-13 15:17 - 2014-02-13 15:17 - 03067492 _____ () C:\Users\Pc\Downloads\narutosource.rar
2014-02-13 14:36 - 2014-02-13 14:36 - 04102163 _____ () C:\Users\Pc\Downloads\tdsskiller.zip
2014-02-13 14:30 - 2014-02-12 19:36 - 00000000 ____D () C:\Qoobox
2014-02-13 14:29 - 2014-02-13 14:29 - 00043125 _____ () C:\ComboFix.txt
2014-02-13 14:18 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2014-02-13 14:16 - 2014-02-12 18:58 - 00000000 ____D () C:\Windows\erdnt
2014-02-13 14:15 - 2012-09-28 18:06 - 00000000 ___RD () C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-02-13 13:50 - 2014-02-13 13:51 - 05180679 ____R (Swearware) C:\Users\Pc\Desktop\ComboFix.exe
2014-02-13 13:50 - 2014-02-13 13:49 - 05180679 _____ (Swearware) C:\Users\Pc\Downloads\ComboFix.exe
2014-02-12 23:12 - 2009-07-14 05:45 - 00010784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-12 23:12 - 2009-07-14 05:45 - 00010784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-12 22:27 - 2014-02-12 22:27 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Avira
2014-02-12 22:27 - 2014-02-12 22:27 - 00000000 ____D () C:\Users\Pc\AppData\Local\VNT
2014-02-12 22:26 - 2014-02-12 22:26 - 00000000 ____D () C:\ProgramData\AskPartnerNetwork
2014-02-12 22:26 - 2014-02-12 22:26 - 00000000 ____D () C:\Program Files (x86)\VNT
2014-02-12 22:26 - 2014-02-12 22:26 - 00000000 ____D () C:\Program Files (x86)\AskPartnerNetwork
2014-02-12 22:24 - 2014-02-12 22:24 - 00002078 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2014-02-12 22:23 - 2014-02-12 22:23 - 00000000 ____D () C:\ProgramData\Avira
2014-02-12 22:23 - 2014-02-12 22:23 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-02-12 22:08 - 2014-02-12 22:04 - 139704984 _____ () C:\Users\Pc\Downloads\avira_ultimate_protection_suite_de.exe
2014-02-12 22:05 - 2014-02-12 22:05 - 00264757 _____ () C:\Users\Pc\Downloads\FHSetup.exe
2014-02-12 22:05 - 2014-02-12 22:05 - 00001981 _____ () C:\Users\Pc\Desktop\Update Checker.lnk
2014-02-12 22:05 - 2014-02-12 22:05 - 00000000 ____D () C:\Program Files (x86)\FileHippo.com
2014-02-12 21:54 - 2014-02-12 21:54 - 00007674 _____ () C:\Users\Pc\AppData\Local\Resmon.ResmonCfg
2014-02-12 21:16 - 2013-08-14 22:07 - 00000000 ____D () C:\Windows\system32\MRT
2014-02-12 21:10 - 2012-10-18 05:30 - 88567024 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-02-12 21:07 - 2012-12-18 19:29 - 01625030 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-02-12 21:07 - 2009-07-14 11:54 - 00710502 _____ () C:\Windows\system32\perfh007.dat
2014-02-12 21:07 - 2009-07-14 11:54 - 00154832 _____ () C:\Windows\system32\perfc007.dat
2014-02-12 21:07 - 2009-07-14 06:13 - 01625030 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-12 21:06 - 2014-02-11 17:54 - 02539172 _____ () C:\Windows\system32\Drivers\Cat.DB
2014-02-12 21:00 - 2014-02-12 21:00 - 00000000 _____ () C:\Windows\setuperr.log
2014-02-12 20:59 - 2014-02-11 17:50 - 00000000 ____D () C:\ProgramData\PC Tools
2014-02-12 20:56 - 2013-10-05 14:34 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-02-12 20:56 - 2012-10-17 23:45 - 00000000 ____D () C:\Users\Pc\AppData\Local\Adobe
2014-02-12 20:55 - 2012-12-10 18:25 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-02-12 20:55 - 2012-12-10 18:25 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-02-12 20:52 - 2012-10-20 13:46 - 00000000 ____D () C:\Users\Pc\AppData\Local\CrashDumps
2014-02-12 20:52 - 2012-10-18 15:02 - 00000000 ____D () C:\Windows\Minidump
2014-02-12 19:58 - 2013-04-04 22:02 - 00000000 ____D () C:\Program Files (x86)\VLC Media Player DB Toolbar Toolbar
2014-02-12 19:44 - 2012-10-18 00:43 - 00000000 ____D () C:\ProgramData\Norton
2014-02-12 16:59 - 2013-04-07 21:02 - 00000000 ____D () C:\Users\Pc\Documents\Mount&Blade Warband Savegames
2014-02-12 16:05 - 2014-02-12 15:21 - 1064637787 _____ () C:\Users\Pc\Downloads\Naruto2.1.rar
2014-02-12 14:12 - 2014-02-12 14:12 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dll Suite 2013
2014-02-12 14:12 - 2014-02-12 14:12 - 00000000 ____D () C:\Program Files (x86)\DLLSuite
2014-02-12 14:11 - 2014-02-12 14:10 - 16588429 _____ ( ) C:\Users\Pc\Downloads\DLLSuite_Setup.exe
2014-02-12 13:51 - 2014-02-12 13:51 - 00001109 _____ () C:\Users\Pc\Desktop\ParetoLogic PC Health Advisor.lnk
2014-02-12 13:47 - 2014-02-12 13:47 - 05249448 _____ (ParetoLogic Inc.) C:\Users\Pc\Downloads\ParetoLogic PC Health Advisor_de.exe
2014-02-12 13:02 - 2014-02-12 12:30 - 1312122312 _____ () C:\Users\Pc\Downloads\ACOK_1.11.rar
2014-02-12 12:27 - 2014-02-12 12:27 - 00001152 _____ () C:\Users\Pc\Desktop\Mount&Blade Warband.lnk
2014-02-12 12:24 - 2013-04-07 16:18 - 00000000 ____D () C:\Program Files (x86)\Mount&Blade Warband
2014-02-12 12:18 - 2014-02-12 12:03 - 615004486 _____ () C:\Users\Pc\Downloads\mb_warband_setup_1158.exe
2014-02-12 11:39 - 2014-02-12 11:22 - 53254767 _____ () C:\Users\Pc\Downloads\LoLRADS_EUW_german.zip
2014-02-12 11:02 - 2013-12-30 17:30 - 00000000 ____D () C:\Program Files (x86)\Supreme Commander 2
2014-02-12 08:31 - 2012-10-19 17:25 - 01008640 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll
2014-02-12 08:31 - 2012-10-19 17:25 - 00833024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user32.dll
2014-02-12 08:31 - 2012-10-19 17:25 - 00419840 _____ (Microsoft Corporation) C:\Windows\system32\systemcpl.dll
2014-02-12 08:31 - 2012-10-19 17:25 - 00014848 _____ (Microsoft Corporation) C:\Windows\system32\slwga.dll
2014-02-12 08:31 - 2012-10-19 17:25 - 00013824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\slwga.dll
2014-02-11 22:21 - 2014-02-11 22:21 - 00000466 _____ () C:\Windows\SysWOW64\defogger_disable.log
2014-02-11 22:21 - 2014-02-11 22:21 - 00000000 _____ () C:\Users\Pc\defogger_reenable
2014-02-11 22:00 - 2014-02-11 21:23 - 00000000 ____D () C:\ProgramData\SecTaskMan
2014-02-11 21:23 - 2014-02-11 21:22 - 00000000 ____D () C:\Program Files (x86)\Security Task Manager
2014-02-11 21:23 - 2014-02-11 16:35 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\DigitalSites
2014-02-11 21:23 - 2013-12-31 15:25 - 00000000 ____D () C:\ProgramData\FuNDeaulls
2014-02-11 21:23 - 2013-10-11 13:19 - 00000000 ____D () C:\Program Files (x86)\Unitech LLC
2014-02-11 21:20 - 2014-02-11 21:19 - 02365840 _____ () C:\Users\Pc\Downloads\SecurityTaskManager_Setup.exe
2014-02-11 21:03 - 2014-02-11 21:03 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\TestApp
2014-02-11 20:58 - 2014-02-11 20:58 - 00001121 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-02-11 20:58 - 2013-08-20 16:44 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-02-11 20:57 - 2014-02-11 20:57 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Pc\Downloads\mbam-setup-1.75.0.1300(1).exe
2014-02-11 20:02 - 2012-12-07 23:10 - 00000000 ____D () C:\Users\Pc\AppData\Local\Pokki
2014-02-11 17:34 - 2014-02-11 16:50 - 00000000 ____D () C:\Users\Pc\AppData\Local\NPE
2014-02-11 16:55 - 2012-12-20 15:52 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-02-11 16:54 - 2014-02-11 16:54 - 00000000 ____D () C:\ProgramData\SMR410
2014-02-11 16:38 - 2014-02-11 16:38 - 00000000 ____D () C:\Windows\System32\Tasks\Norton Internet Security
2014-02-11 16:37 - 2014-02-11 16:37 - 00003234 _____ () C:\Windows\System32\Tasks\Norton WSC Integration
2014-02-11 16:35 - 2014-02-11 16:35 - 00003208 _____ () C:\Windows\System32\Tasks\Digital Sites
2014-02-11 16:35 - 2013-07-29 11:35 - 00000196 _____ () C:\Users\Pc\AppData\Roaming\WB.CFG
2014-02-11 16:32 - 2014-02-11 16:27 - 223165336 ____N (Symantec Corporation) C:\Users\Pc\Downloads\NIS_21.1.0.18_SYMTB_TMD_MRFTT_820_10131.exe
2014-02-11 16:32 - 2013-10-20 11:29 - 00000000 ____D () C:\ProgramData\Oracle
2014-02-11 16:30 - 2014-02-11 16:29 - 00005327 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-02-11 16:30 - 2013-07-20 17:55 - 00000000 ____D () C:\Program Files (x86)\Java
2014-02-11 16:03 - 2013-02-23 20:05 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-02-11 16:03 - 2012-11-10 17:56 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\DAEMON Tools Lite
2014-02-11 16:03 - 2012-11-02 19:39 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\uTorrent
2014-02-11 16:03 - 2012-10-26 14:14 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\TS3Client
2014-02-11 15:59 - 2014-02-11 15:59 - 00003582 _____ () C:\Windows\System32\Tasks\PileFile reminder
2014-02-11 15:59 - 2014-02-11 15:59 - 00003160 _____ () C:\Windows\System32\Tasks\PileFile logon
2014-02-11 15:59 - 2014-02-11 15:59 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Oxy
2014-02-11 15:33 - 2012-10-20 20:58 - 00000000 ____D () C:\ProgramData\PMB Files
2014-02-11 15:20 - 2012-10-26 13:15 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Skype
2014-02-10 23:37 - 2014-02-13 14:36 - 04122976 _____ (Kaspersky Lab ZAO) C:\Users\Pc\Desktop\TDSSKiller.exe
2014-02-07 17:18 - 2013-09-14 20:24 - 00000424 _____ () C:\Users\Pc\Desktop\Accounts.txt
2014-02-06 13:16 - 2014-02-12 21:03 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-06 12:30 - 2014-02-12 21:03 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-06 12:30 - 2014-02-12 21:03 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-02-06 12:12 - 2014-02-12 21:03 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-06 12:07 - 2014-02-12 21:03 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-02-06 12:06 - 2014-02-12 21:03 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-02-06 11:57 - 2014-02-12 21:03 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-06 11:56 - 2014-02-12 21:03 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-02-06 11:52 - 2014-02-12 21:03 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-02-06 11:49 - 2014-02-12 21:03 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-06 11:48 - 2014-02-12 21:03 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-02-06 11:48 - 2014-02-12 21:03 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-02-06 11:38 - 2014-02-12 21:03 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-02-06 11:32 - 2014-02-12 21:03 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-02-06 11:20 - 2014-02-12 21:03 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-02-06 11:17 - 2014-02-12 21:03 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-02-06 11:11 - 2014-02-12 21:03 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-06 11:01 - 2014-02-12 21:03 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-02-06 11:00 - 2014-02-12 21:03 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-02-06 10:57 - 2014-02-12 21:03 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-02-06 10:57 - 2014-02-12 21:03 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-06 10:52 - 2014-02-12 21:03 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-02-06 10:52 - 2014-02-12 21:03 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-02-06 10:50 - 2014-02-12 21:03 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-06 10:49 - 2014-02-12 21:03 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-02-06 10:47 - 2014-02-12 21:03 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-02-06 10:46 - 2014-02-12 21:03 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-02-06 10:25 - 2014-02-12 21:03 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-02-06 10:25 - 2014-02-12 21:03 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-02-06 10:24 - 2014-02-12 21:03 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-06 10:22 - 2014-02-12 21:03 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-06 10:13 - 2014-02-12 21:03 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-02-06 10:09 - 2014-02-12 21:03 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-02-06 10:03 - 2014-02-12 21:03 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-02-06 09:55 - 2014-02-12 21:03 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-06 09:41 - 2014-02-12 21:03 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-02-06 09:40 - 2014-02-12 21:03 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-02-06 09:36 - 2014-02-12 21:03 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-02-06 09:34 - 2014-02-12 21:03 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-02-05 12:36 - 2013-12-28 11:49 - 00291128 _____ () C:\Windows\SysWOW64\PnkBstrB.xtr
2014-02-05 12:36 - 2013-08-18 17:42 - 00291128 _____ () C:\Windows\SysWOW64\PnkBstrB.exe
2014-02-04 15:46 - 2013-08-18 17:42 - 00291128 _____ () C:\Windows\SysWOW64\PnkBstrB.ex0
2014-02-04 15:25 - 2013-12-28 14:47 - 00000000 ____D () C:\ProgramData\surf aand kEEp
2014-02-04 15:25 - 2013-12-28 14:47 - 00000000 ____D () C:\Program Files (x86)\surf aand kEEp
2014-02-04 13:49 - 2014-02-04 13:49 - 00347816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\MicrosoftFixit.WinSecurity.FISC.37314945131128502.8.1.Run.exe
2014-02-04 13:42 - 2014-02-04 13:42 - 00347816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\MicrosoftFixit.WindowsFirewall.RNP.Run.exe
2014-02-04 13:08 - 2014-02-04 13:07 - 34888568 _____ (Riot Games) C:\Users\Pc\Downloads\LeagueofLegends_EUW_Installer_06_12_13.exe
2014-02-04 12:20 - 2014-02-04 12:20 - 00001024 _____ () C:\Windows\SysWOW64\.rnd
2014-02-04 12:20 - 2014-01-21 10:23 - 00000000 ____D () C:\Users\Pc\AppData\Local\CyberGhost
2014-02-02 13:32 - 2014-02-02 13:32 - 00000000 ___SH () C:\Users\Pc\AppData\Local\LumaEmu
2014-02-02 13:28 - 2014-02-02 13:28 - 00000000 ____D () C:\Users\Pc\Desktop\RustClient_v19.12.2013
2014-02-02 13:27 - 2013-02-05 20:06 - 00000000 ____D () C:\Users\Pc\Desktop\Spiele
2014-02-02 13:21 - 2014-02-02 13:20 - 06499816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\vcredist_x86.exe
2014-02-02 13:21 - 2013-08-18 17:43 - 00000000 ____D () C:\ProgramData\Package Cache
2014-02-01 11:35 - 2013-06-17 13:35 - 00000005 _____ () C:\Users\Pc\AppData\Roaming\WBPU-TTL.DAT
2014-01-29 14:14 - 2014-01-29 14:14 - 00000631 _____ () C:\Windows\system32\InstallUtil.InstallLog
2014-01-25 14:59 - 2012-10-17 23:53 - 00003906 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{9DE29845-AC8C-4418-B415-05000DEA2E9F}
2014-01-24 22:17 - 2013-08-18 17:42 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2014-01-24 22:12 - 2013-12-27 22:18 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ubisoft
2014-01-24 22:12 - 2013-12-27 22:18 - 00000000 ____D () C:\Users\Pc\AppData\Local\Deployment
2014-01-23 21:18 - 2013-02-25 14:23 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Spotify
2014-01-23 21:01 - 2013-02-25 14:24 - 00000000 ____D () C:\Users\Pc\AppData\Local\Spotify
2014-01-23 17:26 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-01-21 10:27 - 2014-01-21 10:22 - 00000000 ____D () C:\Program Files\CyberGhost 5
2014-01-21 10:23 - 2014-01-21 10:22 - 00000000 ____D () C:\Program Files\TAP-Windows
2014-01-21 10:22 - 2014-01-21 10:22 - 00001736 _____ () C:\Users\Pc\Desktop\CyberGhost 5.lnk
2014-01-21 10:21 - 2014-01-21 10:21 - 08566128 _____ (CyberGhost S.R.L. ) C:\Users\Pc\Downloads\CG_5.0.9.8chip.de.exe
2014-01-21 09:51 - 2013-12-28 14:48 - 00000000 ____D () C:\Program Files (x86)\GS-Enabler
2014-01-17 13:57 - 2009-07-14 05:45 - 00321600 _____ () C:\Windows\system32\FNTCACHE.DAT

