Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung

Log-Analyse und Auswertung: Vista: schwerwiegender Trojanerbefall von Necrus!A und ähnlichem

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.

Antwort
Alt 03.01.2014, 12:15   #1
Singed
 
Vista: schwerwiegender Trojanerbefall von Necrus!A und ähnlichem - Standard

Vista: schwerwiegender Trojanerbefall von Necrus!A und ähnlichem



Guten Mittag liebe community,
seit etwa 2 Tagen habe ich nen relativ akuten Befall von Trojanern.
ich dachte wenn ich einmal mein Antivir Premium drüber scannen lasse, sei die Sache gegessen ... natürlich nicht. die Premiumversion ist jetzt abgelaufen und ich habe die Freeversion drauf.
folgende Probleme, der verdammte Echtzeitscanner will sich nicht aktivieren lassen ...

Außerdem:
Der Prozess iexplorer.exe wird immer wieder geöffnet (ich sehe ihn nur auf dem Taskmanager).
Außerdem fielen mir so dinge wie mwldaemon u.ä. auf. Nach Reserche stellte sich fest, dass sich manche Viren mit diesem Namen tarnen. Und ich denke die Person die mich "gehackt" hat stellt sonstigen Unfug an, indem er wichtige Prozese runterfährt und meinen Laptop lahm legt.
Bankdaten und sonstiges nicht vorhanden, bin noch minderjährig. Den Trojaner habe ich mir wohl bei der männlichen Nebenbeschäftigung eingefangen .
Mit der Materie kenne ich mich jetzt nicht so aus, aber viele Dateien die auch was mit dem MyWinLocker zu tun haben, sind infiziert (syshost.exe)

Avira-Ereignisse(kann im Threadeditor keine neuen Anhänge erstellen lol):
Zitat:
GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2014-01-03 12:14:49
Windows 6.0.6001 Service Pack 1
Running: gmer_2.1.19163.exe


---- Services - GMER 2.1 ----

Service C:\SystemRoot\System32\Drivers\ec55e6b546b6bca3.sys (*** hidden *** ) [BOOT] ec55e6b546b6bca3 <-- ROOTKIT !!!

---- Registry - GMER 2.1 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\ec55e6b546b6bca3@ImagePath \SystemRoot\System32\Drivers\ec55e6b546b6bca3.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\ec55e6b546b6bca3@Group Boot Bus Extender
Reg HKLM\SYSTEM\CurrentControlSet\Services\ec55e6b546b6bca3@ErrorControl 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\ec55e6b546b6bca3@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\ec55e6b546b6bca3@Start 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\ec55e6b546b6bca3@Tag 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\ec55e6b546b6bca3@DisplayName syshost.exe
Reg HKLM\SYSTEM\CurrentControlSet\Services\ec55e6b546b6bca3
Reg HKLM\SYSTEM\ControlSet002\Services\ec55e6b546b6bca3@ImagePath \SystemRoot\System32\Drivers\ec55e6b546b6bca3.sys
Reg HKLM\SYSTEM\ControlSet002\Services\ec55e6b546b6bca3@Group Boot Bus Extender
Reg HKLM\SYSTEM\ControlSet002\Services\ec55e6b546b6bca3@ErrorControl 0
Reg HKLM\SYSTEM\ControlSet002\Services\ec55e6b546b6bca3@Type 1
Reg HKLM\SYSTEM\ControlSet002\Services\ec55e6b546b6bca3@Start 0
Reg HKLM\SYSTEM\ControlSet002\Services\ec55e6b546b6bca3@Tag 1
Reg HKLM\SYSTEM\ControlSet002\Services\ec55e6b546b6bca3@DisplayName syshost.exe

GMER:
Zitat:
GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2014-01-03 12:14:49
Windows 6.0.6001 Service Pack 1
Running: gmer_2.1.19163.exe


---- Services - GMER 2.1 ----

Service C:\SystemRoot\System32\Drivers\ec55e6b546b6bca3.sys (*** hidden *** ) [BOOT] ec55e6b546b6bca3 <-- ROOTKIT !!!

---- Registry - GMER 2.1 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\ec55e6b546b6bca3@ImagePath \SystemRoot\System32\Drivers\ec55e6b546b6bca3.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\ec55e6b546b6bca3@Group Boot Bus Extender
Reg HKLM\SYSTEM\CurrentControlSet\Services\ec55e6b546b6bca3@ErrorControl 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\ec55e6b546b6bca3@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\ec55e6b546b6bca3@Start 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\ec55e6b546b6bca3@Tag 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\ec55e6b546b6bca3@DisplayName syshost.exe
Reg HKLM\SYSTEM\CurrentControlSet\Services\ec55e6b546b6bca3
Reg HKLM\SYSTEM\ControlSet002\Services\ec55e6b546b6bca3@ImagePath \SystemRoot\System32\Drivers\ec55e6b546b6bca3.sys
Reg HKLM\SYSTEM\ControlSet002\Services\ec55e6b546b6bca3@Group Boot Bus Extender
Reg HKLM\SYSTEM\ControlSet002\Services\ec55e6b546b6bca3@ErrorControl 0
Reg HKLM\SYSTEM\ControlSet002\Services\ec55e6b546b6bca3@Type 1
Reg HKLM\SYSTEM\ControlSet002\Services\ec55e6b546b6bca3@Start 0
Reg HKLM\SYSTEM\ControlSet002\Services\ec55e6b546b6bca3@Tag 1
Reg HKLM\SYSTEM\ControlSet002\Services\ec55e6b546b6bca3@DisplayName syshost.exe
Alle Logfiles im Anhang.

Vielen vielen Dank schonmal.
Angehängte Dateien
Dateityp: txt Addition.txt (34,1 KB, 145x aufgerufen)
Dateityp: txt FRST.txt (60,2 KB, 147x aufgerufen)

Alt 03.01.2014, 12:38   #2
schrauber
/// the machine
/// TB-Ausbilder
 

Vista: schwerwiegender Trojanerbefall von Necrus!A und ähnlichem - Standard

Vista: schwerwiegender Trojanerbefall von Necrus!A und ähnlichem



Hi,

Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen.


So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
__________________

__________________

Alt 03.01.2014, 20:39   #3
Singed
 
Vista: schwerwiegender Trojanerbefall von Necrus!A und ähnlichem - Standard

Vista: schwerwiegender Trojanerbefall von Necrus!A und ähnlichem



Geht klar!
Also hier nochmal:

P.S: Echtzeitscanner funktioniert noch immer nicht, mache mir langsam echt sorgen.

FRST:

FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 02-01-2014 01
Ran by highend-outlets (administrator) on HIGHEND-OUTL-PC on 03-01-2014 11:20:06
Running from C:\Users\highend-outlets\Downloads
Microsoft® Windows Vista™ Home Premium  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EBAPI\eEBSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Dritek System Inc.) C:\Program Files\Launch Manager\dsiwmis.exe
(Acer Incorporated) C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe
(SEIKO EPSON CORPORATION) C:\Program Files\epson\EpsonCustomerResearchParticipation\EPCP.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50ST7.EXE
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RP7.EXE
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
() C:\ProgramData\IBUpdaterService\ibsvc.exe
(Egis Technology Inc.) C:\Program Files\EgisTec\MyWinLocker 3\x86\MWLService.exe
(NewTech Infosystems, Inc.) C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
() C:\Windows\PLFSetI.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(NewTech Infosystems, Inc.) C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
(Acer Incorporated) C:\Program Files\Acer\Optical Drive Power Management\ODDPWRSvc.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Acer Incorporated) C:\Program Files\Acer\Acer VCM\RS_Service.exe
() C:\Windows\System32\ieconfig_1und1_svc.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
() C:\Users\highend-outlets\AppData\LocalLow\StumbleUpon\IE\StumbleUponUpdater.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Dritek System Inc.) C:\Program Files\Launch Manager\LManager.exe
(NewTech Infosystems, Inc.) C:\Program Files\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
(Acer Incorporated) C:\Program Files\Acer\Optical Drive Power Management\ODDPWR.exe
(Egis Technology Inc.) C:\Program Files\EgisTec Egis Software Update\EgisUpdate.exe
(Egis Technology Inc.) C:\Program Files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Epson Software\FAX Utility\FUFAXSTM.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Epson Software\Event Manager\EEventManager.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(The Eraser Project) C:\Program Files\Eraser\Eraser.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Spotify Ltd) C:\Users\highend-outlets\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Microsoft Corporation) C:\Windows\System32\regsvr32.exe
(Acer Incorporated) C:\Program Files\Acer\Acer VCM\AcerVCM.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.130\SSScheduler.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Acer Incorporated) C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTray.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Acer Incorporated) C:\Program Files\Acer\Acer PowerSmart Manager\ePowerEvent.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil32_11_9_900_170_ActiveX.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Windows Defender] - C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-21] (Microsoft Corporation)
HKLM\...\Run: [IAAnotif] - C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe [186904 2009-02-12] (Intel Corporation)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [7399968 2009-04-11] (Realtek Semiconductor)
HKLM\...\Run: [Skytel] - C:\Program Files\Realtek\Audio\HDA\SkyTel.exe [1833504 2009-04-11] (Realtek Semiconductor Corp.)
HKLM\...\Run: [PLFSetI] - C:\Windows\PLFSetI.exe [200704 2008-07-29] ()
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1430824 2009-02-06] (Synaptics Incorporated)
HKLM\...\Run: [LManager] - C:\Program Files\Launch Manager\LManager.exe [1071624 2009-04-09] (Dritek System Inc.)
HKLM\...\Run: [BackupManagerTray] - C:\Program Files\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [253696 2009-05-26] (NewTech Infosystems, Inc.)
HKLM\...\Run: [LanguageShortcut] - C:\Program Files\CyberLink\PowerDVD\Language\Language.exe [62760 2009-03-30] ()
HKLM\...\Run: [Acer ePower Management] - C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTrayLauncher.exe [440864 2009-05-15] (Acer Incorporated)
HKLM\...\Run: [ODDPwr] - C:\Program Files\Acer\Optical Drive Power Management\ODDPWR.exe [176128 2009-04-29] (Acer Incorporated)
HKLM\...\Run: [EgisTecLiveUpdate] - C:\Program Files\EgisTec Egis Software Update\EgisUpdate.exe [199464 2009-05-13] (Egis Technology Inc.)
HKLM\...\Run: [mwlDaemon] - C:\Program Files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe [345384 2009-05-14] (Egis Technology Inc.)
HKLM\...\Run: [GrooveMonitor] - C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM\...\Run: [FUFAXSTM] - C:\Program Files\Epson Software\FAX Utility\FUFAXSTM.exe [847872 2009-12-03] (SEIKO EPSON CORPORATION)
HKLM\...\Run: [EEventManager] - C:\Program Files\Epson Software\Event Manager\EEventManager.exe [976320 2009-12-03] (SEIKO EPSON CORPORATION)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [937920 2011-06-06] (Adobe Systems Incorporated)
HKLM\...\Run: [Eraser] - C:\Program Files\Eraser\Eraser.exe [980920 2012-05-22] (The Eraser Project)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-18] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKCU\...\Run: [ehTray.exe] - C:\Windows\ehome\ehtray.exe [125952 2008-01-21] (Microsoft Corporation)
HKCU\...\Run: [EPSON BX620FWD Series] - C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIGBU.EXE /FU "C:\Windows\TEMP\E_S80CA.tmp" /EF "HKCU"
HKCU\...\Run: [Epson Stylus Office BX620FWD(Netzwerk)] - C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIGBU.EXE /FU "C:\Windows\TEMP\E_SD214.tmp" /EF "HKCU"
HKCU\...\Run: [EPSON56091C (Epson Stylus Office BX620FWD)] - C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIGBU.EXE /FU "C:\Windows\TEMP\E_S1639.tmp" /EF "HKCU"
HKCU\...\Run: [] - [x]
HKCU\...\Run: [swg] - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2012-08-23] (Google Inc.)
HKCU\...\Run: [Skype] - C:\Program Files\Skype\Phone\Skype.exe [20584608 2013-11-14] (Skype Technologies S.A.)
HKCU\...\Run: [Spotify Web Helper] - C:\Users\highend-outlets\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1168896 2013-12-03] (Spotify Ltd)
HKCU\...\Run: [ATworks] - regsvr32.exe C:\Users\highend-outlets\AppData\Local\ATworks\CompatObjclass16.dll <===== ATTENTION
HKU\Default\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Default\...\Run: [ProductReg] - C:\Program Files\Acer\WR_PopUp\ProductReg.exe [ 2008-11-17] (Acer)
HKU\Default\...\RunOnce: [ScrSav] - C:\Windows\Screensavers\Acer\run_Acer.exe [ 2009-04-03] ()
Startup: C:\Users\highend-outlets\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk
ShortcutTarget: Adobe Gamma.lnk -> C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://search.b1.org/?bsrc=hmior&chid=c167991
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.b1.org/?bsrc=hmior&chid=c167991
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Before = hxxp://www.google.de/
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yahoo.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.yahoo.com
SearchScopes: HKLM - DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
SearchScopes: HKLM - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
SearchScopes: HKCU - DefaultScope {66CF46B7-0878-4292-95F5-70B05FC496D3} URL = hxxp://go.web.de/suchbox/google?q={searchTerms}
SearchScopes: HKCU - {14D5D798-17F3-45C5-B0AB-2A4CC6ED9858} URL = hxxp://go.web.de/suchbox/ebay?query={searchTerms}
SearchScopes: HKCU - {18C99010-B9BE-4B7A-BA93-CB181559E261} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000027&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=U3&apn_dtid=OSJ000YYDE&apn_uid=60B6B759-9C1B-4A21-A993-F7EAEECEFD45&apn_sauid=0BD38239-5FA8-474D-9E35-0A30DC2A1C6F
SearchScopes: HKCU - {2AB03437-A933-4AB1-BC95-C24C4EDABA12} URL = hxxp://go.1und1.de/suchbox/amazon?tag=1und1icon-21&field-keywords={searchTerms}
SearchScopes: HKCU - {3293CBE3-FE02-4EDE-894F-4262A6ECB575} URL = hxxp://go.1und1.de/suchbox/1und1suche?su={searchTerms}
SearchScopes: HKCU - {66CF46B7-0878-4292-95F5-70B05FC496D3} URL = hxxp://go.web.de/suchbox/google?q={searchTerms}
BHO: No Name - {02478D38-C3F9-4efb-9B51-7695ECA05670} -  No File
BHO: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.130\McAfeeMSS_IE.dll No File
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.9012.1008\swg.dll (Google Inc.)
BHO: 1&&1 Internet AG Browser Configuration by mquadr.at - {D48FF4B4-E68F-47D1-8E25-81A0F0EEB341} - C:\Windows\System32\ieconfig_1und1.dll (mquadr.at software engineering und consulting GmbH)
BHO: StumbleUpon - {DB616CFF-D989-48A8-9C85-E2A8D56AB2CA} - C:\Users\highend-outlets\AppData\LocalLow\StumbleUpon\IE\StumbleUpon.dll (StumbleUpon Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: DVDVideoSoft WebPageAdjuster Class - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
Toolbar: HKLM - No Name - {10EDB994-47F8-43F7-AE96-F2EA63E9F90F} -  No File
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} -  No File
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} hxxp://www.ipix.com/download/ipixx.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog9 01 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 02 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 03 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 04 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 05 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 06 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 07 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 08 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 36 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
Tcpip\..\Interfaces\{1270B9F4-11CF-4ED7-8A0C-36D3CED1DD4C}: [NameServer]8.8.8.8,8.8.4.4

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw_1203133.dll (Adobe Systems, Inc.)
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.130\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin: @raidcall.en/RCplugin - C:\Users\highend-outlets\AppData\Roaming\raidcall\plugins\nprcplugin.dll (Raidcall)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\highend-outlets\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\highend-outlets\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF HKLM\...\Firefox\Extensions: [{A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}] - C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\
FF Extension: Firefox Synchronisation Extension - C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\
FF HKLM\...\Thunderbird\Extensions: [{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}] - C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\
FF Extension: Thunderbird Address Book Synchronisation Extension - C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\

Chrome: 
=======
CHR HomePage: hxxp://search.b1.org/?bsrc=hmcor&chid=c167991
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\31.0.1650.63\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\31.0.1650.63\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\31.0.1650.63\pdf.dll ()
CHR Plugin: (Screen Capture Plugin) - C:\Users\highend-outlets\AppData\Local\Google\Chrome\User Data\Default\Extensions\alelhddbbhepgpmgidjdcjakblofbmce\3.4.5_0\plugins/screen_capture.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Google Earth Plugin) - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 7 U25) - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (McAfee Security Scanner +) - C:\Program Files\McAfee Security Scan\3.0.318\npMcAfeeMss.dll No File
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
CHR Plugin: (Pando Web Plugin) - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
CHR Plugin: (Windows Live\u00AE Photo Gallery) - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Unity Player) - C:\Users\highend-outlets\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
CHR Plugin: (Facebook Video Calling Plugin) - C:\Users\highend-outlets\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
CHR Plugin: (Raidcall plugin) - C:\Users\highend-outlets\AppData\Roaming\raidcall\plugins\nprcplugin.dll (Raidcall)
CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw_1203133.dll (Adobe Systems, Inc.)
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32_11_8_800_168.dll No File
CHR Plugin: (Java Deployment Toolkit 7.0.250.17) - C:\Windows\system32\npDeployJava1.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll No File
CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Extension: (Awesome Screenshot: Capture & Annotate) - C:\Users\highend-outlets\AppData\Local\Google\Chrome\User Data\Default\Extensions\alelhddbbhepgpmgidjdcjakblofbmce\3.5.10_0
CHR Extension: (Google Docs) - C:\Users\highend-outlets\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0
CHR Extension: (Google Drive) - C:\Users\highend-outlets\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (Turn Off the Lights) - C:\Users\highend-outlets\AppData\Local\Google\Chrome\User Data\Default\Extensions\bfbmjmiodbnnpllbbbfblcplfjjepjdn\2.3.0.5_0
CHR Extension: (YouTube) - C:\Users\highend-outlets\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Adblock Plus) - C:\Users\highend-outlets\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.7.2_0
CHR Extension: (Google Search) - C:\Users\highend-outlets\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (Photovisi - Photo Collage Maker) - C:\Users\highend-outlets\AppData\Local\Google\Chrome\User Data\Default\Extensions\emkkfkcbnpdnhgeolpbggbdogfngiadf\1.2_0
CHR Extension: (AdBlock) - C:\Users\highend-outlets\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.6.16_0
CHR Extension: (Quick Note) - C:\Users\highend-outlets\AppData\Local\Google\Chrome\User Data\Default\Extensions\mijlebbfndhelmdpmllgcfadlkankhok\1.6.3_0
CHR Extension: (DVDVideoSoft Browser Extension) - C:\Users\highend-outlets\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0
CHR Extension: (Google Wallet) - C:\Users\highend-outlets\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0
CHR Extension: (Gmail) - C:\Users\highend-outlets\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
CHR HKLM\...\Chrome\Extension: [pgifblbjgdjhcelbanblbhkhmbnnmhfg] - C:\Users\highend-outlets\AppData\LocalLow\StumbleUpon\CHROME\StumbleUpon.crx

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440376 2013-12-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-25] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1011768 2013-12-18] (Avira Operations GmbH & Co. KG)
R2 ePowerSvc; C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe [703008 2009-05-15] (Acer Incorporated)
R2 EpsonBidirectionalService; C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe [94208 2006-12-19] (SEIKO EPSON CORPORATION)
R2 EpsonCustomerResearchParticipation; C:\Program Files\EPSON\EpsonCustomerResearchParticipation\EPCP.exe [547936 2011-10-06] (SEIKO EPSON CORPORATION)
R2 EPSON_EB_RPCV4_04; C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50ST7.EXE [153600 2009-09-14] (SEIKO EPSON CORPORATION)
R2 EPSON_PM_RPCV4_04; C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RP7.EXE [121856 2009-09-14] (SEIKO EPSON CORPORATION)
R2 IBUpdaterService; C:\ProgramData\IBUpdaterService\ibsvc.exe [573920 2012-12-10] ()
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe [235216 2013-09-06] (McAfee, Inc.)
R2 MWLService; C:\Program Files\EgisTec\MyWinLocker 3\x86\\MWLService.exe [305448 2009-05-14] (Egis Technology Inc.)
S3 npggsvc; C:\Windows\system32\GameMon.des [4121080 2011-06-13] (INCA Internet Co., Ltd.)
R2 NTI IScheduleSvc; C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [62208 2009-05-26] (NewTech Infosystems, Inc.)
R2 NTISchedulerSvc; C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [144632 2008-09-23] (NewTech Infosystems, Inc.)
R2 ODDPwrSvc; C:\Program Files\Acer\Optical Drive Power Management\ODDPWRSvc.exe [118784 2009-04-29] (Acer Incorporated)
S3 OverwolfUpdaterService; C:\Program Files\Overwolf\OverwolfUpdater.exe [18360 2013-08-22] (Overwolf Ltd)
R2 RS_Service; C:\Program Files\Acer\Acer VCM\RS_Service.exe [237568 2009-02-05] (Acer Incorporated)
R2 serviceIEConfig; C:\Windows\System32\ieconfig_1und1_svc.exe [1053848 2012-04-11] ()
R2 StumbleUponUpdater; C:\Users\highend-outlets\AppData\LocalLow\StumbleUpon\IE\StumbleUponUpdater.exe [18432 2011-11-22] ()
R2 syshost32; C:\Windows\Installer\{8CDD9792-6D88-7828-3896-30F91874EE00}\syshost.exe [76800 2014-01-01] ()

