Hallo leider stürzen seit kurzer Zeit viele Programme einfach ab Vlc player ,Media Monkey win 7 64 bit Avira findet nichts deshalb habe ich

glat · 25.05.2014, 15:32

OTL logfile created on: 25.05.2014 15:57:42 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\hw\Downloads
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.11.9600.17041)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

7,94 Gb Total Physical Memory | 4,98 Gb Available Physical Memory | 62,67% Memory free
15,88 Gb Paging File | 12,59 Gb Available in Paging File | 79,29% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 1851,64 Gb Total Space | 1753,78 Gb Free Space | 94,72% Space Free | Partition Type: NTFS
Drive E: | 74,53 Gb Total Space | 12,01 Gb Free Space | 16,11% Space Free | Partition Type: NTFS
Drive F: | 698,46 Gb Total Space | 117,17 Gb Free Space | 16,78% Space Free | Partition Type: FAT32
Drive G: | 465,76 Gb Total Space | 105,74 Gb Free Space | 22,70% Space Free | Partition Type: NTFS
Drive H: | 931,28 Gb Total Space | 164,08 Gb Free Space | 17,62% Space Free | Partition Type: FAT32

Computer Name: HW-PC | User Name: hw | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\hw\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Users\hw\AppData\Local\Temp\838.exe ()
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avscan.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe (Adobe Systems, Inc.)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe (Star Finanz-Software Entwicklung und Vertriebs GmbH)
PRC - C:\Program Files (x86)\PDF Architect\HelperService.exe (pdfforge GmbH)
PRC - C:\Program Files (x86)\PDF Architect\ConversionService.exe (pdfforge GmbH)
PRC - C:\Windows\SysWOW64\cmd.exe (Microsoft Corporation)
PRC - C:\Program Files (x86)\TheraPlus\db\Sybase\BIN32\dbsrv11.exe (iAnywhere Solutions, Inc.)
PRC - C:\Program Files (x86)\TheraPlus\java\bin\java.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files (x86)\TheraPlus\server\bin\jbosssvc.exe (Red Hat®, Inc.)
PRC - C:\Windows\Samsung\PanelMgr\SSMMgr.exe ()

========== Modules (No Company Name) ==========

MOD - C:\Users\hw\AppData\Local\Temp\838.exe ()
MOD - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ()
MOD - C:\Programme\TeraCopy\TeraCopyExt.dll ()
MOD - C:\Windows\Samsung\PanelMgr\SSMMgr.exe ()

========== Services (SafeList) ==========

SRV:64bit: - (IEEtwCollectorService) -- C:\Windows\SysNative\IEEtwCollector.exe (Microsoft Corporation)
SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirWebService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirMailService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirFirewallService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe (Avira Operations GmbH & Co. KG)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (StarMoney 9.0 OnlineUpdate) -- C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe (Star Finanz-Software Entwicklung und Vertriebs GmbH)
SRV - (ose64) -- C:\Programme\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (PDF Architect Helper Service) -- C:\Program Files (x86)\PDF Architect\HelperService.exe (pdfforge GmbH)
SRV - (PDF Architect Service) -- C:\Program Files (x86)\PDF Architect\ConversionService.exe (pdfforge GmbH)
SRV - (osppsvc) -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Corporation)
SRV - (wlidsvc) -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (SQLANYs_theraplus) -- C:\Program Files (x86)\TheraPlus\db\Sybase\BIN32\dbsrv11.exe (iAnywhere Solutions, Inc.)
SRV - (TPSERVER) -- C:\Program Files (x86)\TheraPlus\server\bin\jbosssvc.exe (Red Hat®, Inc.)

========== Driver Services (SafeList) ==========

DRV:64bit: - (acedrv11) -- C:\Windows\SysNative\drivers\acedrv11.sys (Protect Software GmbH)
DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira Operations GmbH & Co. KG)
DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira Operations GmbH & Co. KG)
DRV:64bit: - (avnetflt) -- C:\Windows\SysNative\drivers\avnetflt.sys (Avira Operations GmbH & Co. KG)
DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira Operations GmbH & Co. KG)
DRV:64bit: - (avfwot) -- C:\Windows\SysNative\drivers\avfwot.sys (Avira GmbH)
DRV:64bit: - (avfwim) -- C:\Windows\SysNative\drivers\avfwim.sys (Avira GmbH)
DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (AtiHDAudioService) -- C:\Windows\SysNative\drivers\AtihdW76.sys (Advanced Micro Devices)
DRV:64bit: - (VClone) -- C:\Windows\SysNative\drivers\VClone.sys (Elaborate Bytes AG)
DRV:64bit: - (amd_xata) -- C:\Windows\SysNative\drivers\amd_xata.sys (Advanced Micro Devices)
DRV:64bit: - (amd_sata) -- C:\Windows\SysNative\drivers\amd_sata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxhc) -- C:\Windows\SysNative\drivers\amdxhc.sys (Advanced Micro Devices, INC.)
DRV:64bit: - (amdkmpfd) -- C:\Windows\SysNative\drivers\amdkmpfd.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (ElbyCDIO) -- C:\Windows\SysNative\drivers\ElbyCDIO.sys (Elaborate Bytes AG)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek )
DRV:64bit: - (fssfltr) -- C:\Windows\SysNative\drivers\fssfltr.sys (Microsoft Corporation)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (dmvsc) -- C:\Windows\SysNative\drivers\dmvsc.sys (Microsoft Corporation)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbGD) -- C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (SSPORT) -- C:\Windows\SysNative\drivers\SSPORT.SYS (Samsung Electronics)
DRV:64bit: - (DgiVecp) -- C:\Windows\SysNative\drivers\DGIVECP.SYS (Samsung Electronics Co., Ltd.)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
DRV - (DgiVecp) -- C:\Windows\SysWOW64\drivers\DGIVECP.SYS (Samsung Electronics Co., Ltd.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{9D3302CB-173B-43D8-9AA6-E9A36588075B}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=IE9TR&src=IE9TR&pc=MASBJS
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{9D3302CB-173B-43D8-9AA6-E9A36588075B}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=IE9TR&src=IE9TR&pc=MASBJS

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://localoem.msn.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://localoem.msn.com
IE - HKCU\..\SearchScopes,DefaultScope = {9D3302CB-173B-43D8-9AA6-E9A36588075B}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:29.0.1
FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/Lync,version=15.0: C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=16.4.3505.0912: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.1.2: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.1.3: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\FFPDFArchitectConverter@pdfarchitect.com: C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt [2014.03.22 23:07:16 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 29.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 29.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2014.05.11 14:43:56 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 29.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 29.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2014.05.11 14:43:56 | 000,000,000 | ---D | M]

[2014.03.26 12:34:58 | 000,000,000 | ---D | M] (No name found) -- C:\Users\hw\AppData\Roaming\mozilla\Extensions
[2014.05.21 10:24:16 | 000,000,000 | ---D | M] (No name found) -- C:\Users\hw\AppData\Roaming\mozilla\Firefox\Profiles\84cuywaq.default-1400660170003\extensions
[2014.05.11 14:43:56 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\browser\extensions
[2014.05.11 14:44:01 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\mozilla firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2014.03.03 01:49:30 | 000,034,072 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll

O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Lync Browser Helper) - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Programme\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
O2:64bit: - BHO: (Microsoft SkyDrive Pro Browser Helper) - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Programme\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (PDF Architect Helper) - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GmbH)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office15\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Microsoft SkyDrive Pro Browser Helper) - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\PROGRA~2\MICROS~1\Office15\GROOVEEX.DLL (Microsoft Corporation)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (PDF Architect Toolbar) - {25A3A431-30BB-47C8-AD6A-E1063801134F} - C:\Program Files (x86)\PDF Architect\PDFIEPlugin.dll (pdfforge GmbH)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Samsung PanelMgr] C:\Windows\Samsung\PanelMgr\SSMMgr.exe ()
O4 - HKCU..\Run: [ccleaner] F:\DATEN Rechner\Lokaler Datenträger (C)\Dokumente und Einstellungen\Dokumente und Einstellungen\Programme\CCleaner\CCleaner.exe (Piriform Ltd)
O4 - HKCU..\Run: [w1Synt] C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe (Microsoft Corporation)
O4 - HKCU..\Run: [Windows Update Service] C:\ProgramData\Windows Update Service0\gtqadjqbe.exe (Internet Download Manager, Tonec Inc.)
O4 - Startup: C:\Users\hw\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Outlook 2013.lnk = C:\Windows\Installer\{91150000-0011-0000-1000-0000000FF1CE}\outicon.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: An OneNote s&enden - C:\Programme\Microsoft Office\Office15\ONBttnIE.dll (Microsoft Corporation)
O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Programme\Microsoft Office\Office15\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: An OneNote s&enden - C:\Programme\Microsoft Office\Office15\ONBttnIE.dll (Microsoft Corporation)
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Programme\Microsoft Office\Office15\EXCEL.EXE (Microsoft Corporation)
O9:64bit: - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office15\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office15\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra Button: Lync: Anruf per Mausklick - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Programme\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : Lync: Anruf per Mausklick - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Programme\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
O9:64bit: - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office15\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office15\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A1424DDD-2456-4B47-9FA8-73C3E21304F6}: DhcpNameServer = 192.168.178.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\osf {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Programme\Microsoft Office\Office15\MSOSB.DLL (Microsoft Corporation)
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Filter\text/xml {807583E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE15\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2014.05.22 10:37:33 | 000,000,000 | ---D | C] -- C:\Users\hw\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
[2014.05.22 10:37:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
[2014.05.22 10:37:30 | 000,000,000 | ---D | C] -- C:\Program Files\WinRAR
[2014.05.21 22:30:56 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft.NET
[2014.05.21 10:07:30 | 000,000,000 | ---D | C] -- C:\Users\hw\Desktop\Alte Firefox-Daten
[2014.05.21 08:37:50 | 000,000,000 | ---D | C] -- C:\Windows\pss
[2014.05.21 08:24:18 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\MetArt_2014-04-03_CONDATIS-KEI-A-by-RYLSKY_175ac_med
[2014.05.17 23:01:18 | 000,000,000 | -HSD | C] -- C:\ProgramData\Windows Update Service0
[2014.05.15 08:41:49 | 000,084,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2014.05.15 08:41:49 | 000,069,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2014.05.15 08:36:39 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\DESIGNER
[2014.05.14 13:39:26 | 000,000,000 | ---D | C] -- C:\Users\hw\AppData\Roaming\WinRAR
[2014.05.14 12:50:25 | 000,477,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\aepdu.dll
[2014.05.14 12:50:25 | 000,424,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\aeinv.dll
[2014.05.14 12:50:12 | 001,460,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\lsasrv.dll
[2014.05.14 12:50:11 | 005,550,016 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe
[2014.05.14 12:50:11 | 003,969,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe
[2014.05.14 12:50:11 | 003,914,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe
[2014.05.14 12:50:11 | 000,722,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\objsel.dll
[2014.05.14 12:50:11 | 000,538,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\objsel.dll
[2014.05.14 12:50:11 | 000,455,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winlogon.exe
[2014.05.14 12:50:11 | 000,424,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\KernelBase.dll
[2014.05.14 12:50:10 | 000,136,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\sspicli.dll
[2014.05.14 12:50:10 | 000,057,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cngprovider.dll
[2014.05.14 12:50:10 | 000,056,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\adprovider.dll
[2014.05.14 12:50:10 | 000,053,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\capiprovider.dll
[2014.05.14 12:50:10 | 000,052,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dpapiprovider.dll
[2014.05.14 12:50:10 | 000,051,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\cngprovider.dll
[2014.05.14 12:50:10 | 000,049,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\adprovider.dll
[2014.05.14 12:50:10 | 000,048,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\capiprovider.dll
[2014.05.14 12:50:10 | 000,047,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\dpapiprovider.dll
[2014.05.14 12:50:10 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dimsroam.dll
[2014.05.14 12:50:10 | 000,039,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wincredprovider.dll
[2014.05.14 12:50:10 | 000,036,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\dimsroam.dll
[2014.05.14 12:50:10 | 000,035,328 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wincredprovider.dll
[2014.05.14 12:50:10 | 000,029,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\sspisrv.dll
[2014.05.14 12:50:10 | 000,028,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\secur32.dll
[2014.05.11 14:43:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2014.05.08 23:24:53 | 000,000,000 | -HSD | C] -- C:\Users\hw\AppData\Local\EmieUserList
[2014.05.08 23:24:53 | 000,000,000 | -HSD | C] -- C:\Users\hw\AppData\Local\EmieSiteList
[2014.05.07 12:23:14 | 000,335,288 | ---- | C] (Protect Software GmbH) -- C:\Windows\SysNative\drivers\acedrv11.sys
[2014.05.07 12:23:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ProtectDisc Driver Installer
[2014.05.07 12:23:11 | 000,000,000 | ---D | C] -- C:\Users\hw\AppData\Roaming\ProtectDisc
[2014.05.07 12:22:06 | 000,509,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_2.dll
[2014.05.07 12:22:06 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_2.dll
[2014.05.07 12:22:06 | 000,177,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_2.dll
[2014.05.07 12:22:06 | 000,068,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_1.dll
[2014.05.07 12:22:05 | 001,942,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_39.dll
[2014.05.07 12:22:05 | 001,493,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_39.dll
[2014.05.07 12:22:05 | 000,540,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_39.dll
[2014.05.07 12:22:05 | 000,467,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_39.dll
[2014.05.07 12:22:04 | 004,992,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_39.dll
[2014.05.07 12:22:04 | 003,851,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_39.dll
[2014.05.07 12:22:04 | 001,491,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_38.dll
[2014.05.07 12:22:04 | 000,511,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_1.dll
[2014.05.07 12:22:04 | 000,507,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_1.dll
[2014.05.07 12:22:04 | 000,467,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_38.dll
[2014.05.07 12:22:04 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_1.dll
[2014.05.07 12:22:04 | 000,177,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_1.dll
[2014.05.07 12:22:04 | 000,068,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_0.dll
[2014.05.07 12:22:04 | 000,065,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_0.dll
[2014.05.07 12:22:04 | 000,025,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\X3DAudio1_4.dll
[2014.05.07 12:22:03 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_0.dll
[2014.05.07 12:22:03 | 000,177,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_0.dll
[2014.05.07 12:22:02 | 003,786,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_37.dll
[2014.05.07 12:22:02 | 000,411,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_10.dll
[2014.05.07 12:22:02 | 000,267,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_10.dll
[2014.05.07 12:22:01 | 002,006,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_36.dll
[2014.05.07 12:22:01 | 000,508,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_36.dll
[2014.05.07 12:22:00 | 001,358,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_35.dll
[2014.05.07 12:22:00 | 000,444,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_35.dll
[2014.05.07 12:21:59 | 001,401,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_34.dll
[2014.05.07 12:21:59 | 001,124,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_34.dll
[2014.05.07 12:21:59 | 000,506,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_34.dll
[2014.05.07 12:21:59 | 000,443,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_34.dll
[2014.05.07 12:21:59 | 000,409,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_8.dll
[2014.05.07 12:21:59 | 000,266,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_8.dll
[2014.05.07 12:21:59 | 000,021,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\X3DAudio1_2.dll
[2014.05.07 12:21:58 | 004,494,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_33.dll
[2014.05.07 12:21:58 | 000,403,304 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_7.dll
[2014.05.07 12:21:58 | 000,107,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xinput1_3.dll
[2014.05.07 12:21:57 | 000,440,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10.dll
[2014.05.07 12:21:57 | 000,393,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_6.dll
[2014.05.07 12:21:57 | 000,390,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_5.dll
[2014.05.07 12:21:57 | 000,251,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_5.dll
[2014.05.07 12:21:56 | 003,977,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_31.dll
[2014.05.07 12:21:56 | 002,414,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_31.dll
[2014.05.07 12:21:56 | 000,363,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_3.dll
[2014.05.07 12:21:56 | 000,237,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_4.dll
[2014.05.07 12:21:56 | 000,236,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_3.dll
[2014.05.07 12:21:56 | 000,083,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xinput1_2.dll
[2014.05.07 12:21:56 | 000,062,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xinput1_2.dll
[2014.05.07 12:21:56 | 000,017,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\x3daudio1_1.dll
[2014.05.07 11:49:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Elaborate Bytes
[2014.05.07 11:49:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Elaborate Bytes
[2014.05.07 00:36:51 | 000,000,000 | --SD | C] -- C:\Windows\SysNative\CompatTel
[2014.05.03 21:43:24 | 000,000,000 | ---D | C] -- C:\Users\hw\AppData\Roaming\dvdcss
[2014.05.02 22:09:59 | 000,000,000 | ---D | C] -- C:\Users\hw\AppData\Local\Apps
[2014.04.28 09:47:29 | 000,000,000 | ---D | C] -- C:\Users\hw\AppData\Roaming\Foxit Software
[2014.04.27 18:31:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Foxit Reader
[2014.04.27 18:31:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Foxit Software
[2014.04.27 18:31:11 | 000,000,000 | ---D | C] -- C:\ProgramData\StarMoney 9.0
[2014.04.27 18:31:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StarMoney 9.0
[2014.04.27 18:30:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Business Objects
[2014.04.27 18:30:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\StarMoney 9.0
[2014.04.27 18:30:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\StarFinanz
[2014.04.26 20:43:21 | 000,000,000 | ---D | C] -- C:\Users\hw\AppData\Roaming\UseNeXT
[2014.04.26 20:43:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UseNeXT
[2014.04.26 20:43:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\UseNeXT
[38 C:\Users\hw\Documents\*.tmp files -> C:\Users\hw\Documents\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2014.05.25 15:54:57 | 000,021,680 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2014.05.25 15:54:57 | 000,021,680 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2014.05.25 15:49:02 | 000,271,360 | ---- | M] () -- C:\Users\hw\Documents\archive.pst
[2014.05.25 15:17:04 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2014.05.25 14:51:10 | 001,643,090 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2014.05.25 14:51:10 | 000,730,564 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2014.05.25 14:51:10 | 000,679,854 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2014.05.25 14:51:10 | 000,128,702 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2014.05.25 14:51:10 | 000,108,980 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2014.05.25 14:46:51 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2014.05.25 14:46:49 | 2100,936,703 | -HS- | M] () -- C:\hiberfil.sys
[2014.05.22 10:11:23 | 000,001,634 | ---- | M] () -- C:\Users\hw\Desktop\CCleaner - Verknüpfung.lnk
[2014.05.22 09:28:58 | 000,001,926 | ---- | M] () -- C:\Users\hw\Desktop\TheraPlus.lnk
[2014.05.21 23:39:00 | 000,017,802 | ---- | M] () -- C:\Users\hw\Documents\cc_20140521_233832 neu.reg
[2014.05.21 22:37:43 | 000,439,640 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2014.05.21 14:46:40 | 000,671,180 | ---- | M] () -- C:\Users\hw\Documents\DSCF6174.pdf
[2014.05.21 14:44:33 | 000,721,731 | ---- | M] () -- C:\Users\hw\Documents\DSCF6175.pdf
[2014.05.21 13:46:36 | 002,372,481 | ---- | M] () -- C:\Users\hw\Desktop\DSCF6175.JPG
[2014.05.21 13:46:22 | 002,298,167 | ---- | M] () -- C:\Users\hw\Desktop\DSCF6174.JPG
[2014.05.20 08:24:00 | 000,000,470 | ---- | M] () -- C:\Users\hw\Documents\rarreg.key
[2014.05.16 01:11:13 | 000,002,864 | ---- | M] () -- C:\Users\hw\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Outlook 2013.lnk
[2014.05.13 23:17:28 | 000,692,400 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2014.05.13 23:17:28 | 000,070,832 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2014.05.09 08:14:03 | 000,477,184 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\aepdu.dll
[2014.05.09 08:11:23 | 000,424,448 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\aeinv.dll
[2014.05.07 12:23:48 | 000,004,096 | ---- | M] () -- C:\Users\Public\Documents\00000B37.LCS
[2014.05.07 12:23:14 | 000,335,288 | ---- | M] (Protect Software GmbH) -- C:\Windows\SysNative\drivers\acedrv11.sys
[2014.05.07 11:53:33 | 000,001,257 | ---- | M] () -- C:\Users\Public\Desktop\Virtual CloneDrive.lnk
[2014.05.07 11:50:04 | 000,000,085 | -HS- | M] () -- C:\ProgramData\.zreglib
[2014.05.07 11:49:50 | 000,001,206 | ---- | M] () -- C:\Users\Public\Desktop\CloneDVD2.lnk
[2014.05.06 05:00:47 | 000,084,992 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2014.05.06 04:10:52 | 000,069,632 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2014.04.29 10:55:12 | 000,130,584 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avipbb.sys
[2014.04.29 10:55:12 | 000,112,080 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avgntflt.sys
[2014.04.27 18:31:17 | 000,001,061 | ---- | M] () -- C:\Users\Public\Desktop\Foxit Reader.lnk
[2014.04.27 18:31:09 | 000,002,045 | ---- | M] () -- C:\Users\Public\Desktop\StarMoney 9.0.lnk
[2014.04.26 20:43:17 | 000,001,864 | ---- | M] () -- C:\Users\hw\Desktop\UseNeXT by Tangysoft.lnk
[38 C:\Users\hw\Documents\*.tmp files -> C:\Users\hw\Documents\*.tmp -> ]

