Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung

Log-Analyse und Auswertung: Internet extrem langsam -viel zu viele Netzwerkverbindunge - ein Zeichen für Schadware

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML

Antwort
Alt 20.07.2015, 07:21   #1
GunHill
 
Internet extrem langsam -viel zu viele Netzwerkverbindunge - ein Zeichen für Schadware - Standard

Internet extrem langsam -viel zu viele Netzwerkverbindunge - ein Zeichen für Schadware



Hallo,
habe seit einigen Tagen ein extrem langsames Internet. Habe mit "Netstat -a" bei Eingabeaufforderung weit über 100 Netzwerkverbindungen entdeckt - ein Zeichen für Virenbefall?
Nutze aber Kaspersky Internet Security plus regelmäßig CCleaner (nur Cleaner, nicht an die Registry).
Bis vor ein paar Tagen habe ich auch regelmäßig (alle 2 Wochen) Malware Antimalware durchlaufen lasse - immer ohne Fund. Inzwischen geht die Aktualisierung der Datenbank nicht mehr. Habe heute die neue Version runtergeladen, aber beim Suchlauf scheiter der Rechner an der Aktualisierung.
Gerade meldet mit Malware folgendes: "Malwarebytes war nicht in der Lage,den ANti.Rootkit-DDA-Treiber zu laden. Dieser Fehler kann durch eine Rootkit-Aktivität verursacht werden. Möchten Sie das System neu starten und versuchen, den Treiber zu installieren? ..." Ich habe erstmal auf "nein" geklickt.

LogFiles unten

Fehlermeldung bei Gmer: "C:/Windows/system32/config/system: Der Prozess kann nciht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird"

Ich freue mich über Hilfe, 1000 Dank!
Gunther

Code:
ATTFilter
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 07:33 on 20/07/2015 (Gunther)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
         

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:18-07-2015 01
Ran by Gunther (administrator) on ARLT on 20-07-2015 07:48:17
Running from C:\Users\Gunther\Desktop
Loaded Profiles: Gunther (Available Profiles: Gunther & Kinder)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

() C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe
(Acronis) C:\Program Files (x86)\Acronis\TrueImageHome\prl_stat.exe
() C:\Program Files (x86)\Acronis\TrueImageHome\prl_report.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avpui.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTsysTray8.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(MSI) C:\Program Files (x86)\MSI\Super Charger\Super Charger.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Acronis) C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe
(Acronis International GmbH) C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7543000 2014-03-04] (Realtek Semiconductor)
HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
HKLM\...\Run: [ISCT Tray] => C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTsysTray8.exe [5860656 2014-02-21] (Intel Corporation)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2465088 2014-11-17] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [VDownloader] => C:\Program Files\VDownloader\VDownloader4.exe [3017216 2014-10-23] (Vitzo)
HKLM\...\Run: [Acronis Scheduler2 Service] => C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe [571192 2014-08-14] (Acronis)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [169768 2015-04-07] (Apple Inc.)
HKLM-x32\...\Run: [Super Charger] => C:\Program Files (x86)\MSI\Super Charger\Super Charger.exe [1047536 2014-04-08] (MSI)
HKLM-x32\...\Run: [CanonQuickMenu] => C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE [1284680 2014-01-17] (CANON INC.)
HKLM-x32\...\Run: [TrueImageMonitor.exe] => C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe [5343272 2014-11-27] (Acronis)
HKLM-x32\...\Run: [AcronisTibMounterMonitor] => C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe [606096 2014-10-17] (Acronis International GmbH)
HKU\S-1-5-21-3601908654-2614856020-1968441776-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7404312 2015-01-20] (Piriform Ltd)
HKU\S-1-5-21-3601908654-2614856020-1968441776-1001\...\Run: [VDownloader] => C:\Program Files\VDownloader\VDownloader4.exe [3017216 2014-10-23] (Vitzo)
HKU\S-1-5-21-3601908654-2614856020-1968441776-1001\...\Run: [SkyDrive] => C:\Users\Gunther\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe [277672 2015-01-04] (Microsoft Corporation)
HKU\S-1-5-21-3601908654-2614856020-1968441776-1001\...\Run: [Rainlendar2] => C:\Program Files\Rainlendar2\Rainlendar2.exe [4411488 2014-03-16] ()
HKU\S-1-5-21-3601908654-2614856020-1968441776-1001\...\Run: [Monotype SkyFonts Clean Up] => C:\Program Files\Monotype\SkyFonts\Monotype.SkyFonts.CleanUp.exe
Startup: C:\Users\Gunther\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sidebar660.lnk [2015-02-16]
ShortcutTarget: Sidebar660.lnk -> C:\Program Files\Windows Sidebar\sidebar.exe (No File)
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File
ShellIconOverlayIdentifiers: [AcronisSyncError] -> {934BC6C0-FEC2-4df5-A100-961DE2C8A0ED} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2014-09-09] (Acronis)
ShellIconOverlayIdentifiers: [AcronisSyncInProgress] -> {00F848DC-B1D4-4892-9C25-CAADC86A215D} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2014-09-09] (Acronis)
ShellIconOverlayIdentifiers: [AcronisSyncOk] -> {71573297-552E-46fc-BE3D-3DFAF88D47B7} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2014-09-09] (Acronis)
ShellIconOverlayIdentifiers-x32: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-3601908654-2614856020-1968441776-1001\Software\Microsoft\Internet Explorer\Main,Start Page = https://lernen.phase-6.de/#/login
HKU\S-1-5-21-3601908654-2614856020-1968441776-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.arlt.com
BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll [2014-12-22] (Kaspersky Lab ZAO)
BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO: DVDVideoSoft IE Extension -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll [2014-12-15] (DVDVideoSoft Ltd.)
BHO-x32: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll [2014-12-22] (Kaspersky Lab ZAO)
BHO-x32: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\OnlineBanking\online_banking_bho.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO-x32: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\UrlAdvisor\klwtbbho.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO-x32: DVDVideoSoft IE Extension -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll [2014-12-15] (DVDVideoSoft Ltd.)
Tcpip\..\Interfaces\{071B0494-A52A-4CEC-ABF8-B2C19B27E7E2}: [NameServer] 195.50.140.182 195.50.140.114

FireFox:
========
FF ProfilePath: C:\Users\Gunther\AppData\Roaming\Mozilla\Firefox\Profiles\8fcu2t3l.default
FF Homepage: hxxp://www.google.de/
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_18_0_0_209.dll [2015-07-20] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_209.dll [2015-07-20] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2014-02-19] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2014-02-19] (Intel Corporation)
FF Plugin-x32: @kaspersky.com/content_blocker -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com [2014-12-22] ()
FF Plugin-x32: @kaspersky.com/online_banking -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com [2014-12-22] ()
FF Plugin-x32: @kaspersky.com/virtual_keyboard -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-12-22] ()
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2013-02-05] (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2014-11-12] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2014-11-12] (NVIDIA Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-06-29] (Adobe Systems Inc.)
FF user.js: detected! => C:\Users\Gunther\AppData\Roaming\Mozilla\Firefox\Profiles\8fcu2t3l.default\user.js [2014-12-22]
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Users\Gunther\AppData\Roaming\Mozilla\Firefox\Profiles\8fcu2t3l.default\Extensions\{B64D9B05-48E1-4CEB-BF58-E0643994E900} [2014-12-22]
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{B64D9B05-48E1-4CEB-BF58-E0643994E900}.xpi [2015-06-03]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: Dangerous Websites Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com [2014-12-22]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-12-22]
FF HKLM-x32\...\Firefox\Extensions:  - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com [2014-12-22]
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com
FF Extension: Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com [2014-12-22]
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com
FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com [2014-12-22]
FF HKLM-x32\...\Firefox\Extensions: [{F003DA68-8256-4b37-A6C4-350FA04494DF}] - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt
FF HKU\S-1-5-21-3601908654-2614856020-1968441776-1001\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-12-22]

Chrome: 
=======
CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho
CHR HKLM-x32\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S2 AAV UpdateService; C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()
S2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-19] (Apple Inc.)
R2 AVP15.0.0; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [233552 2014-04-20] (Kaspersky Lab ZAO)
S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-29] (Microsoft Corporation)
S2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1149760 2014-11-17] (NVIDIA Corporation)
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [887232 2014-01-31] (Intel(R) Corporation)
R2 ISCTAgent; C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe [209712 2014-02-21] ()
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [154584 2014-02-19] (Intel Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2015-06-18] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)
S2 MSI_SuperCharger; C:\Program Files (x86)\MSI\Super Charger\ChargeService.exe [162800 2014-03-17] (MSI)
S2 MSI_Trigger_Service; C:\Program Files (x86)\MSI\MSITrigger\MSI_Trigger_Service.exe [30240 2013-09-26] (MICRO-STAR INTERNATIONAL CO., LTD.)
S2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1796928 2014-11-17] (NVIDIA Corporation)
S2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19821376 2014-11-17] (NVIDIA Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-04] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-04] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R0 file_tracker; C:\Windows\System32\DRIVERS\file_tracker.sys [296736 2015-01-03] (Acronis International GmbH)
R3 ikbevent; C:\Windows\system32\DRIVERS\ikbevent.sys [22216 2014-02-03] ()
R3 imsevent; C:\Windows\system32\DRIVERS\imsevent.sys [22728 2014-02-03] ()
R3 INETMON; C:\Windows\System32\Drivers\INETMON.sys [23936 2014-02-03] ()
R3 ISCT; C:\Windows\System32\drivers\ISCTD.sys [44744 2014-02-03] ()
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [457824 2014-02-20] (Kaspersky Lab ZAO)
S0 klelam; C:\Windows\System32\DRIVERS\klelam.sys [29616 2012-07-27] (Kaspersky Lab)
R3 klflt; C:\Windows\system32\DRIVERS\klflt.sys [142344 2014-12-22] (Kaspersky Lab ZAO)
R1 klhk; C:\Windows\system32\DRIVERS\klhk.sys [243808 2014-04-10] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [771272 2014-12-22] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\system32\DRIVERS\klim6.sys [30304 2014-02-25] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\system32\DRIVERS\klkbdflt.sys [28768 2014-03-28] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\system32\DRIVERS\klmouflt.sys [29280 2013-08-08] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\system32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 klwfp; C:\Windows\system32\DRIVERS\klwfp.sys [67680 2014-03-19] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\system32\DRIVERS\kneps.sys [179296 2014-03-26] (Kaspersky Lab ZAO)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [113880 2015-07-20] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2015-06-18] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [116736 2014-02-19] (Intel Corporation)
R3 NTIOLib_1_0_3; C:\Program Files (x86)\MSI\Super Charger\NTIOLib_X64.sys [13368 2012-10-25] (MSI)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [38216 2014-10-03] (NVIDIA Corporation)
R0 tib; C:\Windows\System32\DRIVERS\tib.sys [1328928 2015-01-03] (Acronis International GmbH)
R0 tib_mounter; C:\Windows\System32\DRIVERS\tib_mounter.sys [234784 2014-12-20] (Acronis International GmbH)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-04] (Microsoft Corporation)
S3 MSICDSetup; \??\F:\CDriver64.sys [X]
S3 NTIOLib_1_0_C; \??\F:\NTIOLib_X64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-07-20 07:48 - 2015-07-20 07:48 - 00020266 _____ C:\Users\Gunther\Desktop\FRST.txt
2015-07-20 07:48 - 2015-07-20 07:48 - 00000000 ____D C:\FRST
2015-07-20 07:36 - 2015-07-20 07:44 - 02134528 _____ (Farbar) C:\Users\Gunther\Desktop\FRST64.exe
2015-07-20 07:33 - 2015-07-20 07:33 - 00000476 _____ C:\Users\Gunther\Desktop\defogger_disable.log
2015-07-20 07:33 - 2015-07-20 07:33 - 00000000 _____ C:\Users\Gunther\defogger_reenable
2015-07-20 06:56 - 2015-07-20 06:56 - 00050477 _____ C:\Users\Gunther\Desktop\Defogger.exe
2015-07-19 19:05 - 2015-07-20 05:18 - 00118195 _____ C:\Windows\WindowsUpdate.log
2015-07-19 19:05 - 2015-07-19 19:05 - 00000842 _____ C:\Windows\setupact.log
2015-07-19 19:05 - 2015-07-19 19:05 - 00000000 _____ C:\Windows\setuperr.log
2015-07-15 19:03 - 2015-07-02 23:21 - 19877376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-07-15 19:03 - 2015-07-02 22:50 - 02279424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-07-15 19:03 - 2015-07-02 22:49 - 25193984 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-07-15 19:03 - 2015-07-02 22:23 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-07-15 19:03 - 2015-07-02 22:19 - 12855296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-07-15 19:03 - 2015-07-02 21:55 - 01310720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-07-15 19:03 - 2015-07-02 21:20 - 14453248 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-07-15 19:03 - 2015-07-02 20:59 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-07-15 18:52 - 2015-06-16 00:39 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-07-15 18:52 - 2015-06-16 00:38 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-07-15 18:52 - 2015-06-16 00:26 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-07-15 18:52 - 2015-06-16 00:24 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-07-15 18:52 - 2015-06-16 00:02 - 00087552 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2015-07-15 18:52 - 2015-06-15 23:58 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-07-15 18:52 - 2015-06-15 23:57 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-07-15 18:52 - 2015-06-15 23:56 - 00145408 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2015-07-15 18:52 - 2015-06-15 23:55 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-07-15 18:52 - 2015-06-15 23:49 - 01032704 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2015-07-15 18:52 - 2015-06-15 23:41 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2015-07-15 18:52 - 2015-06-15 23:38 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-07-15 18:52 - 2015-06-15 23:36 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-07-15 18:52 - 2015-06-15 23:17 - 02880000 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll
2015-07-15 18:52 - 2015-06-15 23:16 - 02427392 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-07-15 18:52 - 2015-06-15 23:15 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-07-15 18:52 - 2015-06-15 23:13 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-07-15 18:52 - 2015-06-15 23:04 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-07-15 18:52 - 2015-06-15 23:03 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-07-15 18:52 - 2015-06-15 22:52 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-07-15 18:52 - 2015-06-15 22:47 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2015-07-15 18:52 - 2015-06-15 22:44 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-07-15 18:52 - 2015-06-15 22:43 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-07-15 18:52 - 2015-06-15 22:42 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2015-07-15 18:52 - 2015-06-15 22:41 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-07-15 18:52 - 2015-06-15 22:37 - 00880128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2015-07-15 18:52 - 2015-06-15 22:32 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2015-07-15 18:52 - 2015-06-15 22:31 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-07-15 18:52 - 2015-06-15 22:30 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-07-15 18:52 - 2015-06-15 22:30 - 00327168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-07-15 18:52 - 2015-06-15 22:17 - 01048576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\actxprxy.dll
2015-07-15 18:52 - 2015-06-15 22:07 - 01951232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-07-15 18:52 - 2015-06-15 22:02 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-07-15 18:44 - 2015-07-02 00:08 - 05923840 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-07-15 18:44 - 2015-07-01 23:14 - 04520448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-07-15 18:28 - 2015-07-03 15:52 - 00358912 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-07-15 18:28 - 2015-07-03 15:52 - 00044032 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-07-15 18:28 - 2015-07-03 15:50 - 00301056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-07-15 18:28 - 2015-07-03 15:50 - 00035840 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-07-15 18:28 - 2015-06-28 07:07 - 00442712 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-07-15 18:28 - 2015-06-28 07:07 - 00178008 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-07-15 18:28 - 2015-06-28 07:06 - 01311960 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2015-07-15 18:28 - 2015-06-28 07:06 - 00332120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-07-15 18:28 - 2015-06-27 18:42 - 00747520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2015-07-15 18:28 - 2015-06-27 05:13 - 00202240 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2015-07-15 18:28 - 2015-06-27 05:12 - 00401408 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2015-07-15 18:28 - 2015-06-27 05:12 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2015-07-15 18:28 - 2015-06-27 04:40 - 00445440 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-07-15 18:28 - 2015-06-27 04:05 - 01441792 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-07-15 18:28 - 2015-06-27 04:00 - 00989184 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-07-15 18:28 - 2015-06-27 03:53 - 00324096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2015-07-15 18:28 - 2015-06-27 03:26 - 00802816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-07-15 18:28 - 2015-06-25 04:31 - 04177920 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-07-15 18:28 - 2015-06-16 00:41 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\msiexec.exe
2015-07-15 18:28 - 2015-06-16 00:24 - 03320320 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2015-07-15 18:28 - 2015-06-15 23:16 - 00059904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msiexec.exe
2015-07-15 18:28 - 2015-06-15 23:09 - 03607552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2015-07-15 18:28 - 2015-06-15 22:50 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2015-07-15 18:28 - 2015-06-15 21:57 - 02460160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2015-07-15 18:28 - 2015-05-30 23:18 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\werdiagcontroller.dll
2015-07-15 18:28 - 2015-05-30 21:36 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\AudioEndpointBuilder.dll
2015-07-15 18:28 - 2015-05-30 21:35 - 00911360 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2015-07-15 18:28 - 2015-01-30 03:29 - 00035840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\atlthunk.dll
2015-07-15 18:08 - 2015-06-11 05:49 - 01380600 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2015-07-15 18:08 - 2015-06-10 18:13 - 01097216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2015-07-15 18:07 - 2015-06-16 07:36 - 01661576 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2015-07-15 18:07 - 2015-06-16 07:36 - 01212248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2015-07-15 18:05 - 2015-05-07 18:47 - 00564224 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll
2015-07-15 18:05 - 2015-03-11 03:49 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\sdbinst.exe
2015-07-15 18:05 - 2015-03-11 03:09 - 00021504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sdbinst.exe
2015-07-13 08:41 - 2015-07-13 08:41 - 00000000 ____D C:\Program Files (x86)\MSECache
2015-06-22 11:21 - 2015-06-28 23:22 - 00000000 ____D C:\Users\Gunther\Desktop\dagmar neu
2015-06-22 10:41 - 2015-06-22 14:37 - 00000000 ____D C:\Users\Gunther\Desktop\ebay