==================== Drivers (Whitelisted) ====================

R0 ACPI; C:\Windows\System32\drivers\acpi.sys [266808 2008-01-21] ()
S4 adp94xx; C:\Windows\system32\drivers\adp94xx.sys [422968 2008-01-21] ()
S4 adpahci; C:\Windows\system32\drivers\adpahci.sys [300600 2008-01-21] ()
S4 adpu160m; C:\Windows\system32\drivers\adpu160m.sys [101432 2008-01-21] ()
S4 adpu320; C:\Windows\system32\drivers\adpu320.sys [149560 2008-01-21] ()
R1 AFD; C:\Windows\system32\drivers\afd.sys [273408 2011-04-21] ()
S3 agp440; C:\Windows\system32\drivers\agp440.sys [56376 2008-01-21] ()
S4 aic78xx; C:\Windows\system32\drivers\djsvs.sys [71272 2006-11-02] ()
S4 aliide; C:\Windows\system32\drivers\aliide.sys [17464 2008-01-21] ()
S3 amdagp; C:\Windows\system32\drivers\amdagp.sys [57400 2008-01-21] ()
S4 amdide; C:\Windows\system32\drivers\amdide.sys [17976 2008-01-21] ()
S4 AmdK7; C:\Windows\system32\drivers\amdk7.sys [41472 2008-01-21] ()
S4 AmdK8; C:\Windows\system32\drivers\amdk8.sys [44032 2008-01-21] ()
S4 arc; C:\Windows\system32\drivers\arc.sys [79416 2008-01-21] ()
S4 arcsas; C:\Windows\system32\drivers\arcsas.sys [79928 2008-01-21] ()
S3 AsyncMac; C:\Windows\System32\DRIVERS\asyncmac.sys [17408 2008-01-21] ()
R0 atapi; C:\Windows\System32\drivers\atapi.sys [21560 2008-01-21] ()
S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [90400 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135648 2013-12-18] ()
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-25] ()
S3 b57nd60x; C:\Windows\System32\DRIVERS\b57nd60x.sys [179712 2008-01-21] ()
R1 Beep; C:\Windows\System32\Drivers\Beep.sys [6144 2008-01-21] ()
S4 blbdrive; C:\Windows\system32\drivers\blbdrive.sys [45568 2008-01-21] ()
R3 bowser; C:\Windows\System32\DRIVERS\bowser.sys [69632 2011-02-22] ()
S3 BrFiltLo; C:\Windows\system32\drivers\brfiltlo.sys [13568 2006-11-02] ()
S3 BrFiltUp; C:\Windows\system32\drivers\brfiltup.sys [5248 2006-11-02] ()
S4 Brserid; C:\Windows\system32\drivers\brserid.sys [71808 2006-11-02] ()
S4 BrSerWdm; C:\Windows\system32\drivers\brserwdm.sys [62336 2006-11-02] ()
S4 BrUsbMdm; C:\Windows\system32\drivers\brusbmdm.sys [12160 2006-11-02] ()
S3 BrUsbSer; C:\Windows\system32\drivers\brusbser.sys [11904 2006-11-02] ()
S4 BTHMODEM; C:\Windows\system32\drivers\bthmodem.sys [39936 2006-11-02] ()
R4 cdfs; C:\Windows\System32\DRIVERS\cdfs.sys [70144 2008-01-21] ()
R1 cdrom; C:\Windows\System32\DRIVERS\cdrom.sys [67072 2008-01-21] ()
S4 circlass; C:\Windows\system32\drivers\circlass.sys [35328 2008-01-21] ()
R0 CLFS; C:\Windows\System32\CLFS.sys [247352 2008-01-21] ()
R3 CmBatt; C:\Windows\System32\DRIVERS\CmBatt.sys [14208 2008-01-21] ()
S4 cmdide; C:\Windows\system32\drivers\cmdide.sys [19000 2008-01-21] ()
R0 Compbatt; C:\Windows\System32\DRIVERS\compbatt.sys [20792 2008-01-21] ()
R0 crcdisk; C:\Windows\System32\drivers\crcdisk.sys [24632 2008-01-21] ()
S4 Crusoe; C:\Windows\system32\drivers\crusoe.sys [40960 2008-01-21] ()
R1 DfsC; C:\Windows\System32\Drivers\dfsc.sys [75264 2011-04-14] ()
R0 disk; C:\Windows\System32\drivers\disk.sys [55352 2008-01-21] ()
R3 DKbFltr; C:\Windows\System32\DRIVERS\DKbFltr.sys [21000 2009-03-26] ()
S3 drmkaud; C:\Windows\System32\drivers\drmkaud.sys [5632 2008-01-21] ()
R3 DXGKrnl; C:\Windows\System32\drivers\dxgkrnl.sys [625152 2008-08-02] ()
S3 E1G60; C:\Windows\System32\DRIVERS\E1G60I32.sys [118784 2008-01-21] ()
R0 Ecache; C:\Windows\System32\drivers\ecache.sys [143416 2008-01-21] ()
S4 elxstor; C:\Windows\system32\drivers\elxstor.sys [342584 2008-01-21] ()
S4 ErrDev; C:\Windows\system32\drivers\errdev.sys [6656 2008-01-21] ()
S3 exfat; C:\Windows\System32\Drivers\exfat.sys [136192 2008-01-21] ()
R3 fastfat; C:\Windows\System32\Drivers\fastfat.sys [143360 2008-01-21] ()
S4 fdc; C:\Windows\System32\DRIVERS\fdc.sys [25088 2008-01-21] ()
R0 FileInfo; C:\Windows\System32\drivers\fileinfo.sys [58936 2008-01-21] ()
S3 Filetrace; C:\Windows\System32\drivers\filetrace.sys [27648 2008-01-21] ()
S4 flpydisk; C:\Windows\System32\DRIVERS\flpydisk.sys [20480 2008-01-21] ()
R0 FltMgr; C:\Windows\System32\drivers\fltmgr.sys [192056 2008-01-21] ()
U1 Fs_Rec; C:\Windows\System32\Drivers\Fs_Rec.sys [12800 2008-01-21] ()
S3 gagp30kx; C:\Windows\system32\drivers\gagp30kx.sys [61496 2008-01-21] ()
S3 HdAudAddService; C:\Windows\System32\drivers\HdAudio.sys [235520 2006-11-02] ()
R3 HDAudBus; C:\Windows\System32\DRIVERS\HDAudBus.sys [53760 2008-01-21] ()
S4 HidBth; C:\Windows\system32\drivers\hidbth.sys [29184 2006-11-02] ()
S4 HidIr; C:\Windows\system32\drivers\hidir.sys [21504 2006-11-02] ()
R3 HidUsb; C:\Windows\System32\DRIVERS\hidusb.sys [12288 2009-07-16] ()
S4 HpCISSs; C:\Windows\system32\drivers\hpcisss.sys [40504 2008-01-21] ()
R3 HTTP; C:\Windows\System32\drivers\HTTP.sys [411136 2010-02-20] ()
S4 i2omp; C:\Windows\system32\drivers\i2omp.sys [30264 2008-01-21] ()
R1 i8042prt; C:\Windows\System32\DRIVERS\i8042prt.sys [54784 2008-01-21] ()
R0 iaStor; C:\Windows\System32\DRIVERS\iaStor.sys [329752 2009-02-12] ()
S4 iaStorV; C:\Windows\system32\drivers\iastorv.sys [235064 2008-01-21] ()
R3 igfx; C:\Windows\System32\DRIVERS\igdkmd32.sys [9024512 2010-08-25] ()
S4 iirsp; C:\Windows\system32\drivers\iirsp.sys [41576 2006-11-02] ()
R3 IntcAzAudAddService; C:\Windows\System32\drivers\RTKVHDA.sys [2358112 2009-04-11] ()
R3 IntcHdmiAddService; C:\Windows\System32\drivers\IntcHdmi.sys [112640 2008-12-05] ()
S4 intelide; C:\Windows\system32\drivers\intelide.sys [17976 2008-01-21] ()
R3 intelppm; C:\Windows\System32\DRIVERS\intelppm.sys [41472 2008-01-21] ()
S3 IpFilterDriver; C:\Windows\System32\DRIVERS\ipfltdrv.sys [47616 2008-01-21] ()
S4 IPMIDRV; C:\Windows\system32\drivers\ipmidrv.sys [64512 2008-01-21] ()
S3 IPNAT; C:\Windows\System32\DRIVERS\ipnat.sys [100864 2008-01-21] ()
R2 irda; C:\Windows\System32\DRIVERS\irda.sys [95744 2008-01-21] ()
S3 IRENUM; C:\Windows\System32\drivers\irenum.sys [13312 2008-01-21] ()
S4 isapnp; C:\Windows\system32\drivers\isapnp.sys [49720 2008-01-21] ()
R3 iScsiPrt; C:\Windows\System32\DRIVERS\msiscsi.sys [181304 2008-01-21] ()
S4 iteatapi; C:\Windows\system32\drivers\iteatapi.sys [35944 2006-11-02] ()
S4 iteraid; C:\Windows\system32\drivers\iteraid.sys [35944 2006-11-02] ()
R1 kbdclass; C:\Windows\System32\DRIVERS\kbdclass.sys [35384 2008-01-21] ()
R1 kbdhid; C:\Windows\System32\DRIVERS\kbdhid.sys [15872 2008-01-21] ()
R0 KSecDD; C:\Windows\System32\Drivers\ksecdd.sys [439896 2009-06-15] ()
R3 L1C; C:\Windows\System32\DRIVERS\L1C60x86.sys [57344 2009-11-13] ()
S3 libusb0; C:\Windows\System32\DRIVERS\libusb0.sys [35392 2010-10-02] ()
R2 lltdio; C:\Windows\System32\DRIVERS\lltdio.sys [47104 2008-01-21] ()
S4 LSI_FC; C:\Windows\system32\drivers\lsi_fc.sys [96312 2008-01-21] ()
S4 LSI_SAS; C:\Windows\system32\drivers\lsi_sas.sys [89656 2008-01-21] ()
S4 LSI_SCSI; C:\Windows\system32\drivers\lsi_scsi.sys [96312 2008-01-21] ()
R2 luafv; C:\Windows\system32\drivers\luafv.sys [84480 2008-01-21] ()
S4 megasas; C:\Windows\system32\drivers\megasas.sys [31288 2008-01-21] ()
S4 MegaSR; C:\Windows\system32\drivers\megasr.sys [386616 2008-01-21] ()
S3 Modem; C:\Windows\System32\drivers\modem.sys [31744 2008-01-21] ()
R3 monitor; C:\Windows\System32\DRIVERS\monitor.sys [41984 2008-01-21] ()
R1 mouclass; C:\Windows\System32\DRIVERS\mouclass.sys [34360 2008-01-21] ()
R3 mouhid; C:\Windows\System32\DRIVERS\mouhid.sys [15872 2008-01-21] ()
R0 MountMgr; C:\Windows\System32\drivers\mountmgr.sys [57400 2008-01-21] ()
S4 mpio; C:\Windows\system32\drivers\mpio.sys [105016 2008-01-21] ()
R3 mpsdrv; C:\Windows\System32\drivers\mpsdrv.sys [64000 2008-01-21] ()
S4 Mraid35x; C:\Windows\system32\drivers\mraid35x.sys [33384 2006-11-02] ()
S3 MRxDAV; C:\Windows\system32\drivers\mrxdav.sys [110080 2008-01-21] ()
R3 mrxsmb; C:\Windows\System32\DRIVERS\mrxsmb.sys [105984 2011-04-29] ()
R3 mrxsmb10; C:\Windows\System32\DRIVERS\mrxsmb10.sys [213504 2011-07-06] ()
R3 mrxsmb20; C:\Windows\System32\DRIVERS\mrxsmb20.sys [79360 2011-04-29] ()
S4 msahci; C:\Windows\system32\drivers\msahci.sys [28728 2008-01-21] ()
S4 msdsm; C:\Windows\system32\drivers\msdsm.sys [94776 2008-01-21] ()
R1 Msfs; C:\Windows\System32\Drivers\Msfs.sys [22528 2008-01-21] ()
R0 msisadrv; C:\Windows\System32\drivers\msisadrv.sys [16440 2008-01-21] ()
S3 MSKSSRV; C:\Windows\System32\drivers\MSKSSRV.sys [8192 2008-01-21] ()
S3 MSPCLOCK; C:\Windows\System32\drivers\MSPCLOCK.sys [5888 2008-01-21] ()
S3 MSPQM; C:\Windows\System32\drivers\MSPQM.sys [5504 2008-01-21] ()
S3 MsRPC; C:\Windows\System32\Drivers\MsRPC.sys [163384 2008-01-21] ()
R3 mssmbios; C:\Windows\System32\DRIVERS\mssmbios.sys [31288 2008-01-21] ()
S3 MSTEE; C:\Windows\System32\drivers\MSTEE.sys [6016 2008-01-21] ()
R0 Mup; C:\Windows\System32\Drivers\mup.sys [49720 2008-01-21] ()
R1 mwlPSDFilter; C:\Windows\System32\DRIVERS\mwlPSDFilter.sys [19504 2008-12-04] ()
R1 mwlPSDNServ; C:\Windows\System32\DRIVERS\mwlPSDNServ.sys [16432 2008-12-04] ()
R1 mwlPSDVDisk; C:\Windows\System32\DRIVERS\mwlPSDVDisk.sys [59952 2008-12-04] ()
R3 NativeWifiP; C:\Windows\System32\DRIVERS\nwifi.sys [148480 2008-05-20] ()
R0 NDIS; C:\Windows\System32\drivers\ndis.sys [529464 2009-07-16] ()
R3 NdisTapi; C:\Windows\System32\DRIVERS\ndistapi.sys [20992 2008-01-21] ()
R3 Ndisuio; C:\Windows\System32\DRIVERS\ndisuio.sys [16896 2008-01-21] ()
R3 NdisWan; C:\Windows\System32\DRIVERS\ndiswan.sys [121344 2008-01-21] ()
R3 NDProxy; C:\Windows\System32\Drivers\NDProxy.sys [49664 2008-01-21] ()
R1 NetBIOS; C:\Windows\System32\DRIVERS\netbios.sys [35840 2008-01-21] ()
R1 netbt; C:\Windows\System32\DRIVERS\netbt.sys [184320 2008-01-21] ()
R3 NETw5v32; C:\Windows\System32\DRIVERS\NETw5v32.sys [3668480 2008-11-17] ()
S4 nfrd960; C:\Windows\system32\drivers\nfrd960.sys [45160 2006-11-02] ()
S3 nmwcd; C:\Windows\System32\drivers\ccdcmb.sys [18304 2010-12-02] ()
S3 nmwcdc; C:\Windows\System32\drivers\ccdcmbo.sys [23168 2010-12-02] ()
S3 nmwcdnsu; C:\Windows\System32\drivers\nmwcdnsu.sys [137600 2010-12-02] ()
S3 nmwcdnsuc; C:\Windows\System32\drivers\nmwcdnsuc.sys [8576 2010-12-02] ()
R1 Npfs; C:\Windows\System32\Drivers\Npfs.sys [34816 2008-01-21] ()
S3 NSCIRDA; C:\Windows\System32\DRIVERS\nscirda.sys [30720 2008-01-21] ()
R1 nsiproxy; C:\Windows\System32\drivers\nsiproxy.sys [16384 2008-01-21] ()
R3 Ntfs; C:\Windows\System32\Drivers\Ntfs.sys [1081912 2008-01-21] ()
R3 NTIDrvr; C:\Windows\system32\drivers\NTIDrvr.sys [15360 2009-05-05] ()
S4 ntrigdigi; C:\Windows\system32\drivers\ntrigdigi.sys [20608 2006-11-02] ()
R1 Null; C:\Windows\System32\Drivers\Null.sys [4608 2008-01-21] ()
S4 nvraid; C:\Windows\system32\drivers\nvraid.sys [102968 2008-01-21] ()
S4 nvstor; C:\Windows\system32\drivers\nvstor.sys [45112 2008-01-21] ()
S3 nv_agp; C:\Windows\system32\drivers\nv_agp.sys [109112 2008-01-21] ()
S4 ohci1394; C:\Windows\System32\DRIVERS\ohci1394.sys [61952 2008-01-21] ()
S4 Parport; C:\Windows\system32\drivers\parport.sys [79360 2006-11-02] ()
R0 partmgr; C:\Windows\System32\drivers\partmgr.sys [56376 2008-01-21] ()
S2 Parvdm; C:\Windows\system32\drivers\parvdm.sys [8704 2006-11-02] ()
S3 pccsmcfd; C:\Windows\System32\DRIVERS\pccsmcfd.sys [18816 2008-08-26] ()
R0 pci; C:\Windows\System32\drivers\pci.sys [151096 2008-01-21] ()
S4 pciide; C:\Windows\system32\drivers\pciide.sys [16440 2008-01-21] ()
S4 pcmcia; C:\Windows\system32\DRIVERS\pcmcia.sys [179256 2008-01-21] ()
R2 PEAUTH; C:\Windows\System32\drivers\peauth.sys [878080 2006-11-02] ()
R3 PptpMiniport; C:\Windows\System32\DRIVERS\raspptp.sys [62976 2008-01-21] ()
S4 Processor; C:\Windows\system32\drivers\processr.sys [40960 2008-01-21] ()
R1 PSched; C:\Windows\System32\DRIVERS\pacer.sys [72192 2008-04-05] ()
R3 pspdisp; C:\Windows\System32\DRIVERS\pspdisp.sys [3072 2011-01-18] ()
S4 ql2300; C:\Windows\system32\drivers\ql2300.sys [1122360 2008-01-21] ()
S4 ql40xx; C:\Windows\system32\drivers\ql40xx.sys [106088 2006-11-02] ()
S3 QWAVEdrv; C:\Windows\system32\drivers\qwavedrv.sys [31232 2008-01-21] ()
R1 RasAcd; C:\Windows\System32\DRIVERS\rasacd.sys [11776 2008-01-21] ()
R3 Rasl2tp; C:\Windows\System32\DRIVERS\rasl2tp.sys [76288 2008-01-21] ()
R3 RasPppoe; C:\Windows\System32\DRIVERS\raspppoe.sys [41472 2008-01-21] ()
R3 RasSstp; C:\Windows\System32\DRIVERS\rassstp.sys [69120 2008-01-21] ()
R1 rdbss; C:\Windows\System32\DRIVERS\rdbss.sys [224768 2008-01-21] ()
R1 RDPCDD; C:\Windows\System32\DRIVERS\RDPCDD.sys [6144 2008-01-21] ()
S4 rdpdr; C:\Windows\system32\drivers\rdpdr.sys [248832 2008-01-21] ()
R1 RDPENCDD; C:\Windows\System32\drivers\rdpencdd.sys [6144 2008-01-21] ()
S3 RDPWD; C:\Windows\System32\Drivers\RDPWD.sys [181248 2008-01-21] ()
S3 RRNetCap; C:\Windows\System32\DRIVERS\rrnetcap.sys [31848 2012-12-18] ()
R3 RRNetCapMP; C:\Windows\System32\DRIVERS\rrnetcap.sys [31848 2012-12-18] ()
R2 rspndr; C:\Windows\System32\DRIVERS\rspndr.sys [60416 2008-01-21] ()
S3 RTSTOR; C:\Windows\System32\drivers\RTSTOR.SYS [62976 2008-12-02] ()
S4 sbp2port; C:\Windows\system32\drivers\sbp2port.sys [76392 2006-11-02] ()
S4 sdbus; C:\Windows\System32\DRIVERS\sdbus.sys [88576 2008-01-21] ()
R2 secdrv; C:\Windows\System32\Drivers\secdrv.sys [20480 2006-11-02] ()
S3 Serenum; C:\Windows\system32\drivers\serenum.sys [17920 2006-11-02] ()
S3 Serial; C:\Windows\system32\drivers\serial.sys [83456 2006-11-02] ()
S4 sermouse; C:\Windows\system32\drivers\sermouse.sys [19968 2008-01-21] ()
S4 sffdisk; C:\Windows\system32\drivers\sffdisk.sys [13312 2008-01-21] ()
S3 sffp_mmc; C:\Windows\system32\drivers\sffp_mmc.sys [12288 2008-01-21] ()
S3 sffp_sd; C:\Windows\system32\drivers\sffp_sd.sys [11776 2008-01-21] ()
S4 sfloppy; C:\Windows\system32\drivers\sfloppy.sys [13312 2006-11-02] ()
S3 sisagp; C:\Windows\system32\drivers\sisagp.sys [55864 2008-01-21] ()
S4 SiSRaid2; C:\Windows\system32\drivers\sisraid2.sys [41016 2008-01-21] ()
S4 SiSRaid4; C:\Windows\system32\drivers\sisraid4.sys [74808 2008-01-21] ()
R1 Smb; C:\Windows\System32\DRIVERS\smb.sys [66560 2008-01-21] ()
R0 spldr; C:\Windows\System32\Drivers\spldr.sys [21048 2008-01-21] ()
R3 srv; C:\Windows\System32\DRIVERS\srv.sys [304640 2011-02-18] ()
R3 srv2; C:\Windows\System32\DRIVERS\srv2.sys [146432 2011-04-29] ()
R3 srvnet; C:\Windows\System32\DRIVERS\srvnet.sys [102400 2011-04-29] ()
S1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-12-09] (Avira GmbH)
R3 swenum; C:\Windows\System32\DRIVERS\swenum.sys [15288 2008-01-21] ()
S4 Symc8xx; C:\Windows\system32\drivers\symc8xx.sys [35944 2006-11-02] ()
S4 Sym_hi; C:\Windows\system32\drivers\sym_hi.sys [31848 2006-11-02] ()
S4 Sym_u3; C:\Windows\system32\drivers\sym_u3.sys [34920 2006-11-02] ()
R3 SynTP; C:\Windows\System32\DRIVERS\SynTP.sys [205232 2009-02-06] ()
R3 tbhsd; C:\Windows\System32\drivers\tbhsd.sys [39048 2012-12-18] ()
R1 Tcpip; C:\Windows\System32\drivers\tcpip.sys [898952 2010-06-16] ()
S3 Tcpip6; C:\Windows\System32\DRIVERS\tcpip.sys [898952 2010-06-16] ()
R2 tcpipreg; C:\Windows\System32\drivers\tcpipreg.sys [30208 2008-01-21] ()
S3 TDPIPE; C:\Windows\System32\drivers\tdpipe.sys [17920 2008-01-21] ()
S3 TDTCP; C:\Windows\System32\drivers\tdtcp.sys [29184 2008-01-21] ()
R1 tdx; C:\Windows\System32\DRIVERS\tdx.sys [71680 2008-01-21] ()
R1 TermDD; C:\Windows\System32\DRIVERS\termdd.sys [54328 2008-01-21] ()
S3 tssecsrv; C:\Windows\System32\DRIVERS\tssecsrv.sys [23552 2008-01-21] ()
R3 tunmp; C:\Windows\System32\DRIVERS\tunmp.sys [15360 2008-01-21] ()
R3 tunnel; C:\Windows\System32\DRIVERS\tunnel.sys [25088 2010-02-18] ()
S3 uagp35; C:\Windows\system32\drivers\uagp35.sys [59448 2008-01-21] ()
R3 UBHelper; C:\Windows\system32\drivers\UBHelper.sys [14336 2009-05-05] ()
S4 udfs; C:\Windows\System32\DRIVERS\udfs.sys [226816 2008-01-21] ()
S3 uliagpkx; C:\Windows\system32\drivers\uliagpkx.sys [60984 2008-01-21] ()
S4 uliahci; C:\Windows\system32\drivers\uliahci.sys [238648 2008-01-21] ()
S4 UlSata; C:\Windows\system32\drivers\ulsata.sys [98408 2006-11-02] ()
S4 ulsata2; C:\Windows\system32\drivers\ulsata2.sys [115816 2008-01-21] ()
R3 umbus; C:\Windows\System32\DRIVERS\umbus.sys [34816 2008-01-21] ()
S3 upperdev; C:\Windows\System32\DRIVERS\usbser_lowerflt.sys [8192 2010-12-02] ()
R3 usbccgp; C:\Windows\System32\DRIVERS\usbccgp.sys [73216 2009-07-16] ()
S4 usbcir; C:\Windows\system32\drivers\usbcir.sys [68608 2006-11-02] ()
R3 usbehci; C:\Windows\System32\DRIVERS\usbehci.sys [39936 2009-07-16] ()
R3 usbhub; C:\Windows\System32\DRIVERS\usbhub.sys [194560 2009-07-16] ()
S4 usbohci; C:\Windows\system32\drivers\usbohci.sys [19456 2006-11-02] ()
S3 usbprint; C:\Windows\System32\DRIVERS\usbprint.sys [18944 2008-01-21] ()
S3 usbscan; C:\Windows\System32\DRIVERS\usbscan.sys [35328 2008-01-21] ()
S3 usbser; C:\Windows\System32\drivers\usbser.sys [28160 2008-01-21] ()
S3 UsbserFilt; C:\Windows\System32\DRIVERS\usbser_lowerfltj.sys [8192 2010-12-02] ()
S3 USBSTOR; C:\Windows\System32\DRIVERS\USBSTOR.SYS [55296 2008-01-21] ()
R3 usbuhci; C:\Windows\System32\DRIVERS\usbuhci.sys [23552 2009-07-16] ()
R3 usbvideo; C:\Windows\System32\Drivers\usbvideo.sys [134016 2008-01-21] ()
S3 vga; C:\Windows\System32\DRIVERS\vgapnp.sys [26112 2008-01-21] ()
R1 VgaSave; C:\Windows\System32\drivers\vga.sys [25088 2008-01-21] ()
S3 viaagp; C:\Windows\system32\drivers\viaagp.sys [56888 2008-01-21] ()
S4 ViaC7; C:\Windows\system32\drivers\viac7.sys [41472 2008-01-21] ()
S4 viaide; C:\Windows\system32\drivers\viaide.sys [20024 2008-01-21] ()
R0 volmgr; C:\Windows\System32\drivers\volmgr.sys [52792 2008-01-21] ()
R0 volmgrx; C:\Windows\System32\drivers\volmgrx.sys [294456 2008-01-21] ()
R0 volsnap; C:\Windows\System32\drivers\volsnap.sys [227896 2008-01-21] ()
S4 vsmraid; C:\Windows\system32\drivers\vsmraid.sys [130616 2008-01-21] ()
S3 w800bus; C:\Windows\System32\DRIVERS\w800bus.sys [60768 2005-06-13] ()
S4 WacomPen; C:\Windows\system32\drivers\wacompen.sys [20608 2006-11-02] ()
S3 Wanarp; C:\Windows\System32\DRIVERS\wanarp.sys [62464 2008-01-21] ()
R1 Wanarpv6; C:\Windows\System32\DRIVERS\wanarp.sys [62464 2008-01-21] ()
S4 Wd; C:\Windows\system32\drivers\wd.sys [22072 2008-01-21] ()
R0 Wdf01000; C:\Windows\System32\drivers\Wdf01000.sys [445008 2009-07-14] ()
S3 WinUSB; C:\Windows\System32\DRIVERS\WinUSB.sys [31616 2008-01-21] ()
R3 WmiAcpi; C:\Windows\System32\DRIVERS\wmiacpi.sys [11264 2008-01-21] ()
S3 WpdUsb; C:\Windows\System32\DRIVERS\wpdusb.sys [39936 2008-01-21] ()
S4 ws2ifsl; C:\Windows\system32\drivers\ws2ifsl.sys [15872 2008-01-21] ()
R3 WSDPrintDevice; C:\Windows\System32\DRIVERS\WSDPrint.sys [16896 2008-01-21] ()
R3 WSDScan; C:\Windows\System32\DRIVERS\WSDScan.sys [19968 2008-01-21] ()
R3 WudfPf; C:\Windows\System32\drivers\WudfPf.sys [92672 2009-07-14] ()
R3 WUDFRd; C:\Windows\System32\DRIVERS\WUDFRd.sys [132224 2009-07-14] ()
U5 BattC; C:\Windows\System32\Drivers\BattC.sys [28216 2008-01-21] ()
S3 EagleXNt; \??\C:\Windows\system32\drivers\EagleXNt.sys [x]
U5 ec55e6b546b6bca3; C:\Windows\System32\Drivers\ec55e6b546b6bca3.sys [60544 2014-01-03] ()
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
S3 XDva402; \??\C:\Windows\system32\XDva402.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-01-03 11:20 - 2014-01-03 11:20 - 00046963 _____ C:\Users\highend-outlets\Downloads\FRST.txt
2014-01-03 11:19 - 2014-01-03 11:19 - 00004528 _____ C:\Users\highend-outlets\Downloads\defogger_disable.log
2014-01-03 11:19 - 2014-01-03 11:19 - 00000000 ____D C:\FRST
2014-01-03 11:19 - 2014-01-03 11:19 - 00000000 _____ C:\Users\highend-outlets\defogger_reenable
2014-01-03 11:18 - 2014-01-03 11:18 - 00377856 _____ C:\Users\highend-outlets\Downloads\gmer_2.1.19163.exe
2014-01-03 11:17 - 2014-01-03 11:18 - 01064581 _____ (Farbar) C:\Users\highend-outlets\Downloads\FRST.exe
2014-01-03 11:17 - 2014-01-03 11:17 - 00050477 _____ C:\Users\highend-outlets\Downloads\Defogger.exe
2014-01-03 11:08 - 2014-01-03 11:08 - 00000000 ____D C:\Users\highend-outlets\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD
2014-01-03 09:45 - 2014-01-03 09:48 - 129598176 _____ C:\Users\highend-outlets\Downloads\avira_free_antivirus_de.exe
2014-01-03 09:37 - 2014-01-03 09:37 - 00060544 _____ C:\Windows\system32\Drivers\ec55e6b546b6bca3.sys
2014-01-01 19:51 - 2014-01-03 18:31 - 00000000 ____D C:\Users\highend-outlets\AppData\Local\ATworks
2014-01-01 19:39 - 2014-01-01 19:39 - 00485376 _____ (Microsoft Corporation) C:\Users\highend-outlets\Downloads\Nicht bestätigt 40043.crdownload
2013-12-31 20:20 - 2013-12-31 20:22 - 00000283 _____ C:\Windows\SIERRA.INI
2013-12-31 20:20 - 2013-12-31 20:22 - 00000000 ____D C:\SIERRA
2013-12-31 20:20 - 2013-12-31 20:21 - 00000000 ____D C:\Program Files\Sierra OnLine
2013-12-31 20:20 - 2013-12-31 20:20 - 00000000 __RSH C:\MSDOS.SYS
2013-12-31 20:20 - 2013-12-31 20:20 - 00000000 __RSH C:\IO.SYS
2013-12-31 20:20 - 1998-01-23 12:20 - 00305664 _____ (InstallShield Software Corporation ) C:\Windows\IsUn0407.exe
2013-12-30 13:29 - 2014-01-01 19:50 - 00000000 ____D C:\Program Files\Tales of Pirates II
2013-12-29 22:17 - 2012-10-31 22:13 - 00245612 _____ C:\Program Files\CharacterAction.tx
2013-12-29 22:15 - 2013-12-29 22:15 - 00241923 _____ C:\Users\highend-outlets\Downloads\CharacterAction (4).tx
2013-12-28 02:52 - 2013-12-28 02:52 - 02848968 _____ C:\Users\highend-outlets\Downloads\Black Skin Ver. 3.1.1.rar
2013-12-27 18:00 - 2013-12-27 18:00 - 00000000 _____ C:\Windows\setuperr.log
2013-12-27 18:00 - 2013-12-27 18:00 - 00000000 _____ C:\Windows\setupact.log
2013-12-17 22:19 - 2013-12-17 22:19 - 00168816 _____ C:\Users\highend-outlets\Downloads\lethal_league.zip
2013-12-15 19:20 - 2013-12-15 19:20 - 00030022 _____ C:\Users\highend-outlets\Downloads\M14 (1).zip
2013-12-15 14:55 - 2013-12-15 14:55 - 00110484 _____ C:\Users\highend-outlets\Downloads\Metroid II - Return of Samus (World).zip
2013-12-15 14:52 - 2013-12-15 14:52 - 00296339 _____ C:\Users\highend-outlets\Downloads\Legend of Zelda, The - Link's Awakening (USA, Europe).zip
2013-12-15 14:51 - 2013-12-15 14:51 - 00331754 _____ C:\Users\highend-outlets\Downloads\Kirby's Dream Land 2 (USA, Europe).zip
2013-12-15 14:49 - 2013-12-15 14:50 - 00378607 _____ C:\Users\highend-outlets\Downloads\Pokemon - Red Version (USA, Europe).zip
2013-12-15 14:24 - 2013-12-15 14:25 - 32551762 _____ C:\Users\highend-outlets\Downloads\OFW 660.zip
2013-12-10 20:54 - 2013-12-29 13:23 - 00000000 ____D C:\Users\highend-outlets\Programme
2013-12-10 20:52 - 2013-12-10 20:53 - 00985720 _____ C:\Users\highend-outlets\Downloads\ElophantClient.zip
2013-12-08 15:01 - 2014-01-03 09:58 - 00099196 _____ C:\Windows\PFRO.log
2013-12-04 16:50 - 2013-12-04 16:51 - 38090383 _____ C:\Users\highend-outlets\Downloads\core_0190 (1).zip
2013-12-04 16:49 - 2013-12-04 16:49 - 02455823 _____ C:\Users\highend-outlets\Downloads\wagic_0190_win_r4801.zip
2013-12-04 16:41 - 2013-12-04 16:41 - 00030022 _____ C:\Users\highend-outlets\Downloads\M14.zip
2013-12-04 16:05 - 2013-12-04 16:05 - 27896224 _____ C:\Users\highend-outlets\Downloads\WTH_0186_PSP.zip
2013-12-04 16:01 - 2014-01-03 09:04 - 227684352 _____ C:\Users\highend-outlets\Downloads\PR_GAWM_TE.7z
2013-12-04 15:45 - 2013-12-04 15:45 - 01807507 _____ C:\Users\highend-outlets\Downloads\WTH_0190_r4789.zip
2013-12-04 15:44 - 2013-12-04 15:48 - 843235382 _____ C:\Users\highend-outlets\Downloads\sets_psp_low.zip
2013-12-04 15:30 - 2013-12-04 15:30 - 38090383 _____ C:\Users\highend-outlets\Downloads\core_0190.zip