========== Files Created - No Company Name ==========

[2014.05.22 10:11:23 | 000,001,634 | ---- | C] () -- C:\Users\hw\Desktop\CCleaner - Verknüpfung.lnk
[2014.05.22 09:28:58 | 000,001,926 | ---- | C] () -- C:\Users\hw\Desktop\TheraPlus.lnk
[2014.05.21 23:38:51 | 000,017,802 | ---- | C] () -- C:\Users\hw\Documents\cc_20140521_233832 neu.reg
[2014.05.21 14:45:38 | 000,671,180 | ---- | C] () -- C:\Users\hw\Documents\DSCF6174.pdf
[2014.05.21 14:44:32 | 000,721,731 | ---- | C] () -- C:\Users\hw\Documents\DSCF6175.pdf
[2014.05.21 14:43:09 | 002,298,167 | ---- | C] () -- C:\Users\hw\Desktop\DSCF6174.JPG
[2014.05.21 14:43:05 | 002,372,481 | ---- | C] () -- C:\Users\hw\Desktop\DSCF6175.JPG
[2014.05.20 08:24:00 | 000,000,470 | ---- | C] () -- C:\Users\hw\Documents\rarreg.key
[2014.05.07 12:23:14 | 000,004,096 | ---- | C] () -- C:\Users\Public\Documents\00000B37.LCS
[2014.05.07 11:53:33 | 000,001,257 | ---- | C] () -- C:\Users\Public\Desktop\Virtual CloneDrive.lnk
[2014.05.07 11:50:04 | 000,000,085 | -HS- | C] () -- C:\ProgramData\.zreglib
[2014.05.07 11:49:50 | 000,001,206 | ---- | C] () -- C:\Users\Public\Desktop\CloneDVD2.lnk
[2014.04.27 18:31:17 | 000,001,061 | ---- | C] () -- C:\Users\Public\Desktop\Foxit Reader.lnk
[2014.04.27 18:31:09 | 000,002,045 | ---- | C] () -- C:\Users\Public\Desktop\StarMoney 9.0.lnk
[2014.04.26 20:43:17 | 000,001,864 | ---- | C] () -- C:\Users\hw\Desktop\UseNeXT by Tangysoft.lnk
[2014.03.26 15:00:06 | 000,471,040 | ---- | C] () -- C:\Windows\ssndii.exe
[2014.03.21 09:21:44 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2013.12.21 13:05:05 | 000,995,342 | ---- | C] () -- C:\Windows\SysWow64\amdocl_as32.exe
[2013.12.21 13:05:05 | 000,798,734 | ---- | C] () -- C:\Windows\SysWow64\amdocl_ld32.exe
[2013.12.21 13:05:03 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2013.12.21 13:05:02 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat
[2013.12.21 13:05:02 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat
[2013.11.19 13:02:40 | 001,665,732 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI

========== ZeroAccess Check ==========

[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2014.03.25 04:43:12 | 014,175,744 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2014.03.25 04:09:54 | 012,874,240 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.21 05:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

< End of report >

schrauber · 25.05.2014, 18:03

hi,

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

glat · 25.05.2014, 19:56

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 25-05-2014 01
Ran by hw (administrator) on HW-PC on 25-05-2014 19:43:03
Running from C:\Users\hw\Downloads
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect\HelperService.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect\ConversionService.exe
(iAnywhere Solutions, Inc.) C:\Program Files (x86)\TheraPlus\db\Sybase\BIN32\dbsrv11.exe
(Star Finanz-Software Entwicklung und Vertriebs GmbH) C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office15\OUTLOOK.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
() C:\Windows\Samsung\PanelMgr\SSMMgr.exe
(Elaborate Bytes AG) C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
() C:\Users\hw\AppData\Local\Temp\838.exe
(Red Hat®, Inc.) C:\Program Files (x86)\TheraPlus\server\bin\jbosssvc.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\TheraPlus\java\bin\java.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avscan.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe
(VideoLAN) C:\Program Files (x86)\VideoLAN\VLC\vlc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe


==================== Registry (Whitelisted) ==================

HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [737872 2014-05-15] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Samsung PanelMgr] => C:\Windows\Samsung\PanelMgr\SSMMgr.exe [520192 2006-12-01] ()
HKLM-x32\...\Run: [VirtualCloneDrive] => C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [88984 2013-03-10] (Elaborate Bytes AG)
HKU\S-1-5-21-342420900-2787957736-1177342204-1000\...\Run: [ccleaner] => F:\DATEN Rechner\Lokaler Datenträger (C)\Dokumente und Einstellungen\Dokumente und Einstellungen\Programme\CCleaner\CCleaner.exe [3497240 2013-03-25] (Piriform Ltd)
HKU\S-1-5-21-342420900-2787957736-1177342204-1000\...\Run: [w1Synt] => C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe [32768 2010-11-21] (Microsoft Corporation)
HKU\S-1-5-21-342420900-2787957736-1177342204-1000\...\Run: [Windows Update Service] => C:\ProgramData\Windows Update Service0\gtqadjqbe.exe [128134734 2014-04-14] (Internet Download Manager, Tonec Inc.)
Startup: C:\Users\hw\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Outlook 2013.lnk
ShortcutTarget: Outlook 2013.lnk -> C:\Windows\Installer\{91150000-0011-0000-1000-0000000FF1CE}\outicon.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://localoem.msn.com
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://localoem.msn.com
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM - {9D3302CB-173B-43D8-9AA6-E9A36588075B} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE9TR&src=IE9TR&pc=MASBJS
SearchScopes: HKLM-x32 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 - {9D3302CB-173B-43D8-9AA6-E9A36588075B} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE9TR&src=IE9TR&pc=MASBJS
SearchScopes: HKCU - DefaultScope {9D3302CB-173B-43D8-9AA6-E9A36588075B} URL = 
BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO-x32: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GmbH)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
Toolbar: HKLM-x32 - PDF Architect Toolbar - {25A3A431-30BB-47C8-AD6A-E1063801134F} - C:\Program Files (x86)\PDF Architect\PDFIEPlugin.dll (pdfforge GmbH)
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\hw\AppData\Roaming\Mozilla\Firefox\Profiles\ve3lmjvc.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()
FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf - C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 - C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll (Microsoft Corporation)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt [2014-03-22]

==================== Services (Whitelisted) =================

R2 AntiVirFirewallService; C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe [1043024 2014-05-15] (Avira Operations GmbH & Co. KG)
R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [811088 2014-05-15] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-05-15] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-05-15] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1039952 2014-05-15] (Avira Operations GmbH & Co. KG)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1320496 2013-04-08] (pdfforge GmbH)
R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [799280 2013-04-08] (pdfforge GmbH)
R2 SQLANYs_theraplus; C:\Program Files (x86)\TheraPlus\db\Sybase\BIN32\dbsrv11.exe [141104 2009-05-20] (iAnywhere Solutions, Inc.)
R2 StarMoney 9.0 OnlineUpdate; C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe [663184 2014-01-27] (Star Finanz-Software Entwicklung und Vertriebs GmbH)
R2 TPSERVER; C:\Program Files (x86)\TheraPlus\server\bin\jbosssvc.exe [61440 2008-10-30] (Red Hat®, Inc.)