Some content of TEMP:
====================
C:\Users\Pc\AppData\Local\Temp\avgnt.exe
C:\Users\Pc\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-02-11 14:00

==================== End Of Log ============================
         

--- --- ---

--- --- ---

--- --- ---

Schritt 1
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2013-12-20] (APN LLC.)
C:\Program Files (x86)\AskPartnerNetwork
S2 e81a9dc1; "C:\Windows\system32\rundll32.exe" "c:\progra~2\gs-ena~1\BrowsafeSvc.dll",service
c:\progra~2\gs-ena~1
S2 vToolbarUpdater15.0.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.0.0\ToolbarUpdater.exe [X]
HKLM-x32\...\Run: [VNT] - C:\Program Files (x86)\VNT\vntldr.exe [202192 2013-12-20] (APN LLC.)
C:\Program Files (x86)\VNT
SearchScopes: HKCU - ToolbarSearchProviderProgress {96bd48dd-741b-41ae-ac4a-aff96ba00f7e}
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
BHO: Avira SearchFree Toolbar - {41564952-412D-5637-4300-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport_x64.dll (APN LLC.)
BHO: FuNDeaulls - {4CEECF2F-7433-3E1D-4954-FE2A3682FC20} - C:\ProgramData\FuNDeaulls\DD2qL.x64.dll No File
BHO: 50Coeuupons - {A257D1AE-C8F9-32E7-03CF-8F68563FB5A4} - C:\ProgramData\50Coeuupons\gKoa.x64.dll No File
BHO-x32: Avira SearchFree Toolbar - {41564952-412D-5637-4300-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport.dll (APN LLC.)
Toolbar: HKLM - Avira SearchFree Toolbar - {41564952-412D-5637-4300-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport_x64.dll (APN LLC.)
Toolbar: HKLM-x32 - Avira SearchFree Toolbar - {41564952-412D-5637-4300-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport.dll (APN LLC.)
FF Extension: Avira SearchFree Toolbar plus Web Protection - C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\Extensions\toolbar_AVIRA-V7C@apn.ask.com.xpi [2013-12-20]
FF Plugin HKCU: pokki.com/PokkiDownloadHelper - C:\Users\Pc\AppData\Local\Pokki\Download Helper\npPokkiDownloadHelper.1.2.0.78.dll (Pokki)
C:\Users\Pc\AppData\Local\Pokki
FF HKCU\...\Firefox\Extensions: [lyricsmonkey@mendoni.net] - C:\Program Files (x86)\LyricsMonkey\FF\
FF HKCU\...\Firefox\Extensions: [YTKaraoke@DacSoft.org] - C:\Program Files (x86)\YTKaraoke\FF\
C:\Program Files (x86)\YTKaraoke
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
2014-02-12 22:27 - 2014-02-12 22:27 - 00000000 ____D () C:\Users\Pc\AppData\Local\VNT
2014-02-12 22:26 - 2014-02-12 22:26 - 00000000 ____D () C:\ProgramData\AskPartnerNetwork
2014-02-12 19:58 - 2013-04-04 22:02 - 00000000 ____D () C:\Program Files (x86)\VLC Media Player DB Toolbar Toolbar
2014-02-12 13:51 - 2014-02-12 13:51 - 00001109 _____ () C:\Users\Pc\Desktop\ParetoLogic PC Health Advisor.lnk
2014-02-12 13:47 - 2014-02-12 13:47 - 05249448 _____ (ParetoLogic Inc.) C:\Users\Pc\Downloads\ParetoLogic PC Health Advisor_de.exe
2014-02-11 16:35 - 2014-02-11 21:23 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\DigitalSites
2014-02-11 16:35 - 2014-02-11 16:35 - 00003208 _____ () C:\Windows\System32\Tasks\Digital Sites
2014-02-11 21:23 - 2013-12-31 15:25 - 00000000 ____D () C:\ProgramData\FuNDeaulls
2014-02-11 21:23 - 2013-10-11 13:19 - 00000000 ____D () C:\Program Files (x86)\Unitech LLC
2014-02-04 15:25 - 2013-12-28 14:47 - 00000000 ____D () C:\ProgramData\surf aand kEEp
2014-02-04 15:25 - 2013-12-28 14:47 - 00000000 ____D () C:\Program Files (x86)\surf aand kEEp
C:\Windows\Tasks\Digital Sites.job
C:\Windows\Tasks\DSite.job
AlternateDataStreams: C:\ProgramData\TEMP:373E1720
AlternateDataStreams: C:\ProgramData\TEMP:430C6D84
AlternateDataStreams: C:\ProgramData\TEMP:DFC5A2B2
Reg: reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\MpsSvc /v Start /t REG_DWORD /d 0x00000002 /f
         