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-07-20 07:41 - 2015-05-03 10:35 - 00113880 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-07-20 07:33 - 2014-12-20 18:46 - 00000000 ____D C:\Users\Gunther
2015-07-20 07:32 - 2014-12-27 16:12 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-07-20 07:26 - 2014-12-22 17:39 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2015-07-20 07:22 - 2014-12-20 20:55 - 00000000 ____D C:\Users\Gunther\AppData\Local\Adobe
2015-07-20 07:19 - 2014-12-27 16:12 - 00003772 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-07-20 06:35 - 2014-12-20 18:51 - 00003600 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3601908654-2614856020-1968441776-1001
2015-07-20 06:19 - 2015-05-03 10:35 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-07-20 06:19 - 2015-01-21 09:47 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-07-20 03:21 - 2014-12-20 18:49 - 00003922 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{F5319551-2BF6-4B80-A504-C4DA1805D0B8}
2015-07-20 00:04 - 2014-12-20 18:40 - 00000000 ____D C:\ProgramData\NVIDIA
2015-07-20 00:00 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\system32\sru
2015-07-19 16:24 - 2015-01-04 08:55 - 00000000 ____D C:\Users\Gunther\OneDrive
2015-07-19 16:20 - 2014-12-20 20:39 - 00074777 _____ C:\Windows\SysWOW64\Gms.log
2015-07-19 13:02 - 2015-02-16 09:41 - 00000000 ____D C:\Users\Gunther\.rainlendar2
2015-07-18 09:29 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\tracing
2015-07-17 07:16 - 2013-08-22 17:20 - 00000000 ____D C:\Windows\CbsTemp
2015-07-16 12:30 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\rescache
2015-07-16 08:51 - 2014-12-20 20:56 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-07-16 00:17 - 2013-09-16 16:11 - 01776918 _____ C:\Windows\system32\PerfStringBackup.INI
2015-07-16 00:17 - 2013-08-23 01:24 - 00764340 _____ C:\Windows\system32\perfh007.dat
2015-07-16 00:17 - 2013-08-23 01:24 - 00159160 _____ C:\Windows\system32\perfc007.dat
2015-07-16 00:10 - 2013-08-22 16:45 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-07-16 00:10 - 2013-08-22 16:44 - 00598952 _____ C:\Windows\system32\FNTCACHE.DAT
2015-07-16 00:10 - 2013-08-22 15:25 - 00524288 ___SH C:\Windows\system32\config\BBI
2015-07-16 00:08 - 2014-12-27 15:52 - 00000000 ____D C:\Program Files (x86)\CDBurnerXP
2015-07-16 00:08 - 2014-12-20 20:57 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-07-15 21:28 - 2014-12-20 20:21 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-07-15 21:27 - 2014-12-20 19:52 - 00000000 ____D C:\Windows\system32\MRT
2015-07-15 17:20 - 2015-01-01 20:50 - 00003886 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2015-07-15 12:41 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\AppReadiness
2015-07-13 23:10 - 2013-08-22 17:38 - 00792568 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-07-13 23:10 - 2013-08-22 17:38 - 00178168 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-07-12 17:17 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\system32\NDF
2015-07-10 11:10 - 2014-12-20 19:42 - 00000000 __SHD C:\Users\Gunther\AppData\Local\EmieUserList
2015-07-10 11:10 - 2014-12-20 19:42 - 00000000 __SHD C:\Users\Gunther\AppData\Local\EmieSiteList
2015-07-10 11:10 - 2014-12-20 19:42 - 00000000 __SHD C:\Users\Gunther\AppData\Local\EmieBrowserModeList
2015-07-08 17:33 - 2015-01-26 19:44 - 00001131 _____ C:\Users\Public\Desktop\CDBurnerXP.lnk
2015-07-08 17:33 - 2015-01-26 19:44 - 00001081 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk
2015-07-06 09:39 - 2015-06-03 09:29 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-07-03 13:26 - 2014-12-29 09:08 - 00004096 _____ C:\Users\Public\Documents\000016E5.LCS
2015-07-03 08:43 - 2014-12-20 19:52 - 130333168 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

==================== Files in the root of some directories =======

2015-01-23 09:02 - 2015-01-23 09:02 - 0000604 ____H () C:\Program Files (x86)\_43_S
2014-12-22 16:18 - 2010-01-26 12:11 - 0444283 _____ () C:\Program Files\Common Files\WinPcapNmap.exe
2015-01-07 10:08 - 2015-02-22 20:49 - 0235520 _____ () C:\Users\Gunther\AppData\Roaming\AllSimiliarSigns.rsd
2015-01-19 10:38 - 2015-01-19 10:38 - 0001564 _____ () C:\Users\Gunther\AppData\Local\recently-used.xbel
2014-12-23 19:07 - 2014-12-23 19:07 - 0000017 _____ () C:\Users\Gunther\AppData\Local\resmon.resmoncfg
2014-12-20 20:33 - 2014-12-20 20:33 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-07-20 05:11

==================== End of log ============================
         
--- --- ---


[CODE]Additional
FRST Logfile:
Code:
ATTFilter
scan result of Farbar Recovery Scan Tool (x64) Version:18-07-2015 01
Ran by Gunther at 2015-07-20 07:48:28
Running from C:\Users\Gunther\Desktop
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-3601908654-2614856020-1968441776-500 - Administrator - Disabled)
Gast (S-1-5-21-3601908654-2614856020-1968441776-501 - Limited - Disabled)
Gunther (S-1-5-21-3601908654-2614856020-1968441776-1001 - Administrator - Enabled) => C:\Users\Gunther
Kinder (S-1-5-21-3601908654-2614856020-1968441776-1002 - Limited - Enabled) => C:\Users\Kinder

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Kaspersky Internet Security (Enabled - Up to date) {179979E8-273D-D14E-0543-2861940E4886}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Kaspersky Internet Security (Enabled - Up to date) {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky Internet Security (Enabled) {2FA2F8CD-6D52-D016-2E1C-81546ADD0FFD}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

AAVUpdateManager (HKLM-x32\...\{AFA42FE1-A5C3-485F-9180-BFCF5BF1F1C3}) (Version: 18.00.0000 - Wolters Kluwer Deutschland GmbH)
Acronis True Image 2015 (HKLM-x32\...\{08DC7D7A-1CA0-4E96-B12F-9B9577FCF0F8}Visible) (Version: 18.0.6525 - Acronis)
Acronis True Image 2015 (x32 Version: 18.0.6525 - Acronis) Hidden
Adobe Digital Editions 2.0 (HKLM-x32\...\Adobe Digital Editions 2.0) (Version: 2.0.1 - Adobe Systems Incorporated)
Adobe Flash Player 18 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 18.0.0.209 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.12) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.12 - Adobe Systems Incorporated)
AllSimiliarSigns Version 1.5.2 (HKLM-x32\...\{C08B26CF-7FC6-4D7A-858A-C1BA3B6E6491}_is1) (Version: 1.5.2 - AllSimiliarSigns)
Apple Application Support (32-Bit) (HKLM-x32\...\{AFA1153A-F547-409B-B837-3A0D6C5A3FEC}) (Version: 3.1.3 - Apple Inc.)
Apple Application Support (64-Bit) (HKLM\...\{D7B824DE-DA32-4772-9E5E-39C5158136A7}) (Version: 3.1.3 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{C4123106-B685-48E6-B9BD-E4F911841EB4}) (Version: 8.1.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Audacity 2.0.6 (HKLM-x32\...\Audacity_is1) (Version: 2.0.6 - Audacity Team)
Avid License Control (HKLM-x32\...\{F187D064-F101-4E95-8D05-4027809AA0F8}) (Version: 3.0.1 - Avid Technology, Inc.)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Canon CanoScan LiDE 220 On-screen Manual (HKLM-x32\...\Canon CanoScan LiDE 220 On-screen Manual) (Version: 7.7.1 - Canon Inc.)
Canon IJ Scan Utility (HKLM-x32\...\Canon_IJ_Scan_Utility) (Version: 1.1.11.1 - Canon Inc.)
Canon Quick Menu (HKLM-x32\...\CanonQuickMenu) (Version: 2.4.0 - Canon Inc.)
CanoScan LiDE 220 Scanner Driver (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_CNQ4811) (Version: 1.00 - Canon Inc.)
capella reader (HKLM-x32\...\{660A1E62-8B31-4CC4-A36A-7EBDD099831E}) (Version: 7.1.25 - capella software AG)
CCleaner (HKLM\...\CCleaner) (Version: 5.02 - Piriform)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.5.5666 - CDBurnerXP)
CDex - Open Source Digital Audio CD Extractor (HKLM-x32\...\CDex) (Version: 1.75.0.2014 - Georgy Berdyshev)
CD-LabelPrint (HKLM-x32\...\MediaNavigation.CDLabelPrint) (Version:  - )
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Fotogalerie (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Free M4a to MP3 Converter 8.3 (HKLM-x32\...\Free M4a to MP3 Converter_is1) (Version:  - ManiacTools.com)
Free YouTube to MP3 Converter version 3.12.52.1215 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.52.1215 - DVDVideoSoft Ltd.)
G DATA Logox4 Speechengine (HKLM-x32\...\lgx4.lgx.server) (Version:  - G DATA Software AG)
GIMP 2.8.14 (HKLM\...\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team)
Intel(R) Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 10.0.0.1168 - Intel Corporation)
Intel(R) Smart Connect Technology (HKLM\...\{9A37ADB3-3D8D-4EDF-8F6D-B8A66F18087B}) (Version: 5.0.10.2793 - Intel Corporation)
Intel® Chipsatz-Gerätesoftware (x32 Version: 10.0.13 - Intel(R) Corporation) Hidden
iTunes (HKLM\...\{93F2A022-6C37-48B8-B241-FFABD9F60C30}) (Version: 12.1.2.27 - Apple Inc.)
Kaspersky Internet Security (HKLM-x32\...\InstallWIX_{653C1B5A-3287-47B1-8613-0745D4E771C4}) (Version: 15.0.0.463 - Kaspersky Lab)
Kaspersky Internet Security (x32 Version: 15.0.0.463 - Kaspersky Lab) Hidden
Lernwerkstatt 8 (HKLM-x32\...\InstallShield_{08BE0A17-0AB8-4B0C-88E2-EB1B4977A511}) (Version: 8.00.0000 - Medienwerkstatt Mühlacker Verlagsgesellschaft mbH)
Lernwerkstatt 8 (x32 Version: 8.00.0000 - Medienwerkstatt Mühlacker Verlagsgesellschaft mbH) Hidden
MAGIX Video deluxe 2015 (HKLM\...\MX.{FFDC29E6-5C7C-4AA8-AF5A-99E015165382}) (Version: 14.0.0.159 - MAGIX Software GmbH)
MAGIX Video deluxe 2015 (Version: 14.0.0.159 - MAGIX Software GmbH) Hidden
MAGIX Video deluxe 2015 Update (Version: 14.0.0.162 - MAGIX AG) Hidden
Malwarebytes Anti-Malware Version 2.1.8.1057 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.8.1057 - Malwarebytes Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (HKLM-x32\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-3601908654-2614856020-1968441776-1001\...\OneDriveSetup.exe) (Version: 17.3.1229.0918 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 ENU (HKLM-x32\...\{3A9FC03D-C685-4831-94CF-4EDFD3749497}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 x64 ENU (HKLM\...\{D4AD39AD-091E-4D33-BB2B-59F6FCB8ADC3}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319 (HKLM-x32\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{90ffcee5-8608-4e94-8c18-a4feb4f83fb8}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Works 6-9 Converter (HKLM-x32\...\{95140000-0137-0407-0000-0000000FF1CE}) (Version: 14.0.6120.5002 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
MozBackup 1.5.1 (HKLM-x32\...\MozBackup) (Version:  - Pavel Cvrcek)
Mozilla Firefox 39.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 39.0 (x86 de)) (Version: 39.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 31.3.0 - Mozilla)
Mozilla Thunderbird 31.7.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 31.7.0 (x86 de)) (Version: 31.7.0 - Mozilla)
MSI Super Charger (HKLM-x32\...\{7CDF10DD-A9B5-4DA3-AB95-E193248D4369}_is1) (Version: 1.2.025 - MSI)
MSXML 4.0 SP3 Parser (KB2721691) (HKLM-x32\...\{355B5AC0-CEEE-42C5-AD4D-7F3CFD806C36}) (Version: 4.30.2114.0 - Microsoft Corporation)
NVIDIA 3D Vision Controller-Treiber 344.75 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 344.75 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 344.75 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 344.75 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.1.4.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1.4.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 344.75 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 344.75 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.32.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.32.1 - NVIDIA Corporation)
NVIDIA Miracast Virtueller Ton 344.75 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Miracast.VirtualAudio) (Version: 344.75 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.14.0702 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.14.0702 - NVIDIA Corporation)
PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 2.0.1 - pdfforge)
Rainlendar2 (remove only) (HKLM-x32\...\Rainlendar2) (Version:  - )
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.23.1126.2013 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7188 - Realtek Semiconductor Corp.)
Recuva (HKLM\...\Recuva) (Version: 1.51 - Piriform)
SHIELD Streaming (Version: 3.1.2000 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 16.13.69 - NVIDIA Corporation) Hidden
Sibelius 7 OpenType Fonts (HKLM-x32\...\{623C2BD8-1B28-4F98-B578-E9D139827269}) (Version: 7.1.3 - Avid)
Sibelius 7.5 (HKLM\...\{BBADBAB3-56A4-444B-834E-D8730B574C3E}) (Version: 7.5.0.157 - Avid Technology)
SteuerBerater 2014-2015 (HKLM-x32\...\{415227BD-34D9-4DB3-B74C-554407208203}) (Version: 14.11.2 - Akademische Arbeitsgemeinschaft)
SteuerSparErklärung Plus 2015 (HKLM-x32\...\{312C0E08-8F94-4536-AAF6-3413F784AC5F}) (Version: 20.34.161 - Akademische Arbeitsgemeinschaft)
The Inner World 1.0 (HKLM\...\{E8C6E886-0605-416D-BCC1-33B84E08F7EA}) (Version: 1.0 - Headup Games)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
VDownloader 4.0.959 (HKLM\...\{A7E19604-93AF-4611-8C9F-CE509C2B286E}_is1) (Version:  - Vitzo Limited)
VGA Boost (HKLM-x32\...\{809ACFAE-9A4D-4C60-9223-D8B615CD8CBA}}_is1) (Version: 1.0.0.7 - MSI)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3508.0205 - Microsoft Corporation)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-3601908654-2614856020-1968441776-1001_Classes\CLSID\{0B7AD8D3-094A-44DE-A348-83C6C3FA347C}\InprocServer32 -> C:\Users\Gunther\AppData\Local\Microsoft\Windows Sidebar\Gadgets\Clipboarder.gadget\Release\Clipboarder64.dll (Helmut Buhler)
CustomCLSID: HKU\S-1-5-21-3601908654-2614856020-1968441776-1001_Classes\CLSID\{0E7BE950-4ACC-47CB-834B-41A8B96BBFF9}\InprocServer32 -> C:\Users\Gunther\AppData\Local\Microsoft\Windows Sidebar\Gadgets\Sidebar7.gadget\Release\Sidebar7.64.dll (Helmut Buhler)
CustomCLSID: HKU\S-1-5-21-3601908654-2614856020-1968441776-1001_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Gunther\AppData\Local\Microsoft\SkyDrive\17.3.1229.0918\amd64\FileSyncApi64.dll (Microsoft Corporation)