==================== Drivers (Whitelisted) ====================

R0 amdkmpfd; C:\Windows\System32\drivers\amdkmpfd.sys [36096 2013-05-21] (Advanced Micro Devices, Inc.)
R3 avfwim; C:\Windows\System32\DRIVERS\avfwim.sys [114608 2014-03-26] (Avira GmbH)
R1 avfwot; C:\Windows\System32\DRIVERS\avfwot.sys [141376 2014-03-26] (Avira GmbH)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [112080 2014-04-29] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-04-29] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-03-26] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [84720 2014-03-26] (Avira Operations GmbH & Co. KG)
S2 DgiVecp; C:\Windows\system32\Drivers\DgiVecp.sys [53816 2009-03-02] (Samsung Electronics Co., Ltd.)
S2 DgiVecp; C:\Windows\SysWOW64\Drivers\DgiVecp.sys [41984 2006-12-23] (Samsung Electronics Co., Ltd.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-05-25] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation)
S3 DIRECTIO; \??\UNC\srv1c027-b.wds8-b.intern\reminst\Test\BitPro64\DirectIo.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-25 19:43 - 2014-05-25 19:43 - 00012442 _____ () C:\Users\hw\Downloads\FRST.txt
2014-05-25 19:43 - 2014-05-25 19:43 - 00000000 ____D () C:\FRST
2014-05-25 19:42 - 2014-05-25 19:42 - 02066944 _____ (Farbar) C:\Users\hw\Downloads\FRST64.exe
2014-05-25 19:39 - 2014-05-25 19:40 - 00131072 ___HT () C:\Users\hw\Documents\~archive.pst.tmp
2014-05-25 16:36 - 2014-05-25 16:37 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-25 16:35 - 2014-05-25 16:35 - 00001109 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-05-25 16:35 - 2014-05-25 16:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-05-25 16:35 - 2014-05-25 16:35 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-25 16:35 - 2014-05-25 16:35 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-05-25 16:35 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-25 16:35 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-25 16:35 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-05-25 16:34 - 2014-05-25 16:34 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\hw\Downloads\mbam-setup-2.0.2.1012.exe
2014-05-25 16:10 - 2014-05-25 16:10 - 00056114 _____ () C:\Users\hw\Downloads\Extras.Txt
2014-05-25 16:09 - 2014-05-25 16:09 - 00081828 _____ () C:\Users\hw\Downloads\OTL.Txt
2014-05-25 15:54 - 2014-05-25 15:54 - 00602112 _____ (OldTimer Tools) C:\Users\hw\Downloads\OTL.exe
2014-05-23 19:12 - 2014-05-25 14:46 - 00000280 _____ () C:\Windows\setupact.log
2014-05-23 19:12 - 2014-05-23 19:12 - 00000000 _____ () C:\Windows\setuperr.log
2014-05-22 10:37 - 2014-05-22 11:17 - 00000000 ____D () C:\Program Files\WinRAR
2014-05-22 10:37 - 2014-05-22 10:37 - 00000000 ____D () C:\Users\hw\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-05-22 10:37 - 2014-05-22 10:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-05-22 10:11 - 2014-05-22 10:11 - 00001634 _____ () C:\Users\hw\Desktop\CCleaner - Verknüpfung.lnk
2014-05-22 09:28 - 2014-05-22 09:28 - 00001926 _____ () C:\Users\hw\Desktop\TheraPlus.lnk
2014-05-21 23:38 - 2014-05-21 23:39 - 00017802 _____ () C:\Users\hw\Documents\cc_20140521_233832 neu.reg
2014-05-21 10:07 - 2014-05-21 10:16 - 00000000 ____D () C:\Users\hw\Desktop\Alte Firefox-Daten
2014-05-21 08:37 - 2014-05-21 08:38 - 00000000 ____D () C:\Windows\pss
2014-05-21 08:24 - 2014-04-05 13:34 - 00000000 ____D () C:\Windows\SysWOW64\MetArt_2014-04-03_CONDATIS-KEI-A-by-RYLSKY_175ac_med
2014-05-20 08:24 - 2014-05-20 08:24 - 00000470 _____ () C:\Users\hw\Documents\rarreg.key
2014-05-17 23:01 - 2014-05-21 22:19 - 00000000 __SHD () C:\ProgramData\Windows Update Service0
2014-05-15 20:00 - 2014-05-15 20:00 - 00000000 _____ () C:\Users\hw\Documents\FAP942E.tmp
2014-05-15 20:00 - 2014-05-15 20:00 - 00000000 _____ () C:\Users\hw\Documents\FAP90F1.tmp
2014-05-15 20:00 - 2014-05-15 20:00 - 00000000 _____ () C:\Users\hw\Documents\FAP712F.tmp
2014-05-15 20:00 - 2014-05-15 20:00 - 00000000 _____ () C:\Users\hw\Documents\FAP6DE3.tmp
2014-05-15 20:00 - 2014-05-15 20:00 - 00000000 _____ () C:\Users\hw\Documents\FAP6930.tmp
2014-05-15 20:00 - 2014-05-15 20:00 - 00000000 _____ () C:\Users\hw\Documents\FAP50DD.tmp
2014-05-15 19:58 - 2014-05-15 19:58 - 00000000 _____ () C:\Users\hw\Documents\FAPAEA4.tmp
2014-05-15 19:58 - 2014-05-15 19:58 - 00000000 _____ () C:\Users\hw\Documents\FAPAB86.tmp
2014-05-15 19:37 - 2014-05-15 19:37 - 00000000 _____ () C:\Users\hw\Documents\FAPD58E.tmp
2014-05-15 19:37 - 2014-05-15 19:37 - 00000000 _____ () C:\Users\hw\Documents\FAP72B4.tmp
2014-05-15 19:37 - 2014-05-15 19:37 - 00000000 _____ () C:\Users\hw\Documents\FAP4AA9.tmp
2014-05-15 19:37 - 2014-05-15 19:37 - 00000000 _____ () C:\Users\hw\Documents\FAP305.tmp
2014-05-15 19:36 - 2014-05-15 19:36 - 00000000 _____ () C:\Users\hw\Documents\FAPFBCD.tmp
2014-05-15 19:36 - 2014-05-15 19:36 - 00000000 _____ () C:\Users\hw\Documents\FAP928D.tmp
2014-05-15 19:35 - 2014-05-15 19:35 - 00000000 _____ () C:\Users\hw\Documents\FAPCC12.tmp
2014-05-15 19:27 - 2014-05-15 19:27 - 00000000 _____ () C:\Users\hw\Documents\FAPB3DE.tmp
2014-05-15 19:27 - 2014-05-15 19:27 - 00000000 _____ () C:\Users\hw\Documents\FAPB1E9.tmp
2014-05-15 18:53 - 2014-05-15 18:53 - 00000000 _____ () C:\Users\hw\Documents\FAP8D76.tmp
2014-05-15 18:53 - 2014-05-15 18:53 - 00000000 _____ () C:\Users\hw\Documents\FAP87E8.tmp
2014-05-15 18:53 - 2014-05-15 18:53 - 00000000 _____ () C:\Users\hw\Documents\FAP8354.tmp
2014-05-15 18:53 - 2014-05-15 18:53 - 00000000 _____ () C:\Users\hw\Documents\FAP8094.tmp
2014-05-15 18:45 - 2014-05-15 18:45 - 00000000 _____ () C:\Users\hw\Documents\FAPF8B.tmp
2014-05-15 18:45 - 2014-05-15 18:45 - 00000000 _____ () C:\Users\hw\Documents\FAPE9F.tmp
2014-05-15 18:45 - 2014-05-15 18:45 - 00000000 _____ () C:\Users\hw\Documents\FAPD56.tmp
2014-05-15 18:45 - 2014-05-15 18:45 - 00000000 _____ () C:\Users\hw\Documents\FAP334D.tmp
2014-05-15 18:45 - 2014-05-15 18:45 - 00000000 _____ () C:\Users\hw\Documents\FAP2CD5.tmp
2014-05-15 18:45 - 2014-05-15 18:45 - 00000000 _____ () C:\Users\hw\Documents\FAP288F.tmp
2014-05-15 18:45 - 2014-05-15 18:45 - 00000000 _____ () C:\Users\hw\Documents\FAP2746.tmp
2014-05-15 18:45 - 2014-05-15 18:45 - 00000000 _____ () C:\Users\hw\Documents\FAP2013.tmp
2014-05-15 18:45 - 2014-05-15 18:45 - 00000000 _____ () C:\Users\hw\Documents\FAP1CC7.tmp
2014-05-15 08:41 - 2014-05-06 06:40 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-15 08:41 - 2014-05-06 06:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-15 08:41 - 2014-05-06 05:25 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-15 08:41 - 2014-05-06 05:07 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-15 08:41 - 2014-05-06 05:00 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-15 08:41 - 2014-05-06 04:10 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-15 08:36 - 2014-05-15 08:36 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER
2014-05-14 13:39 - 2014-05-20 08:32 - 00000000 ____D () C:\Users\hw\AppData\Roaming\WinRAR
2014-05-14 13:37 - 2014-05-14 13:37 - 02083288 _____ () C:\Users\hw\Downloads\winrar-x64-501d.exe
2014-05-14 12:50 - 2014-05-09 08:14 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-14 12:50 - 2014-05-09 08:11 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-14 12:50 - 2014-04-12 04:22 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-05-14 12:50 - 2014-04-12 04:22 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2014-05-14 12:50 - 2014-04-12 04:19 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-05-14 12:50 - 2014-04-12 04:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2014-05-14 12:50 - 2014-04-12 04:19 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2014-05-14 12:50 - 2014-04-12 04:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2014-05-14 12:50 - 2014-04-12 04:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2014-05-14 12:50 - 2014-04-12 04:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-05-14 12:50 - 2014-04-12 04:10 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-05-14 12:50 - 2014-03-25 04:43 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-05-14 12:50 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-05-14 12:50 - 2014-03-04 11:47 - 05550016 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-05-14 12:50 - 2014-03-04 11:44 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-05-14 12:50 - 2014-03-04 11:44 - 00722944 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll
2014-05-14 12:50 - 2014-03-04 11:44 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2014-05-14 12:50 - 2014-03-04 11:44 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-05-14 12:50 - 2014-03-04 11:44 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-05-14 12:50 - 2014-03-04 11:44 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-05-14 12:50 - 2014-03-04 11:44 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-05-14 12:50 - 2014-03-04 11:44 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll
2014-05-14 12:50 - 2014-03-04 11:43 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-05-14 12:50 - 2014-03-04 11:43 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll
2014-05-14 12:50 - 2014-03-04 11:43 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll
2014-05-14 12:50 - 2014-03-04 11:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll
2014-05-14 12:50 - 2014-03-04 11:43 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll
2014-05-14 12:50 - 2014-03-04 11:43 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll
2014-05-14 12:50 - 2014-03-04 11:43 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-05-14 12:50 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2014-05-14 12:50 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2014-05-14 12:50 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-05-14 12:50 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll
2014-05-14 12:50 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-05-14 12:50 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-05-14 12:50 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-05-14 12:50 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-05-14 12:50 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cngprovider.dll
2014-05-14 12:50 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adprovider.dll
2014-05-14 12:50 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\capiprovider.dll
2014-05-14 12:50 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpapiprovider.dll
2014-05-14 12:50 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll
2014-05-14 12:50 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincredprovider.dll
2014-05-14 12:50 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-05-14 12:50 - 2014-03-04 11:16 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2014-05-11 14:43 - 2014-05-11 14:44 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-05-08 23:24 - 2014-05-08 23:24 - 00000000 __SHD () C:\Users\hw\AppData\Local\EmieUserList
2014-05-08 23:24 - 2014-05-08 23:24 - 00000000 __SHD () C:\Users\hw\AppData\Local\EmieSiteList
2014-05-07 12:23 - 2014-05-07 12:23 - 00335288 _____ (Protect Software GmbH) C:\Windows\system32\Drivers\acedrv11.sys
2014-05-07 12:23 - 2014-05-07 12:23 - 00004096 _____ () C:\Users\Public\Documents\00000B37.LCS
2014-05-07 12:23 - 2014-05-07 12:23 - 00000000 ____D () C:\Users\hw\AppData\Roaming\ProtectDisc
2014-05-07 12:22 - 2008-07-31 10:41 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_2.dll
2014-05-07 12:22 - 2008-07-31 10:41 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_2.dll
2014-05-07 12:22 - 2008-07-31 10:41 - 00068616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_1.dll
2014-05-07 12:22 - 2008-07-31 10:40 - 00509448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_2.dll
2014-05-07 12:22 - 2008-07-12 08:18 - 04992520 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_39.dll
2014-05-07 12:22 - 2008-07-12 08:18 - 03851784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_39.dll
2014-05-07 12:22 - 2008-07-12 08:18 - 01942552 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_39.dll
2014-05-07 12:22 - 2008-07-12 08:18 - 01493528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_39.dll
2014-05-07 12:22 - 2008-07-12 08:18 - 00540688 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_39.dll
2014-05-07 12:22 - 2008-07-12 08:18 - 00467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_39.dll
2014-05-07 12:22 - 2008-05-30 14:19 - 00511496 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_1.dll
2014-05-07 12:22 - 2008-05-30 14:19 - 00507400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_1.dll
2014-05-07 12:22 - 2008-05-30 14:18 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_1.dll
2014-05-07 12:22 - 2008-05-30 14:18 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_1.dll
2014-05-07 12:22 - 2008-05-30 14:17 - 00068104 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_0.dll
2014-05-07 12:22 - 2008-05-30 14:17 - 00065032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_0.dll
2014-05-07 12:22 - 2008-05-30 14:17 - 00025608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_4.dll
2014-05-07 12:22 - 2008-05-30 14:11 - 01491992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_38.dll
2014-05-07 12:22 - 2008-05-30 14:11 - 00467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_38.dll
2014-05-07 12:22 - 2008-03-05 16:03 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_0.dll
2014-05-07 12:22 - 2008-03-05 16:03 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_0.dll
2014-05-07 12:22 - 2008-03-05 15:56 - 03786760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_37.dll
2014-05-07 12:22 - 2007-10-22 03:40 - 00411656 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_10.dll
2014-05-07 12:22 - 2007-10-22 03:39 - 00267272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_10.dll
2014-05-07 12:22 - 2007-10-12 15:14 - 02006552 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_36.dll
2014-05-07 12:22 - 2007-10-02 09:56 - 00508264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_36.dll
2014-05-07 12:22 - 2007-07-19 18:14 - 01358192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_35.dll
2014-05-07 12:22 - 2007-07-19 18:14 - 00444776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_35.dll
2014-05-07 12:21 - 2007-10-22 03:37 - 00021000 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_2.dll
2014-05-07 12:21 - 2007-06-20 20:49 - 00409960 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_8.dll
2014-05-07 12:21 - 2007-06-20 20:46 - 00266088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_8.dll
2014-05-07 12:21 - 2007-05-16 16:45 - 01401200 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_34.dll
2014-05-07 12:21 - 2007-05-16 16:45 - 01124720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_34.dll
2014-05-07 12:21 - 2007-05-16 16:45 - 00506728 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_34.dll
2014-05-07 12:21 - 2007-05-16 16:45 - 00443752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_34.dll
2014-05-07 12:21 - 2007-04-04 18:55 - 00403304 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_7.dll
2014-05-07 12:21 - 2007-04-04 18:54 - 00107368 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_3.dll
2014-05-07 12:21 - 2007-03-12 16:42 - 04494184 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_33.dll
2014-05-07 12:21 - 2007-03-05 12:42 - 00017688 _____ (Microsoft Corporation) C:\Windows\system32\x3daudio1_1.dll
2014-05-07 12:21 - 2007-01-24 15:27 - 00393576 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_6.dll
2014-05-07 12:21 - 2006-12-08 12:02 - 00251672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_5.dll
2014-05-07 12:21 - 2006-12-08 12:00 - 00390424 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_5.dll
2014-05-07 12:21 - 2006-11-29 13:06 - 00440080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10.dll
2014-05-07 12:21 - 2006-09-28 16:05 - 03977496 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_31.dll
2014-05-07 12:21 - 2006-09-28 16:05 - 02414360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_31.dll
2014-05-07 12:21 - 2006-09-28 16:05 - 00237848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_4.dll
2014-05-07 12:21 - 2006-07-28 09:31 - 00083736 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_2.dll
2014-05-07 12:21 - 2006-07-28 09:30 - 00363288 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_3.dll
2014-05-07 12:21 - 2006-07-28 09:30 - 00236824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_3.dll
2014-05-07 12:21 - 2006-07-28 09:30 - 00062744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_2.dll
2014-05-07 11:54 - 2014-05-07 11:54 - 00002990 _____ () C:\Windows\System32\Tasks\elbyExecuteWithUAC
2014-05-07 11:53 - 2014-05-07 11:53 - 00001257 _____ () C:\Users\Public\Desktop\Virtual CloneDrive.lnk
2014-05-07 11:51 - 2014-05-07 11:51 - 00629584 _____ (Chip Digital GmbH) C:\Users\hw\Downloads\Virtual CloneDrive - CHIP-Downloader.exe
2014-05-07 11:50 - 2014-05-07 11:50 - 00000085 ___SH () C:\ProgramData\.zreglib
2014-05-07 11:49 - 2014-05-07 11:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Elaborate Bytes
2014-05-07 11:49 - 2014-05-07 11:52 - 00000000 ____D () C:\Program Files (x86)\Elaborate Bytes
2014-05-07 11:49 - 2014-05-07 11:49 - 00001206 _____ () C:\Users\Public\Desktop\CloneDVD2.lnk
2014-05-07 11:48 - 2014-05-07 11:48 - 00629584 _____ (Chip Digital GmbH) C:\Users\hw\Downloads\CloneDVD - CHIP-Downloader.exe
2014-05-07 00:36 - 2014-05-15 08:44 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-06 23:12 - 2014-05-06 23:12 - 00003240 _____ () C:\Windows\System32\Tasks\{CD397BD8-A777-4F16-825A-1EAE4F8AF1D6}
2014-05-03 21:43 - 2014-05-09 00:49 - 00000000 ____D () C:\Users\hw\AppData\Roaming\dvdcss
2014-05-02 22:09 - 2014-05-02 22:09 - 00000000 ____D () C:\Users\hw\AppData\Local\Apps\2.0
2014-04-28 09:47 - 2014-04-28 09:47 - 00000000 ____D () C:\Users\hw\AppData\Roaming\Foxit Software
2014-04-28 09:01 - 2014-05-25 15:52 - 01465087 _____ () C:\Windows\WindowsUpdate.log
2014-04-27 18:31 - 2014-04-27 18:31 - 00002045 _____ () C:\Users\Public\Desktop\StarMoney 9.0.lnk
2014-04-27 18:31 - 2014-04-27 18:31 - 00001061 _____ () C:\Users\Public\Desktop\Foxit Reader.lnk
2014-04-27 18:31 - 2014-04-27 18:31 - 00000000 ____D () C:\ProgramData\StarMoney 9.0
2014-04-27 18:31 - 2014-04-27 18:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StarMoney 9.0
2014-04-27 18:31 - 2014-04-27 18:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Foxit Reader
2014-04-27 18:31 - 2014-04-27 18:31 - 00000000 ____D () C:\Program Files (x86)\Foxit Software
2014-04-27 18:30 - 2014-05-22 18:31 - 00000000 ____D () C:\Program Files (x86)\StarMoney 9.0
2014-04-27 18:30 - 2014-04-27 18:30 - 00000000 ____D () C:\Program Files (x86)\Business Objects
2014-04-27 18:24 - 2014-04-27 18:28 - 184705416 _____ () C:\Users\hw\Downloads\SM_9_dkb.exe
2014-04-26 20:43 - 2014-05-25 13:54 - 00000000 ____D () C:\Users\hw\AppData\Roaming\UseNeXT
2014-04-26 20:43 - 2014-04-26 20:43 - 00001864 _____ () C:\Users\hw\Desktop\UseNeXT by Tangysoft.lnk
2014-04-26 20:43 - 2014-04-26 20:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UseNeXT
2014-04-26 20:43 - 2014-04-26 20:43 - 00000000 ____D () C:\Program Files (x86)\UseNeXT