==================== One Month Modified Files and Folders =======

2014-01-03 18:31 - 2014-01-01 19:51 - 00000000 ____D C:\Users\highend-outlets\AppData\Local\ATworks
2014-01-03 18:31 - 2010-01-11 21:00 - 00000000 ____D C:\ProgramData\McAfee Security Scan
2014-01-03 18:31 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\system32\spool
2014-01-03 18:31 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\system32\Msdtc
2014-01-03 18:31 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\registration
2014-01-03 18:31 - 2006-11-02 11:22 - 54263808 _____ C:\Windows\system32\config\software_previous
2014-01-03 18:31 - 2006-11-02 11:22 - 25427968 _____ C:\Windows\system32\config\system_previous
2014-01-03 18:27 - 2006-11-02 11:22 - 31195136 _____ C:\Windows\system32\config\components_previous
2014-01-03 18:27 - 2006-11-02 11:22 - 00262144 _____ C:\Windows\system32\config\security_previous
2014-01-03 18:27 - 2006-11-02 11:22 - 00262144 _____ C:\Windows\system32\config\default_previous
2014-01-03 18:27 - 2006-11-02 11:22 - 00053248 _____ C:\Windows\system32\config\sam_previous
2014-01-03 11:20 - 2014-01-03 11:20 - 00046963 _____ C:\Users\highend-outlets\Downloads\FRST.txt
2014-01-03 11:19 - 2014-01-03 11:19 - 00004528 _____ C:\Users\highend-outlets\Downloads\defogger_disable.log
2014-01-03 11:19 - 2014-01-03 11:19 - 00000000 ____D C:\FRST
2014-01-03 11:19 - 2014-01-03 11:19 - 00000000 _____ C:\Users\highend-outlets\defogger_reenable
2014-01-03 11:19 - 2013-01-08 19:13 - 00000000 ____D C:\Users\highend-outlets\AppData\Roaming\Skype
2014-01-03 11:19 - 2009-12-10 12:06 - 00000000 ____D C:\Users\highend-outlets
2014-01-03 11:18 - 2014-01-03 11:18 - 00377856 _____ C:\Users\highend-outlets\Downloads\gmer_2.1.19163.exe
2014-01-03 11:18 - 2014-01-03 11:17 - 01064581 _____ (Farbar) C:\Users\highend-outlets\Downloads\FRST.exe
2014-01-03 11:17 - 2014-01-03 11:17 - 00050477 _____ C:\Users\highend-outlets\Downloads\Defogger.exe
2014-01-03 11:11 - 2006-11-02 11:33 - 00769188 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-03 11:08 - 2014-01-03 11:08 - 00000000 ____D C:\Users\highend-outlets\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD
2014-01-03 11:06 - 2013-07-19 14:33 - 00007388 _____ C:\autoupdate.log
2014-01-03 11:06 - 2012-06-17 20:24 - 00001112 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-03 11:05 - 2006-11-02 14:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-03 11:05 - 2006-11-02 13:47 - 00003424 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-03 11:05 - 2006-11-02 13:47 - 00003424 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-03 10:59 - 2012-04-13 10:51 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-01-03 10:31 - 2012-09-02 12:26 - 00000968 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-76954294-2760295059-2378521770-1000UA.job
2014-01-03 10:21 - 2012-06-17 20:24 - 00001116 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-03 09:58 - 2013-12-08 15:01 - 00099196 _____ C:\Windows\PFRO.log
2014-01-03 09:57 - 2006-11-02 14:01 - 00032594 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2014-01-03 09:54 - 2012-12-09 12:17 - 00000000 ____D C:\ProgramData\Avira
2014-01-03 09:48 - 2014-01-03 09:45 - 129598176 _____ C:\Users\highend-outlets\Downloads\avira_free_antivirus_de.exe
2014-01-03 09:37 - 2014-01-03 09:37 - 00060544 _____ C:\Windows\system32\Drivers\ec55e6b546b6bca3.sys
2014-01-03 09:04 - 2013-12-04 16:01 - 227684352 _____ C:\Users\highend-outlets\Downloads\PR_GAWM_TE.7z
2014-01-03 01:39 - 2012-03-13 10:37 - 01632784 _____ C:\Windows\WindowsUpdate.log
2014-01-02 19:35 - 2013-04-30 17:47 - 00000000 ____D C:\Users\highend-outlets\AppData\Roaming\Spotify
2014-01-02 19:32 - 2013-06-09 21:01 - 00000000 ____D C:\Users\highend-outlets\AppData\Local\PMB Files
2014-01-02 19:32 - 2013-06-09 21:01 - 00000000 ____D C:\ProgramData\PMB Files
2014-01-02 18:27 - 2013-04-30 17:48 - 00000000 ____D C:\Users\highend-outlets\AppData\Local\Spotify
2014-01-02 01:23 - 2013-08-28 18:27 - 00000000 ____D C:\Program Files\DevPro
2014-01-01 21:47 - 2013-03-15 19:16 - 00000000 ____D C:\Users\highend-outlets\AppData\Local\CrashDumps
2014-01-01 19:50 - 2013-12-30 13:29 - 00000000 ____D C:\Program Files\Tales of Pirates II
2014-01-01 19:39 - 2014-01-01 19:39 - 00485376 _____ (Microsoft Corporation) C:\Users\highend-outlets\Downloads\Nicht bestätigt 40043.crdownload
2014-01-01 18:10 - 2011-05-06 17:05 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-76954294-2760295059-2378521770-1000Core.job
2013-12-31 20:22 - 2013-12-31 20:20 - 00000283 _____ C:\Windows\SIERRA.INI
2013-12-31 20:22 - 2013-12-31 20:20 - 00000000 ____D C:\SIERRA
2013-12-31 20:21 - 2013-12-31 20:20 - 00000000 ____D C:\Program Files\Sierra OnLine
2013-12-31 20:20 - 2013-12-31 20:20 - 00000000 __RSH C:\MSDOS.SYS
2013-12-31 20:20 - 2013-12-31 20:20 - 00000000 __RSH C:\IO.SYS
2013-12-31 13:31 - 2012-09-02 12:26 - 00000946 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-76954294-2760295059-2378521770-1000Core.job
2013-12-30 13:26 - 2013-03-26 10:45 - 00000000 ____D C:\Program Files\Tales of Pirates Tweak
2013-12-29 22:15 - 2013-12-29 22:15 - 00241923 _____ C:\Users\highend-outlets\Downloads\CharacterAction (4).tx
2013-12-29 13:23 - 2013-12-10 20:54 - 00000000 ____D C:\Users\highend-outlets\Programme
2013-12-28 16:30 - 2012-06-30 19:28 - 00000000 ____D C:\Users\highend-outlets\AppData\Local\Eraser 6
2013-12-28 15:45 - 2006-11-02 13:47 - 00424896 _____ C:\Windows\system32\FNTCACHE.DAT
2013-12-28 02:52 - 2013-12-28 02:52 - 02848968 _____ C:\Users\highend-outlets\Downloads\Black Skin Ver. 3.1.1.rar
2013-12-27 18:00 - 2013-12-27 18:00 - 00000000 _____ C:\Windows\setuperr.log
2013-12-27 18:00 - 2013-12-27 18:00 - 00000000 _____ C:\Windows\setupact.log
2013-12-18 10:01 - 2012-12-09 12:17 - 00135648 _____ C:\Windows\system32\Drivers\avipbb.sys
2013-12-18 10:01 - 2012-12-09 12:17 - 00090400 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-12-18 10:00 - 2009-12-10 12:08 - 00117104 _____ C:\Users\highend-outlets\AppData\Local\GDIPFONTCACHEV1.DAT
2013-12-17 22:19 - 2013-12-17 22:19 - 00168816 _____ C:\Users\highend-outlets\Downloads\lethal_league.zip
2013-12-15 19:20 - 2013-12-15 19:20 - 00030022 _____ C:\Users\highend-outlets\Downloads\M14 (1).zip
2013-12-15 14:55 - 2013-12-15 14:55 - 00110484 _____ C:\Users\highend-outlets\Downloads\Metroid II - Return of Samus (World).zip
2013-12-15 14:52 - 2013-12-15 14:52 - 00296339 _____ C:\Users\highend-outlets\Downloads\Legend of Zelda, The - Link's Awakening (USA, Europe).zip
2013-12-15 14:51 - 2013-12-15 14:51 - 00331754 _____ C:\Users\highend-outlets\Downloads\Kirby's Dream Land 2 (USA, Europe).zip
2013-12-15 14:50 - 2013-12-15 14:49 - 00378607 _____ C:\Users\highend-outlets\Downloads\Pokemon - Red Version (USA, Europe).zip
2013-12-15 14:25 - 2013-12-15 14:24 - 32551762 _____ C:\Users\highend-outlets\Downloads\OFW 660.zip
2013-12-15 11:24 - 2009-12-10 12:07 - 00000000 ____D C:\Program Files\Google
2013-12-13 00:00 - 2009-04-08 19:26 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-12-12 23:58 - 2013-08-15 00:25 - 00000000 ____D C:\Windows\system32\MRT
2013-12-12 23:44 - 2006-11-02 11:24 - 88123800 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2013-12-11 18:59 - 2012-04-13 10:51 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-12-11 18:59 - 2011-05-26 14:26 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-12-10 20:53 - 2013-12-10 20:52 - 00985720 _____ C:\Users\highend-outlets\Downloads\ElophantClient.zip
2013-12-08 15:52 - 2009-12-16 00:17 - 00000000 ____D C:\Users\highend-outlets\AppData\Local\Adobe
2013-12-06 23:30 - 2009-12-13 08:34 - 00075264 _____ C:\Users\highend-outlets\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-12-06 16:13 - 2012-12-29 12:18 - 00000000 ____D C:\levendusb
2013-12-06 16:06 - 2013-01-08 19:11 - 00000000 ____D C:\ProgramData\Skype
2013-12-06 15:27 - 2013-01-08 19:12 - 00000000 ___RD C:\Program Files\Skype
2013-12-05 20:03 - 2013-10-24 16:37 - 00633649 _____ C:\Users\highend-outlets\Documents\Die Kanarischen Inseln.pptx
2013-12-04 16:51 - 2013-12-04 16:50 - 38090383 _____ C:\Users\highend-outlets\Downloads\core_0190 (1).zip
2013-12-04 16:49 - 2013-12-04 16:49 - 02455823 _____ C:\Users\highend-outlets\Downloads\wagic_0190_win_r4801.zip
2013-12-04 16:41 - 2013-12-04 16:41 - 00030022 _____ C:\Users\highend-outlets\Downloads\M14.zip
2013-12-04 16:05 - 2013-12-04 16:05 - 27896224 _____ C:\Users\highend-outlets\Downloads\WTH_0186_PSP.zip
2013-12-04 15:48 - 2013-12-04 15:44 - 843235382 _____ C:\Users\highend-outlets\Downloads\sets_psp_low.zip
2013-12-04 15:45 - 2013-12-04 15:45 - 01807507 _____ C:\Users\highend-outlets\Downloads\WTH_0190_r4789.zip
2013-12-04 15:30 - 2013-12-04 15:30 - 38090383 _____ C:\Users\highend-outlets\Downloads\core_0190.zip