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

• Starte nun FRST erneut und klicke den Entfernen Button.
• Das Tool erstellt eine Fixlog.txt.
• Poste mir deren Inhalt.

Schritt 2
Bitte deinstalliere Google Chrome vollständig und installiere ihn wieder (je nachdem, ob du diesen verwendest).

Schritt 3

ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Schritt 4
Starte noch einmal FRST.

• Ändere keine der Voreinstellungen und drücke auf Scan.
• Wenn der Scan abgeschlossen ist, wird ein neues Logfile FRST.txt erstellt und auf dem Desktop gespeichert.
• Poste den Inhalt dieses Logfiles bitte hier in deinen Thread.

Treten noch von dir genannte Probleme auf? Gibt es noch weitere Unstimmigkeiten mit deinem Rechner?



Poste folgende Logfiles in deiner nächsten Antwort:

• FRST-Fix
• ESET-Scan
• FRST-Scan

Ich habe Eset 8 Stunden lang laufen gelassen und es erreichte 95 %. Danach wurde es beendet und ich hatte um ehrlich zu sein, keine Lust mehr es erneut zu starten. Wenn es nötig ist, kann ich den Vorgang nochmal wiederholen.Es wurden zwar 5 Infektionen gefunden, aber ich hatte nicht die Möglichkeit diese zu entfernen. Außerdem bestehen die beschriebenen Probleme weiterhin (Siehe Anhang).

Logs:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 13-02-2014 01
Ran by Pc at 2014-02-15 20:32:43 Run:3
Running from C:\Users\Pc\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2013-12-20] (APN LLC.)
C:\Program Files (x86)\AskPartnerNetwork
S2 e81a9dc1; "C:\Windows\system32\rundll32.exe" "c:\progra~2\gs-ena~1\BrowsafeSvc.dll",service
c:\progra~2\gs-ena~1
S2 vToolbarUpdater15.0.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.0.0\ToolbarUpdater.exe [X]
HKLM-x32\...\Run: [VNT] - C:\Program Files (x86)\VNT\vntldr.exe [202192 2013-12-20] (APN LLC.)
C:\Program Files (x86)\VNT
SearchScopes: HKCU - ToolbarSearchProviderProgress {96bd48dd-741b-41ae-ac4a-aff96ba00f7e}
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
BHO: Avira SearchFree Toolbar - {41564952-412D-5637-4300-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport_x64.dll (APN LLC.)
BHO: FuNDeaulls - {4CEECF2F-7433-3E1D-4954-FE2A3682FC20} - C:\ProgramData\FuNDeaulls\DD2qL.x64.dll No File
BHO: 50Coeuupons - {A257D1AE-C8F9-32E7-03CF-8F68563FB5A4} - C:\ProgramData\50Coeuupons\gKoa.x64.dll No File
BHO-x32: Avira SearchFree Toolbar - {41564952-412D-5637-4300-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport.dll (APN LLC.)
Toolbar: HKLM - Avira SearchFree Toolbar - {41564952-412D-5637-4300-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport_x64.dll (APN LLC.)
Toolbar: HKLM-x32 - Avira SearchFree Toolbar - {41564952-412D-5637-4300-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport.dll (APN LLC.)
FF Extension: Avira SearchFree Toolbar plus Web Protection - C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\Extensions\toolbar_AVIRA-V7C@apn.ask.com.xpi [2013-12-20]
FF Plugin HKCU: pokki.com/PokkiDownloadHelper - C:\Users\Pc\AppData\Local\Pokki\Download Helper\npPokkiDownloadHelper.1.2.0.78.dll (Pokki)
C:\Users\Pc\AppData\Local\Pokki
FF HKCU\...\Firefox\Extensions: [lyricsmonkey@mendoni.net] - C:\Program Files (x86)\LyricsMonkey\FF\
FF HKCU\...\Firefox\Extensions: [YTKaraoke@DacSoft.org] - C:\Program Files (x86)\YTKaraoke\FF\
C:\Program Files (x86)\YTKaraoke
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
2014-02-12 22:27 - 2014-02-12 22:27 - 00000000 ____D () C:\Users\Pc\AppData\Local\VNT
2014-02-12 22:26 - 2014-02-12 22:26 - 00000000 ____D () C:\ProgramData\AskPartnerNetwork
2014-02-12 19:58 - 2013-04-04 22:02 - 00000000 ____D () C:\Program Files (x86)\VLC Media Player DB Toolbar Toolbar
2014-02-12 13:51 - 2014-02-12 13:51 - 00001109 _____ () C:\Users\Pc\Desktop\ParetoLogic PC Health Advisor.lnk
2014-02-12 13:47 - 2014-02-12 13:47 - 05249448 _____ (ParetoLogic Inc.) C:\Users\Pc\Downloads\ParetoLogic PC Health Advisor_de.exe
2014-02-11 16:35 - 2014-02-11 21:23 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\DigitalSites
2014-02-11 16:35 - 2014-02-11 16:35 - 00003208 _____ () C:\Windows\System32\Tasks\Digital Sites
2014-02-11 21:23 - 2013-12-31 15:25 - 00000000 ____D () C:\ProgramData\FuNDeaulls
2014-02-11 21:23 - 2013-10-11 13:19 - 00000000 ____D () C:\Program Files (x86)\Unitech LLC
2014-02-04 15:25 - 2013-12-28 14:47 - 00000000 ____D () C:\ProgramData\surf aand kEEp
2014-02-04 15:25 - 2013-12-28 14:47 - 00000000 ____D () C:\Program Files (x86)\surf aand kEEp
C:\Windows\Tasks\Digital Sites.job
C:\Windows\Tasks\DSite.job
AlternateDataStreams: C:\ProgramData\TEMP:373E1720
AlternateDataStreams: C:\ProgramData\TEMP:430C6D84
AlternateDataStreams: C:\ProgramData\TEMP:DFC5A2B2
Reg: reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\MpsSvc /v Start /t REG_DWORD /d 0x00000002 /f
         