==================== One Month Modified Files and Folders =======

2014-05-25 19:43 - 2014-05-25 19:43 - 00012442 _____ () C:\Users\hw\Downloads\FRST.txt
2014-05-25 19:43 - 2014-05-25 19:43 - 00000000 ____D () C:\FRST
2014-05-25 19:42 - 2014-05-25 19:42 - 02066944 _____ (Farbar) C:\Users\hw\Downloads\FRST64.exe
2014-05-25 19:40 - 2014-05-25 19:39 - 00131072 ___HT () C:\Users\hw\Documents\~archive.pst.tmp
2014-05-25 19:40 - 2014-04-05 22:18 - 00271360 _____ () C:\Users\hw\Documents\archive.pst
2014-05-25 19:40 - 2014-03-26 10:42 - 00000000 ____D () C:\Users\hw\Documents\Outlook-Dateien
2014-05-25 19:17 - 2014-03-26 18:51 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-25 16:37 - 2014-05-25 16:36 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-25 16:35 - 2014-05-25 16:35 - 00001109 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-05-25 16:35 - 2014-05-25 16:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-05-25 16:35 - 2014-05-25 16:35 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-25 16:35 - 2014-05-25 16:35 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-05-25 16:34 - 2014-05-25 16:34 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\hw\Downloads\mbam-setup-2.0.2.1012.exe
2014-05-25 16:10 - 2014-05-25 16:10 - 00056114 _____ () C:\Users\hw\Downloads\Extras.Txt
2014-05-25 16:09 - 2014-05-25 16:09 - 00081828 _____ () C:\Users\hw\Downloads\OTL.Txt
2014-05-25 15:57 - 2014-03-26 13:07 - 00000000 ____D () C:\Users\hw\AppData\Roaming\MediaMonkey
2014-05-25 15:54 - 2014-05-25 15:54 - 00602112 _____ (OldTimer Tools) C:\Users\hw\Downloads\OTL.exe
2014-05-25 15:54 - 2009-07-14 06:45 - 00021680 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-25 15:54 - 2009-07-14 06:45 - 00021680 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-25 15:52 - 2014-04-28 09:01 - 01465087 _____ () C:\Windows\WindowsUpdate.log
2014-05-25 15:19 - 2014-04-13 16:00 - 00005094 _____ () C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for hw-PC-hw hw-PC
2014-05-25 14:51 - 2011-04-12 09:43 - 00730564 _____ () C:\Windows\system32\perfh007.dat
2014-05-25 14:51 - 2011-04-12 09:43 - 00108980 _____ () C:\Windows\system32\perfc007.dat
2014-05-25 14:51 - 2009-07-14 07:13 - 01643090 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-25 14:46 - 2014-05-23 19:12 - 00000280 _____ () C:\Windows\setupact.log
2014-05-25 14:46 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-25 14:39 - 2014-04-21 13:25 - 00000000 ____D () C:\Users\hw\Desktop\Online TV mit VLC - Player (2014) - DRM Passwort
2014-05-25 14:36 - 2014-03-27 12:36 - 00000000 ____D () C:\Users\hw\Documents\UseNeXT
2014-05-25 14:35 - 2014-04-16 08:11 - 00000000 ____D () C:\Users\hw\Desktop\chris
2014-05-25 14:35 - 2014-04-14 15:35 - 00000000 ____D () C:\Users\hw\Downloads\Ich rede 2
2014-05-25 14:17 - 2014-03-26 13:06 - 00000000 ____D () C:\Users\hw\Desktop\MediaMonkey 4 (Download)
2014-05-25 13:54 - 2014-04-26 20:43 - 00000000 ____D () C:\Users\hw\AppData\Roaming\UseNeXT
2014-05-25 12:29 - 2014-03-22 23:12 - 00000000 ____D () C:\Users\hw\AppData\Local\CrashDumps
2014-05-25 01:34 - 2014-03-22 23:08 - 00000000 ____D () C:\Users\hw\AppData\Roaming\vlc
2014-05-23 19:12 - 2014-05-23 19:12 - 00000000 _____ () C:\Windows\setuperr.log
2014-05-23 11:37 - 2014-03-26 09:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2014-05-23 11:37 - 2014-03-22 22:54 - 00000000 ___RD () C:\Users\hw\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-22 18:31 - 2014-04-27 18:30 - 00000000 ____D () C:\Program Files (x86)\StarMoney 9.0
2014-05-22 11:17 - 2014-05-22 10:37 - 00000000 ____D () C:\Program Files\WinRAR
2014-05-22 10:37 - 2014-05-22 10:37 - 00000000 ____D () C:\Users\hw\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-05-22 10:37 - 2014-05-22 10:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-05-22 10:11 - 2014-05-22 10:11 - 00001634 _____ () C:\Users\hw\Desktop\CCleaner - Verknüpfung.lnk
2014-05-22 09:29 - 2014-03-26 14:08 - 00000000 ____D () C:\Program Files (x86)\TheraPlus
2014-05-22 09:28 - 2014-05-22 09:28 - 00001926 _____ () C:\Users\hw\Desktop\TheraPlus.lnk
2014-05-21 23:39 - 2014-05-21 23:38 - 00017802 _____ () C:\Users\hw\Documents\cc_20140521_233832 neu.reg
2014-05-21 22:37 - 2014-03-25 22:54 - 00111912 _____ () C:\Users\hw\AppData\Local\GDIPFONTCACHEV1.DAT
2014-05-21 22:37 - 2009-07-14 06:45 - 00439640 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-05-21 22:35 - 2014-03-26 09:08 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-05-21 22:35 - 2009-07-14 05:20 - 00000000 ____D () C:\Program Files\Common Files\System
2014-05-21 22:35 - 2009-07-14 04:34 - 00000478 _____ () C:\Windows\win.ini
2014-05-21 22:30 - 2009-07-14 05:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2014-05-21 22:20 - 2014-03-22 22:54 - 00000000 ____D () C:\Users\hw
2014-05-21 22:19 - 2014-05-17 23:01 - 00000000 __SHD () C:\ProgramData\Windows Update Service0
2014-05-21 22:19 - 2014-03-28 09:54 - 00000000 ____D () C:\Users\hw\AppData\Roaming\TeraCopy
2014-05-21 22:19 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\AppCompat
2014-05-21 22:18 - 2014-03-22 23:04 - 00000000 ____D () C:\Users\hw\AppData\Local\Mozilla
2014-05-21 22:18 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\registration
2014-05-21 22:17 - 2014-03-26 09:08 - 00000000 ____D () C:\Program Files\Microsoft Office
2014-05-21 21:20 - 2011-04-12 09:54 - 00000000 ___RD () C:\Users\Public\Recorded TV
2014-05-21 14:14 - 2014-04-13 23:48 - 00000000 ____D () C:\Users\hw\AppData\Local\QuickPar
2014-05-21 10:16 - 2014-05-21 10:07 - 00000000 ____D () C:\Users\hw\Desktop\Alte Firefox-Daten
2014-05-21 08:38 - 2014-05-21 08:37 - 00000000 ____D () C:\Windows\pss
2014-05-20 08:32 - 2014-05-14 13:39 - 00000000 ____D () C:\Users\hw\AppData\Roaming\WinRAR
2014-05-20 08:24 - 2014-05-20 08:24 - 00000470 _____ () C:\Users\hw\Documents\rarreg.key
2014-05-16 11:00 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-05-15 20:00 - 2014-05-15 20:00 - 00000000 _____ () C:\Users\hw\Documents\FAP942E.tmp
2014-05-15 20:00 - 2014-05-15 20:00 - 00000000 _____ () C:\Users\hw\Documents\FAP90F1.tmp
2014-05-15 20:00 - 2014-05-15 20:00 - 00000000 _____ () C:\Users\hw\Documents\FAP712F.tmp
2014-05-15 20:00 - 2014-05-15 20:00 - 00000000 _____ () C:\Users\hw\Documents\FAP6DE3.tmp
2014-05-15 20:00 - 2014-05-15 20:00 - 00000000 _____ () C:\Users\hw\Documents\FAP6930.tmp
2014-05-15 20:00 - 2014-05-15 20:00 - 00000000 _____ () C:\Users\hw\Documents\FAP50DD.tmp
2014-05-15 19:58 - 2014-05-15 19:58 - 00000000 _____ () C:\Users\hw\Documents\FAPAEA4.tmp
2014-05-15 19:58 - 2014-05-15 19:58 - 00000000 _____ () C:\Users\hw\Documents\FAPAB86.tmp
2014-05-15 19:37 - 2014-05-15 19:37 - 00000000 _____ () C:\Users\hw\Documents\FAPD58E.tmp
2014-05-15 19:37 - 2014-05-15 19:37 - 00000000 _____ () C:\Users\hw\Documents\FAP72B4.tmp
2014-05-15 19:37 - 2014-05-15 19:37 - 00000000 _____ () C:\Users\hw\Documents\FAP4AA9.tmp
2014-05-15 19:37 - 2014-05-15 19:37 - 00000000 _____ () C:\Users\hw\Documents\FAP305.tmp
2014-05-15 19:36 - 2014-05-15 19:36 - 00000000 _____ () C:\Users\hw\Documents\FAPFBCD.tmp
2014-05-15 19:36 - 2014-05-15 19:36 - 00000000 _____ () C:\Users\hw\Documents\FAP928D.tmp
2014-05-15 19:35 - 2014-05-15 19:35 - 00000000 _____ () C:\Users\hw\Documents\FAPCC12.tmp
2014-05-15 19:27 - 2014-05-15 19:27 - 00000000 _____ () C:\Users\hw\Documents\FAPB3DE.tmp