Some content of TEMP:
====================
C:\Users\highend-outlets\AppData\Local\Temp\avgnt.exe
C:\Users\highend-outlets\AppData\Local\Temp\devpro.dll
C:\Users\highend-outlets\AppData\Local\Temp\DevPro.exe
C:\Users\highend-outlets\AppData\Local\Temp\ICSharpCode.SharpZipLib.dll
C:\Users\highend-outlets\AppData\Local\Temp\install_flashplayer11x32au_mssa_aaa_aih.exe
C:\Users\highend-outlets\AppData\Local\Temp\qrmwyglg.exe
C:\Users\highend-outlets\AppData\Local\Temp\YgoUpdater.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys
[2008-01-21 03:23] - [2008-01-21 03:23] - 0227896 ____A () D41D8CD98F00B204E9800998ECF8427E

C:\Windows\System32\Drivers\volsnap.sys IS INFECTED. <===== ATTENTION!



LastRegBack: 2014-01-03 11:13

==================== End Of Log ============================
         
--- --- ---

--- --- ---


Addition:

Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x86) Version: 02-01-2014 01
Ran by highend-outlets at 2014-01-03 11:21:09
Running from C:\Users\highend-outlets\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Disabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Disabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

 Update for Microsoft Office 2007 (KB2508958) (Version:  - Microsoft)
1und1 Internet Explorer Add-On (Version: 1.0 - 1&1 Internet AG) Hidden
A Ruler for Windows (Version: 2.5 - Latour)
Acer Backup Manager (Version: 1.1.0.72 - NewTech Infosystems)
Acer Crystal Eye Webcam (Version: 5.2.5.3 - Suyin Optronics Corp)
Acer eRecovery Management (Version: 4.00.3008 - Acer Incorporated)
Acer GridVista (Version: 2.75.825 - Acer Inc.)
Acer PowerSmart Manager (Version: 4.02.3006 - Acer Incorporated)
Acer Product Registration (Version: 3.0.0.10 - Acer Incorporated)
Acer ScreenSaver (Version: 1.0.5.0511 - Acer)
Acer VCM (Version: 4.00.3006 - Acer Incorporated)
Adobe Bridge 1.0 (Version: 001.000.001 - Adobe Systems) Hidden
Adobe Common File Installer (Version: 1.00.001 - Adobe System Incorporated) Hidden
Adobe Flash Player 11 ActiveX (Version: 11.9.900.170 - Adobe Systems Incorporated)
Adobe Flash Player 11 Plugin (Version: 11.9.900.170 - Adobe Systems Incorporated)
Adobe Help Center 1.0 (Version: 1.0.1 - Adobe Systems) Hidden
Adobe Photoshop CS2 (Version: 9.0 - Adobe Systems, Inc.)
Adobe Photoshop CS2 (Version: 9.0 - Adobe Systems, Inc.) Hidden
Adobe Reader X (10.1.1) - Deutsch (Version: 10.1.1 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.0 (Version: 12.0.3.133 - Adobe Systems, Inc.)
Adobe Stock Photos 1.0 (Version: 1.0.1 - Adobe Systems) Hidden
Any Video Converter 5 5.0.4 (Version:  - Any-Video-Converter.com)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (Version: 1.0.0.18 - Atheros Communications Inc.)
Audials (Version: 10.1.514.1400 - Audials AG)
Avira Free Antivirus (Version: 14.0.2.286 - Avira)
Backup Manager Basic (Version: 1.1.0.72 - NewTech Infosystems) Hidden
BattleForge™ (Version: 1.0.0.0 - Electronic Arts)
Camtasia Studio 8 (Version: 8.0.4.1060 - TechSmith Corporation)
CCleaner (Version: 3.10 - Piriform)
Dev-C++ 5 beta 9 release (4.9.9.2) (Version:  - )
Elsword_DE (Version:  - )
EPSON BX620FWD Series Handbuch (Version:  - )
EPSON BX620FWD Series Netzwerk-Handbuch (Version:  - )
EPSON BX620FWD Series Printer Uninstall (Version:  - SEIKO EPSON Corporation)
Epson Customer Research Participation (Version: 1.30.0000 - EPSON)
Epson Easy Photo Print 2 (Version: 2.2.0.0 - SEIKO EPSON CORPORATION)
Epson Easy Photo Print Plug-in for PMB(Picture Motion Browser) (Version: 1.00.0000 - SEIKO EPSON CORPORATION)
Epson Event Manager (Version: 2.40.0001 - SEIKO EPSON CORPORATION)
Epson FAX Utility (Version: 1.10.00 - SEIKO EPSON CORPORATION)
Epson PC-FAX Driver (Version:  - )
EPSON Scan (Version:  - Seiko Epson Corporation)
EpsonNet Print (Version: 2.4i - SEIKO EPSON CORPORATION)
EpsonNet Setup 3.3 (Version: 3.3a - SEIKO EPSON CORPORATION)
Eraser 6.0.10.2620 (Version: 6.0.2620 - The Eraser Project)
Façade (Version: 1.1.2 - Procedural Arts)
Facebook Video Calling 1.2.0.287 (Version: 1.2.287 - Skype Limited)
FormatFactory 3.0.1 (Version: 3.0.1 - Free Time)
Free YouTube to MP3 Converter version 3.12.0.128 (Version: 3.12.0.128 - DVDVideoSoft Ltd.)
GIMP 2.8.4 (Version: 2.8.4 - The GIMP Team)
Google Chrome (Version: 31.0.1650.63 - Google Inc.)
Google Earth (Version: 7.1.2.2041 - Google)
Google Toolbar for Internet Explorer (Version: 1.0.0 - Google Inc.) Hidden
Google Toolbar for Internet Explorer (Version: 7.5.4805.320 - Google Inc.)
Google Update Helper (Version: 1.3.22.3 - Google Inc.) Hidden
GS Auto Clicker (Version: V3.1.2 - goldensoft.org)
Intel PROSet Wireless (Version:  - ) Hidden
Intel(R) Graphics Media Accelerator Driver (Version:  - Intel Corporation)
Intel(R) PROSet/Wireless WiFi-Software (Version: 12.02.0000 - Intel(R) Corporation)
Intel® Matrix Storage Manager (Version:  - Intel Corporation)
Java 7 Update 45 (Version: 7.0.450 - Oracle)
Java Auto Updater (Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
JDownloader 0.9 (Version: 0.9 - AppWork GmbH)
Junk Mail filter update (Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Launch Manager (Version: 2.0.03 - Acer Inc.)
League of Legends (Version: 1.3 - Riot Games)
Maske der Ewigkeit (Version:  - )
McAfee Security Scan Plus (Version: 3.8.130.10 - McAfee, Inc.)
Metin2 (Version:  - Gameforge 4D GmbH)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 Language Pack SP1 - deu (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 3.5 SP1 (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5 (Version: 4.5.50709 - Microsoft Corporation)
Microsoft .NET Framework 4.5 (Version: 4.5.50709 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5 DEU Language Pack (Version: 4.5.50709 - Microsoft Corporation)
Microsoft .NET Framework 4.5 DEU Language Pack (Version: 4.5.50709 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6012.5000 - Microsoft Corporation) Hidden
Microsoft Choice Guard (Version: 2.0.48.0 - Microsoft Corporation) Hidden
Microsoft Office 2007 Service Pack 3 (SP3) (Version:  - Microsoft) Hidden
Microsoft Office Access MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Enterprise 2007 (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office FrontPage 2003 (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Office Groove MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Live Add-in 1.5 (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office OneNote MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (Version:  - Microsoft) Hidden
Microsoft Office Publisher MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office SharePoint Designer 2007 (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office SharePoint Designer 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office SharePoint Designer 2007 Service Pack 3 (SP3) (Version:  - Microsoft)
Microsoft Office SharePoint Designer 2007 Service Pack 3 (SP3) (Version:  - Microsoft) Hidden
Microsoft Office SharePoint Designer MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Sync Framework Runtime Native v1.0 (x86) (Version: 1.0.1215.0 - Microsoft Corporation)
Microsoft Sync Framework Services Native v1.0 (x86) (Version: 1.0.1215.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Works (Version: 9.7.0621 - Microsoft Corporation)
MinecraftAlpha (Version:  - )
Moo0 VoiceRecorder 1.32 (Version:  - )
MSVC80_x86_v2 (Version: 1.0.3.0 - Nokia) Hidden
MSVC90_x86 (Version: 1.0.1.2 - Nokia) Hidden
MSVCRT (Version: 14.0.1468.721 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0 - Microsoft Corporation)
MyWinLocker (Version: 3.1.59.0 - Egis Technology Inc.)
No23 Recorder (Version: 2.1.0.3 - No23)
Nokia Connectivity Cable Driver (Version: 7.1.41.0 - Nokia)
Nokia Ovi Player (Version: 2.0.1106 - Nokia Ovi Player)
Nokia Ovi Suite (Version: 3.1.0.84 - Nokia)
Nokia Ovi Suite (Version: 3.1.0.84 - Nokia) Hidden
Nokia Ovi Suite Software Updater (Version: 02.07.004.45780 - Nokia Corporation)
Nokia_Multimedia_Common_Components_2_5 (Version: 2.5.197 - Nokia)
NTI Backup Now 5 (Version: 5.1.2.616 - NewTech Infosystems)
NTI Backup Now Standard (Version: 5.1.2.616 - NewTech Infosystems) Hidden
NTI Media Maker 8 (Version: 8.0.2.6509 - NewTech Infosystems)
NTI Media Maker 8 (Version: 8.0.2.6509 - NewTech Infosystems) Hidden
Ocean Express (Version:  - Oberon Media)
OpenOffice.org 3.4.1 (Version: 3.41.9593 - Apache Software Foundation)
Optical Drive Power Management (Version: 1.00.3006 - Acer Incorporated)
Orion (Version: 2.5.0 - Convesoft)
osu! (Version: 0.0.0.0 - peppy)
Overwolf (Version: 0.44.256 - Overwolf)
Ovi Desktop Sync Engine (Version: 1.5.257.0 - Nokia) Hidden
OviMPlatform (Version: 2.7.66.0 - Nokia) Hidden
Paint.NET v3.5.10 (Version: 3.60.0 - dotPDN LLC)
Pando Media Booster (Version: 2.6.0.9 - Pando Networks Inc.)
PC Connectivity Solution (Version: 11.4.15.0 - Nokia)
PHANTASY STAR UNIVERSE (Version:  - SEGA SONIC TEAM)
Pinnacle VideoSpin (Version: 2.0.0.669 - Pinnacle Systems)
Pokemon Online 2.2.4c (Version:  - Dreambelievers)
PowerDVD (Version: 7.0.4028.0 - CyberLink Corp.)
Project64 1.6 (Version: 1.6 - Project64)
PSPdisp v0.6 (Version: v0.6 - JJS)
Puzzle Express (Version:  - Oberon Media)
RaidCall (Version: 7.1.8-1.0.4843.13 - raidcall.com)
Razer Game Booster (Version: 3.7 - Razer USA Ltd)
Realtek High Definition Audio Driver (Version: 6.0.1.5830 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (Version: 6.0.6000.20113 - Realtek Semiconductor Corp.)
S4 League_EU (Version: 1.00.0000 - )
Sierra Utilities (Version:  - )
Skype™ 6.11 (Version: 6.11.102 - Skype Technologies S.A.)
Softwarenetz Kassenbuch4 (Version:  - )
Softwarenetz Rechnung3 (Version:  - )
Spotify (Version: 0.9.6.81.gd359a796 - Spotify AB)
swMSM (Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Synaptics Pointing Device Driver (Version: 12.2.2.0 - Synaptics Incorporated)
Tales of Pirates II (Version: 1.0.63 - IGG,Inc.)
Tales of Pirates Online (Version: 2.00 - IGG,Inc.)
TeamSpeak 3 Client (Version: 3.0.13 - TeamSpeak Systems GmbH)
Tri-Peaks Solitaire To Go (Version:  - Oberon Media)
Unity Web Player (Version:  - Unity Technologies ApS)
Update for 2007 Microsoft Office System (KB967642) (Version:  - Microsoft)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (Version: 1 - Microsoft Corporation)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2850085) 32-Bit Edition (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (Version:  - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (Version:  - Microsoft)
Updater Service (Version: 14,12,8,9 - ) <==== ATTENTION
Windows Live Call (Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live Communications Platform (Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Windows Live Essentials (Version: 14.0.8117.0416 - Microsoft Corporation)
Windows Live Essentials (Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Windows Live ID-Anmelde-Assistent (Version: 6.500.3165.0 - Microsoft Corporation)
Windows Live Mail (Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live Messenger (Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live Movie Maker (Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live OneCare safety scanner (Version:  - Microsoft Corporation)
Windows Live OneCare safety scanner (Version: 1.0.0.0 - Microsoft Corporation) Hidden
Windows Live Sync (Version: 14.0.8117.416 - Microsoft Corporation)
Windows Live Writer (Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live-Uploadtool (Version: 14.0.8014.1029 - Microsoft Corporation)
Windows Media Encoder 9-Reihe (Version:  - )
Windows Media Encoder 9-Reihe (Version: 9.00.3374 - Microsoft Corporation) Hidden
Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0) (Version: 08/22/2008 7.0.0.0 - Nokia)
WinRAR (Version:  - )
YGOPro DevPro Version 1.9.6 r0 (Version: 1.9.6 r0 - YGOPro DevPro Online)

==================== Restore Points  =========================


==================== Hosts content: ==========================

2006-11-02 11:23 - 2006-09-18 22:41 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
::1             localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {1CC81347-6204-4B83-900C-01E02F50F067} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {23DD560C-243A-445D-832A-1C5D000E14C3} - System32\Tasks\RunAsStdUser Task => C:\Program Files\Moo0\VoiceRecorder 1.32\VoiceRecorder.exe [2012-12-08] (Moo0)
Task: {320124A7-D70F-41DE-A9D1-D5E8E19D5D91} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {3BCDF251-CA5C-4045-A1FC-8FCEF9FBDC93} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {44980BEE-7809-44A9-AC24-D6E578A3B7DF} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\System32\RacAgent.exe [2008-01-21] (Microsoft Corporation)
Task: {66F4192C-CB24-483F-9921-4419A21887F1} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance => C:\Program Files\TuneUp Utilities 2010\OneClick.exe
Task: {934DCA32-97E5-44D7-9D50-F59EA48F6F05} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-11] (Adobe Systems Incorporated)
Task: {9F19DC2B-EF0B-4D5C-B441-F7E52C62CE00} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2012-06-17] (Google Inc.)
Task: {B71A2F7D-B177-4953-8E43-E2A87B54E842} - System32\Tasks\Razer_Game_Booster_AutoUpdate => C:\Program Files\Razer\Razer Game Booster\AutoUpdate.exe [2013-06-05] ()
Task: {C563A681-F725-4797-A49A-3CF91A72630B} - System32\Tasks\Microsoft\Windows\RestartManager\{89FF3A27-10E6-4625-A0C3-C87A29BD3920} => C:\Windows\System32\RmClient.exe [2006-11-02] (Microsoft Corporation)
Task: {CB86B84B-8BA3-4309-830A-B4A8D36F94FF} - System32\Tasks\Microsoft\Windows\RestartManager\{F1DAADE9-048D-4c73-AB80-23FE9E867D86} => C:\Windows\System32\RmClient.exe [2006-11-02] (Microsoft Corporation)
Task: {CD5EFA92-F851-4E18-A578-6C147CC39750} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-76954294-2760295059-2378521770-1000UA => C:\Users\highend-outlets\AppData\Local\Google\Update\GoogleUpdate.exe [2011-05-06] (Google Inc.)
Task: {E5150B95-F9B4-4D5D-95A2-7EC1ACBA95F8} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\System32\gatherWirelessInfo.vbs [2008-01-21] ()
Task: {E56B1436-3183-444C-B2DF-AC953488D3CB} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2012-06-17] (Google Inc.)
Task: {ECFD679D-C93F-4B61-A36A-22657793F7EA} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-76954294-2760295059-2378521770-1000Core => C:\Users\highend-outlets\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-09-02] (Facebook Inc.)
Task: {EDECC2FA-CDF1-4E4D-9512-91877876D395} - System32\Tasks\Java Update Scheduler => C:\Program Files\Common Files\Java\Java Update\jusched.exe [2013-07-02] (Oracle Corporation)
Task: {F07446DC-AB25-47C8-BFB7-8ADF973A0FF8} - System32\Tasks\Adobe Reader and Acrobat Manager => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2011-06-06] (Adobe Systems Incorporated)
Task: {F0F13B91-2E61-4F83-92F9-D051598F9CB2} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-76954294-2760295059-2378521770-1000Core => C:\Users\highend-outlets\AppData\Local\Google\Update\GoogleUpdate.exe [2011-05-06] (Google Inc.)
Task: {F30C6B22-2347-460B-A064-5116DEF5E245} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-76954294-2760295059-2378521770-1000UA => C:\Users\highend-outlets\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-09-02] (Facebook Inc.)
Task: {FD7B84A3-1A67-4505-B821-27E689A7FA9E} - System32\Tasks\Game_Booster_AutoUpdate => C:\Program Files\IObit\Game Booster 3\AutoUpdate.exe
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-76954294-2760295059-2378521770-1000Core.job => C:\Users\highend-outlets\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-76954294-2760295059-2378521770-1000UA.job => C:\Users\highend-outlets\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-76954294-2760295059-2378521770-1000Core.job => C:\Users\highend-outlets\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-76954294-2760295059-2378521770-1000UA.job => C:\Users\highend-outlets\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\User_Feed_Synchronization-{96A8A4AD-CD8F-4D37-8F51-72C50F28B58B}.job => C:\Windows\system32\msfeedssync.exe

==================== Loaded Modules (whitelisted) =============

2014-01-01 19:51 - 2014-01-01 19:51 - 00025600 _____ () C:\Users\highend-outlets\AppData\Local\ATworks\CompatObjclass16.dll
2009-07-16 08:27 - 2003-06-07 22:30 - 00057344 _____ () C:\Program Files\Launch Manager\PowerUtl.dll
2009-02-02 16:33 - 2009-02-02 16:33 - 00460199 _____ () C:\Program Files\NewTech Infosystems\Acer Backup Manager\sqlite3.dll
2008-01-21 03:24 - 2008-01-21 03:24 - 00368640 _____ () C:\Windows\system32\msjetoledb40.dll
2013-12-06 08:45 - 2013-12-04 03:48 - 04055504 _____ () C:\Program Files\Google\Chrome\Application\31.0.1650.63\pdf.dll
2013-12-06 08:45 - 2013-12-04 03:48 - 00399312 _____ () C:\Program Files\Google\Chrome\Application\31.0.1650.63\ppGoogleNaClPluginChrome.dll
2013-12-06 08:45 - 2013-12-04 03:47 - 01619408 _____ () C:\Program Files\Google\Chrome\Application\31.0.1650.63\ffmpegsumo.dll
2013-12-17 18:04 - 2013-12-17 18:04 - 00358400 _____ () C:\Users\highend-outlets\AppData\Local\Google\Chrome\User Data\Default\Extensions\alelhddbbhepgpmgidjdcjakblofbmce\3.5.10_0\plugins\screen_capture.dll
2013-12-06 08:45 - 2013-12-04 03:47 - 00702416 _____ () C:\Program Files\Google\Chrome\Application\31.0.1650.63\libglesv2.dll
2013-12-06 08:45 - 2013-12-04 03:47 - 00099792 _____ () C:\Program Files\Google\Chrome\Application\31.0.1650.63\libegl.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\ProgramData\TEMP:3B3A35EC
AlternateDataStreams: C:\ProgramData\TEMP:4F636E25
AlternateDataStreams: C:\ProgramData\TEMP:798A3728
AlternateDataStreams: C:\ProgramData\TEMP:814B9485
AlternateDataStreams: C:\ProgramData\TEMP:8750DCE4
AlternateDataStreams: C:\ProgramData\TEMP:9E22BBE8
AlternateDataStreams: C:\ProgramData\TEMP:ABE89FFE
AlternateDataStreams: C:\ProgramData\TEMP:ADE16379
AlternateDataStreams: C:\ProgramData\TEMP:B203B914
AlternateDataStreams: C:\ProgramData\TEMP:B623B5B8
AlternateDataStreams: C:\ProgramData\TEMP:BB24555F
AlternateDataStreams: C:\ProgramData\TEMP:CDFF58FE
AlternateDataStreams: C:\ProgramData\TEMP:CE0A077E

==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MpfService => ""="Service"

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (01/03/2014 11:11:42 AM) (Source: LoadPerf) (User: )
Description: Performance16

Error: (01/03/2014 11:10:38 AM) (Source: Windows Search Service) (User: )
Description: Eintrag <C:\USERS\HIGHEND-OUTLETS\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\CYBERLINK POWERDVD\POWERDVD DEINSTALLIEREN.LNK> in der Hash-Zuordnung kann nicht aktualisiert werden.

Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)

Error: (01/03/2014 11:10:38 AM) (Source: Windows Search Service) (User: )
Description: Eintrag <C:\USERS\HIGHEND-OUTLETS\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\CYBERLINK POWERDVD\POWERDVD DEINSTALLIEREN.LNK> in der Hash-Zuordnung kann nicht aktualisiert werden.

Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)

Error: (01/03/2014 11:10:38 AM) (Source: Windows Search Service) (User: )
Description: Eintrag <C:\USERS\HIGHEND-OUTLETS\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\CYBERLINK POWERDVD\README.LNK> in der Hash-Zuordnung kann nicht aktualisiert werden.

Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)

Error: (01/03/2014 11:10:38 AM) (Source: Windows Search Service) (User: )
Description: Eintrag <C:\USERS\HIGHEND-OUTLETS\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\CYBERLINK POWERDVD\README.LNK> in der Hash-Zuordnung kann nicht aktualisiert werden.

Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)

Error: (01/03/2014 11:10:38 AM) (Source: Windows Search Service) (User: )
Description: Eintrag <C:\USERS\HIGHEND-OUTLETS\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\CYBERLINK POWERDVD\ONLINE-REGISTRIERUNG.LNK> in der Hash-Zuordnung kann nicht aktualisiert werden.

Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)

Error: (01/03/2014 11:10:38 AM) (Source: Windows Search Service) (User: )
Description: Eintrag <C:\USERS\HIGHEND-OUTLETS\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\CYBERLINK POWERDVD\ONLINE-REGISTRIERUNG.LNK> in der Hash-Zuordnung kann nicht aktualisiert werden.

Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)

Error: (01/03/2014 11:10:38 AM) (Source: Windows Search Service) (User: )
Description: Eintrag <C:\USERS\HIGHEND-OUTLETS\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\CYBERLINK POWERDVD\POWERDVD-HILFE.LNK> in der Hash-Zuordnung kann nicht aktualisiert werden.

Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)

Error: (01/03/2014 11:10:38 AM) (Source: Windows Search Service) (User: )
Description: Eintrag <C:\USERS\HIGHEND-OUTLETS\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\CYBERLINK POWERDVD\POWERDVD-HILFE.LNK> in der Hash-Zuordnung kann nicht aktualisiert werden.

Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)

Error: (01/03/2014 11:10:38 AM) (Source: Windows Search Service) (User: )
Description: Eintrag <C:\USERS\HIGHEND-OUTLETS\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\CYBERLINK POWERDVD\CYBERLINK POWERDVD.LNK> in der Hash-Zuordnung kann nicht aktualisiert werden.

Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)


System errors:
=============
Error: (01/03/2014 11:07:18 AM) (Source: Service Control Manager) (User: )
Description: ssmdrv

Error: (01/03/2014 11:07:03 AM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}NT-AUTORITÄTLOKALER DIENSTS-1-5-19LocalHost (unter Verwendung von LRPC)

Error: (01/03/2014 11:06:54 AM) (Source: Service Control Manager) (User: )
Description: avgntflt%%31

Error: (01/03/2014 11:06:39 AM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)

Error: (01/03/2014 11:05:37 AM) (Source: HTTP) (User: )
Description: \Device\Http\ReqQueueKerberos

Error: (01/03/2014 11:05:25 AM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am 03.01.2014 um 11:04:07 unerwartet heruntergefahren.

Error: (01/03/2014 10:00:23 AM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}NT-AUTORITÄTLOKALER DIENSTS-1-5-19LocalHost (unter Verwendung von LRPC)

Error: (01/03/2014 10:00:10 AM) (Source: Service Control Manager) (User: )
Description: ssmdrv

Error: (01/03/2014 09:59:53 AM) (Source: Service Control Manager) (User: )
Description: avgntflt%%31

Error: (01/03/2014 09:59:33 AM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)


Microsoft Office Sessions:
=========================
Error: (01/21/2013 08:37:04 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 156 seconds with 120 seconds of active time.  This session ended with a crash.

Error: (12/06/2012 09:28:27 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 12 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (10/26/2012 03:59:23 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6661.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 20 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (08/19/2012 09:57:53 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6661.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 218 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (08/18/2012 02:41:14 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6661.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 3 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (08/10/2012 10:42:21 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6661.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 7 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (08/06/2012 02:35:26 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6661.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 9 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (08/04/2012 02:38:04 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6661.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 4 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (08/02/2012 08:49:26 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6661.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 18 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (08/01/2012 07:40:24 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6661.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 265 seconds with 120 seconds of active time.  This session ended with a crash.


CodeIntegrity Errors:
===================================
  Date: 2014-01-03 09:52:07.135
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-01-03 09:52:06.928
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-01-03 09:52:06.744
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-01-03 09:52:06.568
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-01-03 09:52:06.383
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-01-03 09:52:06.188
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-01-03 09:52:06.013
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-01-03 09:52:05.808
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-01-03 09:51:50.745
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-01-03 09:51:50.534
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Percentage of memory in use: 54%
Total physical RAM: 3002.86 MB
Available physical RAM: 1380.9 MB
Total Pagefile: 6212.75 MB
Available Pagefile: 4078.36 MB
Total Virtual: 2047.88 MB
Available Virtual: 1903.71 MB

==================== Drives ================================

Drive c: (ACER) (Fixed) (Total:223.12 GB) (Free:90.62 GB) NTFS ==>[Drive with boot components (obtained from BCD)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 233 GB) (Disk ID: BE0AF550)
Partition 1: (Not Active) - (Size=10 GB) - (Type=27)
Partition 2: (Active) - (Size=223 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         
Avira:
Code:
ATTFilter
Exportierte Ereignisse:

03.01.2014 09:50 [System-Scanner] Malware gefunden
      Die Datei 
      'C:\Windows\Installer\{8CDD9792-6D88-7828-3896-30F91874EE00}\syshost.exe'
      enthielt einen Virus oder unerwünschtes Programm 'TR/NecursX.A.17' [trojan].
      Durchgeführte Aktion(en):
      Die Datei konnte nicht geöffnet werden!
      Es wird versucht die Datei mit Hilfe des Snapshot Treibers zu durchsuchen.
      Für die abschliessende Reparatur wird ein Neustart des Computers eingeleitet.
      Beim Versuch eine Sicherungskopie der Datei anzulegen ist ein Fehler 
      aufgetreten und die Datei wurde nicht gelöscht. Fehlernummer: 26004.
      Die Quelldatei konnte nicht gefunden werden.
      Es wird versucht die Aktion mit Hilfe der ARK Library durchzuführen.
      Die Datei konnte nicht ins Quarantäneverzeichnis verschoben werden!
      Die Datei konnte nicht gelöscht werden!
      Für die abschliessende Reparatur wird ein Neustart des Computers eingeleitet.

03.01.2014 09:45 [Echtzeit-Scanner] Malware gefunden
      In der Datei 
      'C:\Windows\Installer\{8CDD9792-6D88-7828-3896-30F91874EE00}\syshost.exe'
      wurde ein Virus oder unerwünschtes Programm 'TR/NecursX.A.17' [trojan] gefunden.
      Ausgeführte Aktion: Zugriff verweigern

03.01.2014 09:43 [System-Scanner] Malware gefunden
      Die Datei 'C:\Users\highend-outlets\AppData\Roaming\Microsoft\Windows\Start 
      Menu\Programs\Startup\HpM3Util.exe'
      enthielt einen Virus oder unerwünschtes Programm 'TR/Crypt.Xpack.39878' 
      [trojan].
      Durchgeführte Aktion(en):
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5af3e7d3.qua' 
      verschoben!

03.01.2014 09:36 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Users\highend-outlets\AppData\Roaming\Microsoft\Windows\Start 
      Menu\Programs\Startup\HpM3Util.exe'
      wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.Xpack.39878' [trojan] 
      gefunden.
      Ausgeführte Aktion: Zugriff verweigern

03.01.2014 09:04 [System-Scanner] Malware gefunden
      Die Datei 
      'C:\Windows\Installer\{8CDD9792-6D88-7828-3896-30F91874EE00}\syshost.exe'
      enthielt einen Virus oder unerwünschtes Programm 'TR/NecursX.A.17' [trojan].
      Durchgeführte Aktion(en):
      Beim Versuch eine Sicherungskopie der Datei anzulegen ist ein Fehler 
      aufgetreten und die Datei wurde nicht gelöscht. Fehlernummer: 26003.
      Die Datei konnte nicht gelöscht werden!
      Es wird versucht die Aktion mit Hilfe der ARK Library durchzuführen.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4308ea67.qua' 
      verschoben!

03.01.2014 09:04 [System-Scanner] Malware gefunden
      Die Datei 
      'C:\Windows\Installer\{8CDD9792-6D88-7828-3896-30F91874EE00}\syshost.exe'
      enthielt einen Virus oder unerwünschtes Programm 'TR/NecursX.A.17' [trojan].
      Durchgeführte Aktion(en):
      Beim Versuch eine Sicherungskopie der Datei anzulegen ist ein Fehler 
      aufgetreten und die Datei wurde nicht gelöscht. Fehlernummer: 26003.
      Die Datei konnte nicht gelöscht werden!
      Die Datei wurde zum Löschen nach einem Neustart markiert.
      Für die abschliessende Reparatur wird ein Neustart des Computers eingeleitet.

03.01.2014 07:54 [Updater] Update nicht ausgeführt
      Das Update von Computer HIGHEND-OUTL-PC (127.0.0.1) von 
      "hxxp://prempeak.avira-update.com/update" ist fehlgeschlagen.
      Während des Herunterladens ist ein Fehler aufgetreten.
      Es wurden keine neuen Dateien geladen.

03.01.2014 05:54 [Updater] Update nicht ausgeführt
      Das Update von Computer HIGHEND-OUTL-PC (127.0.0.1) von 
      "hxxp://prempeak.avira-update.com/update" ist fehlgeschlagen.
      Während des Herunterladens ist ein Fehler aufgetreten.
      Es wurden keine neuen Dateien geladen.

03.01.2014 03:54 [Updater] Update nicht ausgeführt
      Das Update von Computer HIGHEND-OUTL-PC (127.0.0.1) von 
      "hxxp://prempeak.avira-update.com/update" ist fehlgeschlagen.
      Während des Herunterladens ist ein Fehler aufgetreten.
      Es wurden keine neuen Dateien geladen.

03.01.2014 01:54 [Updater] Update nicht ausgeführt
      Das Update von Computer HIGHEND-OUTL-PC (127.0.0.1) von 
      "hxxp://prempeak.avira-update.com/update" ist fehlgeschlagen.
      Während des Herunterladens ist ein Fehler aufgetreten.
      Es wurden keine neuen Dateien geladen.

02.01.2014 23:45 [System-Scanner] Malware gefunden
      Die Datei 
      'C:\Windows\Installer\{8CDD9792-6D88-7828-3896-30F91874EE00}\syshost.exe'
      enthielt einen Virus oder unerwünschtes Programm 'TR/NecursX.A.17' [trojan].
      Durchgeführte Aktion(en):
      Beim Versuch eine Sicherungskopie der Datei anzulegen ist ein Fehler 
      aufgetreten und die Datei wurde nicht gelöscht. Fehlernummer: 26003.
      Die Datei konnte nicht gelöscht werden!
      Die Datei wurde zum Löschen nach einem Neustart markiert.
      Für die abschliessende Reparatur wird ein Neustart des Computers eingeleitet.

02.01.2014 23:45 [System-Scanner] Malware gefunden
      Die Datei 'C:\Users\highend-outlets\AppData\Local\Temp\98D7.tmp'
      enthielt einen Virus oder unerwünschtes Programm 'TR/Dropper.VB.8966' [trojan].
      Durchgeführte Aktion(en):
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4e456f16.qua' 
      verschoben!

02.01.2014 13:30 [Updater] Update nicht ausgeführt
      Das Update von Computer HIGHEND-OUTL-PC (127.0.0.1) von 
      "hxxp://prempeak.avira-update.com/update" ist fehlgeschlagen.
      Während des Herunterladens ist ein Fehler aufgetreten.
      Es wurden keine neuen Dateien geladen.

02.01.2014 12:33 [System-Scanner] Malware gefunden
      Die Datei 
      'c:\windows\installer\{8cdd9792-6d88-7828-3896-30f91874ee00}\syshost.exe'
      enthielt einen Virus oder unerwünschtes Programm 'TR/NecursX.A.17' [trojan].
      Durchgeführte Aktion(en):

02.01.2014 12:24 [System-Scanner] Malware gefunden
      Die Datei 
      'C:\Windows\Installer\{8CDD9792-6D88-7828-3896-30F91874EE00}\syshost.exe'
      enthielt einen Virus oder unerwünschtes Programm 'TR/NecursX.A.17' [trojan].
      Durchgeführte Aktion(en):
      Die Datei konnte nicht geöffnet werden!
      Es wird versucht die Datei mit Hilfe des Snapshot Treibers zu durchsuchen.
      Für die abschliessende Reparatur wird ein Neustart des Computers eingeleitet.
      Beim Versuch eine Sicherungskopie der Datei anzulegen ist ein Fehler 
      aufgetreten und die Datei wurde nicht gelöscht. Fehlernummer: 26004.
      Die Quelldatei konnte nicht gefunden werden.
      Es wird versucht die Aktion mit Hilfe der ARK Library durchzuführen.
      Eine Instanz der ARK Library läuft bereits.
      Für die abschliessende Reparatur wird ein Neustart des Computers eingeleitet.

02.01.2014 12:21 [Echtzeit-Scanner] Malware gefunden
      In der Datei 
      'C:\Windows\Installer\{8CDD9792-6D88-7828-3896-30F91874EE00}\syshost.exe'
      wurde ein Virus oder unerwünschtes Programm 'TR/NecursX.A.17' [trojan] gefunden.
      Ausgeführte Aktion: Zugriff verweigern

02.01.2014 12:10 [System-Scanner] Malware gefunden
      Die Datei 'C:\Users\highend-outlets\AppData\Local\Temp\qrmwyglg.exe'
      enthielt einen Virus oder unerwünschtes Programm 'TR/Dropper.VB.8966' [trojan].
      Durchgeführte Aktion(en):
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5b80d8da.qua' 
      verschoben!

02.01.2014 12:07 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Users\highend-outlets\AppData\Local\Temp\qrmwyglg.exe'
      wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.VB.8966' [trojan] 
      gefunden.
      Ausgeführte Aktion: Zugriff verweigern

02.01.2014 12:05 [System-Scanner] Malware gefunden
      Die Datei 'C:\Users\highend-outlets\AppData\Roaming\Microsoft\Windows\Start 
      Menu\Programs\Startup\HpM3Util.exe'
      enthielt einen Virus oder unerwünschtes Programm 'TR/Crypt.Xpack.39878' 
      [trojan].
      Durchgeführte Aktion(en):
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5b6bd8eb.qua' 
      verschoben!

02.01.2014 11:51 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Users\highend-outlets\AppData\Roaming\Microsoft\Windows\Start 
      Menu\Programs\Startup\HpM3Util.exe'
      wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.Xpack.39878' [trojan] 
      gefunden.
      Ausgeführte Aktion: Zugriff verweigern

02.01.2014 11:41 [System-Scanner] Malware gefunden
      Die Datei 'C:\Users\highend-outlets\AppData\Roaming\verison.dll'
      enthielt einen Virus oder unerwünschtes Programm 'TR/Crypt.Xpack.39878' 
      [trojan].
      Durchgeführte Aktion(en):
      Beim Versuch eine Sicherungskopie der Datei anzulegen ist ein Fehler 
      aufgetreten und die Datei wurde nicht gelöscht. Fehlernummer: 26003.
      Die Datei konnte nicht gelöscht werden!
      Es wird versucht die Aktion mit Hilfe der ARK Library durchzuführen.
      Eine Instanz der ARK Library läuft bereits.
      Die Datei wurde zum Löschen nach einem Neustart markiert.
      Für die abschliessende Reparatur wird ein Neustart des Computers eingeleitet.

02.01.2014 11:41 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Users\highend-outlets\AppData\Roaming\verison.dll'
      wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.Xpack.39878' [trojan] 
      gefunden.
      Ausgeführte Aktion: Zugriff verweigern

02.01.2014 11:41 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Users\highend-outlets\AppData\Roaming\verison.dll'
      wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.Xpack.39878' [trojan] 
      gefunden.
      Ausgeführte Aktion: Zugriff verweigern

02.01.2014 11:40 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Users\highend-outlets\AppData\Roaming\verison.dll'
      wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.Xpack.39878' [trojan] 
      gefunden.
      Ausgeführte Aktion: Zugriff verweigern

02.01.2014 11:39 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Users\highend-outlets\AppData\Roaming\verison.dll'
      wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.Xpack.39878' [trojan] 
      gefunden.
      Ausgeführte Aktion: Zugriff verweigern

02.01.2014 11:39 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Users\highend-outlets\AppData\Roaming\verison.dll'
      wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.Xpack.39878' [trojan] 
      gefunden.
      Ausgeführte Aktion: Zugriff verweigern

02.01.2014 10:28 [Browser-Schutz] Webseite Blockiert
      Die URL (hxxp://recipecorner.com/themes/recipecorner_v2/js/curvycorners.js) 
      wurde als Malware ermittelt. Sie wurde blockiert.

02.01.2014 10:26 [Browser-Schutz] Webseite Blockiert
      Die URL (hxxp://recipecorner.com/themes/recipecorner_v2/js/curvycorners.js) 
      wurde als Malware ermittelt. Sie wurde blockiert.

02.01.2014 10:25 [Browser-Schutz] Webseite Blockiert
      Die URL (hxxp://recipecorner.com/themes/recipecorner_v2/js/curvycorners.js) 
      wurde als Malware ermittelt. Sie wurde blockiert.

02.01.2014 10:23 [Browser-Schutz] Webseite Blockiert
      Die URL (hxxp://recipecorner.com/themes/recipecorner_v2/js/curvycorners.js) 
      wurde als Malware ermittelt. Sie wurde blockiert.

02.01.2014 10:21 [Browser-Schutz] Webseite Blockiert
      Die URL (hxxp://recipecorner.com/themes/recipecorner_v2/js/curvycorners.js) 
      wurde als Malware ermittelt. Sie wurde blockiert.

02.01.2014 10:17 [Browser-Schutz] Webseite Blockiert
      Die URL (hxxp://recipecorner.com/themes/recipecorner_v2/js/curvycorners.js) 
      wurde als Malware ermittelt. Sie wurde blockiert.

02.01.2014 09:30 [Updater] Update nicht ausgeführt
      Das Update von Computer HIGHEND-OUTL-PC (127.0.0.1) von 
      "hxxp://prempeak.avira-update.com/update" ist fehlgeschlagen.
      Während des Herunterladens ist ein Fehler aufgetreten.
      Es wurden keine neuen Dateien geladen.

02.01.2014 07:30 [Updater] Update nicht ausgeführt
      Das Update von Computer HIGHEND-OUTL-PC (127.0.0.1) von 
      "hxxp://prempeak.avira-update.com/update" ist fehlgeschlagen.
      Während des Herunterladens ist ein Fehler aufgetreten.
      Es wurden keine neuen Dateien geladen.