*****************

APNMCP => Service deleted successfully.
C:\Program Files (x86)\AskPartnerNetwork => Moved successfully.
e81a9dc1 => Service deleted successfully.
c:\progra~2\gs-ena~1 => Moved successfully.
vToolbarUpdater15.0.0 => Service deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\VNT => Value deleted successfully.
C:\Program Files (x86)\VNT => Moved successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\ToolbarSearchProviderProgress => Value deleted successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990} => Key deleted successfully.
HKCR\CLSID\{6A1806CD-94D4-4689-BA73-E35EA1EA9990} => Key not found.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{41564952-412D-5637-4300-7A786E7484D7} => Key deleted successfully.
HKCR\CLSID\{41564952-412D-5637-4300-7A786E7484D7} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4CEECF2F-7433-3E1D-4954-FE2A3682FC20} => Key deleted successfully.
HKCR\CLSID\{4CEECF2F-7433-3E1D-4954-FE2A3682FC20} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A257D1AE-C8F9-32E7-03CF-8F68563FB5A4} => Key deleted successfully.
HKCR\CLSID\{A257D1AE-C8F9-32E7-03CF-8F68563FB5A4} => Key deleted successfully.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{41564952-412D-5637-4300-7A786E7484D7} => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{41564952-412D-5637-4300-7A786E7484D7} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{41564952-412D-5637-4300-7A786E7484D7} => Value deleted successfully.
HKCR\CLSID\{41564952-412D-5637-4300-7A786E7484D7} => Key not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{41564952-412D-5637-4300-7A786E7484D7} => Value deleted successfully.
HKCR\Wow6432Node\CLSID\{41564952-412D-5637-4300-7A786E7484D7} => Key not found.
C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\Extensions\toolbar_AVIRA-V7C@apn.ask.com.xpi => Moved successfully.
HKCU\Software\MozillaPlugins\pokki.com/PokkiDownloadHelper => Key deleted successfully.
C:\Users\Pc\AppData\Local\Pokki\Download Helper\npPokkiDownloadHelper.1.2.0.78.dll => Moved successfully.
C:\Users\Pc\AppData\Local\Pokki => Moved successfully.
HKCU\Software\Mozilla\Firefox\Extensions\\lyricsmonkey@mendoni.net => Value deleted successfully.
HKCU\Software\Mozilla\Firefox\Extensions\\YTKaraoke@DacSoft.org => Value deleted successfully.
"C:\Program Files (x86)\YTKaraoke" => File/Directory not found.
HKLM\SOFTWARE\Policies\Google => Key deleted successfully.
C:\Users\Pc\AppData\Local\VNT => Moved successfully.
C:\ProgramData\AskPartnerNetwork => Moved successfully.
C:\Program Files (x86)\VLC Media Player DB Toolbar Toolbar => Moved successfully.
C:\Users\Pc\Desktop\ParetoLogic PC Health Advisor.lnk => Moved successfully.
C:\Users\Pc\Downloads\ParetoLogic PC Health Advisor_de.exe => Moved successfully.
C:\Users\Pc\AppData\Roaming\DigitalSites => Moved successfully.
C:\Windows\System32\Tasks\Digital Sites => Moved successfully.
C:\ProgramData\FuNDeaulls => Moved successfully.
C:\Program Files (x86)\Unitech LLC => Moved successfully.
C:\ProgramData\surf aand kEEp => Moved successfully.
C:\Program Files (x86)\surf aand kEEp => Moved successfully.
"C:\Windows\Tasks\Digital Sites.job" => File/Directory not found.
"C:\Windows\Tasks\DSite.job" => File/Directory not found.
C:\ProgramData\TEMP => ":373E1720" ADS removed successfully.
C:\ProgramData\TEMP => ":430C6D84" ADS removed successfully.
C:\ProgramData\TEMP => ":DFC5A2B2" ADS removed successfully.

========= reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\MpsSvc /v Start /t REG_DWORD /d 0x00000002 /f =========

Der Vorgang wurde erfolgreich beendet.



========= End of Reg: =========



The system needs a manual reboot. 

==== End of Fixlog ====
         

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=cb30d69d079cfd44a32d8722cb78ffdc
# engine=17090
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-02-15 07:56:52
# local_time=2014-02-15 08:56:52 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=771 16777214 16 1 363676 363676 0 0
# compatibility_mode=5893 16776573 100 94 79912 144124062 0 0
# scanned=1696
# found=1
# cleaned=0
# scan_time=939
sh=B49F71236B95E6A0CC972FEB330C23952D19A3E2 ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Yontoo\YontooLayers.crx.vir"
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=cb30d69d079cfd44a32d8722cb78ffdc
# engine=17090
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-02-15 08:00:27
# local_time=2014-02-15 09:00:27 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=771 16777214 16 1 360291 360291 0 0
# compatibility_mode=5893 16776573 100 94 76527 144124277 0 0
# scanned=1696
# found=1
# cleaned=0
# scan_time=135
sh=B49F71236B95E6A0CC972FEB330C23952D19A3E2 ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Yontoo\YontooLayers.crx.vir"
ESETSmartInstaller@High as downloader log:
all ok
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=cb30d69d079cfd44a32d8722cb78ffdc
# engine=17093
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-02-16 08:37:01
# local_time=2014-02-16 09:37:01 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=771 16777214 16 1 452485 452485 0 0
# compatibility_mode=5893 16776573 100 94 88570 144212871 0 0
# scanned=411507
# found=5
# cleaned=0
# scan_time=29321
sh=B49F71236B95E6A0CC972FEB330C23952D19A3E2 ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Yontoo\YontooLayers.crx.vir"
sh=F8027A71143DEF6FCDB04E88CF5B39BF8C08603E ft=0 fh=0000000000000000 vn="VBS/Runner.NBV trojan" ac=I fn="C:\FRST\Quarantine\cc4j5zs76kd2kj13-02-2014_21-36-11\92050.vbs"
sh=958E7DA26C2C86E093A1F40F64775539C61BFDC6 ft=1 fh=f49d817a11669fc4 vn="a variant of Generik.DAZLFYY trojan" ac=I fn="C:\Program Files (x86)\Microsoft Games\Age of Empires II\Age.dll"
sh=D540934F4129BF0469D99DB9A6BA42B17400BAFD ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\Users\Pc\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34\a6fcaa2-468d1870"
sh=1A3446B261E6B70723619F3002476781BA728D25 ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\Users\Pc\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46\2219a3ae-784affda"
         

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 16-02-2014
Ran by Pc (administrator) on PC-PC on 17-02-2014 16:53:48
Running from C:\Users\Pc\Desktop
Windows 7 Enterprise Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(AMD) C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe
() C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraMD.exe
(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe
(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraMD64.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(ASUSTeK Computer Inc.) C:\Program Files\ASUS\Turbo Key\TurboKey.exe
(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Hi-Rez Studios) C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe
(CyberGhost S.R.L) C:\Program Files\CyberGhost 5\Service.exe
() C:\Windows\SysWOW64\WinMsgBalloonServer.exe
() C:\Windows\SysWOW64\WinMsgBalloonClient.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\system32\AUDIODG.EXE
(Microsoft Corporation) C:\Windows\system32\taskmgr.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7560296 2011-12-12] (Realtek Semiconductor)
HKLM-x32\...\Run: [NUSB3MON] - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [Cpu Level Up help] - C:\Program Files\ASUS\Ai Suite\CpuLevelUpHelp.exe [887936 2009-12-28] ()
HKLM-x32\...\Run: [Turbo Key] - C:\Program Files\ASUS\Turbo Key\TurboKey.exe [1874432 2009-11-24] (ASUSTeK Computer Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-09] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [TaskbarNoNotification] 0
HKLM\...\Policies\Explorer: [HideSCAHealth] 0
HKU\.DEFAULT\...\Policies\Explorer: [TaskbarNoNotification] 0
HKU\.DEFAULT\...\Policies\Explorer: [HideSCAHealth] 0
HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Run: [HydraVisionMDEngine] - C:\Program Files (x86)\ATI Technologies\HydraVision\HydraMD.exe [569344 2011-07-07] (AMD)
HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Run: [HydraVisionDesktopManager] - C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe [393216 2011-07-07] (AMD)
HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Policies\Explorer: [TaskbarNoNotification] 0

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xEA5B1E2628BDCD01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKCU - DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
DPF: HKLM-x32 {E6F480FC-BD44-4CBA-B74A-89AF7842937D} hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.5.1.0.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566
FF Homepage: hxxp://www.google.de/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_44.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_44.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @soe.sony.com/installer,version=1.0.3 - C:\Users\Pc\AppData\LocalLow\Sony Online Entertainment\npsoe.dll ()
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin HKCU: thehappycloud.com/HappyCloudPlugin - C:\ProgramData\HappyCloud\Application\npHappyCloudPlugin.dll (The Happy Cloud)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\searchplugins\ividi.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Adblock Plus - C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-01-03]

==================== Services (Whitelisted) =================

R2 Akamai; c:\program files (x86)\common files\akamai/netsession_win_8fa3539.dll [4569856 2013-07-01] (Akamai Technologies, Inc.)
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2013-12-06] (Advanced Micro Devices, Inc.)
R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [908856 2013-12-09] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-09] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-12-09] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1011768 2013-12-09] (Avira Operations GmbH & Co. KG)
R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [96896 2009-12-29] (ASUSTeK Computer Inc.)
R2 CGVPNCliService; C:\Program Files\CyberGhost 5\Service.exe [64112 2014-01-16] (CyberGhost S.R.L)
R2 ForceWare Intelligent Application Manager (IAM); C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe [496232 2010-01-21] ()
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 npggsvc; C:\Windows\SysWOW64\GameMon.des [4521720 2012-09-26] (INCA Internet Co., Ltd.)
R2 nSvcIp; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe [209000 2010-01-21] ()
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2014-01-24] ()
S4 TunngleService; C:\Program Files (x86)\Tunngle\TnglCtrl.exe [745368 2012-11-26] (Tunngle.net GmbH)
S3 ArcService; C:\Users\Pc\Desktop\ArcService.exe [X]