==================== Restore Points =========================

24-06-2015 14:37:04 Windows Update
06-07-2015 07:38:57 Geplanter Prüfpunkt
09-07-2015 08:46:47 Windows Update
15-07-2015 21:26:04 Windows Update

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {0B3E03D0-938A-4C4C-B1E6-F5642A3678F0} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {1510DFDB-61DF-4526-8D16-75B4D5193104} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-07-07] (Adobe Systems Incorporated)
Task: {57C6D167-A9B3-4C87-8CD3-E1E7DD25EBCF} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2015-07-03] (Microsoft Corporation)
Task: {8E413AFB-B1D6-45B9-A994-1638992CB378} - System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-3601908654-2614856020-1968441776-1001 => %localappdata%\Microsoft\SkyDrive\SkyDrive.exe
Task: {E6C46F73-25FA-4596-8555-7ED962051810} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-01-20] (Piriform Ltd)
Task: {EC4DEF59-39A4-469F-8F3C-D2F05ABAF8EB} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-07-20] (Adobe Systems Incorporated)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (Whitelisted) ==============

2014-02-21 10:47 - 2014-02-21 10:47 - 00209712 _____ () C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe
2014-02-21 10:47 - 2014-02-21 10:47 - 00057648 _____ () C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\NetworkHeuristic.dll
2014-02-21 10:47 - 2014-02-21 10:47 - 00057648 _____ () C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\ISCTEncryptionCheck.dll
2014-02-21 10:47 - 2014-02-21 10:47 - 00037168 _____ () C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\ISCTNetMon.dll
2012-07-09 10:23 - 2012-07-09 10:23 - 02700672 _____ () C:\Program Files (x86)\Acronis\TrueImageHome\prl_report.exe
2015-03-20 18:12 - 2015-03-20 18:12 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-03-20 18:12 - 2015-03-20 18:12 - 01346344 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2015-01-21 04:06 - 2015-01-21 04:06 - 00057344 _____ () C:\Program Files\CCleaner\lang\lang-1031.dll
2014-12-20 18:40 - 2014-11-12 23:56 - 00118080 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2014-02-19 19:51 - 2014-02-19 19:51 - 01241560 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
2014-03-06 16:00 - 2014-03-06 16:00 - 01269952 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\kpcengine.2.3.dll
2014-11-27 11:42 - 2014-11-27 11:42 - 00037696 _____ () C:\Program Files (x86)\Acronis\TrueImageHome\qt_icontray_ex.dll
2014-11-27 11:42 - 2014-11-27 11:42 - 00034624 _____ () C:\Program Files (x86)\Common Files\Acronis\Home\thread_pool.dll
2014-04-20 02:42 - 2014-04-20 02:42 - 00468672 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com\npcontentblocker.dll
2014-04-20 02:42 - 2014-04-20 02:42 - 00347328 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com\nponlinebanking.dll
2014-04-20 02:42 - 2014-12-22 17:40 - 00642344 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com\npvkplugin.dll
2014-09-09 11:00 - 2014-09-09 11:00 - 00023576 _____ () C:\Program Files (x86)\Acronis\TrueImageHome\ti_managers_proxy_stub.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\Users\Gunther\OneDrive:ms-properties

==================== Safe Mode (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3601908654-2614856020-1968441776-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Gunther\AppData\Local\Microsoft\Windows\Themes\RoamedThemeFiles\DesktopBackground\img_0939.jpg
DNS Servers: 195.50.140.182 - 195.50.140.114

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

HKLM\...\StartupApproved\Run: => "Acronis Scheduler2 Service"
HKLM\...\StartupApproved\Run: => "ISCT Tray"
HKLM\...\StartupApproved\Run: => "Logitech Download Assistant"
HKLM\...\StartupApproved\Run: => "ShadowPlay"
HKLM\...\StartupApproved\Run: => "NvBackend"
HKLM\...\StartupApproved\Run: => "VDownloader"
HKLM\...\StartupApproved\Run: => "iTunesHelper"
HKLM\...\StartupApproved\Run32: => "AcronisTibMounterMonitor"
HKLM\...\StartupApproved\Run32: => "TrueImageMonitor.exe"
HKLM\...\StartupApproved\Run32: => "CanonQuickMenu"
HKLM\...\StartupApproved\Run32: => "Super Charger"
HKU\S-1-5-21-3601908654-2614856020-1968441776-1001\...\StartupApproved\StartupFolder: => "Sidebar660.lnk"
HKU\S-1-5-21-3601908654-2614856020-1968441776-1001\...\StartupApproved\Run: => "CCleaner Monitoring"
HKU\S-1-5-21-3601908654-2614856020-1968441776-1001\...\StartupApproved\Run: => "SkyDrive"
HKU\S-1-5-21-3601908654-2614856020-1968441776-1001\...\StartupApproved\Run: => "VDownloader"
HKU\S-1-5-21-3601908654-2614856020-1968441776-1001\...\StartupApproved\Run: => "Monotype SkyFonts Clean Up"
HKU\S-1-5-21-3601908654-2614856020-1968441776-1001\...\StartupApproved\Run: => "Rainlendar2"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{CFD465DB-7F04-4F78-95FB-A9B29866DD3C}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{B0AA1134-D870-4BA4-A28C-62BFA3C64DA2}] => (Allow) LPort=2869
FirewallRules: [{CE0D6CA9-640A-4159-8EF4-6750B1163A7D}] => (Allow) LPort=1900
FirewallRules: [{104C89DE-27BB-4517-BA83-662B1F52FB3F}] => (Allow) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
FirewallRules: [{DEC50003-F7CC-40BE-A7E2-327F9BE959D7}] => (Allow) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
FirewallRules: [{ED3AC2A9-EC26-42E6-9986-2EB92066E9BE}] => (Allow) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
FirewallRules: [{0B27EEBA-B2BB-4396-92AE-5CA857761E61}] => (Allow) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
FirewallRules: [{7A2E2C6A-840E-4159-9A9E-0F8DB1F772A0}] => (Allow) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
FirewallRules: [{5956D6E9-DE01-4D19-A1D9-B7F4744B37B4}] => (Allow) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
FirewallRules: [{D816479E-63A6-43A0-8EFA-265BA1BC3B12}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{9E891A22-0218-4316-BC9C-643FF06BD1FD}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{E227CD03-E21A-4BB5-999C-C89A424B87AF}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{7BAB5499-C409-4804-8A73-211BED315671}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{8694782E-E50C-4BDB-B7E9-149DCC06E386}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{30FC0C01-35A8-47AB-B8EF-6B59E4F77ABB}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{EC8E8DBB-D45C-47F8-8CBA-ACE99FB18DBA}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{038C5AF0-7350-4112-84B9-DD42766D1844}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{3054D7A2-AD10-4661-91CE-C433C6408E3D}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{525083E5-4874-4596-9F60-6678269ABF6B}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{BE5D6CD9-3274-410F-BE0B-E9E8EC017114}] => (Allow) C:\Users\Gunther\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
FirewallRules: [{D6DF458D-EC88-4260-8300-C5B55565FF60}] => (Allow) C:\Program Files\MAGIX\Video deluxe 2015\Videodeluxe.exe
FirewallRules: [{DB54A79F-855A-4A68-A2D5-0D7AA5B99CA5}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{44F44605-9734-4CB4-824D-D79FCB3476B5}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{06A224B6-87DA-4DA4-B62C-DE909EDB3378}] => (Allow) C:\Program Files\iTunes\iTunes.exe

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (07/20/2015 12:04:07 AM) (Source: NvStreamSvc) (EventID: 1) (User: )
Description: NvStreamSvcCan continue stopping. [0]

Error: (07/19/2015 07:05:46 PM) (Source: Microsoft-Windows-LocationProvider) (EventID: 2007) (User: NT-AUTORITÄT)
Description: There was an error communicating to the Orion inference server

Error: (07/19/2015 07:05:24 PM) (Source: Microsoft-Windows-LocationProvider) (EventID: 2006) (User: NT-AUTORITÄT)
Description: There was an error with the Windows Location Provider database

Error: (07/19/2015 06:05:44 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_a9edf09f013934e0.manifest.

Error: (07/18/2015 09:29:41 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: svchost.exe_stisvc, Version: 6.3.9600.17415, Zeitstempel: 0x54504177
Name des fehlerhaften Moduls: CNQ_CIL.dll, Version: 1.0.0.1, Zeitstempel: 0x534e21ac
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000002b530
ID des fehlerhaften Prozesses: 0x8d0
Startzeit der fehlerhaften Anwendung: 0xsvchost.exe_stisvc0
Pfad der fehlerhaften Anwendung: svchost.exe_stisvc1
Pfad des fehlerhaften Moduls: svchost.exe_stisvc2
Berichtskennung: svchost.exe_stisvc3
Vollständiger Name des fehlerhaften Pakets: svchost.exe_stisvc4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: svchost.exe_stisvc5

Error: (07/17/2015 05:15:28 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 39.0.0.5659, Zeitstempel: 0x55934d06
Name des fehlerhaften Moduls: mozalloc.dll, Version: 39.0.0.5659, Zeitstempel: 0x55933a83
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001aa1
ID des fehlerhaften Prozesses: 0xc0c
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3
Vollständiger Name des fehlerhaften Pakets: plugin-container.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: plugin-container.exe5

Error: (07/17/2015 05:15:26 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 39.0.0.5659, Zeitstempel: 0x55934d06
Name des fehlerhaften Moduls: mozalloc.dll, Version: 39.0.0.5659, Zeitstempel: 0x55933a83
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001aa1
ID des fehlerhaften Prozesses: 0x1830
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3
Vollständiger Name des fehlerhaften Pakets: plugin-container.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: plugin-container.exe5

Error: (07/17/2015 05:15:24 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 39.0.0.5659, Zeitstempel: 0x55934d06
Name des fehlerhaften Moduls: mozalloc.dll, Version: 39.0.0.5659, Zeitstempel: 0x55933a83
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001aa1
ID des fehlerhaften Prozesses: 0xcd4
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3
Vollständiger Name des fehlerhaften Pakets: plugin-container.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: plugin-container.exe5

Error: (07/17/2015 07:16:51 AM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )
Description: Das Volume "Wiederherstellung" wurde aufgrund eines Fehlers nicht optimiert: Falscher Parameter. (0x80070057)

Error: (07/16/2015 02:36:13 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: wwahost.exe, Version: 6.3.9600.17415, Zeitstempel: 0x5450355f
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.3.9600.17736, Zeitstempel: 0x550f42c2
Ausnahmecode: 0xc0000008
Fehleroffset: 0x0003ca2c
ID des fehlerhaften Prozesses: 0x150c
Startzeit der fehlerhaften Anwendung: 0xwwahost.exe0
Pfad der fehlerhaften Anwendung: wwahost.exe1
Pfad des fehlerhaften Moduls: wwahost.exe2
Berichtskennung: wwahost.exe3
Vollständiger Name des fehlerhaften Pakets: wwahost.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: wwahost.exe5


System errors:
=============
Error: (07/20/2015 07:12:23 AM) (Source: Microsoft-Windows-Kernel-General) (EventID: 5) (User: ARLT)
Description: 0x8000002a117\??\C:\ProgramData\Malwarebytes\ Malwarebytes Anti-Malware \S-1-5-21-3601908654-2614856020-1968441776-1001-0-ntuser.dat

Error: (07/20/2015 07:04:21 AM) (Source: DCOM) (EventID: 10016) (User: ARLT)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}ARLTGuntherS-1-5-21-3601908654-2614856020-1968441776-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar

Error: (07/20/2015 07:01:10 AM) (Source: Microsoft-Windows-Kernel-General) (EventID: 5) (User: ARLT)
Description: 0x8000002a117\??\C:\ProgramData\Malwarebytes\ Malwarebytes Anti-Malware \S-1-5-21-3601908654-2614856020-1968441776-1001-0-ntuser.dat

Error: (07/20/2015 06:56:18 AM) (Source: DCOM) (EventID: 10016) (User: ARLT)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}ARLTGuntherS-1-5-21-3601908654-2614856020-1968441776-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar

Error: (07/20/2015 06:46:14 AM) (Source: Microsoft-Windows-Kernel-General) (EventID: 5) (User: ARLT)
Description: 0x8000002a117\??\C:\ProgramData\Malwarebytes\ Malwarebytes Anti-Malware \S-1-5-21-3601908654-2614856020-1968441776-1001-0-ntuser.dat

Error: (07/20/2015 06:31:44 AM) (Source: Microsoft-Windows-Kernel-General) (EventID: 5) (User: ARLT)
Description: 0x8000002a117\??\C:\ProgramData\Malwarebytes\ Malwarebytes Anti-Malware \S-1-5-21-3601908654-2614856020-1968441776-1001-0-ntuser.dat

Error: (07/20/2015 06:26:25 AM) (Source: DCOM) (EventID: 10016) (User: ARLT)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}ARLTGuntherS-1-5-21-3601908654-2614856020-1968441776-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar

Error: (07/20/2015 06:24:58 AM) (Source: Microsoft-Windows-Kernel-General) (EventID: 5) (User: ARLT)
Description: 0x8000002a117\??\C:\ProgramData\Malwarebytes\ Malwarebytes Anti-Malware \S-1-5-21-3601908654-2614856020-1968441776-1001-0-ntuser.dat

Error: (07/20/2015 06:10:56 AM) (Source: DCOM) (EventID: 10016) (User: ARLT)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}ARLTGuntherS-1-5-21-3601908654-2614856020-1968441776-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar

Error: (07/20/2015 06:10:56 AM) (Source: DCOM) (EventID: 10016) (User: ARLT)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}ARLTGuntherS-1-5-21-3601908654-2614856020-1968441776-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar


Microsoft Office:
=========================

==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i7-4790K CPU @ 4.00GHz
Percentage of memory in use: 13%
Total physical RAM: 16335.72 MB
Available physical RAM: 14051.61 MB
Total Virtual: 18767.72 MB
Available Virtual: 16159.16 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:111.27 GB) (Free:49.09 GB) NTFS
Drive d: () (Fixed) (Total:1863.01 GB) (Free:1607.31 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: 27C2FF93)
Partition 1: (Not Active) - (Size=1863 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 111.8 GB) (Disk ID: 00000000)

Partition: GPT Partition Type.