2014-05-15 19:27 - 2014-05-15 19:27 - 00000000 _____ () C:\Users\hw\Documents\FAPB1E9.tmp
2014-05-15 18:53 - 2014-05-15 18:53 - 00000000 _____ () C:\Users\hw\Documents\FAP8D76.tmp
2014-05-15 18:53 - 2014-05-15 18:53 - 00000000 _____ () C:\Users\hw\Documents\FAP87E8.tmp
2014-05-15 18:53 - 2014-05-15 18:53 - 00000000 _____ () C:\Users\hw\Documents\FAP8354.tmp
2014-05-15 18:53 - 2014-05-15 18:53 - 00000000 _____ () C:\Users\hw\Documents\FAP8094.tmp
2014-05-15 18:45 - 2014-05-15 18:45 - 00000000 _____ () C:\Users\hw\Documents\FAPF8B.tmp
2014-05-15 18:45 - 2014-05-15 18:45 - 00000000 _____ () C:\Users\hw\Documents\FAPE9F.tmp
2014-05-15 18:45 - 2014-05-15 18:45 - 00000000 _____ () C:\Users\hw\Documents\FAPD56.tmp
2014-05-15 18:45 - 2014-05-15 18:45 - 00000000 _____ () C:\Users\hw\Documents\FAP334D.tmp
2014-05-15 18:45 - 2014-05-15 18:45 - 00000000 _____ () C:\Users\hw\Documents\FAP2CD5.tmp
2014-05-15 18:45 - 2014-05-15 18:45 - 00000000 _____ () C:\Users\hw\Documents\FAP288F.tmp
2014-05-15 18:45 - 2014-05-15 18:45 - 00000000 _____ () C:\Users\hw\Documents\FAP2746.tmp
2014-05-15 18:45 - 2014-05-15 18:45 - 00000000 _____ () C:\Users\hw\Documents\FAP2013.tmp
2014-05-15 18:45 - 2014-05-15 18:45 - 00000000 _____ () C:\Users\hw\Documents\FAP1CC7.tmp
2014-05-15 08:47 - 2014-03-22 22:54 - 00000000 ___RD () C:\Users\hw\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-15 08:44 - 2014-05-07 00:36 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-15 08:44 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-05-15 08:38 - 2014-03-27 11:48 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-05-15 08:38 - 2014-03-27 11:48 - 00000000 ____D () C:\Windows\system32\MRT
2014-05-15 08:36 - 2014-05-15 08:36 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER
2014-05-14 13:37 - 2014-05-14 13:37 - 02083288 _____ () C:\Users\hw\Downloads\winrar-x64-501d.exe
2014-05-13 23:17 - 2014-03-26 18:51 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-05-13 23:17 - 2014-03-26 18:51 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-05-13 23:17 - 2014-03-26 18:51 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-05-13 09:17 - 2014-03-26 12:52 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-05-12 07:26 - 2014-05-25 16:35 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-12 07:26 - 2014-05-25 16:35 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-12 07:25 - 2014-05-25 16:35 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-05-11 14:44 - 2014-05-11 14:43 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-05-09 08:14 - 2014-05-14 12:50 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-09 08:11 - 2014-05-14 12:50 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-09 00:49 - 2014-05-03 21:43 - 00000000 ____D () C:\Users\hw\AppData\Roaming\dvdcss
2014-05-08 23:24 - 2014-05-08 23:24 - 00000000 __SHD () C:\Users\hw\AppData\Local\EmieUserList
2014-05-08 23:24 - 2014-05-08 23:24 - 00000000 __SHD () C:\Users\hw\AppData\Local\EmieSiteList
2014-05-07 12:23 - 2014-05-07 12:23 - 00335288 _____ (Protect Software GmbH) C:\Windows\system32\Drivers\acedrv11.sys
2014-05-07 12:23 - 2014-05-07 12:23 - 00004096 _____ () C:\Users\Public\Documents\00000B37.LCS
2014-05-07 12:23 - 2014-05-07 12:23 - 00000000 ____D () C:\Users\hw\AppData\Roaming\ProtectDisc
2014-05-07 11:54 - 2014-05-07 11:54 - 00002990 _____ () C:\Windows\System32\Tasks\elbyExecuteWithUAC
2014-05-07 11:53 - 2014-05-07 11:53 - 00001257 _____ () C:\Users\Public\Desktop\Virtual CloneDrive.lnk
2014-05-07 11:52 - 2014-05-07 11:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Elaborate Bytes
2014-05-07 11:52 - 2014-05-07 11:49 - 00000000 ____D () C:\Program Files (x86)\Elaborate Bytes
2014-05-07 11:51 - 2014-05-07 11:51 - 00629584 _____ (Chip Digital GmbH) C:\Users\hw\Downloads\Virtual CloneDrive - CHIP-Downloader.exe
2014-05-07 11:50 - 2014-05-07 11:50 - 00000085 ___SH () C:\ProgramData\.zreglib
2014-05-07 11:49 - 2014-05-07 11:49 - 00001206 _____ () C:\Users\Public\Desktop\CloneDVD2.lnk
2014-05-07 11:48 - 2014-05-07 11:48 - 00629584 _____ (Chip Digital GmbH) C:\Users\hw\Downloads\CloneDVD - CHIP-Downloader.exe
2014-05-06 23:12 - 2014-05-06 23:12 - 00003240 _____ () C:\Windows\System32\Tasks\{CD397BD8-A777-4F16-825A-1EAE4F8AF1D6}
2014-05-06 06:40 - 2014-05-15 08:41 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-06 06:17 - 2014-05-15 08:41 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-06 05:25 - 2014-05-15 08:41 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-06 05:07 - 2014-05-15 08:41 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-06 05:00 - 2014-05-15 08:41 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-06 04:10 - 2014-05-15 08:41 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-02 22:09 - 2014-05-02 22:09 - 00000000 ____D () C:\Users\hw\AppData\Local\Apps\2.0
2014-04-29 10:55 - 2014-03-26 08:20 - 00130584 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-04-29 10:55 - 2014-03-26 08:20 - 00112080 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-04-28 09:47 - 2014-04-28 09:47 - 00000000 ____D () C:\Users\hw\AppData\Roaming\Foxit Software
2014-04-27 18:31 - 2014-04-27 18:31 - 00002045 _____ () C:\Users\Public\Desktop\StarMoney 9.0.lnk
2014-04-27 18:31 - 2014-04-27 18:31 - 00001061 _____ () C:\Users\Public\Desktop\Foxit Reader.lnk
2014-04-27 18:31 - 2014-04-27 18:31 - 00000000 ____D () C:\ProgramData\StarMoney 9.0
2014-04-27 18:31 - 2014-04-27 18:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StarMoney 9.0
2014-04-27 18:31 - 2014-04-27 18:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Foxit Reader
2014-04-27 18:31 - 2014-04-27 18:31 - 00000000 ____D () C:\Program Files (x86)\Foxit Software
2014-04-27 18:30 - 2014-04-27 18:30 - 00000000 ____D () C:\Program Files (x86)\Business Objects
2014-04-27 18:30 - 2009-07-14 04:34 - 00017486 _____ () C:\Windows\system32\Drivers\etc\services
2014-04-27 18:29 - 2014-03-25 23:11 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-04-27 18:28 - 2014-04-27 18:24 - 184705416 _____ () C:\Users\hw\Downloads\SM_9_dkb.exe
2014-04-26 20:43 - 2014-04-26 20:43 - 00001864 _____ () C:\Users\hw\Desktop\UseNeXT by Tangysoft.lnk
2014-04-26 20:43 - 2014-04-26 20:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UseNeXT
2014-04-26 20:43 - 2014-04-26 20:43 - 00000000 ____D () C:\Program Files (x86)\UseNeXT

Some content of TEMP:
====================
C:\Users\hw\AppData\Local\Temp\142.exe
C:\Users\hw\AppData\Local\Temp\695.exe
C:\Users\hw\AppData\Local\Temp\747.exe
C:\Users\hw\AppData\Local\Temp\789.exe
C:\Users\hw\AppData\Local\Temp\838.exe
C:\Users\hw\AppData\Local\Temp\900.exe
C:\Users\hw\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-05-19 09:35

==================== End Of Log ============================

--- --- ---

schrauber · 26.05.2014, 19:26

Addition.txt fehlt noch

26.05.2014, 19:26	#4
schrauber /// the machine /// TB-Ausbilder	Hallo leider stürzen seit kurzer Zeit viele Programme einfach ab Vlc player ,Media Monkey win 7 64 bit Avira findet nichts deshalb habe ich Addition.txt fehlt noch __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

Hallo leider stürzen seit kurzer Zeit viele Programme einfach ab Vlc player ,Media Monkey win 7 64 bit Avira findet nichts deshalb habe ich

Log-Analyse und Auswertung: Hallo leider stürzen seit kurzer Zeit viele Programme einfach ab Vlc player ,Media Monkey win 7 64 bit Avira findet nichts deshalb habe ich