==================== Drivers (Whitelisted) ====================

R2 AODDriver4.2.0; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [59648 2013-09-19] (Advanced Micro Devices)
R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2010-08-25] ()
R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [13368 2009-07-07] ()
S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [303616 2013-05-13] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-09] (Avira Operations GmbH & Co. KG)
R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [39768 2013-04-14] (AVG Technologies)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-09] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-12-09] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [84720 2013-12-09] (Avira Operations GmbH & Co. KG)
S3 cpudrv64; C:\Program Files (x86)\SystemRequirementsLab\cpudrv64.sys [17864 2011-06-02] ()
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2013-12-30] (Disc Soft Ltd)
R3 hxctlflt; C:\Windows\System32\Drivers\hxctlflt.sys [111104 2009-02-08] (Guillemot Corporation)
S2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [35328 2013-05-13] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-16] ()
S3 RT73; C:\Windows\System32\DRIVERS\Dr71WU.sys [610816 2008-01-16] (Ralink Technology, Corp.)
S3 RTL85n64; C:\Windows\System32\DRIVERS\RTL85n64.sys [378368 2009-06-10] (Realtek)
R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
R0 sfdrv01; C:\Windows\System32\drivers\sfdrv01.sys [75384 2009-02-03] (Protection Technology (StarForce))
R0 sfdrv01a; C:\Windows\System32\drivers\sfdrv01a.sys [77432 2009-02-03] (Protection Technology (StarForce))
R0 sfsync04; C:\Windows\System32\drivers\sfsync04.sys [79800 2012-06-19] (Protection Technology (StarForce))
R0 sfvfs02; C:\Windows\System32\drivers\sfvfs02.sys [107384 2007-02-08] (Protection Technology (StarForce))
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [3552384 2009-04-22] ()
S3 tap0901t; C:\Windows\System32\DRIVERS\tap0901t.sys [31232 2009-09-16] (Tunngle.net)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
S3 X6va011; \??\C:\Windows\SysWOW64\Drivers\X6va011 [X]
S3 X6va012; \??\C:\Windows\SysWOW64\Drivers\X6va012 [X]
S3 X6va013; \??\C:\Windows\SysWOW64\Drivers\X6va013 [X]
S3 X6va015; \??\C:\Windows\SysWOW64\Drivers\X6va015 [X]
S3 xhunter1; \??\C:\Windows\xhunter1.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-02-17 16:53 - 2014-02-17 16:53 - 00015237 _____ () C:\Users\Pc\Desktop\FRST.txt
2014-02-16 20:16 - 2014-02-16 20:45 - 523239424 _____ () C:\Users\Pc\Downloads\0utl4st.part4.rar
2014-02-16 18:33 - 2014-02-16 19:03 - 523239424 _____ () C:\Users\Pc\Downloads\0utl4st.part6.rar
2014-02-16 16:11 - 2014-02-16 18:32 - 03398085 _____ () C:\Users\Pc\Downloads\0utl4st.part7.rar
2014-02-16 16:11 - 2014-02-16 16:11 - 00000189 _____ () C:\Users\Pc\Downloads\0utl4st_checksums.sfv
2014-02-16 16:10 - 2014-02-16 16:10 - 03610608 _____ () C:\Users\Pc\Downloads\0utl4st.part2.rar.part
2014-02-15 20:38 - 2014-02-15 20:38 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-02-15 20:36 - 2014-02-15 20:36 - 02347384 _____ (ESET) C:\Users\Pc\Downloads\esetsmartinstaller_enu.exe
2014-02-14 14:24 - 2014-02-14 14:24 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-02-13 22:16 - 2014-02-13 22:16 - 00000000 ____D () C:\Windows\ERUNT
2014-02-13 22:13 - 2014-02-13 22:13 - 01037530 _____ (Thisisu) C:\Users\Pc\Desktop\JRT.exe
2014-02-13 21:51 - 2014-02-13 22:05 - 00000000 ____D () C:\AdwCleaner
2014-02-13 21:51 - 2014-02-13 21:51 - 01166132 _____ () C:\Users\Pc\Desktop\adwcleaner.exe
2014-02-13 21:35 - 2014-02-17 16:53 - 00000000 ____D () C:\Users\Pc\Desktop\FRST-OlderVersion
2014-02-13 21:19 - 2014-02-13 21:19 - 01243588 _____ () C:\Users\Pc\Downloads\ProcessExplorer.zip
2014-02-13 16:43 - 2014-02-13 16:43 - 00001613 _____ () C:\Users\Public\Desktop\Play League of Legends.lnk
2014-02-13 16:40 - 2014-02-13 16:41 - 34888568 _____ (Riot Games) C:\Users\Pc\Downloads\LeagueofLegends_EUW_Installer_06_12_13(1).exe
2014-02-13 16:40 - 2014-02-13 16:41 - 32229024 _____ (Riot Games) C:\Users\Pc\Downloads\LeagueofLegends_NA_Installer_05_07_13.exe
2014-02-13 15:18 - 2014-02-13 15:40 - 347645656 _____ () C:\Users\Pc\Downloads\2.0_Music.rar
2014-02-13 15:17 - 2014-02-13 15:17 - 03067492 _____ () C:\Users\Pc\Downloads\narutosource.rar
2014-02-13 15:16 - 2014-02-13 15:19 - 29934138 _____ () C:\Users\Pc\Downloads\narutowippatch.14.zip
2014-02-13 15:11 - 2014-02-13 15:43 - 760671830 _____ () C:\Users\Pc\Downloads\Narutowip2.rar
2014-02-13 14:36 - 2014-02-13 14:36 - 04102163 _____ () C:\Users\Pc\Downloads\tdsskiller.zip
2014-02-13 14:36 - 2014-02-10 23:37 - 04122976 _____ (Kaspersky Lab ZAO) C:\Users\Pc\Desktop\TDSSKiller.exe
2014-02-13 14:29 - 2014-02-13 14:29 - 00043125 _____ () C:\ComboFix.txt
2014-02-13 13:51 - 2014-02-13 13:50 - 05180679 ____R (Swearware) C:\Users\Pc\Desktop\ComboFix.exe
2014-02-13 13:49 - 2014-02-13 13:50 - 05180679 _____ (Swearware) C:\Users\Pc\Downloads\ComboFix.exe
2014-02-12 22:27 - 2014-02-12 22:27 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Avira
2014-02-12 22:24 - 2014-02-12 22:24 - 00002078 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2014-02-12 22:23 - 2014-02-12 22:23 - 00000000 ____D () C:\ProgramData\Avira
2014-02-12 22:23 - 2014-02-12 22:23 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-02-12 22:23 - 2013-12-09 11:45 - 00131576 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-02-12 22:23 - 2013-12-09 11:45 - 00108440 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-02-12 22:23 - 2013-12-09 11:45 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-02-12 22:23 - 2013-12-09 11:45 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2014-02-12 22:05 - 2014-02-12 22:05 - 00264757 _____ () C:\Users\Pc\Downloads\FHSetup.exe
2014-02-12 22:05 - 2014-02-12 22:05 - 00001981 _____ () C:\Users\Pc\Desktop\Update Checker.lnk
2014-02-12 22:05 - 2014-02-12 22:05 - 00000000 ____D () C:\Program Files (x86)\FileHippo.com
2014-02-12 22:04 - 2014-02-12 22:08 - 139704984 _____ () C:\Users\Pc\Downloads\avira_ultimate_protection_suite_de.exe
2014-02-12 21:54 - 2014-02-12 21:54 - 00007674 _____ () C:\Users\Pc\AppData\Local\Resmon.ResmonCfg
2014-02-12 21:18 - 2014-02-13 21:59 - 00110882 _____ () C:\Windows\PFRO.log
2014-02-12 21:04 - 2013-12-21 10:53 - 00548864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-02-12 21:04 - 2013-12-21 09:56 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-02-12 21:03 - 2014-02-06 13:16 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-12 21:03 - 2014-02-06 12:30 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-12 21:03 - 2014-02-06 12:30 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-02-12 21:03 - 2014-02-06 12:12 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-12 21:03 - 2014-02-06 12:07 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-02-12 21:03 - 2014-02-06 12:06 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-02-12 21:03 - 2014-02-06 11:57 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-12 21:03 - 2014-02-06 11:56 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-02-12 21:03 - 2014-02-06 11:52 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-02-12 21:03 - 2014-02-06 11:49 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-12 21:03 - 2014-02-06 11:48 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-02-12 21:03 - 2014-02-06 11:48 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-02-12 21:03 - 2014-02-06 11:38 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-02-12 21:03 - 2014-02-06 11:32 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-02-12 21:03 - 2014-02-06 11:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-02-12 21:03 - 2014-02-06 11:17 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-02-12 21:03 - 2014-02-06 11:11 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-12 21:03 - 2014-02-06 11:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-02-12 21:03 - 2014-02-06 11:00 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-02-12 21:03 - 2014-02-06 10:57 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-02-12 21:03 - 2014-02-06 10:57 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-12 21:03 - 2014-02-06 10:52 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-02-12 21:03 - 2014-02-06 10:52 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-02-12 21:03 - 2014-02-06 10:50 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-12 21:03 - 2014-02-06 10:49 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-02-12 21:03 - 2014-02-06 10:47 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-02-12 21:03 - 2014-02-06 10:46 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-02-12 21:03 - 2014-02-06 10:25 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-02-12 21:03 - 2014-02-06 10:25 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-02-12 21:03 - 2014-02-06 10:24 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-12 21:03 - 2014-02-06 10:22 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-12 21:03 - 2014-02-06 10:13 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-02-12 21:03 - 2014-02-06 10:09 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-02-12 21:03 - 2014-02-06 10:03 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-02-12 21:03 - 2014-02-06 09:55 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-12 21:03 - 2014-02-06 09:41 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-02-12 21:03 - 2014-02-06 09:40 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-02-12 21:03 - 2014-02-06 09:36 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-02-12 21:03 - 2014-02-06 09:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-02-12 21:00 - 2014-02-17 16:08 - 00060928 _____ () C:\Windows\setupact.log
2014-02-12 21:00 - 2014-02-12 21:00 - 00000000 _____ () C:\Windows\setuperr.log
2014-02-12 20:57 - 2014-01-01 00:05 - 00420008 _____ () C:\Windows\SysWOW64\locale.nls
2014-02-12 20:57 - 2014-01-01 00:04 - 00420008 _____ () C:\Windows\system32\locale.nls
2014-02-12 20:57 - 2013-12-25 00:09 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-02-12 20:57 - 2013-12-24 23:48 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-02-12 20:57 - 2013-12-06 03:30 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-02-12 20:57 - 2013-12-06 03:30 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-02-12 20:57 - 2013-12-06 03:02 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-02-12 20:57 - 2013-12-06 03:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-02-12 20:57 - 2013-12-04 03:27 - 00488448 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll
2014-02-12 20:57 - 2013-12-04 03:27 - 00485888 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll
2014-02-12 20:57 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll
2014-02-12 20:57 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll
2014-02-12 20:57 - 2013-12-04 03:26 - 00528384 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll
2014-02-12 20:57 - 2013-12-04 03:16 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe
2014-02-12 20:57 - 2013-12-04 03:16 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe
2014-02-12 20:57 - 2013-12-04 03:16 - 00553984 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe
2014-02-12 20:57 - 2013-12-04 03:16 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe
2014-02-12 20:57 - 2013-12-04 03:03 - 00428032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc.dll
2014-02-12 20:57 - 2013-12-04 03:03 - 00423936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_isv.dll
2014-02-12 20:57 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp_isv.dll
2014-02-12 20:57 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp.dll
2014-02-12 20:57 - 2013-12-04 03:02 - 00390144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdrm.dll
2014-02-12 20:57 - 2013-12-04 02:54 - 00594944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_isv.exe
2014-02-12 20:57 - 2013-12-04 02:54 - 00572416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate.exe
2014-02-12 20:57 - 2013-12-04 02:54 - 00510976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp.exe
2014-02-12 20:57 - 2013-12-04 02:54 - 00508928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp_isv.exe
2014-02-12 20:57 - 2013-11-26 09:16 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2014-02-12 20:57 - 2013-11-22 23:48 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2014-02-12 19:44 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-02-12 19:44 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-02-12 19:44 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-02-12 19:44 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-02-12 19:44 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-02-12 19:44 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2014-02-12 19:44 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2014-02-12 19:44 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2014-02-12 19:36 - 2014-02-13 14:30 - 00000000 ____D () C:\Qoobox
2014-02-12 18:58 - 2014-02-13 14:16 - 00000000 ____D () C:\Windows\erdnt
2014-02-12 15:21 - 2014-02-12 16:05 - 1064637787 _____ () C:\Users\Pc\Downloads\Naruto2.1.rar
2014-02-12 14:12 - 2014-02-12 14:12 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dll Suite 2013
2014-02-12 14:12 - 2014-02-12 14:12 - 00000000 ____D () C:\Program Files (x86)\DLLSuite
2014-02-12 14:10 - 2014-02-12 14:11 - 16588429 _____ ( ) C:\Users\Pc\Downloads\DLLSuite_Setup.exe
2014-02-12 12:30 - 2014-02-12 13:02 - 1312122312 _____ () C:\Users\Pc\Downloads\ACOK_1.11.rar
2014-02-12 12:27 - 2014-02-12 12:27 - 00001152 _____ () C:\Users\Pc\Desktop\Mount&Blade Warband.lnk
2014-02-12 12:03 - 2014-02-12 12:18 - 615004486 _____ () C:\Users\Pc\Downloads\mb_warband_setup_1158.exe
2014-02-12 11:22 - 2014-02-12 11:39 - 53254767 _____ () C:\Users\Pc\Downloads\LoLRADS_EUW_german.zip
2014-02-11 22:27 - 2014-02-15 20:31 - 00000000 ____D () C:\Users\Pc\Desktop\Dokus
2014-02-11 22:23 - 2014-02-17 16:53 - 00000000 ____D () C:\FRST
2014-02-11 22:22 - 2014-02-17 16:53 - 02152448 _____ (Farbar) C:\Users\Pc\Desktop\FRST64.exe
2014-02-11 22:21 - 2014-02-11 22:21 - 00000466 _____ () C:\Windows\SysWOW64\defogger_disable.log
2014-02-11 22:21 - 2014-02-11 22:21 - 00000000 _____ () C:\Users\Pc\defogger_reenable
2014-02-11 21:23 - 2014-02-11 22:00 - 00000000 ____D () C:\ProgramData\SecTaskMan
2014-02-11 21:22 - 2014-02-11 21:23 - 00000000 ____D () C:\Program Files (x86)\Security Task Manager
2014-02-11 21:19 - 2014-02-11 21:20 - 02365840 _____ () C:\Users\Pc\Downloads\SecurityTaskManager_Setup.exe
2014-02-11 21:03 - 2014-02-11 21:03 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\TestApp
2014-02-11 20:58 - 2014-02-11 20:58 - 00001121 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-02-11 20:57 - 2014-02-11 20:57 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Pc\Downloads\mbam-setup-1.75.0.1300(1).exe
2014-02-11 17:54 - 2014-02-12 21:06 - 02539172 _____ () C:\Windows\system32\Drivers\Cat.DB
2014-02-11 17:50 - 2014-02-12 20:59 - 00000000 ____D () C:\ProgramData\PC Tools
2014-02-11 16:54 - 2014-02-11 16:54 - 00000000 ____D () C:\ProgramData\SMR410
2014-02-11 16:50 - 2014-02-11 17:34 - 00000000 ____D () C:\Users\Pc\AppData\Local\NPE
2014-02-11 16:38 - 2014-02-11 16:38 - 00000000 ____D () C:\Windows\System32\Tasks\Norton Internet Security
2014-02-11 16:37 - 2014-02-11 16:37 - 00003234 _____ () C:\Windows\System32\Tasks\Norton WSC Integration
2014-02-11 16:30 - 2013-12-18 21:09 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-02-11 16:30 - 2013-12-18 21:04 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-02-11 16:30 - 2013-12-18 21:04 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-02-11 16:30 - 2013-12-18 21:03 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-02-11 16:29 - 2014-02-11 16:30 - 00005327 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-02-11 16:27 - 2014-02-11 16:32 - 223165336 ____N (Symantec Corporation) C:\Users\Pc\Downloads\NIS_21.1.0.18_SYMTB_TMD_MRFTT_820_10131.exe
2014-02-11 15:59 - 2014-02-11 15:59 - 00003582 _____ () C:\Windows\System32\Tasks\PileFile reminder
2014-02-11 15:59 - 2014-02-11 15:59 - 00003160 _____ () C:\Windows\System32\Tasks\PileFile logon
2014-02-11 15:59 - 2014-02-11 15:59 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Oxy
2014-02-04 16:14 - 2013-06-12 15:15 - 00100864 _____ () C:\Users\Pc\AppData\Roaming\zlib1.dll
2014-02-04 13:49 - 2014-02-04 13:49 - 00347816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\MicrosoftFixit.WinSecurity.FISC.37314945131128502.8.1.Run.exe
2014-02-04 13:42 - 2014-02-04 13:42 - 00347816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\MicrosoftFixit.WindowsFirewall.RNP.Run.exe
2014-02-04 13:09 - 2014-02-13 16:47 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Riot Games
2014-02-04 13:07 - 2014-02-04 13:08 - 34888568 _____ (Riot Games) C:\Users\Pc\Downloads\LeagueofLegends_EUW_Installer_06_12_13.exe
2014-02-04 12:20 - 2014-02-04 12:20 - 00001024 _____ () C:\Windows\SysWOW64\.rnd
2014-02-02 13:32 - 2014-02-02 13:32 - 00000000 ___SH () C:\Users\Pc\AppData\Local\LumaEmu
2014-02-02 13:28 - 2014-02-02 13:28 - 00000000 ____D () C:\Users\Pc\Desktop\RustClient_v19.12.2013
2014-02-02 13:20 - 2014-02-02 13:21 - 06499816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\vcredist_x86.exe
2014-01-29 14:14 - 2014-01-29 14:14 - 00000631 _____ () C:\Windows\system32\InstallUtil.InstallLog
2014-01-21 10:23 - 2014-02-04 12:20 - 00000000 ____D () C:\Users\Pc\AppData\Local\CyberGhost
2014-01-21 10:22 - 2014-01-21 10:27 - 00000000 ____D () C:\Program Files\CyberGhost 5
2014-01-21 10:22 - 2014-01-21 10:23 - 00000000 ____D () C:\Program Files\TAP-Windows
2014-01-21 10:22 - 2014-01-21 10:22 - 00001736 _____ () C:\Users\Pc\Desktop\CyberGhost 5.lnk
2014-01-21 10:21 - 2014-01-21 10:21 - 08566128 _____ (CyberGhost S.R.L. ) C:\Users\Pc\Downloads\CG_5.0.9.8chip.de.exe