==================== End of log ============================
         
--- --- ---



Code:
ATTFilter
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-07-20 07:58:22
Windows 6.2.9200  x64 \Device\Harddisk1\DR1 -> \Device\00000039 Samsung_SSD_840_EVO_120GB rev.EXT0BB0Q 111,79GB
Running: Gmer-19357.exe; Driver: C:\Users\Gunther\AppData\Local\Temp\pxldrpow.sys


---- Kernel code sections - GMER 2.1 ----

.text   C:\Windows\System32\win32k.sys!W32pServiceTable                                                                                                    fffff9600023b600 15 bytes [00, 96, F2, 01, 00, 6A, 6C, ...]
.text   C:\Windows\System32\win32k.sys!W32pServiceTable + 16                                                                                               fffff9600023b610 11 bytes [00, D7, FB, FF, 00, 7B, D1, ...]

---- User code sections - GMER 2.1 ----

.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 132                            00007ffe8dfa4b04 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!RtlPrefixString + 316                                00007ffe8dfa4f2c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!TpAllocIoCompletion + 710                            00007ffe8dfa5206 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!RtlWaitForWnfMetaNotification + 479                  00007ffe8dfa53ff 8 bytes {JMP 0xffffffffffffffee}
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!RtlUserThreadStart + 911                             00007ffe8dfa579f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!TpAllocWork + 420                                    00007ffe8dfa5954 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!RtlWaitOnAddress + 657                               00007ffe8dfa5ef1 8 bytes {JMP 0xffffffffffffff9e}
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!RtlUnsubscribeWnfNotificationWaitForCompletion + 78  00007ffe8dfa5f4e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!RtlWakeAddressAll + 399                              00007ffe8dfa60ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!RtlUnsubscribeWnfStateChangeNotification + 977       00007ffe8dfa64d1 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!TpSimpleTryPost + 310                                00007ffe8dfa6616 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!TpSimpleTryPost + 491                                00007ffe8dfa66cb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!RtlReportSilentProcessExit + 359                     00007ffe8dfa8397 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!LdrFindEntryForAddress + 67                          00007ffe8dfa8a13 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!LdrFindEntryForAddress + 864                         00007ffe8dfa8d30 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!LdrGetDllHandleByName + 143                          00007ffe8dfa8e9f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!LdrInitializeThunk + 510                             00007ffe8dfa90ae 8 bytes {JMP 0xffffffffffffff96}
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!LdrInitializeThunk + 715                             00007ffe8dfa917b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!RtlQueueWorkItem + 772                               00007ffe8dfa9d14 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!LdrAddRefDll + 685                                   00007ffe8dfa9fcd 8 bytes {JMP 0xffffffffffffffaf}
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!SbSelectProcedure + 352                              00007ffe8dfaaae0 8 bytes {JMP 0xffffffffffffffcd}
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!SbSelectProcedure + 488                              00007ffe8dfaab68 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   ...                                                                                                                                                * 3
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!RtlGetVersion + 565                                  00007ffe8dfab2e5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!RtlGetNtProductType + 78                             00007ffe8dfab33e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll + 311                                   00007ffe8dfac4d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll + 528                                   00007ffe8dfac5b0 8 bytes {JMP 0xffffffffffffffc7}
.text   ...                                                                                                                                                * 2
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!RtlAllocateActivationContextStack + 579              00007ffe8dfad0d3 8 bytes {JMP 0xffffffffffffffef}
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!RtlFreeThreadActivationContextStack + 47             00007ffe8dfad10f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!RtlProcessFlsData + 495                              00007ffe8dfad57f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!RtlDetectHeapLeaks + 43                              00007ffe8dfad6eb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!RtlDetectHeapLeaks + 456                             00007ffe8dfad888 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseWait + 180                                  00007ffe8dfad944 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!RtlRegisterWait + 596                                00007ffe8dfadba4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!TpAllocWait + 424                                    00007ffe8dfadd58 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!TpSetWaitEx + 771                                    00007ffe8dfae073 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!TpSetWaitEx + 948                                    00007ffe8dfae124 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!EtwRegisterTraceGuidsA + 48                          00007ffe8dfae160 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!RtlRandomEx + 756                                    00007ffe8dfaeb74 8 bytes {JMP 0xffffffffffffffd0}
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteFunctionTable + 371                         00007ffe8dfafe63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!RtlAddFunctionTable + 556                            00007ffe8dfb009c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!RtlProtectHeap + 171                                 00007ffe8dfb015b 8 bytes [70, 6C, BD, 7E, 00, 00, 00, ...]
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeCriticalSectionEx + 744                 00007ffe8dfb1438 8 bytes [40, 6C, BD, 7E, 00, 00, 00, ...]
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!EtwRegisterTraceGuidsW + 214                         00007ffe8dfb15e6 8 bytes [30, 6C, BD, 7E, 00, 00, 00, ...]
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!EtwNotificationRegister + 567                        00007ffe8dfb1877 8 bytes [20, 6C, BD, 7E, 00, 00, 00, ...]
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!RtlDllShutdownInProgress + 429                       00007ffe8dfb1a2d 8 bytes [10, 6C, BD, 7E, 00, 00, 00, ...]
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!RtlRunOnceExecuteOnce + 213                          00007ffe8dfb1c35 8 bytes [00, 6C, BD, 7E, 00, 00, 00, ...]
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                               00007ffe8e021290 8 bytes {JMP QWORD [RIP-0x6fe5e]}
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                             00007ffe8e021410 8 bytes {JMP QWORD [RIP-0x6fe30]}
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                   00007ffe8e021440 8 bytes {JMP QWORD [RIP-0x712eb]}
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                 00007ffe8e021560 8 bytes {JMP QWORD [RIP-0x70c1e]}
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                     00007ffe8e021610 8 bytes {JMP QWORD [RIP-0x71122]}
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                     00007ffe8e021cd0 8 bytes {JMP QWORD [RIP-0x700a1]}
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                   00007ffe8e021fd0 8 bytes {JMP QWORD [RIP-0x705a9]}
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                   00007ffe8e022850 8 bytes {JMP QWORD [RIP-0x70fdf]}
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\system32\wow64cpu.dll!CpuSetContext + 438                               00000000775713f6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\system32\wow64cpu.dll!CpuGetContext + 387                               0000000077571583 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\system32\wow64cpu.dll!CpuSetInstructionPointer + 49                     0000000077571621 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\system32\wow64cpu.dll!CpuProcessInit + 68                               0000000077571674 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\system32\wow64cpu.dll!CpuGetStackPointer + 23                           00000000775716d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 9                       00000000775716e9 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 71                      0000000077571727 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   ...                                                                                                                                                * 7
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\system32\wow64cpu.dll!CpuFlushInstructionCache + 16                     00000000775725d0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\system32\wow64cpu.dll!CpuInitializeStartupContext + 308                 0000000077572714 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\system32\wow64cpu.dll!CpuResetToConsistentState + 529                   0000000077572961 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\system32\wow64cpu.dll!CpuProcessTerm + 595                              0000000077572bd3 8 bytes [DC, 6A, BD, 7E, 00, 00, 00, ...]
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 132                                                00007ffe8dfa4b04 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!RtlPrefixString + 316                                                    00007ffe8dfa4f2c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!TpAllocIoCompletion + 710                                                00007ffe8dfa5206 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!RtlWaitForWnfMetaNotification + 479                                      00007ffe8dfa53ff 8 bytes {JMP 0xffffffffffffffee}
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!RtlUserThreadStart + 911                                                 00007ffe8dfa579f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!TpAllocWork + 420                                                        00007ffe8dfa5954 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!RtlWaitOnAddress + 657                                                   00007ffe8dfa5ef1 8 bytes {JMP 0xffffffffffffff9e}
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!RtlUnsubscribeWnfNotificationWaitForCompletion + 78                      00007ffe8dfa5f4e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!RtlWakeAddressAll + 399                                                  00007ffe8dfa60ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!RtlUnsubscribeWnfStateChangeNotification + 977                           00007ffe8dfa64d1 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!TpSimpleTryPost + 310                                                    00007ffe8dfa6616 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!TpSimpleTryPost + 491                                                    00007ffe8dfa66cb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!RtlReportSilentProcessExit + 359                                         00007ffe8dfa8397 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!LdrFindEntryForAddress + 67                                              00007ffe8dfa8a13 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!LdrFindEntryForAddress + 864                                             00007ffe8dfa8d30 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!LdrGetDllHandleByName + 143                                              00007ffe8dfa8e9f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!LdrInitializeThunk + 510                                                 00007ffe8dfa90ae 8 bytes {JMP 0xffffffffffffff96}
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!LdrInitializeThunk + 715                                                 00007ffe8dfa917b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!RtlQueueWorkItem + 772                                                   00007ffe8dfa9d14 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!LdrAddRefDll + 685                                                       00007ffe8dfa9fcd 8 bytes {JMP 0xffffffffffffffaf}
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!SbSelectProcedure + 352                                                  00007ffe8dfaaae0 8 bytes {JMP 0xffffffffffffffcd}
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!SbSelectProcedure + 488                                                  00007ffe8dfaab68 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   ...                                                                                                                                                * 3
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!RtlGetVersion + 565                                                      00007ffe8dfab2e5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!RtlGetNtProductType + 78                                                 00007ffe8dfab33e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll + 311                                                       00007ffe8dfac4d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll + 528                                                       00007ffe8dfac5b0 8 bytes {JMP 0xffffffffffffffc7}
.text   ...                                                                                                                                                * 2
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!RtlAllocateActivationContextStack + 579                                  00007ffe8dfad0d3 8 bytes {JMP 0xffffffffffffffef}
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!RtlFreeThreadActivationContextStack + 47                                 00007ffe8dfad10f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!RtlProcessFlsData + 495                                                  00007ffe8dfad57f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!RtlDetectHeapLeaks + 43                                                  00007ffe8dfad6eb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!RtlDetectHeapLeaks + 456                                                 00007ffe8dfad888 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseWait + 180                                                      00007ffe8dfad944 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!RtlRegisterWait + 596                                                    00007ffe8dfadba4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!TpAllocWait + 424                                                        00007ffe8dfadd58 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!TpSetWaitEx + 771                                                        00007ffe8dfae073 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!TpSetWaitEx + 948                                                        00007ffe8dfae124 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!EtwRegisterTraceGuidsA + 48                                              00007ffe8dfae160 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!RtlRandomEx + 756                                                        00007ffe8dfaeb74 8 bytes {JMP 0xffffffffffffffd0}
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteFunctionTable + 371                                             00007ffe8dfafe63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!RtlAddFunctionTable + 556                                                00007ffe8dfb009c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!RtlProtectHeap + 171                                                     00007ffe8dfb015b 8 bytes {JO 0x6e; JMP 0x82}
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeCriticalSectionEx + 744                                     00007ffe8dfb1438 8 bytes {INS BYTE [RDI], DX; JMP 0x82}
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!EtwRegisterTraceGuidsW + 214                                             00007ffe8dfb15e6 8 bytes [30, 6C, EB, 7E, 00, 00, 00, ...]
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!EtwNotificationRegister + 567                                            00007ffe8dfb1877 8 bytes [20, 6C, EB, 7E, 00, 00, 00, ...]
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!RtlDllShutdownInProgress + 429                                           00007ffe8dfb1a2d 8 bytes [10, 6C, EB, 7E, 00, 00, 00, ...]
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!RtlRunOnceExecuteOnce + 213                                              00007ffe8dfb1c35 8 bytes [00, 6C, EB, 7E, 00, 00, 00, ...]
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                   00007ffe8e021290 8 bytes {JMP QWORD [RIP-0x6fe5e]}
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                 00007ffe8e021410 8 bytes {JMP QWORD [RIP-0x6fe30]}
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                       00007ffe8e021440 8 bytes {JMP QWORD [RIP-0x712eb]}
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                     00007ffe8e021560 8 bytes {JMP QWORD [RIP-0x70c1e]}
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                         00007ffe8e021610 8 bytes {JMP QWORD [RIP-0x71122]}
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                         00007ffe8e021cd0 8 bytes {JMP QWORD [RIP-0x700a1]}
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                       00007ffe8e021fd0 8 bytes {JMP QWORD [RIP-0x705a9]}
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                       00007ffe8e022850 8 bytes {JMP QWORD [RIP-0x70fdf]}
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\system32\wow64cpu.dll!CpuSetContext + 438                                                   00000000775713f6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\system32\wow64cpu.dll!CpuGetContext + 387                                                   0000000077571583 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\system32\wow64cpu.dll!CpuSetInstructionPointer + 49                                         0000000077571621 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\system32\wow64cpu.dll!CpuProcessInit + 68                                                   0000000077571674 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\system32\wow64cpu.dll!CpuGetStackPointer + 23                                               00000000775716d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 9                                           00000000775716e9 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 71                                          0000000077571727 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   ...                                                                                                                                                * 7
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\system32\wow64cpu.dll!CpuFlushInstructionCache + 16                                         00000000775725d0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\system32\wow64cpu.dll!CpuInitializeStartupContext + 308                                     0000000077572714 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\system32\wow64cpu.dll!CpuResetToConsistentState + 529                                       0000000077572961 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\system32\wow64cpu.dll!CpuProcessTerm + 595                                                  0000000077572bd3 8 bytes [DC, 6A, EB, 7E, 00, 00, 00, ...]
.text   C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\PROGRA~2\MICROS~3\Office12\cdlmso.dll!?DoEvent@Cdl@@YG_NAAUtagMSG@@@Z + 28                          0000000073f76588 4 bytes [EE, 2A, 24, 39]
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 132                                               00007ffe8dfa4b04 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!RtlPrefixString + 316                                                   00007ffe8dfa4f2c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!TpAllocIoCompletion + 710                                               00007ffe8dfa5206 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!RtlWaitForWnfMetaNotification + 479                                     00007ffe8dfa53ff 8 bytes {JMP 0xffffffffffffffee}
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!RtlUserThreadStart + 911                                                00007ffe8dfa579f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!TpAllocWork + 420                                                       00007ffe8dfa5954 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!RtlWaitOnAddress + 657                                                  00007ffe8dfa5ef1 8 bytes {JMP 0xffffffffffffff9e}
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!RtlUnsubscribeWnfNotificationWaitForCompletion + 78                     00007ffe8dfa5f4e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!RtlWakeAddressAll + 399                                                 00007ffe8dfa60ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!RtlUnsubscribeWnfStateChangeNotification + 977                          00007ffe8dfa64d1 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!TpSimpleTryPost + 310                                                   00007ffe8dfa6616 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!TpSimpleTryPost + 491                                                   00007ffe8dfa66cb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!RtlReportSilentProcessExit + 359                                        00007ffe8dfa8397 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!LdrFindEntryForAddress + 67                                             00007ffe8dfa8a13 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!LdrFindEntryForAddress + 864                                            00007ffe8dfa8d30 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!LdrGetDllHandleByName + 143                                             00007ffe8dfa8e9f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!LdrInitializeThunk + 510                                                00007ffe8dfa90ae 8 bytes {JMP 0xffffffffffffff96}
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!LdrInitializeThunk + 715                                                00007ffe8dfa917b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!RtlQueueWorkItem + 772                                                  00007ffe8dfa9d14 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!LdrAddRefDll + 685                                                      00007ffe8dfa9fcd 8 bytes {JMP 0xffffffffffffffaf}
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!SbSelectProcedure + 352                                                 00007ffe8dfaaae0 8 bytes {JMP 0xffffffffffffffcd}
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!SbSelectProcedure + 488                                                 00007ffe8dfaab68 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   ...                                                                                                                                                * 3
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!RtlGetVersion + 565                                                     00007ffe8dfab2e5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!RtlGetNtProductType + 78                                                00007ffe8dfab33e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll + 311                                                      00007ffe8dfac4d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll + 528                                                      00007ffe8dfac5b0 8 bytes {JMP 0xffffffffffffffc7}
.text   ...                                                                                                                                                * 2
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!RtlAllocateActivationContextStack + 579                                 00007ffe8dfad0d3 8 bytes {JMP 0xffffffffffffffef}
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!RtlFreeThreadActivationContextStack + 47                                00007ffe8dfad10f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!RtlProcessFlsData + 495                                                 00007ffe8dfad57f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!RtlDetectHeapLeaks + 43                                                 00007ffe8dfad6eb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!RtlDetectHeapLeaks + 456                                                00007ffe8dfad888 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseWait + 180                                                     00007ffe8dfad944 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!RtlRegisterWait + 596                                                   00007ffe8dfadba4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!TpAllocWait + 424                                                       00007ffe8dfadd58 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!TpSetWaitEx + 771                                                       00007ffe8dfae073 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!TpSetWaitEx + 948                                                       00007ffe8dfae124 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!EtwRegisterTraceGuidsA + 48                                             00007ffe8dfae160 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!RtlRandomEx + 756                                                       00007ffe8dfaeb74 8 bytes {JMP 0xffffffffffffffd0}
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteFunctionTable + 371                                            00007ffe8dfafe63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!RtlAddFunctionTable + 556                                               00007ffe8dfb009c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!RtlProtectHeap + 171                                                    00007ffe8dfb015b 8 bytes [70, 6C, F8, 7F, 00, 00, 00, ...]
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeCriticalSectionEx + 744                                    00007ffe8dfb1438 8 bytes [40, 6C, F8, 7F, 00, 00, 00, ...]
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!EtwRegisterTraceGuidsW + 214                                            00007ffe8dfb15e6 8 bytes [30, 6C, F8, 7F, 00, 00, 00, ...]
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!EtwNotificationRegister + 567                                           00007ffe8dfb1877 8 bytes [20, 6C, F8, 7F, 00, 00, 00, ...]
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!RtlDllShutdownInProgress + 429                                          00007ffe8dfb1a2d 8 bytes [10, 6C, F8, 7F, 00, 00, 00, ...]
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!RtlRunOnceExecuteOnce + 213                                             00007ffe8dfb1c35 8 bytes [00, 6C, F8, 7F, 00, 00, 00, ...]
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                  00007ffe8e021290 8 bytes {JMP QWORD [RIP-0x6fe5e]}
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                00007ffe8e021410 8 bytes {JMP QWORD [RIP-0x6fe30]}
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                      00007ffe8e021440 8 bytes {JMP QWORD [RIP-0x712eb]}
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                    00007ffe8e021560 8 bytes {JMP QWORD [RIP-0x70c1e]}
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                        00007ffe8e021610 8 bytes {JMP QWORD [RIP-0x71122]}
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                        00007ffe8e021cd0 8 bytes {JMP QWORD [RIP-0x700a1]}
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                      00007ffe8e021fd0 8 bytes {JMP QWORD [RIP-0x705a9]}
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                      00007ffe8e022850 8 bytes {JMP QWORD [RIP-0x70fdf]}
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\system32\wow64cpu.dll!CpuSetContext + 438                                                  00000000775713f6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\system32\wow64cpu.dll!CpuGetContext + 387                                                  0000000077571583 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\system32\wow64cpu.dll!CpuSetInstructionPointer + 49                                        0000000077571621 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\system32\wow64cpu.dll!CpuProcessInit + 68                                                  0000000077571674 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\system32\wow64cpu.dll!CpuGetStackPointer + 23                                              00000000775716d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 9                                          00000000775716e9 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 71                                         0000000077571727 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   ...                                                                                                                                                * 7
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\system32\wow64cpu.dll!CpuFlushInstructionCache + 16                                        00000000775725d0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\system32\wow64cpu.dll!CpuInitializeStartupContext + 308                                    0000000077572714 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\system32\wow64cpu.dll!CpuResetToConsistentState + 529                                      0000000077572961 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\system32\wow64cpu.dll!CpuProcessTerm + 595                                                 0000000077572bd3 8 bytes [DC, 6A, F8, 7F, 00, 00, 00, ...]