02.01.2014 05:30 [Updater] Update nicht ausgeführt
      Das Update von Computer HIGHEND-OUTL-PC (127.0.0.1) von 
      "hxxp://prempeak.avira-update.com/update" ist fehlgeschlagen.
      Während des Herunterladens ist ein Fehler aufgetreten.
      Es wurden keine neuen Dateien geladen.

02.01.2014 03:30 [Updater] Update nicht ausgeführt
      Das Update von Computer HIGHEND-OUTL-PC (127.0.0.1) von 
      "hxxp://prempeak.avira-update.com/update" ist fehlgeschlagen.
      Während des Herunterladens ist ein Fehler aufgetreten.
      Es wurden keine neuen Dateien geladen.

02.01.2014 01:30 [Updater] Update nicht ausgeführt
      Das Update von Computer HIGHEND-OUTL-PC (127.0.0.1) von 
      "hxxp://prempeak.avira-update.com/update" ist fehlgeschlagen.
      Während des Herunterladens ist ein Fehler aufgetreten.
      Es wurden keine neuen Dateien geladen.

01.01.2014 20:56 [Browser-Schutz] Webseite Blockiert
      Die URL (hxxp://recipecorner.com/themes/recipecorner_v2/js/curvycorners.js) 
      wurde als Malware ermittelt. Sie wurde blockiert.

01.01.2014 20:54 [Browser-Schutz] Webseite Blockiert
      Die URL (hxxp://recipecorner.com/themes/recipecorner_v2/js/curvycorners.js) 
      wurde als Malware ermittelt. Sie wurde blockiert.

01.01.2014 20:53 [Browser-Schutz] Webseite Blockiert
      Die URL (hxxp://recipecorner.com/themes/recipecorner_v2/js/curvycorners.js) 
      wurde als Malware ermittelt. Sie wurde blockiert.

01.01.2014 20:49 [Browser-Schutz] Webseite Blockiert
      Die URL (hxxp://recipecorner.com/themes/recipecorner_v2/js/curvycorners.js) 
      wurde als Malware ermittelt. Sie wurde blockiert.

27.12.2013 11:00 [Updater] Update nicht ausgeführt
      Das Update von Computer HIGHEND-OUTL-PC (127.0.0.1) von 
      "hxxp://prempeak.avira-update.com/update" ist fehlgeschlagen.
      Während des Herunterladens ist ein Fehler aufgetreten.
      Es wurden keine neuen Dateien geladen.

22.12.2013 12:37 [Updater] Update nicht ausgeführt
      Das Update von Computer HIGHEND-OUTL-PC (127.0.0.1) von 
      "hxxp://prempeak.avira-update.com/update" ist fehlgeschlagen.
      Während des Herunterladens ist ein Fehler aufgetreten.
      Es wurden keine neuen Dateien geladen.

20.12.2013 14:10 [Updater] Update nicht ausgeführt
      Das Update von Computer HIGHEND-OUTL-PC (169.254.159.197) von 
      "hxxp://prempeak.avira-update.com/update" ist fehlgeschlagen.
      Während des Herunterladens ist ein Fehler aufgetreten.
      Es wurden keine neuen Dateien geladen.

17.12.2013 19:18 [System-Scanner] Malware gefunden
      Die Datei 'C:\Users\highend-outlets\Downloads\32bit_Win7_Win8_Win81_R273 - 
      CHIP-Downloader.exe'
      enthielt einen Virus oder unerwünschtes Programm 'APPL/Downloader.Gen (Cloud)' 
      [program].
      Durchgeführte Aktion(en):
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '553633b9.qua' 
      verschoben!

17.12.2013 19:16 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Users\highend-outlets\Downloads\32bit_Win7_Win8_Win81_R273 - 
      CHIP-Downloader.exe'
      wurde ein Virus oder unerwünschtes Programm 'APPL/Downloader.Gen (Cloud)' 
      [APPL/Downloader.Gen] gefunden.
      Ausgeführte Aktion: Zugriff verweigern

17.12.2013 19:16 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Users\highend-outlets\Downloads\32bit_Win7_Win8_Win81_R273 - 
      CHIP-Downloader.exe'
      wurde ein Virus oder unerwünschtes Programm 'APPL/Downloader.Gen (Cloud)' 
      [APPL/Downloader.Gen] gefunden.
      Ausgeführte Aktion: Zugriff verweigern

14.12.2013 09:31 [Updater] Update nicht ausgeführt
      Das Update von Computer HIGHEND-OUTL-PC (169.254.159.197) von 
      "hxxp://prempeak.avira-update.com/update" ist fehlgeschlagen.
      Während des Herunterladens ist ein Fehler aufgetreten.
      Es wurden keine neuen Dateien geladen.

06.12.2013 15:27 [Updater] Update nicht ausgeführt
      Das Update von Computer HIGHEND-OUTL-PC (127.0.0.1) von 
      "hxxp://prempeak.avira-update.com/update" ist fehlgeschlagen.
      Während des Herunterladens ist ein Fehler aufgetreten.
      Es wurden keine neuen Dateien geladen.

06.12.2013 13:12 [Updater] Update nicht ausgeführt
      Das Update von Computer HIGHEND-OUTL-PC (127.0.0.1) von 
      "hxxp://prempeak.avira-update.com/update" ist fehlgeschlagen.
      Während des Herunterladens ist ein Fehler aufgetreten.
      Es wurden keine neuen Dateien geladen.

06.12.2013 08:41 [Updater] Update nicht ausgeführt
      Das Update von Computer HIGHEND-OUTL-PC (127.0.0.1) von 
      "hxxp://prempeak.avira-update.com/update" ist fehlgeschlagen.
      Während des Herunterladens ist ein Fehler aufgetreten.
      Es wurden keine neuen Dateien geladen.
         
GMER:
Code:
ATTFilter
GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit quick scan 2014-01-03 14:12:17
Windows 6.0.6001 Service Pack 1 
Running: gmer_2.1.19163.exe


---- Services - GMER 2.1 ----

Service  C:\SystemRoot\System32\Drivers\ec55e6b546b6bca3.sys (*** hidden *** )  [BOOT] ec55e6b546b6bca3   <-- ROOTKIT !!!

---- EOF - GMER 2.1 ----
         
Der Bump ist jetzt ausversehen finde die Editir funktio nicht ...
Hier noch ein MBAM log, falls das mehr klarheit bringt:
Code:
ATTFilter
 Malwarebytes Anti-Malware  (Test) 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2014.01.03.04

Windows Vista Service Pack 1 x86 NTFS
Internet Explorer 8.0.6001.19088
highend-outlets :: HIGHEND-OUTL-PC [Administrator]

Schutz: Deaktiviert

03.01.2014 18:03:51
MBAM-log-2014-01-03 (20-34-29).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 531297
Laufzeit: 2 Stunde(n), 30 Minute(n), 11 Sekunde(n)

Infizierte Speicherprozesse: 2
C:\ProgramData\IBUpdaterService\ibsvc.exe (Adware.InstallBrain) -> 2432 -> Keine Aktion durchgeführt.
c:\windows\installer\{8cdd9792-6d88-7828-3896-30f91874ee00}\syshost.exe (Trojan.Agent) -> 3480 -> Keine Aktion durchgeführt.

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 5
HKLM\SYSTEM\CurrentControlSet\Services\IBUpdaterService (Adware.InstallBrain) -> Keine Aktion durchgeführt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Updater Service (Adware.InstallBrain) -> Keine Aktion durchgeführt.
HKCU\Software\InstallCore\1I1T1Q1S (PUP.Optional.InstallCore.A) -> Keine Aktion durchgeführt.
HKCU\SOFTWARE\INSTALLCORE (PUP.Optional.InstallCore.A) -> Keine Aktion durchgeführt.
HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SYSHOST32 (Trojan.Agent) -> Keine Aktion durchgeführt.

Infizierte Registrierungswerte: 2
HKCU\Software\InstallCore|tb (PUP.Optional.InstallCore.A) -> Daten: 0C2Z1N1R0Q1D1J1C0Q1B -> Keine Aktion durchgeführt.
HKLM\SYSTEM\CurrentControlSet\Services\syshost32|ImagePath (Trojan.Agent) -> Daten: "C:\Windows\Installer\{8CDD9792-6D88-7828-3896-30F91874EE00}\syshost.exe" /service -> Keine Aktion durchgeführt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 1
C:\ProgramData\IBUpdaterService (Adware.InstallBrain) -> Keine Aktion durchgeführt.

Infizierte Dateien: 20
C:\Users\highend-outlets\AppData\Local\Temp\qrmwyglg.exe (Trojan.Dorkbot.ED) -> Keine Aktion durchgeführt.
C:\Users\highend-outlets\AppData\Roaming\verison.dll (Malware.Packer.UKN) -> Keine Aktion durchgeführt.
C:\Users\highend-outlets\Downloads\Razer_Game_Booster_downloader.exe (PUP.Optional.FreeNew.A) -> Keine Aktion durchgeführt.
c:\users\highend-outlets\appdata\local\temp\syshost.exe (Exploit.Drop.GS) -> Keine Aktion durchgeführt.
c:\windows\serviceprofiles\localservice\appdata\local\temp\syshost.exe (Exploit.Drop.GS) -> Keine Aktion durchgeführt.
c:\windows\serviceprofiles\networkservice\appdata\local\temp\syshost.exe (Exploit.Drop.GS) -> Keine Aktion durchgeführt.
c:\windows\temp\syshost.exe (Exploit.Drop.GS) -> Keine Aktion durchgeführt.
c:\users\highend-outlets\appdata\local\syshost.exe (Exploit.Drop.GSLAD) -> Keine Aktion durchgeführt.
c:\windows\serviceprofiles\localservice\appdata\local\syshost.exe (Exploit.Drop.GSLAD) -> Keine Aktion durchgeführt.
c:\windows\serviceprofiles\networkservice\appdata\local\syshost.exe (Exploit.Drop.GSLAD) -> Keine Aktion durchgeführt.
c:\windows\system32\config\systemprofile\appdata\local\syshost.exe (Exploit.Drop.GSLAD) -> Keine Aktion durchgeführt.
c:\users\highend-outlets\syshost.exe (Exploit.Drop.GS) -> Keine Aktion durchgeführt.
c:\users\public\syshost.exe (Exploit.Drop.GS) -> Keine Aktion durchgeführt.
c:\windows\serviceprofiles\localservice\syshost.exe (Exploit.Drop.GS) -> Keine Aktion durchgeführt.
c:\windows\serviceprofiles\networkservice\syshost.exe (Exploit.Drop.GS) -> Keine Aktion durchgeführt.
c:\windows\system32\config\systemprofile\syshost.exe (Exploit.Drop.GS) -> Keine Aktion durchgeführt.
c:\windows\syshost.exe (Trojan.Downloader) -> Keine Aktion durchgeführt.
C:\ProgramData\IBUpdaterService\ibsvc.exe (Adware.InstallBrain) -> Keine Aktion durchgeführt.
C:\ProgramData\IBUpdaterService\repository.xml (Adware.InstallBrain) -> Keine Aktion durchgeführt.
c:\windows\installer\{8cdd9792-6d88-7828-3896-30f91874ee00}\syshost.exe (Trojan.Agent) -> Keine Aktion durchgeführt.

(Ende)
         
__________________

Alt 04.01.2014, 15:45   #4
schrauber
/// the machine
/// TB-Ausbilder
 

Vista: schwerwiegender Trojanerbefall von Necrus!A und ähnlichem - Standard

Vista: schwerwiegender Trojanerbefall von Necrus!A und ähnlichem



Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!
Downloade dir bitte Combofix vom folgenden Downloadspiegel

Link 1


WICHTIG - Speichere Combofix auf deinem Desktop
  • Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.
Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.


Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 04.01.2014, 18:51   #5
Singed
 
Vista: schwerwiegender Trojanerbefall von Necrus!A und ähnlichem - Standard

Vista: schwerwiegender Trojanerbefall von Necrus!A und ähnlichem



Bittesehr ...

Code:
ATTFilter
ComboFix 14-01-04.03 - highend-outlets 04.01.2014  18:25:10.1.1 - x86
Microsoft® Windows Vista™ Home Premium   6.0.6001.1.1252.49.1031.18.3003.1847 [GMT 1:00]
ausgeführt von:: c:\users\Public\Roaming\Intel\Wireless\sessions\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\Roaming
c:\users\highend-outlets\AppData\Local\lame_enc.dll
c:\users\highend-outlets\AppData\Local\no23xwrapper.dll
c:\users\highend-outlets\AppData\Local\ogg.dll
c:\users\highend-outlets\AppData\Local\vorbis.dll
c:\users\highend-outlets\AppData\Local\vorbisenc.dll
c:\users\highend-outlets\AppData\Local\vorbisfile.dll
c:\users\highend-outlets\AppData\Roaming\.#
c:\users\highend-outlets\AppData\Roaming\verison.dll
c:\windows\IsUn0407.exe
c:\windows\system32\drivers\ec55e6b546b6bca3.sys . . . . Nicht in der Lage zu löschen
.
Infizierte Kopie von c:\windows\system32\drivers\ntfs.sys wurde gefunden und desinfiziert 
Kopie von - c:\windows\winsxs\x86_microsoft-windows-ntfs_31bf3856ad364e35_6.0.6001.18000_none_a67129bd1ceb9993\ntfs.sys wurde wiederhergestellt
Infizierte Kopie von c:\windows\system32\drivers\AGP440.sys wurde gefunden und desinfiziert 
Kopie von - c:\windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys wurde wiederhergestellt
Infizierte Kopie von c:\windows\system32\drivers\asyncmac.sys wurde gefunden und desinfiziert 
Kopie von - c:\windows\winsxs\x86_microsoft-windows-rasbase-asyncmac_31bf3856ad364e35_6.0.6001.18000_none_2457cee334d93e6f\asyncmac.sys wurde wiederhergestellt
Infizierte Kopie von c:\windows\system32\drivers\cdrom.sys wurde gefunden und desinfiziert 
Kopie von - c:\windows\System32\DriverStore\FileRepository\cdrom.inf_a29e71c6\cdrom.sys wurde wiederhergestellt
.
(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_syshost32
-------\Legacy_ec55e6b546b6bca3
-------\Service_ec55e6b546b6bca3
.
.
(((((((((((((((((((((((   Dateien erstellt von 2013-12-04 bis 2014-01-04  ))))))))))))))))))))))))))))))
.
.
2014-01-04 17:37 . 2014-01-04 17:37	--------	d-----w-	c:\users\Default\AppData\Local\temp
2014-01-03 17:01 . 2014-01-03 17:01	--------	d-----w-	c:\users\highend-outlets\AppData\Roaming\Malwarebytes
2014-01-03 17:01 . 2014-01-03 17:01	--------	d-----w-	c:\programdata\Malwarebytes
2014-01-03 17:01 . 2014-01-03 17:01	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2014-01-03 17:01 . 2013-04-04 13:50	22856	----a-w-	c:\windows\system32\drivers\mbam.sys
2014-01-03 10:19 . 2014-01-03 10:19	--------	d-----w-	C:\FRST
2014-01-01 18:51 . 2014-01-03 17:31	--------	d-----w-	c:\users\highend-outlets\AppData\Local\ATworks
2014-01-01 01:14 . 2014-01-01 22:31	62576	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{7174A49D-C7F8-4593-B64E-EA7BA7D093E6}\offreg.dll
2014-01-01 01:03 . 2013-12-04 02:57	7760024	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{7174A49D-C7F8-4593-B64E-EA7BA7D093E6}\mpengine.dll
2013-12-31 19:20 . 2014-01-03 17:28	--------	d-----w-	C:\SIERRA
2013-12-31 19:20 . 2013-12-31 19:21	--------	d-----w-	c:\program files\Sierra OnLine
2013-12-30 12:29 . 2014-01-04 13:39	--------	d-----w-	c:\program files\Tales of Pirates II
2013-12-10 19:54 . 2013-12-29 12:23	--------	d-----w-	c:\users\highend-outlets\Programme
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-12-18 09:01 . 2012-12-09 11:17	90400	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2013-12-18 09:01 . 2012-12-09 11:17	135648	----a-w-	c:\windows\system32\drivers\avipbb.sys
2013-12-11 17:59 . 2012-04-13 09:51	692616	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2013-12-11 17:59 . 2011-05-26 13:26	71048	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2013-11-25 13:29 . 2012-12-09 11:17	37352	----a-w-	c:\windows\system32\drivers\avkmgr.sys
2013-11-19 02:33 . 2009-12-12 08:15	230048	------w-	c:\windows\system32\MpSigStub.exe
2013-10-08 05:50 . 2013-10-22 16:32	94632	----a-w-	c:\windows\system32\WindowsAccessBridge.dll
2013-07-19 18:50 . 2013-07-19 18:41	671261856	----a-w-	c:\program files\S4_League.exe
2013-05-25 14:53 . 2013-05-25 14:51	529007518	----a-w-	c:\program files\top2_setup_1.0.63.exe
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{DB616CFF-D989-48A8-9C85-E2A8D56AB2CA}]
2011-11-22 08:59	269824	----a-w-	c:\users\highend-outlets\AppData\LocalLow\StumbleUpon\IE\StumbleUpon.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}]
2013-01-28 14:49	281760	----a-w-	c:\program files\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2009-05-14 21:02	120104	----a-w-	c:\program files\EgisTec\MyWinLocker 3\x86\PSDProtect.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2012-08-23 39408]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2013-11-14 20584608]
"Spotify Web Helper"="c:\users\highend-outlets\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2013-12-03 1168896]
"ATworks"="c:\users\highend-outlets\AppData\Local\ATworks\CompatObjclass16.dll" [2014-01-01 25600]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-02-12 186904]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-04-11 7399968]
"Skytel"="c:\program files\Realtek\Audio\HDA\Skytel.exe" [2009-04-11 1833504]
"PLFSetI"="c:\windows\PLFSetI.exe" [2008-07-29 200704]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-02-06 1430824]
"LManager"="c:\program files\Launch Manager\LManager.exe" [2009-04-09 1071624]
"BackupManagerTray"="c:\program files\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" [2009-05-26 253696]
"LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2009-03-30 62760]
"Acer ePower Management"="c:\program files\Acer\Acer PowerSmart Manager\ePowerTrayLauncher.exe" [2009-05-15 440864]
"ODDPwr"="c:\program files\Acer\Optical Drive Power Management\ODDPwr.exe" [2009-04-29 176128]
"EgisTecLiveUpdate"="c:\program files\EgisTec Egis Software Update\EgisUpdate.exe" [2009-05-13 199464]
"mwlDaemon"="c:\program files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe" [2009-05-14 345384]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"FUFAXSTM"="c:\program files\Epson Software\FAX Utility\FUFAXSTM.exe" [2009-12-02 847872]
"EEventManager"="c:\program files\Epson Software\Event Manager\EEventManager.exe" [2009-12-03 976320]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-08-25 136216]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-08-25 171032]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-08-25 170520]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
"Eraser"="c:\progra~1\Eraser\Eraser.exe" [2012-05-22 980920]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2013-12-18 684600]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
.
c:\users\highend-outlets\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Acer VCM.lnk - c:\program files\Acer\Acer VCM\AcerVCM.exe [2009-7-15 565248]
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\3.8.130\SSScheduler.exe [2013-9-6 273296]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer2"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKLM\~\startupfolder\C:^Users^highend-outlets^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.4.1.lnk]
path=c:\users\highend-outlets\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
backup=c:\windows\pss\OpenOffice.org 3.4.1.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMServer]
c:\program files\Common Files\Nokia\MPlatform\NokiaMServer [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Facebook Update]
2012-09-02 11:26	138096	----atw-	c:\users\highend-outlets\AppData\Local\Facebook\Update\FacebookUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2010-04-16 21:12	3872080	----a-w-	c:\program files\Windows Live\Messenger\msnmsgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMusic FastStart]
2009-11-06 14:00	2090272	----a-w-	c:\program files\Nokia\Ovi Player\NokiaOviPlayer.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaOviSuite2]
2011-05-02 10:25	724536	----a-w-	c:\program files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2013-11-14 15:42	20584608	----a-r-	c:\program files\Skype\Phone\Skype.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spotify]
2013-12-03 19:23	5951488	----a-w-	c:\users\highend-outlets\AppData\Roaming\Spotify\spotify.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spotify Web Helper]
2013-12-03 19:23	1168896	----a-w-	c:\users\highend-outlets\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"WindowsWelcomeCenter"=rundll32.exe oobefldr.dll,ShowWelcomeCenter
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - EC55E6B546B6BCA3
*Deregistered* - ec55e6b546b6bca3
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-12-05 21:21	1210320	----a-w-	c:\program files\Google\Chrome\Application\31.0.1650.63\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2014-01-04 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-13 17:59]
.
2013-12-31 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-76954294-2760295059-2378521770-1000Core.job
- c:\users\highend-outlets\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-09-02 11:26]
.
2014-01-04 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-76954294-2760295059-2378521770-1000UA.job
- c:\users\highend-outlets\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-09-02 11:26]
.
2014-01-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-06-17 19:24]
.
2014-01-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-06-17 19:24]
.
2014-01-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-76954294-2760295059-2378521770-1000Core.job
- c:\users\highend-outlets\AppData\Local\Google\Update\GoogleUpdate.exe [2011-05-06 16:05]
.
2011-05-06 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-76954294-2760295059-2378521770-1000UA.job
- c:\users\highend-outlets\AppData\Local\Google\Update\GoogleUpdate.exe [2011-05-06 16:05]
.
2012-05-14 c:\windows\Tasks\User_Feed_Synchronization-{96A8A4AD-CD8F-4D37-8F51-72C50F28B58B}.job
- c:\windows\system32\msfeedssync.exe [2011-06-15 04:32]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://search.b1.org/?bsrc=hmior&chid=c167991
mStart Page = hxxp://www.yahoo.com
uSearchURL,(Default) = hxxp://go.1und1.de/suchbox/1und1suche?su=%s
IE: Free YouTube Download - c:\program files\Common Files\DVDVideoSoft\plugins\freeytvdownloader.htm
IE: Free YouTube to MP3 Converter - c:\program files\Common Files\DVDVideoSoft\plugins\freeytmp3downloader.htm
IE: {{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - c:\program files\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll
LSP: c:\program files\Avira\AntiVir Desktop\avsda.dll
TCP: DhcpNameServer = 192.168.2.1
TCP: Interfaces\{1270B9F4-11CF-4ED7-8A0C-36D3CED1DD4C}: NameServer = 8.8.8.8,8.8.4.4
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
SafeBoot-WudfPf
SafeBoot-WudfRd
SafeBoot-mcmscsvc
SafeBoot-MCODS
.
.
.
**************************************************************************
Scanne versteckte Prozesse... 
.
Scanne versteckte Autostarteinträge... 
.
Scanne versteckte Dateien... 
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\serviceIEConfig]
"ImagePath"="c:\windows\System32\ieconfig_1und1_svc.exe /startedbyscm:016FE01B-40E31F2D-serviceIEConfig"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\ec55e6b546b6bca3]
"ImagePath"="\SystemRoot\System32\Drivers\ec55e6b546b6bca3.sys"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'Explorer.exe'(2328)
c:\program files\EgisTec\MyWinLocker 3\x86\psdprotect.dll
c:\program files\EgisTec\MyWinLocker 3\x86\sysenv.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\WUDFHost.exe
c:\windows\system32\WLANExt.exe
c:\program files\Avira\AntiVir Desktop\sched.exe
c:\program files\Common Files\EPSON\EBAPI\eEBSVC.exe
c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Launch Manager\dsiwmis.exe
c:\program files\Acer\Acer PowerSmart Manager\ePowerSvc.exe
c:\program files\EPSON\EpsonCustomerResearchParticipation\EPCP.exe
c:\program files\Common Files\EPSON\EPW!3 SSRP\E_S50ST7.EXE
c:\program files\Common Files\EPSON\EPW!3 SSRP\E_S50RP7.EXE
c:\program files\Intel\WiFi\bin\EvtEng.exe
c:\programdata\IBUpdaterService\ibsvc.exe
c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe
c:\program files\EgisTec\MyWinLocker 3\x86\MWLService.exe
c:\program files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
c:\program files\Acer\Optical Drive Power Management\ODDPWRSvc.exe
c:\program files\Common Files\Intel\WirelessCommon\RegSrvc.exe
c:\program files\Acer\Acer VCM\RS_Service.exe
c:\windows\System32\ieconfig_1und1_svc.exe
c:\users\highend-outlets\AppData\LocalLow\StumbleUpon\IE\StumbleUponUpdater.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\windows\system32\conime.exe
c:\windows\system32\wbem\unsecapp.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2014-01-04  18:48:12 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2014-01-04 17:48
.
Vor Suchlauf: 19 Verzeichnis(se), 98.070.712.320 Bytes frei
Nach Suchlauf: 24 Verzeichnis(se), 98.558.181.376 Bytes frei
.
- - End Of File - - E97756BD4148DC46CE6C0A0E7F9AE3ED
BEEDF9B7F43A72A91456F7131AFC11B2
         