==================== One Month Modified Files and Folders =======

2014-02-17 16:54 - 2014-02-17 16:53 - 00015237 _____ () C:\Users\Pc\Desktop\FRST.txt
2014-02-17 16:53 - 2014-02-13 21:35 - 00000000 ____D () C:\Users\Pc\Desktop\FRST-OlderVersion
2014-02-17 16:53 - 2014-02-11 22:23 - 00000000 ____D () C:\FRST
2014-02-17 16:53 - 2014-02-11 22:22 - 02152448 _____ (Farbar) C:\Users\Pc\Desktop\FRST64.exe
2014-02-17 16:21 - 2012-10-18 00:39 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-02-17 16:08 - 2014-02-12 21:00 - 00060928 _____ () C:\Windows\setupact.log
2014-02-17 15:59 - 2013-10-05 14:34 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-02-17 15:47 - 2011-05-10 01:27 - 01092669 _____ () C:\Windows\WindowsUpdate.log
2014-02-17 15:44 - 2011-05-15 23:01 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-02-17 15:43 - 2012-10-18 00:39 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-02-17 15:43 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-16 21:36 - 2012-10-26 13:15 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Skype
2014-02-16 21:36 - 2012-10-20 20:58 - 00000000 ____D () C:\Users\Pc\AppData\Local\PMB Files
2014-02-16 21:36 - 2012-10-20 20:58 - 00000000 ____D () C:\ProgramData\PMB Files
2014-02-16 20:45 - 2014-02-16 20:16 - 523239424 _____ () C:\Users\Pc\Downloads\0utl4st.part4.rar
2014-02-16 19:03 - 2014-02-16 18:33 - 523239424 _____ () C:\Users\Pc\Downloads\0utl4st.part6.rar
2014-02-16 18:32 - 2014-02-16 16:11 - 03398085 _____ () C:\Users\Pc\Downloads\0utl4st.part7.rar
2014-02-16 18:30 - 2012-11-24 19:22 - 00000000 ____D () C:\Program Files (x86)\JDownloader
2014-02-16 17:01 - 2012-10-20 13:46 - 00000000 ____D () C:\Users\Pc\AppData\Local\CrashDumps
2014-02-16 16:11 - 2014-02-16 16:11 - 00000189 _____ () C:\Users\Pc\Downloads\0utl4st_checksums.sfv
2014-02-16 16:10 - 2014-02-16 16:10 - 03610608 _____ () C:\Users\Pc\Downloads\0utl4st.part2.rar.part
2014-02-16 13:27 - 2009-07-14 11:54 - 00710502 _____ () C:\Windows\system32\perfh007.dat
2014-02-16 13:27 - 2009-07-14 11:54 - 00154832 _____ () C:\Windows\system32\perfc007.dat
2014-02-16 13:27 - 2009-07-14 06:13 - 01651686 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-15 21:03 - 2012-10-28 12:40 - 00000000 ____D () C:\AeriaGames
2014-02-15 20:38 - 2014-02-15 20:38 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-02-15 20:36 - 2014-02-15 20:36 - 02347384 _____ (ESET) C:\Users\Pc\Downloads\esetsmartinstaller_enu.exe
2014-02-15 20:35 - 2012-10-18 00:39 - 00000000 ____D () C:\Users\Pc\AppData\Local\Google
2014-02-15 20:35 - 2012-10-18 00:39 - 00000000 ____D () C:\Program Files (x86)\Google
2014-02-15 20:31 - 2014-02-11 22:27 - 00000000 ____D () C:\Users\Pc\Desktop\Dokus
2014-02-15 14:17 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-02-15 14:14 - 2013-08-20 18:51 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-02-14 22:09 - 2012-10-26 14:14 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\TS3Client
2014-02-14 14:24 - 2014-02-14 14:24 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-02-13 22:32 - 2013-12-27 22:18 - 00000000 ____D () C:\Users\Pc\AppData\Local\Apps\2.0
2014-02-13 22:16 - 2014-02-13 22:16 - 00000000 ____D () C:\Windows\ERUNT
2014-02-13 22:13 - 2014-02-13 22:13 - 01037530 _____ (Thisisu) C:\Users\Pc\Desktop\JRT.exe
2014-02-13 22:11 - 2013-05-21 18:37 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Codec Pack Packages
2014-02-13 22:05 - 2014-02-13 21:51 - 00000000 ____D () C:\AdwCleaner
2014-02-13 21:59 - 2014-02-12 21:18 - 00110882 _____ () C:\Windows\PFRO.log
2014-02-13 21:51 - 2014-02-13 21:51 - 01166132 _____ () C:\Users\Pc\Desktop\adwcleaner.exe
2014-02-13 21:36 - 2012-09-28 18:04 - 00000000 ____D () C:\Users\Pc
2014-02-13 21:19 - 2014-02-13 21:19 - 01243588 _____ () C:\Users\Pc\Downloads\ProcessExplorer.zip
2014-02-13 19:45 - 2013-12-30 14:50 - 00000000 ____D () C:\Program Files (x86)\Wargame AirLand Battle
2014-02-13 19:44 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2014-02-13 16:47 - 2014-02-04 13:09 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Riot Games
2014-02-13 16:43 - 2014-02-13 16:43 - 00001613 _____ () C:\Users\Public\Desktop\Play League of Legends.lnk
2014-02-13 16:41 - 2014-02-13 16:40 - 34888568 _____ (Riot Games) C:\Users\Pc\Downloads\LeagueofLegends_EUW_Installer_06_12_13(1).exe
2014-02-13 16:41 - 2014-02-13 16:40 - 32229024 _____ (Riot Games) C:\Users\Pc\Downloads\LeagueofLegends_NA_Installer_05_07_13.exe
2014-02-13 15:43 - 2014-02-13 15:11 - 760671830 _____ () C:\Users\Pc\Downloads\Narutowip2.rar
2014-02-13 15:40 - 2014-02-13 15:18 - 347645656 _____ () C:\Users\Pc\Downloads\2.0_Music.rar
2014-02-13 15:19 - 2014-02-13 15:16 - 29934138 _____ () C:\Users\Pc\Downloads\narutowippatch.14.zip
2014-02-13 15:17 - 2014-02-13 15:17 - 03067492 _____ () C:\Users\Pc\Downloads\narutosource.rar
2014-02-13 14:36 - 2014-02-13 14:36 - 04102163 _____ () C:\Users\Pc\Downloads\tdsskiller.zip
2014-02-13 14:30 - 2014-02-12 19:36 - 00000000 ____D () C:\Qoobox
2014-02-13 14:29 - 2014-02-13 14:29 - 00043125 _____ () C:\ComboFix.txt
2014-02-13 14:18 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2014-02-13 14:16 - 2014-02-12 18:58 - 00000000 ____D () C:\Windows\erdnt
2014-02-13 14:15 - 2012-09-28 18:06 - 00000000 ___RD () C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-02-13 13:50 - 2014-02-13 13:51 - 05180679 ____R (Swearware) C:\Users\Pc\Desktop\ComboFix.exe
2014-02-13 13:50 - 2014-02-13 13:49 - 05180679 _____ (Swearware) C:\Users\Pc\Downloads\ComboFix.exe
2014-02-12 23:12 - 2009-07-14 05:45 - 00010784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-12 23:12 - 2009-07-14 05:45 - 00010784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-12 22:27 - 2014-02-12 22:27 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Avira
2014-02-12 22:24 - 2014-02-12 22:24 - 00002078 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2014-02-12 22:23 - 2014-02-12 22:23 - 00000000 ____D () C:\ProgramData\Avira
2014-02-12 22:23 - 2014-02-12 22:23 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-02-12 22:08 - 2014-02-12 22:04 - 139704984 _____ () C:\Users\Pc\Downloads\avira_ultimate_protection_suite_de.exe
2014-02-12 22:05 - 2014-02-12 22:05 - 00264757 _____ () C:\Users\Pc\Downloads\FHSetup.exe
2014-02-12 22:05 - 2014-02-12 22:05 - 00001981 _____ () C:\Users\Pc\Desktop\Update Checker.lnk
2014-02-12 22:05 - 2014-02-12 22:05 - 00000000 ____D () C:\Program Files (x86)\FileHippo.com
2014-02-12 21:54 - 2014-02-12 21:54 - 00007674 _____ () C:\Users\Pc\AppData\Local\Resmon.ResmonCfg
2014-02-12 21:16 - 2013-08-14 22:07 - 00000000 ____D () C:\Windows\system32\MRT
2014-02-12 21:10 - 2012-10-18 05:30 - 88567024 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-02-12 21:07 - 2012-12-18 19:29 - 01625030 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-02-12 21:06 - 2014-02-11 17:54 - 02539172 _____ () C:\Windows\system32\Drivers\Cat.DB
2014-02-12 21:00 - 2014-02-12 21:00 - 00000000 _____ () C:\Windows\setuperr.log
2014-02-12 20:59 - 2014-02-11 17:50 - 00000000 ____D () C:\ProgramData\PC Tools
2014-02-12 20:56 - 2013-10-05 14:34 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-02-12 20:56 - 2012-10-17 23:45 - 00000000 ____D () C:\Users\Pc\AppData\Local\Adobe
2014-02-12 20:55 - 2012-12-10 18:25 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-02-12 20:55 - 2012-12-10 18:25 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-02-12 20:52 - 2012-10-18 15:02 - 00000000 ____D () C:\Windows\Minidump
2014-02-12 19:44 - 2012-10-18 00:43 - 00000000 ____D () C:\ProgramData\Norton
2014-02-12 16:59 - 2013-04-07 21:02 - 00000000 ____D () C:\Users\Pc\Documents\Mount&Blade Warband Savegames
2014-02-12 16:05 - 2014-02-12 15:21 - 1064637787 _____ () C:\Users\Pc\Downloads\Naruto2.1.rar
2014-02-12 14:12 - 2014-02-12 14:12 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dll Suite 2013
2014-02-12 14:12 - 2014-02-12 14:12 - 00000000 ____D () C:\Program Files (x86)\DLLSuite
2014-02-12 14:11 - 2014-02-12 14:10 - 16588429 _____ ( ) C:\Users\Pc\Downloads\DLLSuite_Setup.exe
2014-02-12 13:02 - 2014-02-12 12:30 - 1312122312 _____ () C:\Users\Pc\Downloads\ACOK_1.11.rar
2014-02-12 12:27 - 2014-02-12 12:27 - 00001152 _____ () C:\Users\Pc\Desktop\Mount&Blade Warband.lnk
2014-02-12 12:24 - 2013-04-07 16:18 - 00000000 ____D () C:\Program Files (x86)\Mount&Blade Warband
2014-02-12 12:18 - 2014-02-12 12:03 - 615004486 _____ () C:\Users\Pc\Downloads\mb_warband_setup_1158.exe
2014-02-12 11:39 - 2014-02-12 11:22 - 53254767 _____ () C:\Users\Pc\Downloads\LoLRADS_EUW_german.zip
2014-02-12 11:02 - 2013-12-30 17:30 - 00000000 ____D () C:\Program Files (x86)\Supreme Commander 2
2014-02-12 08:31 - 2012-10-19 17:25 - 01008640 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll
2014-02-12 08:31 - 2012-10-19 17:25 - 00833024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user32.dll