---- Threads - GMER 2.1 ----

Thread  C:\Windows\system32\csrss.exe [5284:1676]                                                                                                          fffff9600082f2d0

---- EOF - GMER 2.1 ----
         

Geändert von GunHill (20.07.2015 um 07:26 Uhr)

Alt 20.07.2015, 07:24   #2
schrauber
/// the machine
/// TB-Ausbilder
 

Internet extrem langsam -viel zu viele Netzwerkverbindunge - ein Zeichen für Schadware - Standard

Internet extrem langsam -viel zu viele Netzwerkverbindunge - ein Zeichen für Schadware



hi,

Downloade dir bitte Malwarebytes Anti-Rootkit Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
  • Starte bitte die mbar.exe.
  • Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
  • Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
  • Klicke auf den CleanUp Button und erlaube den Neustart.
  • Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
  • Nach dem Neustart starte die mbar.exe erneut.
  • Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.
Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers
__________________

__________________

Alt 20.07.2015, 07:49   #3
GunHill
 
Internet extrem langsam -viel zu viele Netzwerkverbindunge - ein Zeichen für Schadware - Standard

Internet extrem langsam -viel zu viele Netzwerkverbindunge - ein Zeichen für Schadware



Hi,
das ging aber schnell :-))
Nach dem Download habe ich direkt "mbar-1.09.1.1004.exe" auf dem Desktop, da ist nicht zu extrahieren. Soll ich das nehmen?
Danke,
Gunther
__________________

Alt 20.07.2015, 17:05   #4
schrauber
/// the machine
/// TB-Ausbilder
 

Internet extrem langsam -viel zu viele Netzwerkverbindunge - ein Zeichen für Schadware - Standard

Internet extrem langsam -viel zu viele Netzwerkverbindunge - ein Zeichen für Schadware



jop
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 20.07.2015, 17:40   #5
GunHill
 
Internet extrem langsam -viel zu viele Netzwerkverbindunge - ein Zeichen für Schadware - Standard

Internet extrem langsam -viel zu viele Netzwerkverbindunge - ein Zeichen für Schadware



Hi,
runterladen & aktualisieren von Anti-Rootkit hat geklappt.
Beim Scan kam folgende Fehlermeldung:
"Could not load DDA driver.
DDA driver was not installed which may be caused by rootkit activity. Do you want to reboot the computer to install DDA driver (Sca will continue after reboot)?

Soll ich neustarten?

Dank & Gruß von

Gunther


Alt 21.07.2015, 07:00   #6
schrauber
/// the machine
/// TB-Ausbilder
 

Internet extrem langsam -viel zu viele Netzwerkverbindunge - ein Zeichen für Schadware - Standard

Internet extrem langsam -viel zu viele Netzwerkverbindunge - ein Zeichen für Schadware



ja
__________________
--> Internet extrem langsam -viel zu viele Netzwerkverbindunge - ein Zeichen für Schadware

Alt 22.07.2015, 07:46   #7
GunHill
 
Internet extrem langsam -viel zu viele Netzwerkverbindunge - ein Zeichen für Schadware - Standard

Internet extrem langsam -viel zu viele Netzwerkverbindunge - ein Zeichen für Schadware



... jetzt ging auch das Aktualisieren der Datenbank nicht mehr:
Fehlermeldung beim Versuch von Download v2015.07.21.04: "Failed. Host not found"
Trotzdem Scannen?
Danke für die Hilfe.
Gunther

Guten Morgen,
beim 4. Versuch (mit Ausschaltung der Kaspersky Antivir) hat die Aktualisierung der Datenbank heute morgen geklappt.
Scanergebnis: keine Fund.
Was nun?
Gruß, Gunther

Alt 22.07.2015, 08:23   #8
schrauber
/// the machine
/// TB-Ausbilder
 

Internet extrem langsam -viel zu viele Netzwerkverbindunge - ein Zeichen für Schadware - Standard

Internet extrem langsam -viel zu viele Netzwerkverbindunge - ein Zeichen für Schadware



Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


und ein frisches FRST log bitte.
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 23.07.2015, 06:23   #9
GunHill
 
Internet extrem langsam -viel zu viele Netzwerkverbindunge - ein Zeichen für Schadware - Standard

Internet extrem langsam -viel zu viele Netzwerkverbindunge - ein Zeichen für Schadware



Guten Morgen,
hier die logs (Musste mir FRST neu herunterladen) - DANKE!

Code:
ATTFilter
# AdwCleaner v4.208 - Bericht erstellt 22/07/2015 um 17:18:13
# Aktualisiert 09/07/2015 von Xplode
# Datenbank : 2015-07-15.1 [Server]
# Betriebssystem : Windows 8.1  (x64)
# Benutzername : Gunther - ARLT
# Gestarted von : C:\Users\Gunther\Desktop\AdwCleaner_4.208.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\Users\Gunther\AppData\Local\pdfforge
Ordner Gelöscht : C:\Users\Gunther\AppData\Roaming\pdfforge
Datei Gelöscht : C:\Users\Gunther\AppData\Roaming\Mozilla\Firefox\Profiles\8fcu2t3l.default\user.js
Datei Gelöscht : C:\Users\Kinder\AppData\Roaming\Mozilla\Firefox\Profiles\e6p4o9wx.default\user.js

***** [ Geplante Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\OCS

***** [ Internetbrowser ] *****

-\\ Internet Explorer v11.0.9600.17840


-\\ Mozilla Firefox v39.0 (x86 de)


*************************

AdwCleaner[R0].txt - [1997 Bytes] - [22/07/2015 17:17:37]
AdwCleaner[S0].txt - [1863 Bytes] - [22/07/2015 17:18:13]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1922  Bytes] ##########
         
Code:
ATTFilter
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 7.5.1 (07.16.2015:1)
OS: Windows 8.1 x64
Ran by Gunther on 23.07.2015 at  6:53:09,98
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Tasks



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 23.07.2015 at  6:54:43,74
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:20-07-2015
Ran by Gunther (administrator) on ARLT on 23-07-2015 07:18:37
Running from C:\Users\Gunther\Desktop
Loaded Profiles: Gunther (Available Profiles: Gunther & Kinder)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
() C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
() C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(MSI) C:\Program Files (x86)\MSI\Super Charger\ChargeService.exe
(MICRO-STAR INTERNATIONAL CO., LTD.) C:\Program Files (x86)\MSI\MSITrigger\MSI_Trigger_Service.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avpui.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\livecomm.exe
(Microsoft Corporation) C:\Windows\SysWOW64\WWAHost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7543000 2014-03-04] (Realtek Semiconductor)
HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
HKLM\...\Run: [ISCT Tray] => C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTsysTray8.exe [5860656 2014-02-21] (Intel Corporation)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2465088 2014-11-17] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [VDownloader] => C:\Program Files\VDownloader\VDownloader4.exe [3017216 2014-10-23] (Vitzo)
HKLM\...\Run: [Acronis Scheduler2 Service] => C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe [571192 2014-08-14] (Acronis)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [169768 2015-04-07] (Apple Inc.)
HKLM-x32\...\Run: [Super Charger] => C:\Program Files (x86)\MSI\Super Charger\Super Charger.exe [1047536 2014-04-08] (MSI)
HKLM-x32\...\Run: [CanonQuickMenu] => C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE [1284680 2014-01-17] (CANON INC.)
HKLM-x32\...\Run: [TrueImageMonitor.exe] => C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe [5343272 2014-11-27] (Acronis)
HKLM-x32\...\Run: [AcronisTibMounterMonitor] => C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe [606096 2014-10-17] (Acronis International GmbH)
HKU\S-1-5-21-3601908654-2614856020-1968441776-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7404312 2015-01-20] (Piriform Ltd)
HKU\S-1-5-21-3601908654-2614856020-1968441776-1001\...\Run: [VDownloader] => C:\Program Files\VDownloader\VDownloader4.exe [3017216 2014-10-23] (Vitzo)
HKU\S-1-5-21-3601908654-2614856020-1968441776-1001\...\Run: [SkyDrive] => C:\Users\Gunther\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe [277672 2015-01-04] (Microsoft Corporation)
HKU\S-1-5-21-3601908654-2614856020-1968441776-1001\...\Run: [Rainlendar2] => C:\Program Files\Rainlendar2\Rainlendar2.exe [4411488 2014-03-16] ()
HKU\S-1-5-21-3601908654-2614856020-1968441776-1001\...\Run: [Monotype SkyFonts Clean Up] => C:\Program Files\Monotype\SkyFonts\Monotype.SkyFonts.CleanUp.exe
Startup: C:\Users\Gunther\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sidebar660.lnk [2015-02-16]
ShortcutTarget: Sidebar660.lnk -> C:\Program Files\Windows Sidebar\sidebar.exe (No File)
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File
ShellIconOverlayIdentifiers: [AcronisSyncError] -> {934BC6C0-FEC2-4df5-A100-961DE2C8A0ED} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2014-09-09] (Acronis)
ShellIconOverlayIdentifiers: [AcronisSyncInProgress] -> {00F848DC-B1D4-4892-9C25-CAADC86A215D} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2014-09-09] (Acronis)
ShellIconOverlayIdentifiers: [AcronisSyncOk] -> {71573297-552E-46fc-BE3D-3DFAF88D47B7} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2014-09-09] (Acronis)
ShellIconOverlayIdentifiers-x32: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-3601908654-2614856020-1968441776-1001\Software\Microsoft\Internet Explorer\Main,Start Page = https://lernen.phase-6.de/#/login
HKU\S-1-5-21-3601908654-2614856020-1968441776-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.arlt.com
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll [2014-12-22] (Kaspersky Lab ZAO)
BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO-x32: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll [2014-12-22] (Kaspersky Lab ZAO)
BHO-x32: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\OnlineBanking\online_banking_bho.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO-x32: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\UrlAdvisor\klwtbbho.dll [2014-04-20] (Kaspersky Lab ZAO)
Tcpip\..\Interfaces\{071B0494-A52A-4CEC-ABF8-B2C19B27E7E2}: [NameServer] 195.50.140.182 195.50.140.114

FireFox:
========
FF ProfilePath: C:\Users\Gunther\AppData\Roaming\Mozilla\Firefox\Profiles\8fcu2t3l.default
FF Homepage: hxxp://www.google.de/
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_18_0_0_209.dll [2015-07-20] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_209.dll [2015-07-20] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2014-02-19] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2014-02-19] (Intel Corporation)
FF Plugin-x32: @kaspersky.com/content_blocker -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com [2014-12-22] ()
FF Plugin-x32: @kaspersky.com/online_banking -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com [2014-12-22] ()
FF Plugin-x32: @kaspersky.com/virtual_keyboard -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-12-22] ()
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2013-02-05] (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2014-11-12] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2014-11-12] (NVIDIA Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-06-29] (Adobe Systems Inc.)
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Users\Gunther\AppData\Roaming\Mozilla\Firefox\Profiles\8fcu2t3l.default\Extensions\{B64D9B05-48E1-4CEB-BF58-E0643994E900} [2014-12-22]
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{B64D9B05-48E1-4CEB-BF58-E0643994E900}.xpi [2015-06-03]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: Dangerous Websites Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com [2014-12-22]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-12-22]
FF HKLM-x32\...\Firefox\Extensions:  - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com [2014-12-22]
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com
FF Extension: Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com [2014-12-22]
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com
FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com [2014-12-22]
FF HKLM-x32\...\Firefox\Extensions: [{F003DA68-8256-4b37-A6C4-350FA04494DF}] - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt
FF HKU\S-1-5-21-3601908654-2614856020-1968441776-1001\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-12-22]