Alt 05.01.2014, 16:17   #6
schrauber
/// the machine
/// TB-Ausbilder
 

Vista: schwerwiegender Trojanerbefall von Necrus!A und ähnlichem - Standard

Vista: schwerwiegender Trojanerbefall von Necrus!A und ähnlichem



Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.


Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


und ein frisches FRST log bitte.
__________________
--> Vista: schwerwiegender Trojanerbefall von Necrus!A und ähnlichem

Alt 06.01.2014, 13:11   #7
Singed
 
Vista: schwerwiegender Trojanerbefall von Necrus!A und ähnlichem - Standard

Vista: schwerwiegender Trojanerbefall von Necrus!A und ähnlichem



Zwischenstand:
Avira funktioniert noch immer nicht vernünftig, stelle heute auf Avast um.
Windowsupdate lässt sich nicht aktivieren, nicht einmal manuell.
Noch immer Prozesse die nicht geöffnet werden sollen, die in meinem Task-Manager erscheinen.


Frisches FRST:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 02-01-2014 01
Ran by highend-outlets (administrator) on HIGHEND-OUTL-PC on 06-01-2014 12:44:17
Running from C:\Users\highend-outlets\Downloads
Microsoft® Windows Vista™ Home Premium  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EBAPI\eEBSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Dritek System Inc.) C:\Program Files\Launch Manager\dsiwmis.exe
(Acer Incorporated) C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe
(SEIKO EPSON CORPORATION) C:\Program Files\epson\EpsonCustomerResearchParticipation\EPCP.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50ST7.EXE
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RP7.EXE
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Egis Technology Inc.) C:\Program Files\EgisTec\MyWinLocker 3\x86\MWLService.exe
(NewTech Infosystems, Inc.) C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
(NewTech Infosystems, Inc.) C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
(Acer Incorporated) C:\Program Files\Acer\Optical Drive Power Management\ODDPWRSvc.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
() C:\Windows\PLFSetI.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Acer Incorporated) C:\Program Files\Acer\Acer VCM\RS_Service.exe
() C:\Windows\System32\ieconfig_1und1_svc.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Dritek System Inc.) C:\Program Files\Launch Manager\LManager.exe
(NewTech Infosystems, Inc.) C:\Program Files\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
(Acer Incorporated) C:\Program Files\Acer\Optical Drive Power Management\ODDPWR.exe
(Egis Technology Inc.) C:\Program Files\EgisTec Egis Software Update\EgisUpdate.exe
(Egis Technology Inc.) C:\Program Files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Epson Software\FAX Utility\FUFAXSTM.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Epson Software\Event Manager\EEventManager.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(The Eraser Project) C:\Program Files\Eraser\Eraser.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Spotify Ltd) C:\Users\highend-outlets\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Microsoft Corporation) C:\Windows\System32\regsvr32.exe
(Acer Incorporated) C:\Program Files\Acer\Acer VCM\AcerVCM.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.130\SSScheduler.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Acer Incorporated) C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTray.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Acer Incorporated) C:\Program Files\Acer\Acer PowerSmart Manager\ePowerEvent.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [IAAnotif] - C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe [186904 2009-02-12] (Intel Corporation)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [7399968 2009-04-11] (Realtek Semiconductor)
HKLM\...\Run: [Skytel] - C:\Program Files\Realtek\Audio\HDA\SkyTel.exe [1833504 2009-04-11] (Realtek Semiconductor Corp.)
HKLM\...\Run: [PLFSetI] - C:\Windows\PLFSetI.exe [200704 2008-07-29] ()
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1430824 2009-02-06] (Synaptics Incorporated)
HKLM\...\Run: [LManager] - C:\Program Files\Launch Manager\LManager.exe [1071624 2009-04-09] (Dritek System Inc.)
HKLM\...\Run: [BackupManagerTray] - C:\Program Files\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [253696 2009-05-26] (NewTech Infosystems, Inc.)
HKLM\...\Run: [LanguageShortcut] - C:\Program Files\CyberLink\PowerDVD\Language\Language.exe [62760 2009-03-30] ()
HKLM\...\Run: [Acer ePower Management] - C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTrayLauncher.exe [440864 2009-05-15] (Acer Incorporated)
HKLM\...\Run: [ODDPwr] - C:\Program Files\Acer\Optical Drive Power Management\ODDPWR.exe [176128 2009-04-29] (Acer Incorporated)
HKLM\...\Run: [EgisTecLiveUpdate] - C:\Program Files\EgisTec Egis Software Update\EgisUpdate.exe [199464 2009-05-13] (Egis Technology Inc.)
HKLM\...\Run: [mwlDaemon] - C:\Program Files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe [345384 2009-05-14] (Egis Technology Inc.)
HKLM\...\Run: [GrooveMonitor] - C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM\...\Run: [FUFAXSTM] - C:\Program Files\Epson Software\FAX Utility\FUFAXSTM.exe [847872 2009-12-03] (SEIKO EPSON CORPORATION)
HKLM\...\Run: [EEventManager] - C:\Program Files\Epson Software\Event Manager\EEventManager.exe [976320 2009-12-03] (SEIKO EPSON CORPORATION)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [937920 2011-06-06] (Adobe Systems Incorporated)
HKLM\...\Run: [Eraser] - C:\Program Files\Eraser\Eraser.exe [980920 2012-05-22] (The Eraser Project)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-18] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKCU\...\Run: [ehTray.exe] - C:\Windows\ehome\ehtray.exe [125952 2008-01-21] (Microsoft Corporation)
HKCU\...\Run: [swg] - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2012-08-23] (Google Inc.)
HKCU\...\Run: [Skype] - C:\Program Files\Skype\Phone\Skype.exe [20584608 2013-11-14] (Skype Technologies S.A.)
HKCU\...\Run: [Spotify Web Helper] - C:\Users\highend-outlets\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1168896 2013-12-03] (Spotify Ltd)
HKCU\...\Run: [ATworks] - regsvr32.exe C:\Users\highend-outlets\AppData\Local\ATworks\CompatObjclass16.dll <===== ATTENTION
HKU\Default\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Default\...\Run: [ProductReg] - C:\Program Files\Acer\WR_PopUp\ProductReg.exe [ 2008-11-17] (Acer)
HKU\Default\...\RunOnce: [ScrSav] - C:\Windows\Screensavers\Acer\run_Acer.exe [ 2009-04-03] ()
Startup: C:\Users\highend-outlets\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk
ShortcutTarget: Adobe Gamma.lnk -> C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Before = hxxp://www.google.de/
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yahoo.com
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
SearchScopes: HKCU - {14D5D798-17F3-45C5-B0AB-2A4CC6ED9858} URL = hxxp://go.web.de/suchbox/ebay?query={searchTerms}
SearchScopes: HKCU - {2AB03437-A933-4AB1-BC95-C24C4EDABA12} URL = hxxp://go.1und1.de/suchbox/amazon?tag=1und1icon-21&field-keywords={searchTerms}
SearchScopes: HKCU - {3293CBE3-FE02-4EDE-894F-4262A6ECB575} URL = hxxp://go.1und1.de/suchbox/1und1suche?su={searchTerms}
SearchScopes: HKCU - {66CF46B7-0878-4292-95F5-70B05FC496D3} URL = hxxp://go.web.de/suchbox/google?q={searchTerms}
BHO: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.130\McAfeeMSS_IE.dll No File
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.9012.1008\swg.dll (Google Inc.)
BHO: 1&&1 Internet AG Browser Configuration by mquadr.at - {D48FF4B4-E68F-47D1-8E25-81A0F0EEB341} - C:\Windows\System32\ieconfig_1und1.dll (mquadr.at software engineering und consulting GmbH)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} hxxp://www.ipix.com/download/ipixx.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog9 01 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 02 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 03 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 04 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 05 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 06 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 07 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 08 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 20 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
Tcpip\..\Interfaces\{1270B9F4-11CF-4ED7-8A0C-36D3CED1DD4C}: [NameServer]8.8.8.8,8.8.4.4

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw_1203133.dll (Adobe Systems, Inc.)
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.130\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin: @raidcall.en/RCplugin - C:\Users\highend-outlets\AppData\Roaming\raidcall\plugins\nprcplugin.dll (Raidcall)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\highend-outlets\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\highend-outlets\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF HKLM\...\Firefox\Extensions: [{A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}] - C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\
FF Extension: Firefox Synchronisation Extension - C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\
FF HKLM\...\Thunderbird\Extensions: [{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}] - C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\
FF Extension: Thunderbird Address Book Synchronisation Extension - C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\

Chrome: 
=======
CHR HomePage: hxxp://www.google.com
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\31.0.1650.63\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\31.0.1650.63\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\31.0.1650.63\pdf.dll ()
CHR Plugin: (Screen Capture Plugin) - C:\Users\highend-outlets\AppData\Local\Google\Chrome\User Data\Default\Extensions\alelhddbbhepgpmgidjdcjakblofbmce\3.4.5_0\plugins/screen_capture.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Google Earth Plugin) - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 7 U25) - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (McAfee Security Scanner +) - C:\Program Files\McAfee Security Scan\3.0.318\npMcAfeeMss.dll No File
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
CHR Plugin: (Pando Web Plugin) - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
CHR Plugin: (Windows Live\u00AE Photo Gallery) - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Unity Player) - C:\Users\highend-outlets\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
CHR Plugin: (Facebook Video Calling Plugin) - C:\Users\highend-outlets\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
CHR Plugin: (Raidcall plugin) - C:\Users\highend-outlets\AppData\Roaming\raidcall\plugins\nprcplugin.dll (Raidcall)
CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw_1203133.dll (Adobe Systems, Inc.)
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32_11_8_800_168.dll No File
CHR Plugin: (Java Deployment Toolkit 7.0.250.17) - C:\Windows\system32\npDeployJava1.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll No File
CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Extension: (Awesome Screenshot: Capture & Annotate) - C:\Users\highend-outlets\AppData\Local\Google\Chrome\User Data\Default\Extensions\alelhddbbhepgpmgidjdcjakblofbmce\3.5.10_0
CHR Extension: (Google Docs) - C:\Users\highend-outlets\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0
CHR Extension: (Google Drive) - C:\Users\highend-outlets\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (Turn Off the Lights) - C:\Users\highend-outlets\AppData\Local\Google\Chrome\User Data\Default\Extensions\bfbmjmiodbnnpllbbbfblcplfjjepjdn\2.3.0.5_0
CHR Extension: (YouTube) - C:\Users\highend-outlets\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Adblock Plus) - C:\Users\highend-outlets\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.7.2_0
CHR Extension: (Google Search) - C:\Users\highend-outlets\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (Photovisi - Photo Collage Maker) - C:\Users\highend-outlets\AppData\Local\Google\Chrome\User Data\Default\Extensions\emkkfkcbnpdnhgeolpbggbdogfngiadf\1.2_0
CHR Extension: (AdBlock) - C:\Users\highend-outlets\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.6.16_0
CHR Extension: (Quick Note) - C:\Users\highend-outlets\AppData\Local\Google\Chrome\User Data\Default\Extensions\mijlebbfndhelmdpmllgcfadlkankhok\1.6.3_0
CHR Extension: (DVDVideoSoft Browser Extension) - C:\Users\highend-outlets\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0
CHR Extension: (Google Wallet) - C:\Users\highend-outlets\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0
CHR Extension: (Gmail) - C:\Users\highend-outlets\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440376 2013-12-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-25] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1011768 2013-12-18] (Avira Operations GmbH & Co. KG)
R2 ePowerSvc; C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe [703008 2009-05-15] (Acer Incorporated)
R2 EpsonBidirectionalService; C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe [94208 2006-12-19] (SEIKO EPSON CORPORATION)
R2 EpsonCustomerResearchParticipation; C:\Program Files\EPSON\EpsonCustomerResearchParticipation\EPCP.exe [547936 2011-10-06] (SEIKO EPSON CORPORATION)
R2 EPSON_EB_RPCV4_04; C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50ST7.EXE [153600 2009-09-14] (SEIKO EPSON CORPORATION)
R2 EPSON_PM_RPCV4_04; C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RP7.EXE [121856 2009-09-14] (SEIKO EPSON CORPORATION)
R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe [235216 2013-09-06] (McAfee, Inc.)
R2 MWLService; C:\Program Files\EgisTec\MyWinLocker 3\x86\\MWLService.exe [305448 2009-05-14] (Egis Technology Inc.)
S3 npggsvc; C:\Windows\system32\GameMon.des [4121080 2011-06-13] (INCA Internet Co., Ltd.)
R2 NTI IScheduleSvc; C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [62208 2009-05-26] (NewTech Infosystems, Inc.)
R2 NTISchedulerSvc; C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [144632 2008-09-23] (NewTech Infosystems, Inc.)
R2 ODDPwrSvc; C:\Program Files\Acer\Optical Drive Power Management\ODDPWRSvc.exe [118784 2009-04-29] (Acer Incorporated)
S3 OverwolfUpdaterService; C:\Program Files\Overwolf\OverwolfUpdater.exe [18360 2013-08-22] (Overwolf Ltd)
R2 RS_Service; C:\Program Files\Acer\Acer VCM\RS_Service.exe [237568 2009-02-05] (Acer Incorporated)
R2 serviceIEConfig; C:\Windows\System32\ieconfig_1und1_svc.exe [1053848 2012-04-11] ()