2014-02-12 08:31 - 2012-10-19 17:25 - 00419840 _____ (Microsoft Corporation) C:\Windows\system32\systemcpl.dll
2014-02-12 08:31 - 2012-10-19 17:25 - 00014848 _____ (Microsoft Corporation) C:\Windows\system32\slwga.dll
2014-02-12 08:31 - 2012-10-19 17:25 - 00013824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\slwga.dll
2014-02-11 22:21 - 2014-02-11 22:21 - 00000466 _____ () C:\Windows\SysWOW64\defogger_disable.log
2014-02-11 22:21 - 2014-02-11 22:21 - 00000000 _____ () C:\Users\Pc\defogger_reenable
2014-02-11 22:00 - 2014-02-11 21:23 - 00000000 ____D () C:\ProgramData\SecTaskMan
2014-02-11 21:23 - 2014-02-11 21:22 - 00000000 ____D () C:\Program Files (x86)\Security Task Manager
2014-02-11 21:20 - 2014-02-11 21:19 - 02365840 _____ () C:\Users\Pc\Downloads\SecurityTaskManager_Setup.exe
2014-02-11 21:03 - 2014-02-11 21:03 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\TestApp
2014-02-11 20:58 - 2014-02-11 20:58 - 00001121 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-02-11 20:58 - 2013-08-20 16:44 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-02-11 20:57 - 2014-02-11 20:57 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Pc\Downloads\mbam-setup-1.75.0.1300(1).exe
2014-02-11 17:34 - 2014-02-11 16:50 - 00000000 ____D () C:\Users\Pc\AppData\Local\NPE
2014-02-11 16:55 - 2012-12-20 15:52 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-02-11 16:54 - 2014-02-11 16:54 - 00000000 ____D () C:\ProgramData\SMR410
2014-02-11 16:38 - 2014-02-11 16:38 - 00000000 ____D () C:\Windows\System32\Tasks\Norton Internet Security
2014-02-11 16:37 - 2014-02-11 16:37 - 00003234 _____ () C:\Windows\System32\Tasks\Norton WSC Integration
2014-02-11 16:35 - 2013-07-29 11:35 - 00000196 _____ () C:\Users\Pc\AppData\Roaming\WB.CFG
2014-02-11 16:32 - 2014-02-11 16:27 - 223165336 ____N (Symantec Corporation) C:\Users\Pc\Downloads\NIS_21.1.0.18_SYMTB_TMD_MRFTT_820_10131.exe
2014-02-11 16:32 - 2013-10-20 11:29 - 00000000 ____D () C:\ProgramData\Oracle
2014-02-11 16:30 - 2014-02-11 16:29 - 00005327 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-02-11 16:30 - 2013-07-20 17:55 - 00000000 ____D () C:\Program Files (x86)\Java
2014-02-11 16:03 - 2013-02-23 20:05 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-02-11 16:03 - 2012-11-10 17:56 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\DAEMON Tools Lite
2014-02-11 16:03 - 2012-11-02 19:39 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\uTorrent
2014-02-11 15:59 - 2014-02-11 15:59 - 00003582 _____ () C:\Windows\System32\Tasks\PileFile reminder
2014-02-11 15:59 - 2014-02-11 15:59 - 00003160 _____ () C:\Windows\System32\Tasks\PileFile logon
2014-02-11 15:59 - 2014-02-11 15:59 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Oxy
2014-02-10 23:37 - 2014-02-13 14:36 - 04122976 _____ (Kaspersky Lab ZAO) C:\Users\Pc\Desktop\TDSSKiller.exe
2014-02-07 17:18 - 2013-09-14 20:24 - 00000424 _____ () C:\Users\Pc\Desktop\Accounts.txt
2014-02-06 13:16 - 2014-02-12 21:03 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-06 12:30 - 2014-02-12 21:03 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-06 12:30 - 2014-02-12 21:03 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-02-06 12:12 - 2014-02-12 21:03 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-06 12:07 - 2014-02-12 21:03 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-02-06 12:06 - 2014-02-12 21:03 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-02-06 11:57 - 2014-02-12 21:03 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-06 11:56 - 2014-02-12 21:03 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-02-06 11:52 - 2014-02-12 21:03 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-02-06 11:49 - 2014-02-12 21:03 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-06 11:48 - 2014-02-12 21:03 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-02-06 11:48 - 2014-02-12 21:03 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-02-06 11:38 - 2014-02-12 21:03 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-02-06 11:32 - 2014-02-12 21:03 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-02-06 11:20 - 2014-02-12 21:03 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-02-06 11:17 - 2014-02-12 21:03 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-02-06 11:11 - 2014-02-12 21:03 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-06 11:01 - 2014-02-12 21:03 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-02-06 11:00 - 2014-02-12 21:03 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-02-06 10:57 - 2014-02-12 21:03 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-02-06 10:57 - 2014-02-12 21:03 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-06 10:52 - 2014-02-12 21:03 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-02-06 10:52 - 2014-02-12 21:03 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-02-06 10:50 - 2014-02-12 21:03 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-06 10:49 - 2014-02-12 21:03 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-02-06 10:47 - 2014-02-12 21:03 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-02-06 10:46 - 2014-02-12 21:03 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-02-06 10:25 - 2014-02-12 21:03 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-02-06 10:25 - 2014-02-12 21:03 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-02-06 10:24 - 2014-02-12 21:03 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-06 10:22 - 2014-02-12 21:03 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-06 10:13 - 2014-02-12 21:03 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-02-06 10:09 - 2014-02-12 21:03 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-02-06 10:03 - 2014-02-12 21:03 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-02-06 09:55 - 2014-02-12 21:03 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-06 09:41 - 2014-02-12 21:03 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-02-06 09:40 - 2014-02-12 21:03 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-02-06 09:36 - 2014-02-12 21:03 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-02-06 09:34 - 2014-02-12 21:03 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-02-05 12:36 - 2013-12-28 11:49 - 00291128 _____ () C:\Windows\SysWOW64\PnkBstrB.xtr
2014-02-05 12:36 - 2013-08-18 17:42 - 00291128 _____ () C:\Windows\SysWOW64\PnkBstrB.exe
2014-02-04 15:46 - 2013-08-18 17:42 - 00291128 _____ () C:\Windows\SysWOW64\PnkBstrB.ex0
2014-02-04 13:49 - 2014-02-04 13:49 - 00347816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\MicrosoftFixit.WinSecurity.FISC.37314945131128502.8.1.Run.exe
2014-02-04 13:42 - 2014-02-04 13:42 - 00347816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\MicrosoftFixit.WindowsFirewall.RNP.Run.exe
2014-02-04 13:08 - 2014-02-04 13:07 - 34888568 _____ (Riot Games) C:\Users\Pc\Downloads\LeagueofLegends_EUW_Installer_06_12_13.exe
2014-02-04 12:20 - 2014-02-04 12:20 - 00001024 _____ () C:\Windows\SysWOW64\.rnd
2014-02-04 12:20 - 2014-01-21 10:23 - 00000000 ____D () C:\Users\Pc\AppData\Local\CyberGhost
2014-02-02 13:32 - 2014-02-02 13:32 - 00000000 ___SH () C:\Users\Pc\AppData\Local\LumaEmu
2014-02-02 13:28 - 2014-02-02 13:28 - 00000000 ____D () C:\Users\Pc\Desktop\RustClient_v19.12.2013
2014-02-02 13:27 - 2013-02-05 20:06 - 00000000 ____D () C:\Users\Pc\Desktop\Spiele
2014-02-02 13:21 - 2014-02-02 13:20 - 06499816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\vcredist_x86.exe
2014-02-02 13:21 - 2013-08-18 17:43 - 00000000 ____D () C:\ProgramData\Package Cache
2014-02-01 11:35 - 2013-06-17 13:35 - 00000005 _____ () C:\Users\Pc\AppData\Roaming\WBPU-TTL.DAT
2014-01-29 14:14 - 2014-01-29 14:14 - 00000631 _____ () C:\Windows\system32\InstallUtil.InstallLog
2014-01-25 14:59 - 2012-10-17 23:53 - 00003906 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{9DE29845-AC8C-4418-B415-05000DEA2E9F}
2014-01-24 22:17 - 2013-08-18 17:42 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2014-01-24 22:12 - 2013-12-27 22:18 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ubisoft
2014-01-24 22:12 - 2013-12-27 22:18 - 00000000 ____D () C:\Users\Pc\AppData\Local\Deployment
2014-01-23 21:18 - 2013-02-25 14:23 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Spotify
2014-01-23 21:01 - 2013-02-25 14:24 - 00000000 ____D () C:\Users\Pc\AppData\Local\Spotify
2014-01-21 10:27 - 2014-01-21 10:22 - 00000000 ____D () C:\Program Files\CyberGhost 5
2014-01-21 10:23 - 2014-01-21 10:22 - 00000000 ____D () C:\Program Files\TAP-Windows
2014-01-21 10:22 - 2014-01-21 10:22 - 00001736 _____ () C:\Users\Pc\Desktop\CyberGhost 5.lnk
2014-01-21 10:21 - 2014-01-21 10:21 - 08566128 _____ (CyberGhost S.R.L. ) C:\Users\Pc\Downloads\CG_5.0.9.8chip.de.exe