Chrome: 
=======
CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho
CHR HKLM-x32\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AAV UpdateService; C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-19] (Apple Inc.)
R2 AVP15.0.0; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [233552 2014-04-20] (Kaspersky Lab ZAO)
S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-29] (Microsoft Corporation)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1149760 2014-11-17] (NVIDIA Corporation)
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [887232 2014-01-31] (Intel(R) Corporation)
R2 ISCTAgent; C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe [209712 2014-02-21] ()
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [154584 2014-02-19] (Intel Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2015-06-18] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)
R2 MSI_SuperCharger; C:\Program Files (x86)\MSI\Super Charger\ChargeService.exe [162800 2014-03-17] (MSI)
R2 MSI_Trigger_Service; C:\Program Files (x86)\MSI\MSITrigger\MSI_Trigger_Service.exe [30240 2013-09-26] (MICRO-STAR INTERNATIONAL CO., LTD.)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1796928 2014-11-17] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19821376 2014-11-17] (NVIDIA Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-04] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-04] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R0 file_tracker; C:\Windows\System32\DRIVERS\file_tracker.sys [296736 2015-01-03] (Acronis International GmbH)
R3 ikbevent; C:\Windows\system32\DRIVERS\ikbevent.sys [22216 2014-02-03] ()
R3 imsevent; C:\Windows\system32\DRIVERS\imsevent.sys [22728 2014-02-03] ()
R3 INETMON; C:\Windows\System32\Drivers\INETMON.sys [23936 2014-02-03] ()
R3 ISCT; C:\Windows\System32\drivers\ISCTD.sys [44744 2014-02-03] ()
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [457824 2014-02-20] (Kaspersky Lab ZAO)
S0 klelam; C:\Windows\System32\DRIVERS\klelam.sys [29616 2012-07-27] (Kaspersky Lab)
R3 klflt; C:\Windows\system32\DRIVERS\klflt.sys [142344 2014-12-22] (Kaspersky Lab ZAO)
R1 klhk; C:\Windows\system32\DRIVERS\klhk.sys [243808 2014-04-10] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [771272 2014-12-22] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\system32\DRIVERS\klim6.sys [30304 2014-02-25] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\system32\DRIVERS\klkbdflt.sys [28768 2014-03-28] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\system32\DRIVERS\klmouflt.sys [29280 2013-08-08] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\system32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 klwfp; C:\Windows\system32\DRIVERS\klwfp.sys [67680 2014-03-19] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\system32\DRIVERS\kneps.sys [179296 2014-03-26] (Kaspersky Lab ZAO)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [113880 2015-07-23] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2015-06-18] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [116736 2014-02-19] (Intel Corporation)
R3 NTIOLib_1_0_3; C:\Program Files (x86)\MSI\Super Charger\NTIOLib_X64.sys [13368 2012-10-25] (MSI)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20800 2014-11-17] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [38216 2014-10-03] (NVIDIA Corporation)
R0 tib; C:\Windows\System32\DRIVERS\tib.sys [1328928 2015-01-03] (Acronis International GmbH)
R0 tib_mounter; C:\Windows\System32\DRIVERS\tib_mounter.sys [234784 2014-12-20] (Acronis International GmbH)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-04] (Microsoft Corporation)
S3 MSICDSetup; \??\F:\CDriver64.sys [X]
S3 NTIOLib_1_0_C; \??\F:\NTIOLib_X64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-07-23 07:07 - 2015-07-23 07:08 - 02135552 _____ (Farbar) C:\Users\Gunther\Desktop\FRST64.exe
2015-07-23 07:00 - 2015-07-23 07:00 - 00000000 ____D C:\Users\Gunther\Desktop\FRST-OlderVersion
2015-07-23 06:54 - 2015-07-23 06:54 - 00000596 _____ C:\Users\Gunther\Desktop\JRT.txt
2015-07-23 06:45 - 2015-07-23 06:52 - 01798288 _____ (Malwarebytes Corporation) C:\Users\Gunther\Desktop\JRT.exe
2015-07-22 17:16 - 2015-07-22 17:18 - 00000000 ____D C:\AdwCleaner
2015-07-22 17:03 - 2015-07-22 17:15 - 02248704 _____ C:\Users\Gunther\Desktop\AdwCleaner_4.208.exe
2015-07-22 09:28 - 2015-07-22 09:34 - 00100941 _____ C:\Users\Gunther\Desktop\Arita.ESt2014
2015-07-22 09:28 - 2015-07-22 09:28 - 00097309 _____ C:\Users\Gunther\Desktop\Arita.ESt2014_Backup
2015-07-22 08:36 - 2015-07-22 08:42 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-07-21 18:01 - 2015-07-14 16:14 - 00358912 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-07-21 18:01 - 2015-07-14 16:14 - 00301056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-07-21 18:01 - 2015-07-14 16:14 - 00035840 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-07-21 18:01 - 2015-07-14 16:13 - 00044032 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-07-20 18:16 - 2015-07-22 08:44 - 00000000 ____D C:\Users\Gunther\Desktop\mbar
2015-07-20 08:30 - 2015-07-20 08:45 - 16502728 _____ (Malwarebytes Corp.) C:\Users\Gunther\Desktop\mbar-1.09.1.1004.exe
2015-07-20 07:58 - 2015-07-20 07:58 - 00044167 _____ C:\Users\Gunther\Desktop\Gmer.txt
2015-07-20 07:50 - 2015-07-20 07:50 - 00380416 _____ C:\Users\Gunther\Desktop\Gmer-19357.exe
2015-07-20 07:48 - 2015-07-23 07:18 - 00020766 _____ C:\Users\Gunther\Desktop\FRST.txt
2015-07-20 07:48 - 2015-07-23 07:18 - 00000000 ____D C:\FRST
2015-07-20 07:48 - 2015-07-20 07:48 - 00033818 _____ C:\Users\Gunther\Desktop\Addition.txt
2015-07-20 07:33 - 2015-07-20 07:33 - 00000476 _____ C:\Users\Gunther\Desktop\defogger_disable.log
2015-07-20 07:33 - 2015-07-20 07:33 - 00000000 _____ C:\Users\Gunther\defogger_reenable
2015-07-20 06:56 - 2015-07-20 06:56 - 00050477 _____ C:\Users\Gunther\Desktop\Defogger.exe
2015-07-19 19:05 - 2015-07-23 07:04 - 00002798 _____ C:\Windows\setupact.log
2015-07-19 19:05 - 2015-07-23 06:57 - 00642980 _____ C:\Windows\WindowsUpdate.log
2015-07-19 19:05 - 2015-07-19 19:05 - 00000000 _____ C:\Windows\setuperr.log
2015-07-15 19:03 - 2015-07-02 23:21 - 19877376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-07-15 19:03 - 2015-07-02 22:50 - 02279424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-07-15 19:03 - 2015-07-02 22:49 - 25193984 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-07-15 19:03 - 2015-07-02 22:23 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-07-15 19:03 - 2015-07-02 22:19 - 12855296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-07-15 19:03 - 2015-07-02 21:55 - 01310720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-07-15 19:03 - 2015-07-02 21:20 - 14453248 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-07-15 19:03 - 2015-07-02 20:59 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-07-15 18:52 - 2015-06-16 00:39 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-07-15 18:52 - 2015-06-16 00:38 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-07-15 18:52 - 2015-06-16 00:26 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-07-15 18:52 - 2015-06-16 00:24 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-07-15 18:52 - 2015-06-16 00:02 - 00087552 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2015-07-15 18:52 - 2015-06-15 23:58 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-07-15 18:52 - 2015-06-15 23:57 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-07-15 18:52 - 2015-06-15 23:56 - 00145408 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2015-07-15 18:52 - 2015-06-15 23:55 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-07-15 18:52 - 2015-06-15 23:49 - 01032704 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2015-07-15 18:52 - 2015-06-15 23:41 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2015-07-15 18:52 - 2015-06-15 23:38 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-07-15 18:52 - 2015-06-15 23:36 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-07-15 18:52 - 2015-06-15 23:17 - 02880000 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll
2015-07-15 18:52 - 2015-06-15 23:16 - 02427392 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-07-15 18:52 - 2015-06-15 23:15 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-07-15 18:52 - 2015-06-15 23:13 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-07-15 18:52 - 2015-06-15 23:04 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-07-15 18:52 - 2015-06-15 23:03 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-07-15 18:52 - 2015-06-15 22:52 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-07-15 18:52 - 2015-06-15 22:47 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2015-07-15 18:52 - 2015-06-15 22:44 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-07-15 18:52 - 2015-06-15 22:43 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-07-15 18:52 - 2015-06-15 22:42 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2015-07-15 18:52 - 2015-06-15 22:41 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-07-15 18:52 - 2015-06-15 22:37 - 00880128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2015-07-15 18:52 - 2015-06-15 22:32 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2015-07-15 18:52 - 2015-06-15 22:31 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-07-15 18:52 - 2015-06-15 22:30 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-07-15 18:52 - 2015-06-15 22:30 - 00327168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-07-15 18:52 - 2015-06-15 22:17 - 01048576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\actxprxy.dll
2015-07-15 18:52 - 2015-06-15 22:07 - 01951232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-07-15 18:52 - 2015-06-15 22:02 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-07-15 18:44 - 2015-07-02 00:08 - 05923840 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-07-15 18:44 - 2015-07-01 23:14 - 04520448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-07-15 18:28 - 2015-06-28 07:07 - 00442712 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-07-15 18:28 - 2015-06-28 07:07 - 00178008 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-07-15 18:28 - 2015-06-28 07:06 - 01311960 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2015-07-15 18:28 - 2015-06-28 07:06 - 00332120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-07-15 18:28 - 2015-06-27 18:42 - 00747520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2015-07-15 18:28 - 2015-06-27 05:13 - 00202240 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2015-07-15 18:28 - 2015-06-27 05:12 - 00401408 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2015-07-15 18:28 - 2015-06-27 05:12 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2015-07-15 18:28 - 2015-06-27 04:40 - 00445440 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-07-15 18:28 - 2015-06-27 04:05 - 01441792 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-07-15 18:28 - 2015-06-27 04:00 - 00989184 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-07-15 18:28 - 2015-06-27 03:53 - 00324096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2015-07-15 18:28 - 2015-06-27 03:26 - 00802816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-07-15 18:28 - 2015-06-25 04:31 - 04177920 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-07-15 18:28 - 2015-06-16 00:41 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\msiexec.exe
2015-07-15 18:28 - 2015-06-16 00:24 - 03320320 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2015-07-15 18:28 - 2015-06-15 23:16 - 00059904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msiexec.exe
2015-07-15 18:28 - 2015-06-15 23:09 - 03607552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2015-07-15 18:28 - 2015-06-15 22:50 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2015-07-15 18:28 - 2015-06-15 21:57 - 02460160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2015-07-15 18:28 - 2015-05-30 23:18 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\werdiagcontroller.dll
2015-07-15 18:28 - 2015-05-30 21:36 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\AudioEndpointBuilder.dll
2015-07-15 18:28 - 2015-05-30 21:35 - 00911360 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2015-07-15 18:28 - 2015-01-30 03:29 - 00035840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\atlthunk.dll
2015-07-15 18:08 - 2015-06-11 05:49 - 01380600 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2015-07-15 18:08 - 2015-06-10 18:13 - 01097216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2015-07-15 18:07 - 2015-06-16 07:36 - 01661576 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2015-07-15 18:07 - 2015-06-16 07:36 - 01212248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2015-07-15 18:05 - 2015-05-07 18:47 - 00564224 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll
2015-07-15 18:05 - 2015-03-11 03:49 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\sdbinst.exe
2015-07-15 18:05 - 2015-03-11 03:09 - 00021504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sdbinst.exe
2015-07-13 08:41 - 2015-07-13 08:41 - 00000000 ____D C:\Program Files (x86)\MSECache

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-07-23 07:10 - 2013-09-16 16:11 - 01776918 _____ C:\Windows\system32\PerfStringBackup.INI
2015-07-23 07:10 - 2013-08-23 01:24 - 00764340 _____ C:\Windows\system32\perfh007.dat
2015-07-23 07:10 - 2013-08-23 01:24 - 00159160 _____ C:\Windows\system32\perfc007.dat
2015-07-23 07:08 - 2015-01-04 08:55 - 00000000 ___RD C:\Users\Gunther\OneDrive
2015-07-23 07:06 - 2014-12-20 20:39 - 00006464 _____ C:\Windows\SysWOW64\Gms.log
2015-07-23 07:04 - 2015-05-03 10:35 - 00113880 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-07-23 07:04 - 2014-12-22 17:39 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2015-07-23 07:04 - 2014-12-20 18:40 - 00000000 ____D C:\ProgramData\NVIDIA
2015-07-23 07:04 - 2013-08-22 16:45 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-07-23 07:03 - 2013-08-22 15:25 - 00524288 ___SH C:\Windows\system32\config\BBI
2015-07-23 07:00 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\system32\sru
2015-07-23 06:32 - 2014-12-27 16:12 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-07-23 06:20 - 2014-12-20 18:49 - 00003922 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{F5319551-2BF6-4B80-A504-C4DA1805D0B8}
2015-07-22 13:04 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\AppReadiness
2015-07-22 08:44 - 2015-05-03 10:35 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-07-22 00:01 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\tracing
2015-07-22 00:01 - 2013-08-22 16:44 - 00598952 _____ C:\Windows\system32\FNTCACHE.DAT
2015-07-21 21:36 - 2013-08-22 17:20 - 00000000 ____D C:\Windows\CbsTemp
2015-07-20 07:33 - 2014-12-20 18:46 - 00000000 ____D C:\Users\Gunther
2015-07-20 07:22 - 2014-12-20 20:55 - 00000000 ____D C:\Users\Gunther\AppData\Local\Adobe
2015-07-20 07:19 - 2014-12-27 16:12 - 00003772 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-07-20 06:35 - 2014-12-20 18:51 - 00003600 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3601908654-2614856020-1968441776-1001
2015-07-20 06:19 - 2015-05-03 10:35 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-07-20 06:19 - 2015-01-21 09:47 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-07-19 13:02 - 2015-02-16 09:41 - 00000000 ____D C:\Users\Gunther\.rainlendar2
2015-07-16 12:30 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\rescache
2015-07-16 08:51 - 2014-12-20 20:56 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-07-16 00:08 - 2014-12-27 15:52 - 00000000 ____D C:\Program Files (x86)\CDBurnerXP
2015-07-16 00:08 - 2014-12-20 20:57 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-07-15 21:28 - 2014-12-20 20:21 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-07-15 21:27 - 2014-12-20 19:52 - 00000000 ____D C:\Windows\system32\MRT
2015-07-15 17:20 - 2015-01-01 20:50 - 00003886 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2015-07-13 23:10 - 2013-08-22 17:38 - 00792568 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-07-13 23:10 - 2013-08-22 17:38 - 00178168 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-07-12 17:17 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\system32\NDF
2015-07-10 11:10 - 2014-12-20 19:42 - 00000000 __SHD C:\Users\Gunther\AppData\Local\EmieUserList
2015-07-10 11:10 - 2014-12-20 19:42 - 00000000 __SHD C:\Users\Gunther\AppData\Local\EmieSiteList
2015-07-10 11:10 - 2014-12-20 19:42 - 00000000 __SHD C:\Users\Gunther\AppData\Local\EmieBrowserModeList
2015-07-08 17:33 - 2015-01-26 19:44 - 00001131 _____ C:\Users\Public\Desktop\CDBurnerXP.lnk
2015-07-08 17:33 - 2015-01-26 19:44 - 00001081 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk
2015-07-06 09:39 - 2015-06-03 09:29 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-07-03 13:26 - 2014-12-29 09:08 - 00004096 _____ C:\Users\Public\Documents\000016E5.LCS
2015-07-03 08:43 - 2014-12-20 19:52 - 130333168 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-06-28 23:22 - 2015-06-22 11:21 - 00000000 ____D C:\Users\Gunther\Desktop\dagmar neu