Some content of TEMP:
====================
C:\Users\Pc\AppData\Local\Temp\avgnt.exe
C:\Users\Pc\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-02-11 14:00

==================== End Of Log ============================
         

--- --- ---

--- --- ---

--- --- ---

--- --- ---

--- --- ---

--- --- ---

Ich habe Eset 8 Stunden lang laufen gelassen und es erreichte 95 %. Danach wurde es beendet und ich hatte um ehrlich zu sein, keine Lust mehr es erneut zu starten. Wenn es nötig ist, kann ich den Vorgang nochmal wiederholen.Es wurden zwar 5 Infektionen gefunden, aber ich hatte nicht die Möglichkeit diese zu entfernen.

Ne, musst du nicht. Von den "Funden" waren die meisten schon in Quarantäne und gelöscht, bzw. ein Fehlalarm und was in den temporären Ordnern (also alles gut).

Außerdem bestehen die beschriebenen Probleme weiterhin (Siehe Anhang).

Welches Problem? Du hast mir keins beschrieben. Ist dein PC spürbar langsamer als vorher? Der von dir gezeigte Prozess ist völlig legitim und häufig auf Rechnern zu finden (wäre dieser schädlich, hätte ich den schon vorher gefixt ): http://www.akamai.de/html/solutions/client_faq.html. Auch das der svchost.exe Prozess mehrmals läuft ist normal. Kein Grund zur Sorge. Gibt es noch weitere Probleme, startet deine Firewall wieder?

Achso. Weitere Probleme gibt es nicht. Mein Pc läuft jetzt wieder schnell und die Probleme wurden behoben. Mir macht nur die Auslastung zu schaffen. Ich bin mir nicht sicher, ob es auch früher schon so war. Größere Programme wie Spiele, verbrauchen mehr als 1GB RAM. In diesen Fällen nimmt dann auch die Geschwindigkeit stark ab. Falls dies "normal" sein sollte, dann bedanke ich mich bei dir für die Hilfe .

Redblood