==================== Files in the root of some directories =======

2015-01-23 09:02 - 2015-01-23 09:02 - 0000604 ____H () C:\Program Files (x86)\_43_S
2014-12-22 16:18 - 2010-01-26 12:11 - 0444283 _____ () C:\Program Files\Common Files\WinPcapNmap.exe
2015-01-07 10:08 - 2015-02-22 20:49 - 0235520 _____ () C:\Users\Gunther\AppData\Roaming\AllSimiliarSigns.rsd
2015-01-19 10:38 - 2015-01-19 10:38 - 0001564 _____ () C:\Users\Gunther\AppData\Local\recently-used.xbel
2014-12-23 19:07 - 2014-12-23 19:07 - 0000017 _____ () C:\Users\Gunther\AppData\Local\resmon.resmoncfg
2014-12-20 20:33 - 2014-12-20 20:33 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

Some files in TEMP:
====================
C:\Users\Gunther\AppData\Local\Temp\Quarantine.exe
C:\Users\Gunther\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-07-22 07:00

==================== End of log ============================
         

Alt 23.07.2015, 07:48   #10
schrauber
/// the machine
/// TB-Ausbilder
 

Internet extrem langsam -viel zu viele Netzwerkverbindunge - ein Zeichen für Schadware - Standard

Internet extrem langsam -viel zu viele Netzwerkverbindunge - ein Zeichen für Schadware




ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 23.07.2015, 22:59   #11
GunHill
 
Internet extrem langsam -viel zu viele Netzwerkverbindunge - ein Zeichen für Schadware - Standard

Internet extrem langsam -viel zu viele Netzwerkverbindunge - ein Zeichen für Schadware



Hi,
beim ESET Online Scanner kommt folgende Fehlermeldung:
"Updates funktionieren nicht. Ist ein Proxy eingerichtet?"
Was kann ich tun?
Danke,
Gunther

Hi,
auh im 3. Versuch kommt beim installieren von ESET OnlineScanner die gleiche Fehlermeldung.
Auch das Runterladen von "SucurityCheck" ist heute abend mehrfach fehlgeschlagen!
Und das FRST log:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:20-07-2015
Ran by Gunther (administrator) on ARLT on 23-07-2015 23:56:32
Running from C:\Users\Gunther\Desktop
Loaded Profiles: Gunther (Available Profiles: Gunther & Kinder)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
() C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
() C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(MSI) C:\Program Files (x86)\MSI\Super Charger\ChargeService.exe
(MICRO-STAR INTERNATIONAL CO., LTD.) C:\Program Files (x86)\MSI\MSITrigger\MSI_Trigger_Service.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avpui.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\distnoted.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\SyncServer.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe
(Microsoft Corporation) C:\Windows\SysWOW64\WWAHost.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\livecomm.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7543000 2014-03-04] (Realtek Semiconductor)
HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
HKLM\...\Run: [ISCT Tray] => C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTsysTray8.exe [5860656 2014-02-21] (Intel Corporation)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2465088 2014-11-17] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [VDownloader] => C:\Program Files\VDownloader\VDownloader4.exe [3017216 2014-10-23] (Vitzo)
HKLM\...\Run: [Acronis Scheduler2 Service] => C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe [571192 2014-08-14] (Acronis)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [169768 2015-04-07] (Apple Inc.)
HKLM-x32\...\Run: [Super Charger] => C:\Program Files (x86)\MSI\Super Charger\Super Charger.exe [1047536 2014-04-08] (MSI)
HKLM-x32\...\Run: [CanonQuickMenu] => C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE [1284680 2014-01-17] (CANON INC.)
HKLM-x32\...\Run: [TrueImageMonitor.exe] => C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe [5343272 2014-11-27] (Acronis)
HKLM-x32\...\Run: [AcronisTibMounterMonitor] => C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe [606096 2014-10-17] (Acronis International GmbH)
HKU\S-1-5-21-3601908654-2614856020-1968441776-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7404312 2015-01-20] (Piriform Ltd)
HKU\S-1-5-21-3601908654-2614856020-1968441776-1001\...\Run: [VDownloader] => C:\Program Files\VDownloader\VDownloader4.exe [3017216 2014-10-23] (Vitzo)
HKU\S-1-5-21-3601908654-2614856020-1968441776-1001\...\Run: [SkyDrive] => C:\Users\Gunther\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe [277672 2015-01-04] (Microsoft Corporation)
HKU\S-1-5-21-3601908654-2614856020-1968441776-1001\...\Run: [Rainlendar2] => C:\Program Files\Rainlendar2\Rainlendar2.exe [4411488 2014-03-16] ()
HKU\S-1-5-21-3601908654-2614856020-1968441776-1001\...\Run: [Monotype SkyFonts Clean Up] => C:\Program Files\Monotype\SkyFonts\Monotype.SkyFonts.CleanUp.exe
Startup: C:\Users\Gunther\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sidebar660.lnk [2015-02-16]
ShortcutTarget: Sidebar660.lnk -> C:\Program Files\Windows Sidebar\sidebar.exe (No File)
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File
ShellIconOverlayIdentifiers: [AcronisSyncError] -> {934BC6C0-FEC2-4df5-A100-961DE2C8A0ED} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2014-09-09] (Acronis)
ShellIconOverlayIdentifiers: [AcronisSyncInProgress] -> {00F848DC-B1D4-4892-9C25-CAADC86A215D} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2014-09-09] (Acronis)
ShellIconOverlayIdentifiers: [AcronisSyncOk] -> {71573297-552E-46fc-BE3D-3DFAF88D47B7} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2014-09-09] (Acronis)
ShellIconOverlayIdentifiers-x32: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-3601908654-2614856020-1968441776-1001\Software\Microsoft\Internet Explorer\Main,Start Page = https://lernen.phase-6.de/#/login
HKU\S-1-5-21-3601908654-2614856020-1968441776-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.arlt.com
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll [2014-12-22] (Kaspersky Lab ZAO)
BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO-x32: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll [2014-12-22] (Kaspersky Lab ZAO)
BHO-x32: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\OnlineBanking\online_banking_bho.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO-x32: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\UrlAdvisor\klwtbbho.dll [2014-04-20] (Kaspersky Lab ZAO)
Tcpip\..\Interfaces\{37697DAD-A1D7-490E-ABCC-36F156479C68}: [NameServer] 195.50.140.182 195.50.140.114

FireFox:
========
FF ProfilePath: C:\Users\Gunther\AppData\Roaming\Mozilla\Firefox\Profiles\8fcu2t3l.default
FF Homepage: hxxp://www.google.de/
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_18_0_0_209.dll [2015-07-20] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_209.dll [2015-07-20] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2014-02-19] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2014-02-19] (Intel Corporation)
FF Plugin-x32: @kaspersky.com/content_blocker -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com [2014-12-22] ()
FF Plugin-x32: @kaspersky.com/online_banking -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com [2014-12-22] ()
FF Plugin-x32: @kaspersky.com/virtual_keyboard -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-12-22] ()
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2013-02-05] (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2014-11-12] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2014-11-12] (NVIDIA Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-06-29] (Adobe Systems Inc.)
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Users\Gunther\AppData\Roaming\Mozilla\Firefox\Profiles\8fcu2t3l.default\Extensions\{B64D9B05-48E1-4CEB-BF58-E0643994E900} [2014-12-22]
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{B64D9B05-48E1-4CEB-BF58-E0643994E900}.xpi [2015-06-03]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: Dangerous Websites Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com [2014-12-22]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-12-22]
FF HKLM-x32\...\Firefox\Extensions:  - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com [2014-12-22]
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com
FF Extension: Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com [2014-12-22]
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com
FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com [2014-12-22]
FF HKLM-x32\...\Firefox\Extensions: [{F003DA68-8256-4b37-A6C4-350FA04494DF}] - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt
FF HKU\S-1-5-21-3601908654-2614856020-1968441776-1001\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-12-22]

Chrome: 
=======
CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho
CHR HKLM-x32\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AAV UpdateService; C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-19] (Apple Inc.)
R2 AVP15.0.0; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [233552 2014-04-20] (Kaspersky Lab ZAO)
S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-29] (Microsoft Corporation)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1149760 2014-11-17] (NVIDIA Corporation)
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [887232 2014-01-31] (Intel(R) Corporation)
R2 ISCTAgent; C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe [209712 2014-02-21] ()
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [154584 2014-02-19] (Intel Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2015-06-18] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)
R2 MSI_SuperCharger; C:\Program Files (x86)\MSI\Super Charger\ChargeService.exe [162800 2014-03-17] (MSI)
R2 MSI_Trigger_Service; C:\Program Files (x86)\MSI\MSITrigger\MSI_Trigger_Service.exe [30240 2013-09-26] (MICRO-STAR INTERNATIONAL CO., LTD.)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1796928 2014-11-17] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19821376 2014-11-17] (NVIDIA Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-04] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-04] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R0 file_tracker; C:\Windows\System32\DRIVERS\file_tracker.sys [296736 2015-01-03] (Acronis International GmbH)
R3 ikbevent; C:\Windows\system32\DRIVERS\ikbevent.sys [22216 2014-02-03] ()
R3 imsevent; C:\Windows\system32\DRIVERS\imsevent.sys [22728 2014-02-03] ()
R3 INETMON; C:\Windows\System32\Drivers\INETMON.sys [23936 2014-02-03] ()
R3 ISCT; C:\Windows\System32\drivers\ISCTD.sys [44744 2014-02-03] ()
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [457824 2014-02-20] (Kaspersky Lab ZAO)
S0 klelam; C:\Windows\System32\DRIVERS\klelam.sys [29616 2012-07-27] (Kaspersky Lab)
R3 klflt; C:\Windows\system32\DRIVERS\klflt.sys [142344 2014-12-22] (Kaspersky Lab ZAO)
R1 klhk; C:\Windows\system32\DRIVERS\klhk.sys [243808 2014-04-10] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [771272 2014-12-22] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\system32\DRIVERS\klim6.sys [30304 2014-02-25] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\system32\DRIVERS\klkbdflt.sys [28768 2014-03-28] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\system32\DRIVERS\klmouflt.sys [29280 2013-08-08] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\system32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 klwfp; C:\Windows\system32\DRIVERS\klwfp.sys [67680 2014-03-19] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\system32\DRIVERS\kneps.sys [179296 2014-03-26] (Kaspersky Lab ZAO)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [113880 2015-07-23] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2015-06-18] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [116736 2014-02-19] (Intel Corporation)
R3 NTIOLib_1_0_3; C:\Program Files (x86)\MSI\Super Charger\NTIOLib_X64.sys [13368 2012-10-25] (MSI)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20800 2014-11-17] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [38216 2014-10-03] (NVIDIA Corporation)
R0 tib; C:\Windows\System32\DRIVERS\tib.sys [1328928 2015-01-03] (Acronis International GmbH)
R0 tib_mounter; C:\Windows\System32\DRIVERS\tib_mounter.sys [234784 2014-12-20] (Acronis International GmbH)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-04] (Microsoft Corporation)
S3 MSICDSetup; \??\F:\CDriver64.sys [X]
S3 NTIOLib_1_0_C; \??\F:\NTIOLib_X64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-07-23 23:29 - 2015-07-23 23:54 - 00296375 _____ C:\Users\Gunther\Desktop\SecurityCheck.exe.part
2015-07-23 23:02 - 2015-07-23 23:25 - 02870984 _____ (ESET) C:\Users\Gunther\Desktop\esetsmartinstaller_deu.exe
2015-07-23 17:52 - 2015-07-23 17:52 - 00104328 _____ C:\Users\Gunther\2015-07-23.MVP
2015-07-23 13:58 - 2015-07-23 13:58 - 00000000 ____D C:\Program Files (x86)\ESET
2015-07-23 07:07 - 2015-07-23 07:08 - 02135552 _____ (Farbar) C:\Users\Gunther\Desktop\FRST64.exe
2015-07-23 07:00 - 2015-07-23 07:00 - 00000000 ____D C:\Users\Gunther\Desktop\FRST-OlderVersion
2015-07-23 06:54 - 2015-07-23 06:54 - 00000596 _____ C:\Users\Gunther\Desktop\JRT.txt
2015-07-23 06:45 - 2015-07-23 06:52 - 01798288 _____ (Malwarebytes Corporation) C:\Users\Gunther\Desktop\JRT.exe
2015-07-22 17:16 - 2015-07-22 17:18 - 00000000 ____D C:\AdwCleaner
2015-07-22 17:03 - 2015-07-22 17:15 - 02248704 _____ C:\Users\Gunther\Desktop\AdwCleaner_4.208.exe
2015-07-22 09:28 - 2015-07-23 08:35 - 00140413 _____ C:\Users\Gunther\Desktop\Arita.ESt2014
2015-07-22 09:28 - 2015-07-23 08:24 - 00130077 _____ C:\Users\Gunther\Desktop\Arita.ESt2014_Backup
2015-07-22 08:36 - 2015-07-22 08:42 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-07-21 18:01 - 2015-07-14 16:14 - 00358912 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-07-21 18:01 - 2015-07-14 16:14 - 00301056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-07-21 18:01 - 2015-07-14 16:14 - 00035840 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-07-21 18:01 - 2015-07-14 16:13 - 00044032 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-07-20 18:16 - 2015-07-22 08:44 - 00000000 ____D C:\Users\Gunther\Desktop\mbar
2015-07-20 08:30 - 2015-07-20 08:45 - 16502728 _____ (Malwarebytes Corp.) C:\Users\Gunther\Desktop\mbar-1.09.1.1004.exe
2015-07-20 07:58 - 2015-07-20 07:58 - 00044167 _____ C:\Users\Gunther\Desktop\Gmer.txt
2015-07-20 07:50 - 2015-07-20 07:50 - 00380416 _____ C:\Users\Gunther\Desktop\Gmer-19357.exe
2015-07-20 07:48 - 2015-07-23 23:56 - 00021170 _____ C:\Users\Gunther\Desktop\FRST.txt
2015-07-20 07:48 - 2015-07-23 23:56 - 00000000 ____D C:\FRST
2015-07-20 07:48 - 2015-07-20 07:48 - 00033818 _____ C:\Users\Gunther\Desktop\Addition.txt
2015-07-20 07:33 - 2015-07-20 07:33 - 00000476 _____ C:\Users\Gunther\Desktop\defogger_disable.log
2015-07-20 07:33 - 2015-07-20 07:33 - 00000000 _____ C:\Users\Gunther\defogger_reenable
2015-07-20 06:56 - 2015-07-20 06:56 - 00050477 _____ C:\Users\Gunther\Desktop\Defogger.exe
2015-07-19 19:05 - 2015-07-23 18:24 - 00777749 _____ C:\Windows\WindowsUpdate.log
2015-07-19 19:05 - 2015-07-23 17:42 - 00004388 _____ C:\Windows\setupact.log
2015-07-19 19:05 - 2015-07-19 19:05 - 00000000 _____ C:\Windows\setuperr.log
2015-07-15 19:03 - 2015-07-02 23:21 - 19877376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-07-15 19:03 - 2015-07-02 22:50 - 02279424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-07-15 19:03 - 2015-07-02 22:49 - 25193984 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-07-15 19:03 - 2015-07-02 22:23 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-07-15 19:03 - 2015-07-02 22:19 - 12855296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-07-15 19:03 - 2015-07-02 21:55 - 01310720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-07-15 19:03 - 2015-07-02 21:20 - 14453248 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-07-15 19:03 - 2015-07-02 20:59 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-07-15 18:52 - 2015-06-16 00:39 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-07-15 18:52 - 2015-06-16 00:38 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-07-15 18:52 - 2015-06-16 00:26 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-07-15 18:52 - 2015-06-16 00:24 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-07-15 18:52 - 2015-06-16 00:02 - 00087552 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2015-07-15 18:52 - 2015-06-15 23:58 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-07-15 18:52 - 2015-06-15 23:57 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-07-15 18:52 - 2015-06-15 23:56 - 00145408 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2015-07-15 18:52 - 2015-06-15 23:55 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-07-15 18:52 - 2015-06-15 23:49 - 01032704 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2015-07-15 18:52 - 2015-06-15 23:41 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2015-07-15 18:52 - 2015-06-15 23:38 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-07-15 18:52 - 2015-06-15 23:36 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-07-15 18:52 - 2015-06-15 23:17 - 02880000 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll
2015-07-15 18:52 - 2015-06-15 23:16 - 02427392 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-07-15 18:52 - 2015-06-15 23:15 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-07-15 18:52 - 2015-06-15 23:13 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-07-15 18:52 - 2015-06-15 23:04 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-07-15 18:52 - 2015-06-15 23:03 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-07-15 18:52 - 2015-06-15 22:52 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-07-15 18:52 - 2015-06-15 22:47 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2015-07-15 18:52 - 2015-06-15 22:44 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-07-15 18:52 - 2015-06-15 22:43 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-07-15 18:52 - 2015-06-15 22:42 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2015-07-15 18:52 - 2015-06-15 22:41 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-07-15 18:52 - 2015-06-15 22:37 - 00880128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2015-07-15 18:52 - 2015-06-15 22:32 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2015-07-15 18:52 - 2015-06-15 22:31 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-07-15 18:52 - 2015-06-15 22:30 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-07-15 18:52 - 2015-06-15 22:30 - 00327168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-07-15 18:52 - 2015-06-15 22:17 - 01048576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\actxprxy.dll
2015-07-15 18:52 - 2015-06-15 22:07 - 01951232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-07-15 18:52 - 2015-06-15 22:02 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-07-15 18:44 - 2015-07-02 00:08 - 05923840 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-07-15 18:44 - 2015-07-01 23:14 - 04520448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-07-15 18:28 - 2015-06-28 07:07 - 00442712 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-07-15 18:28 - 2015-06-28 07:07 - 00178008 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-07-15 18:28 - 2015-06-28 07:06 - 01311960 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2015-07-15 18:28 - 2015-06-28 07:06 - 00332120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-07-15 18:28 - 2015-06-27 18:42 - 00747520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2015-07-15 18:28 - 2015-06-27 05:13 - 00202240 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2015-07-15 18:28 - 2015-06-27 05:12 - 00401408 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2015-07-15 18:28 - 2015-06-27 05:12 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2015-07-15 18:28 - 2015-06-27 04:40 - 00445440 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-07-15 18:28 - 2015-06-27 04:05 - 01441792 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-07-15 18:28 - 2015-06-27 04:00 - 00989184 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-07-15 18:28 - 2015-06-27 03:53 - 00324096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2015-07-15 18:28 - 2015-06-27 03:26 - 00802816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-07-15 18:28 - 2015-06-25 04:31 - 04177920 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-07-15 18:28 - 2015-06-16 00:41 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\msiexec.exe
2015-07-15 18:28 - 2015-06-16 00:24 - 03320320 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2015-07-15 18:28 - 2015-06-15 23:16 - 00059904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msiexec.exe
2015-07-15 18:28 - 2015-06-15 23:09 - 03607552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2015-07-15 18:28 - 2015-06-15 22:50 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2015-07-15 18:28 - 2015-06-15 21:57 - 02460160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2015-07-15 18:28 - 2015-05-30 23:18 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\werdiagcontroller.dll
2015-07-15 18:28 - 2015-05-30 21:36 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\AudioEndpointBuilder.dll
2015-07-15 18:28 - 2015-05-30 21:35 - 00911360 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2015-07-15 18:28 - 2015-01-30 03:29 - 00035840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\atlthunk.dll
2015-07-15 18:08 - 2015-06-11 05:49 - 01380600 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2015-07-15 18:08 - 2015-06-10 18:13 - 01097216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2015-07-15 18:07 - 2015-06-16 07:36 - 01661576 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2015-07-15 18:07 - 2015-06-16 07:36 - 01212248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2015-07-15 18:05 - 2015-05-07 18:47 - 00564224 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll
2015-07-15 18:05 - 2015-03-11 03:49 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\sdbinst.exe
2015-07-15 18:05 - 2015-03-11 03:09 - 00021504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sdbinst.exe
2015-07-13 08:41 - 2015-07-13 08:41 - 00000000 ____D C:\Program Files (x86)\MSECache

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-07-23 23:32 - 2014-12-27 16:12 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-07-23 23:00 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\system32\sru
2015-07-23 22:24 - 2015-05-03 10:35 - 00113880 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-07-23 22:18 - 2014-12-22 17:39 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2015-07-23 22:09 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\system32\NDF
2015-07-23 17:52 - 2014-12-20 18:46 - 00000000 ____D C:\Users\Gunther
2015-07-23 17:46 - 2013-09-16 16:11 - 01776918 _____ C:\Windows\system32\PerfStringBackup.INI
2015-07-23 17:46 - 2013-08-23 01:24 - 00764340 _____ C:\Windows\system32\perfh007.dat
2015-07-23 17:46 - 2013-08-23 01:24 - 00159160 _____ C:\Windows\system32\perfc007.dat
2015-07-23 13:51 - 2015-01-04 08:55 - 00000000 ____D C:\Users\Gunther\OneDrive
2015-07-23 07:06 - 2014-12-20 20:39 - 00016974 _____ C:\Windows\SysWOW64\Gms.log
2015-07-23 07:04 - 2014-12-20 18:40 - 00000000 ____D C:\ProgramData\NVIDIA
2015-07-23 07:04 - 2013-08-22 16:45 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-07-23 07:03 - 2013-08-22 15:25 - 00524288 ___SH C:\Windows\system32\config\BBI
2015-07-23 06:20 - 2014-12-20 18:49 - 00003922 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{F5319551-2BF6-4B80-A504-C4DA1805D0B8}
2015-07-22 13:04 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\AppReadiness
2015-07-22 08:44 - 2015-05-03 10:35 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-07-22 00:01 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\tracing
2015-07-22 00:01 - 2013-08-22 16:44 - 00598952 _____ C:\Windows\system32\FNTCACHE.DAT
2015-07-21 21:36 - 2013-08-22 17:20 - 00000000 ____D C:\Windows\CbsTemp
2015-07-20 07:22 - 2014-12-20 20:55 - 00000000 ____D C:\Users\Gunther\AppData\Local\Adobe
2015-07-20 07:19 - 2014-12-27 16:12 - 00003772 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-07-20 06:35 - 2014-12-20 18:51 - 00003600 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3601908654-2614856020-1968441776-1001
2015-07-20 06:19 - 2015-05-03 10:35 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-07-20 06:19 - 2015-01-21 09:47 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-07-19 13:02 - 2015-02-16 09:41 - 00000000 ____D C:\Users\Gunther\.rainlendar2
2015-07-16 12:30 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\rescache
2015-07-16 08:51 - 2014-12-20 20:56 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-07-16 00:08 - 2014-12-27 15:52 - 00000000 ____D C:\Program Files (x86)\CDBurnerXP
2015-07-16 00:08 - 2014-12-20 20:57 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-07-15 21:28 - 2014-12-20 20:21 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-07-15 21:27 - 2014-12-20 19:52 - 00000000 ____D C:\Windows\system32\MRT
2015-07-15 17:20 - 2015-01-01 20:50 - 00003886 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2015-07-13 23:10 - 2013-08-22 17:38 - 00792568 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-07-13 23:10 - 2013-08-22 17:38 - 00178168 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-07-10 11:10 - 2014-12-20 19:42 - 00000000 __SHD C:\Users\Gunther\AppData\Local\EmieUserList
2015-07-10 11:10 - 2014-12-20 19:42 - 00000000 __SHD C:\Users\Gunther\AppData\Local\EmieSiteList
2015-07-10 11:10 - 2014-12-20 19:42 - 00000000 __SHD C:\Users\Gunther\AppData\Local\EmieBrowserModeList
2015-07-08 17:33 - 2015-01-26 19:44 - 00001131 _____ C:\Users\Public\Desktop\CDBurnerXP.lnk
2015-07-08 17:33 - 2015-01-26 19:44 - 00001081 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk
2015-07-06 09:39 - 2015-06-03 09:29 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-07-03 13:26 - 2014-12-29 09:08 - 00004096 _____ C:\Users\Public\Documents\000016E5.LCS
2015-07-03 08:43 - 2014-12-20 19:52 - 130333168 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-06-28 23:22 - 2015-06-22 11:21 - 00000000 ____D C:\Users\Gunther\Desktop\dagmar neu

==================== Files in the root of some directories =======

2015-01-23 09:02 - 2015-01-23 09:02 - 0000604 ____H () C:\Program Files (x86)\_43_S
2014-12-22 16:18 - 2010-01-26 12:11 - 0444283 _____ () C:\Program Files\Common Files\WinPcapNmap.exe
2015-01-07 10:08 - 2015-02-22 20:49 - 0235520 _____ () C:\Users\Gunther\AppData\Roaming\AllSimiliarSigns.rsd
2015-01-19 10:38 - 2015-01-19 10:38 - 0001564 _____ () C:\Users\Gunther\AppData\Local\recently-used.xbel
2014-12-23 19:07 - 2014-12-23 19:07 - 0000017 _____ () C:\Users\Gunther\AppData\Local\resmon.resmoncfg
2014-12-20 20:33 - 2014-12-20 20:33 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

Some files in TEMP:
====================
C:\Users\Gunther\AppData\Local\Temp\Quarantine.exe
C:\Users\Gunther\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-07-22 07:00

==================== End of log ============================
         
Danke für weitere Hilfe,
Gunther

Alt 24.07.2015, 07:18   #12
schrauber
/// the machine
/// TB-Ausbilder
 

Internet extrem langsam -viel zu viele Netzwerkverbindunge - ein Zeichen für Schadware - Standard

Internet extrem langsam -viel zu viele Netzwerkverbindunge - ein Zeichen für Schadware



Dann ESET weg lassen und das hier machen:

Lade Dir bitte von hier Emsisoft Emergency Kit Download Emsisoft Emergency Kit herunter.
  • Bitte installiere das Programm in den vorgegebenen Pfad.
  • Starte das Programm durch Doppelklick der Desktopverknüpfung.
  • Das EEK ist nach dem Laden der Malwaresignaturen für den Scan bereit.
  • Folge nun bitte der bebilderten Bildanleitung zu Emergency Kit, entferne alle Funde und poste am Ende des Scans bzw. der Bereinigung das Log.

__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 24.07.2015, 18:20   #13
GunHill
 
Internet extrem langsam -viel zu viele Netzwerkverbindunge - ein Zeichen für Schadware - Standard

Internet extrem langsam -viel zu viele Netzwerkverbindunge - ein Zeichen für Schadware



Hallo,
habe jetzt ein paar Mal versucht, die Emsisoft Emergency Kit runterzuladen, hat leider nicht geklappt.
Download Rate war:
869 KB in 13 Minuten
886 KB in 23 Minuten
Gibt es noch eine Idee für eine Lösung?
Fange langsam an zu zweifeln ...
Gruß, Gunther

Alt 25.07.2015, 10:46   #14
schrauber
/// the machine
/// TB-Ausbilder
 

Internet extrem langsam -viel zu viele Netzwerkverbindunge - ein Zeichen für Schadware - Standard

Internet extrem langsam -viel zu viele Netzwerkverbindunge - ein Zeichen für Schadware



Gibt es mehrere Rechner in deinem Netz? Sind die auch so langsam?
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 25.07.2015, 13:31   #15
GunHill
 
Internet extrem langsam -viel zu viele Netzwerkverbindunge - ein Zeichen für Schadware - Standard

Internet extrem langsam -viel zu viele Netzwerkverbindunge - ein Zeichen für Schadware



Hi,
nein, es ist nur ein Rechner ca 6 Monate alt und eigentlich ziemlich schnell. Habe gestern ein Videomitschnitt eines Konzertes auf DVD gebrannt - ging wie immer sehr zügig.
Nur die Internetgeschwindigkeit hat so extrem nachgelassen.
Gruß & Dank,
Gunther

Antwort

Themen zu Internet extrem langsam -viel zu viele Netzwerkverbindunge - ein Zeichen für Schadware
adware, browser, converter, cpu, ebanking, excel, fehlermeldung, firefox, firefox 39.0, flash player, homepage, internet, kaspersky, langsam, malware, mozilla, mp3, netstat, proxy, prozess, realtek, registry, rundll, scan, schadware, security, software, super, svchost.exe, tracker



Ähnliche Themen: Internet extrem langsam -viel zu viele Netzwerkverbindunge - ein Zeichen für Schadware


  1. Extrem viel Werbung im Browser nach Installation aus eines Programmes aus dem Internet
    Log-Analyse und Auswertung - 22.01.2015 (22)
  2. Ständig Skriptfehler, PC extrem langsam und viel Werbung
    Plagegeister aller Art und deren Bekämpfung - 15.01.2015 (36)
  3. Viel Werbung Firefox Pc extrem langsam geworden...
    Log-Analyse und Auswertung - 06.10.2014 (3)
  4. Internet langsam, und viel Werbung
    Plagegeister aller Art und deren Bekämpfung - 09.03.2014 (12)
  5. Dell Inspiron 15R Internet und PC viel zu langsam!
    Log-Analyse und Auswertung - 26.10.2013 (1)
  6. Internet viel zu langsam, vlt. ein Virus?
    Log-Analyse und Auswertung - 01.07.2013 (39)
  7. Internet langsam, ganz viel Werbung
    Plagegeister aller Art und deren Bekämpfung - 30.06.2013 (22)
  8. Internet Arbeit viel zu langsam aber am Anbieter liegt es nicht
    Plagegeister aller Art und deren Bekämpfung - 05.05.2013 (2)
  9. Rechner (Internet) extrem langsam langsam und hackelig!Leerlaufprozess Task Manager ständig zw. 70-98 %
    Plagegeister aller Art und deren Bekämpfung - 11.04.2013 (17)
  10. Internet läd viel zu langsam warum?
    Log-Analyse und Auswertung - 14.08.2011 (1)
  11. PC extrem langsam, viele Denkpausen
    Log-Analyse und Auswertung - 05.08.2011 (30)
  12. Internet ist viel zu langsam geworden
    Plagegeister aller Art und deren Bekämpfung - 12.06.2011 (12)
  13. PC extrem langsam und sehr viel am arbeiten, Virenverdacht.
    Log-Analyse und Auswertung - 07.03.2010 (1)
  14. Internet viel zu langsam
    Plagegeister aller Art und deren Bekämpfung - 27.08.2008 (15)
  15. Internet viel zu langsam
    Log-Analyse und Auswertung - 13.02.2007 (1)
  16. PC extrem langsam! Zu viel Prozesse laufen im Hintergrund! Was kann ich tun?
    Log-Analyse und Auswertung - 20.07.2006 (3)
  17. Hilfe - Internet viel zu langsam
    Log-Analyse und Auswertung - 24.04.2005 (0)

Zum Thema Internet extrem langsam -viel zu viele Netzwerkverbindunge - ein Zeichen für Schadware - Hallo, habe seit einigen Tagen ein extrem langsames Internet. Habe mit "Netstat -a" bei Eingabeaufforderung weit über 100 Netzwerkverbindungen entdeckt - ein Zeichen für Virenbefall? Nutze aber Kaspersky Internet Security - Internet extrem langsam -viel zu viele Netzwerkverbindunge - ein Zeichen für Schadware...
Archiv
Du betrachtest: Internet extrem langsam -viel zu viele Netzwerkverbindunge - ein Zeichen für Schadware auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.