==================== Drivers (Whitelisted) ====================

S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [90400 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135648 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-25] (Avira Operations GmbH & Co. KG)
S4 flpydisk; C:\Windows\System32\DRIVERS\flpydisk.sys [20480 2008-01-21] ()
R0 FltMgr; C:\Windows\System32\drivers\fltmgr.sys [192056 2008-01-21] ()
U1 Fs_Rec; C:\Windows\System32\Drivers\Fs_Rec.sys [12800 2008-01-21] ()
S3 gagp30kx; C:\Windows\system32\drivers\gagp30kx.sys [61496 2008-01-21] ()
S3 HdAudAddService; C:\Windows\System32\drivers\HdAudio.sys [235520 2006-11-02] ()
R3 HDAudBus; C:\Windows\System32\DRIVERS\HDAudBus.sys [53760 2008-01-21] ()
S4 HidBth; C:\Windows\system32\drivers\hidbth.sys [29184 2006-11-02] ()
S4 HidIr; C:\Windows\system32\drivers\hidir.sys [21504 2006-11-02] ()
R3 HidUsb; C:\Windows\System32\DRIVERS\hidusb.sys [12288 2009-07-16] ()
S4 HpCISSs; C:\Windows\system32\drivers\hpcisss.sys [40504 2008-01-21] ()
R3 HTTP; C:\Windows\System32\drivers\HTTP.sys [411136 2010-02-20] ()
S4 i2omp; C:\Windows\system32\drivers\i2omp.sys [30264 2008-01-21] ()
R1 i8042prt; C:\Windows\System32\DRIVERS\i8042prt.sys [54784 2008-01-21] ()
R0 iaStor; C:\Windows\System32\DRIVERS\iaStor.sys [329752 2009-02-12] ()
S4 iaStorV; C:\Windows\system32\drivers\iastorv.sys [235064 2008-01-21] ()
R3 igfx; C:\Windows\System32\DRIVERS\igdkmd32.sys [9024512 2010-08-25] ()
S4 iirsp; C:\Windows\system32\drivers\iirsp.sys [41576 2006-11-02] ()
R3 IntcAzAudAddService; C:\Windows\System32\drivers\RTKVHDA.sys [2358112 2009-04-11] ()
R3 IntcHdmiAddService; C:\Windows\System32\drivers\IntcHdmi.sys [112640 2008-12-05] ()
S4 intelide; C:\Windows\system32\drivers\intelide.sys [17976 2008-01-21] ()
R3 intelppm; C:\Windows\System32\DRIVERS\intelppm.sys [41472 2008-01-21] ()
S3 IpFilterDriver; C:\Windows\System32\DRIVERS\ipfltdrv.sys [47616 2008-01-21] ()
S4 IPMIDRV; C:\Windows\system32\drivers\ipmidrv.sys [64512 2008-01-21] ()
S3 IPNAT; C:\Windows\System32\DRIVERS\ipnat.sys [100864 2008-01-21] ()
R2 irda; C:\Windows\System32\DRIVERS\irda.sys [95744 2008-01-21] ()
S3 IRENUM; C:\Windows\System32\drivers\irenum.sys [13312 2008-01-21] ()
S4 isapnp; C:\Windows\system32\drivers\isapnp.sys [49720 2008-01-21] ()
R3 iScsiPrt; C:\Windows\System32\DRIVERS\msiscsi.sys [181304 2008-01-21] ()
S4 iteatapi; C:\Windows\system32\drivers\iteatapi.sys [35944 2006-11-02] ()
S4 iteraid; C:\Windows\system32\drivers\iteraid.sys [35944 2006-11-02] ()
R1 kbdclass; C:\Windows\System32\DRIVERS\kbdclass.sys [35384 2008-01-21] ()
R1 kbdhid; C:\Windows\System32\DRIVERS\kbdhid.sys [15872 2008-01-21] ()
R0 KSecDD; C:\Windows\System32\Drivers\ksecdd.sys [439896 2009-06-15] ()
R3 L1C; C:\Windows\System32\DRIVERS\L1C60x86.sys [57344 2009-11-13] ()
S3 libusb0; C:\Windows\System32\DRIVERS\libusb0.sys [35392 2010-10-02] ()
R2 lltdio; C:\Windows\System32\DRIVERS\lltdio.sys [47104 2008-01-21] ()
S4 LSI_FC; C:\Windows\system32\drivers\lsi_fc.sys [96312 2008-01-21] ()
S4 LSI_SAS; C:\Windows\system32\drivers\lsi_sas.sys [89656 2008-01-21] ()
S4 LSI_SCSI; C:\Windows\system32\drivers\lsi_scsi.sys [96312 2008-01-21] ()
R2 luafv; C:\Windows\system32\drivers\luafv.sys [84480 2008-01-21] ()
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
S4 megasas; C:\Windows\system32\drivers\megasas.sys [31288 2008-01-21] ()
S4 MegaSR; C:\Windows\system32\drivers\megasr.sys [386616 2008-01-21] ()
S3 Modem; C:\Windows\System32\drivers\modem.sys [31744 2008-01-21] ()
R3 monitor; C:\Windows\System32\DRIVERS\monitor.sys [41984 2008-01-21] ()
R1 mouclass; C:\Windows\System32\DRIVERS\mouclass.sys [34360 2008-01-21] ()
R3 mouhid; C:\Windows\System32\DRIVERS\mouhid.sys [15872 2008-01-21] ()
R0 MountMgr; C:\Windows\System32\drivers\mountmgr.sys [57400 2008-01-21] ()
S4 mpio; C:\Windows\system32\drivers\mpio.sys [105016 2008-01-21] ()
R3 mpsdrv; C:\Windows\System32\drivers\mpsdrv.sys [64000 2008-01-21] ()
S4 Mraid35x; C:\Windows\system32\drivers\mraid35x.sys [33384 2006-11-02] ()
S3 MRxDAV; C:\Windows\system32\drivers\mrxdav.sys [110080 2008-01-21] ()
R3 mrxsmb; C:\Windows\System32\DRIVERS\mrxsmb.sys [105984 2011-04-29] ()
R3 mrxsmb10; C:\Windows\System32\DRIVERS\mrxsmb10.sys [213504 2011-07-06] ()
R3 mrxsmb20; C:\Windows\System32\DRIVERS\mrxsmb20.sys [79360 2011-04-29] ()
S4 msahci; C:\Windows\system32\drivers\msahci.sys [28728 2008-01-21] ()
S4 msdsm; C:\Windows\system32\drivers\msdsm.sys [94776 2008-01-21] ()
R1 Msfs; C:\Windows\System32\Drivers\Msfs.sys [22528 2008-01-21] ()
R0 msisadrv; C:\Windows\System32\drivers\msisadrv.sys [16440 2008-01-21] ()
S3 MSKSSRV; C:\Windows\System32\drivers\MSKSSRV.sys [8192 2008-01-21] ()
S3 MSPCLOCK; C:\Windows\System32\drivers\MSPCLOCK.sys [5888 2008-01-21] ()
S3 MSPQM; C:\Windows\System32\drivers\MSPQM.sys [5504 2008-01-21] ()
S3 MsRPC; C:\Windows\System32\Drivers\MsRPC.sys [163384 2008-01-21] ()
R3 mssmbios; C:\Windows\System32\DRIVERS\mssmbios.sys [31288 2008-01-21] ()
S3 MSTEE; C:\Windows\System32\drivers\MSTEE.sys [6016 2008-01-21] ()
R0 Mup; C:\Windows\System32\Drivers\mup.sys [49720 2008-01-21] ()
R1 mwlPSDFilter; C:\Windows\System32\DRIVERS\mwlPSDFilter.sys [19504 2008-12-04] ()
R1 mwlPSDNServ; C:\Windows\System32\DRIVERS\mwlPSDNServ.sys [16432 2008-12-04] ()
R1 mwlPSDVDisk; C:\Windows\System32\DRIVERS\mwlPSDVDisk.sys [59952 2008-12-04] ()
R3 NativeWifiP; C:\Windows\System32\DRIVERS\nwifi.sys [148480 2008-05-20] ()
R0 NDIS; C:\Windows\System32\drivers\ndis.sys [529464 2009-07-16] ()
R3 NdisTapi; C:\Windows\System32\DRIVERS\ndistapi.sys [20992 2008-01-21] ()
R3 Ndisuio; C:\Windows\System32\DRIVERS\ndisuio.sys [16896 2008-01-21] ()
R3 NdisWan; C:\Windows\System32\DRIVERS\ndiswan.sys [121344 2008-01-21] ()
R3 NDProxy; C:\Windows\System32\Drivers\NDProxy.sys [49664 2008-01-21] ()
R1 NetBIOS; C:\Windows\System32\DRIVERS\netbios.sys [35840 2008-01-21] ()
R1 netbt; C:\Windows\System32\DRIVERS\netbt.sys [184320 2008-01-21] ()
R3 NETw5v32; C:\Windows\System32\DRIVERS\NETw5v32.sys [3668480 2008-11-17] ()
S4 nfrd960; C:\Windows\system32\drivers\nfrd960.sys [45160 2006-11-02] ()
S3 nmwcd; C:\Windows\System32\drivers\ccdcmb.sys [18304 2010-12-02] ()
S3 nmwcdc; C:\Windows\System32\drivers\ccdcmbo.sys [23168 2010-12-02] ()
S3 nmwcdnsu; C:\Windows\System32\drivers\nmwcdnsu.sys [137600 2010-12-02] ()
S3 nmwcdnsuc; C:\Windows\System32\drivers\nmwcdnsuc.sys [8576 2010-12-02] ()
R1 Npfs; C:\Windows\System32\Drivers\Npfs.sys [34816 2008-01-21] ()
S3 NSCIRDA; C:\Windows\System32\DRIVERS\nscirda.sys [30720 2008-01-21] ()
R1 nsiproxy; C:\Windows\System32\drivers\nsiproxy.sys [16384 2008-01-21] ()
R3 Ntfs; C:\Windows\System32\Drivers\Ntfs.sys [1081912 2008-01-21] ()
R3 NTIDrvr; C:\Windows\system32\drivers\NTIDrvr.sys [15360 2009-05-05] ()
S4 ntrigdigi; C:\Windows\system32\drivers\ntrigdigi.sys [20608 2006-11-02] ()
R1 Null; C:\Windows\System32\Drivers\Null.sys [4608 2008-01-21] ()
S4 nvraid; C:\Windows\system32\drivers\nvraid.sys [102968 2008-01-21] ()
S4 nvstor; C:\Windows\system32\drivers\nvstor.sys [45112 2008-01-21] ()
S3 nv_agp; C:\Windows\system32\drivers\nv_agp.sys [109112 2008-01-21] ()
S4 ohci1394; C:\Windows\System32\DRIVERS\ohci1394.sys [61952 2008-01-21] ()
S4 Parport; C:\Windows\system32\drivers\parport.sys [79360 2006-11-02] ()
R0 partmgr; C:\Windows\System32\drivers\partmgr.sys [56376 2008-01-21] ()
S2 Parvdm; C:\Windows\system32\drivers\parvdm.sys [8704 2006-11-02] ()
S3 pccsmcfd; C:\Windows\System32\DRIVERS\pccsmcfd.sys [18816 2008-08-26] ()
R0 pci; C:\Windows\System32\drivers\pci.sys [151096 2008-01-21] ()
S4 pciide; C:\Windows\system32\drivers\pciide.sys [16440 2008-01-21] ()
S4 pcmcia; C:\Windows\system32\DRIVERS\pcmcia.sys [179256 2008-01-21] ()
R2 PEAUTH; C:\Windows\System32\drivers\peauth.sys [878080 2006-11-02] ()
R3 PptpMiniport; C:\Windows\System32\DRIVERS\raspptp.sys [62976 2008-01-21] ()
S4 Processor; C:\Windows\system32\drivers\processr.sys [40960 2008-01-21] ()
R1 PSched; C:\Windows\System32\DRIVERS\pacer.sys [72192 2008-04-05] ()
R3 pspdisp; C:\Windows\System32\DRIVERS\pspdisp.sys [3072 2011-01-18] ()
S4 ql2300; C:\Windows\system32\drivers\ql2300.sys [1122360 2008-01-21] ()
S4 ql40xx; C:\Windows\system32\drivers\ql40xx.sys [106088 2006-11-02] ()
S3 QWAVEdrv; C:\Windows\system32\drivers\qwavedrv.sys [31232 2008-01-21] ()
R1 RasAcd; C:\Windows\System32\DRIVERS\rasacd.sys [11776 2008-01-21] ()
R3 Rasl2tp; C:\Windows\System32\DRIVERS\rasl2tp.sys [76288 2008-01-21] ()
R3 RasPppoe; C:\Windows\System32\DRIVERS\raspppoe.sys [41472 2008-01-21] ()
R3 RasSstp; C:\Windows\System32\DRIVERS\rassstp.sys [69120 2008-01-21] ()
R1 rdbss; C:\Windows\System32\DRIVERS\rdbss.sys [224768 2008-01-21] ()
R1 RDPCDD; C:\Windows\System32\DRIVERS\RDPCDD.sys [6144 2008-01-21] ()
S4 rdpdr; C:\Windows\system32\drivers\rdpdr.sys [248832 2008-01-21] ()
R1 RDPENCDD; C:\Windows\System32\drivers\rdpencdd.sys [6144 2008-01-21] ()
S3 RDPWD; C:\Windows\System32\Drivers\RDPWD.sys [181248 2008-01-21] ()
S3 RRNetCap; C:\Windows\System32\DRIVERS\rrnetcap.sys [31848 2012-12-18] ()
R3 RRNetCapMP; C:\Windows\System32\DRIVERS\rrnetcap.sys [31848 2012-12-18] ()
R2 rspndr; C:\Windows\System32\DRIVERS\rspndr.sys [60416 2008-01-21] ()
S3 RTSTOR; C:\Windows\System32\drivers\RTSTOR.SYS [62976 2008-12-02] ()
S4 sbp2port; C:\Windows\system32\drivers\sbp2port.sys [76392 2006-11-02] ()
S4 sdbus; C:\Windows\System32\DRIVERS\sdbus.sys [88576 2008-01-21] ()
R2 secdrv; C:\Windows\System32\Drivers\secdrv.sys [20480 2006-11-02] ()
S3 Serenum; C:\Windows\system32\drivers\serenum.sys [17920 2006-11-02] ()
S3 Serial; C:\Windows\system32\drivers\serial.sys [83456 2006-11-02] ()
S4 sermouse; C:\Windows\system32\drivers\sermouse.sys [19968 2008-01-21] ()
S4 sffdisk; C:\Windows\system32\drivers\sffdisk.sys [13312 2008-01-21] ()
S3 sffp_mmc; C:\Windows\system32\drivers\sffp_mmc.sys [12288 2008-01-21] ()
S3 sffp_sd; C:\Windows\system32\drivers\sffp_sd.sys [11776 2008-01-21] ()
S4 sfloppy; C:\Windows\system32\drivers\sfloppy.sys [13312 2006-11-02] ()
S3 sisagp; C:\Windows\system32\drivers\sisagp.sys [55864 2008-01-21] ()
S4 SiSRaid2; C:\Windows\system32\drivers\sisraid2.sys [41016 2008-01-21] ()
S4 SiSRaid4; C:\Windows\system32\drivers\sisraid4.sys [74808 2008-01-21] ()
R1 Smb; C:\Windows\System32\DRIVERS\smb.sys [66560 2008-01-21] ()
R0 spldr; C:\Windows\System32\Drivers\spldr.sys [21048 2008-01-21] ()
R3 srv; C:\Windows\System32\DRIVERS\srv.sys [304640 2011-02-18] ()
R3 srv2; C:\Windows\System32\DRIVERS\srv2.sys [146432 2011-04-29] ()
R3 srvnet; C:\Windows\System32\DRIVERS\srvnet.sys [102400 2011-04-29] ()
S1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-12-09] (Avira GmbH)
R3 swenum; C:\Windows\System32\DRIVERS\swenum.sys [15288 2008-01-21] ()
S4 Symc8xx; C:\Windows\system32\drivers\symc8xx.sys [35944 2006-11-02] ()
S4 Sym_hi; C:\Windows\system32\drivers\sym_hi.sys [31848 2006-11-02] ()
S4 Sym_u3; C:\Windows\system32\drivers\sym_u3.sys [34920 2006-11-02] ()
R3 SynTP; C:\Windows\System32\DRIVERS\SynTP.sys [205232 2009-02-06] ()
R3 tbhsd; C:\Windows\System32\drivers\tbhsd.sys [39048 2012-12-18] ()
R1 Tcpip; C:\Windows\System32\drivers\tcpip.sys [898952 2010-06-16] ()
S3 Tcpip6; C:\Windows\System32\DRIVERS\tcpip.sys [898952 2010-06-16] ()
R2 tcpipreg; C:\Windows\System32\drivers\tcpipreg.sys [30208 2008-01-21] ()
S3 TDPIPE; C:\Windows\System32\drivers\tdpipe.sys [17920 2008-01-21] ()
S3 TDTCP; C:\Windows\System32\drivers\tdtcp.sys [29184 2008-01-21] ()
R1 tdx; C:\Windows\System32\DRIVERS\tdx.sys [71680 2008-01-21] ()
R1 TermDD; C:\Windows\System32\DRIVERS\termdd.sys [54328 2008-01-21] ()
S3 tssecsrv; C:\Windows\System32\DRIVERS\tssecsrv.sys [23552 2008-01-21] ()
R3 tunmp; C:\Windows\System32\DRIVERS\tunmp.sys [15360 2008-01-21] ()
R3 tunnel; C:\Windows\System32\DRIVERS\tunnel.sys [25088 2010-02-18] ()
S3 uagp35; C:\Windows\system32\drivers\uagp35.sys [59448 2008-01-21] ()
R3 UBHelper; C:\Windows\system32\drivers\UBHelper.sys [14336 2009-05-05] ()
S4 udfs; C:\Windows\System32\DRIVERS\udfs.sys [226816 2008-01-21] ()
S3 uliagpkx; C:\Windows\system32\drivers\uliagpkx.sys [60984 2008-01-21] ()
S4 uliahci; C:\Windows\system32\drivers\uliahci.sys [238648 2008-01-21] ()
S4 UlSata; C:\Windows\system32\drivers\ulsata.sys [98408 2006-11-02] ()
S4 ulsata2; C:\Windows\system32\drivers\ulsata2.sys [115816 2008-01-21] ()
R3 umbus; C:\Windows\System32\DRIVERS\umbus.sys [34816 2008-01-21] ()
S3 upperdev; C:\Windows\System32\DRIVERS\usbser_lowerflt.sys [8192 2010-12-02] ()
R3 usbccgp; C:\Windows\System32\DRIVERS\usbccgp.sys [73216 2009-07-16] ()
S4 usbcir; C:\Windows\system32\drivers\usbcir.sys [68608 2006-11-02] ()
R3 usbehci; C:\Windows\System32\DRIVERS\usbehci.sys [39936 2009-07-16] ()
R3 usbhub; C:\Windows\System32\DRIVERS\usbhub.sys [194560 2009-07-16] ()
S4 usbohci; C:\Windows\system32\drivers\usbohci.sys [19456 2006-11-02] ()
S3 usbprint; C:\Windows\System32\DRIVERS\usbprint.sys [18944 2008-01-21] ()
S3 usbscan; C:\Windows\System32\DRIVERS\usbscan.sys [35328 2008-01-21] ()
S3 usbser; C:\Windows\System32\drivers\usbser.sys [28160 2008-01-21] ()
S3 UsbserFilt; C:\Windows\System32\DRIVERS\usbser_lowerfltj.sys [8192 2010-12-02] ()
S3 USBSTOR; C:\Windows\System32\DRIVERS\USBSTOR.SYS [55296 2008-01-21] ()
R3 usbuhci; C:\Windows\System32\DRIVERS\usbuhci.sys [23552 2009-07-16] ()
R3 usbvideo; C:\Windows\System32\Drivers\usbvideo.sys [134016 2008-01-21] ()
S3 vga; C:\Windows\System32\DRIVERS\vgapnp.sys [26112 2008-01-21] ()
R1 VgaSave; C:\Windows\System32\drivers\vga.sys [25088 2008-01-21] ()
S3 viaagp; C:\Windows\system32\drivers\viaagp.sys [56888 2008-01-21] ()
S4 ViaC7; C:\Windows\system32\drivers\viac7.sys [41472 2008-01-21] ()
S4 viaide; C:\Windows\system32\drivers\viaide.sys [20024 2008-01-21] ()
R0 volmgr; C:\Windows\System32\drivers\volmgr.sys [52792 2008-01-21] ()
R0 volmgrx; C:\Windows\System32\drivers\volmgrx.sys [294456 2008-01-21] ()
R0 volsnap; C:\Windows\System32\drivers\volsnap.sys [227896 2008-01-21] ()
S4 vsmraid; C:\Windows\system32\drivers\vsmraid.sys [130616 2008-01-21] ()
S3 w800bus; C:\Windows\System32\DRIVERS\w800bus.sys [60768 2005-06-13] ()
S4 WacomPen; C:\Windows\system32\drivers\wacompen.sys [20608 2006-11-02] ()
S3 Wanarp; C:\Windows\System32\DRIVERS\wanarp.sys [62464 2008-01-21] ()
R1 Wanarpv6; C:\Windows\System32\DRIVERS\wanarp.sys [62464 2008-01-21] ()
S4 Wd; C:\Windows\system32\drivers\wd.sys [22072 2008-01-21] ()
R0 Wdf01000; C:\Windows\System32\drivers\Wdf01000.sys [445008 2009-07-14] ()
S3 WinRing0_1_2_0; C:\Program Files\Razer\Razer Game Booster\Driver\WinRing0.sys [14416 2012-08-01] (OpenLibSys.org)
S3 WinUSB; C:\Windows\System32\DRIVERS\WinUSB.sys [31616 2008-01-21] ()
R3 WmiAcpi; C:\Windows\System32\DRIVERS\wmiacpi.sys [11264 2008-01-21] ()
S3 WpdUsb; C:\Windows\System32\DRIVERS\wpdusb.sys [39936 2008-01-21] ()
R1 ws2ifsl; C:\Windows\system32\drivers\ws2ifsl.sys [15872 2008-01-21] ()
S3 WSDPrintDevice; C:\Windows\System32\DRIVERS\WSDPrint.sys [16896 2008-01-21] ()
S3 WSDScan; C:\Windows\System32\DRIVERS\WSDScan.sys [19968 2008-01-21] ()
R3 WudfPf; C:\Windows\System32\drivers\WudfPf.sys [92672 2009-07-14] ()
R3 WUDFRd; C:\Windows\System32\DRIVERS\WUDFRd.sys [132224 2009-07-14] ()
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-21] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 EagleXNt; \??\C:\Windows\system32\drivers\EagleXNt.sys [x]
U5 ec55e6b546b6bca3; C:\Windows\System32\Drivers\ec55e6b546b6bca3.sys [60544 2014-01-03] ()
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
S3 XDva402; \??\C:\Windows\system32\XDva402.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-01-06 12:17 - 2014-01-06 12:17 - 00001008 _____ C:\Users\highend-outlets\Desktop\JRT.txt
2014-01-06 12:13 - 2014-01-06 12:13 - 00000000 ____D C:\Windows\ERUNT
2014-01-06 11:54 - 2014-01-06 11:54 - 00000000 ____D C:\Users\highend-outlets\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD
2014-01-06 11:49 - 2014-01-06 11:51 - 00000000 ____D C:\AdwCleaner
2014-01-05 18:26 - 2014-01-05 18:27 - 01233962 _____ C:\Users\highend-outlets\Downloads\adwcleaner.exe
2014-01-05 18:26 - 2014-01-05 18:26 - 01036305 _____ (Thisisu) C:\Users\highend-outlets\Downloads\JRT.exe
2014-01-04 18:48 - 2014-01-04 18:48 - 00017223 _____ C:\ComboFix.txt
2014-01-04 18:22 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe
2014-01-04 18:22 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe
2014-01-04 18:22 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-01-04 18:22 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-01-04 18:22 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-01-04 18:22 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe
2014-01-04 18:22 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe
2014-01-04 18:22 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe
2014-01-04 18:03 - 2014-01-04 18:48 - 00000000 ____D C:\Qoobox
2014-01-04 18:01 - 2014-01-04 18:46 - 00000000 ____D C:\Windows\erdnt
2014-01-03 18:01 - 2014-01-03 18:01 - 00000910 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-01-03 18:01 - 2014-01-03 18:01 - 00000000 ____D C:\Users\highend-outlets\AppData\Roaming\Malwarebytes
2014-01-03 18:01 - 2014-01-03 18:01 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-03 18:01 - 2014-01-03 18:01 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2014-01-03 18:01 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-01-03 18:00 - 2014-01-03 18:00 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\highend-outlets\Downloads\mbam-setup-1.75.0.1300.exe
2014-01-03 11:21 - 2014-01-03 11:22 - 00034965 _____ C:\Users\highend-outlets\Downloads\Addition.txt
2014-01-03 11:20 - 2014-01-06 12:44 - 00040577 _____ C:\Users\highend-outlets\Downloads\FRST.txt
2014-01-03 11:19 - 2014-01-03 14:10 - 00014038 _____ C:\Users\highend-outlets\Downloads\defogger_disable.log
2014-01-03 11:19 - 2014-01-03 11:19 - 00000000 ____D C:\FRST
2014-01-03 11:19 - 2014-01-03 11:19 - 00000000 _____ C:\Users\highend-outlets\defogger_reenable
2014-01-03 11:18 - 2014-01-03 11:18 - 00377856 _____ C:\Users\highend-outlets\Downloads\gmer_2.1.19163.exe
2014-01-03 11:17 - 2014-01-03 11:18 - 01064581 _____ (Farbar) C:\Users\highend-outlets\Downloads\FRST.exe
2014-01-03 11:17 - 2014-01-03 11:17 - 00050477 _____ C:\Users\highend-outlets\Downloads\Defogger.exe
2014-01-03 09:45 - 2014-01-03 09:48 - 129598176 _____ C:\Users\highend-outlets\Downloads\avira_free_antivirus_de.exe
2014-01-03 09:37 - 2014-01-03 09:37 - 00060544 _____ C:\Windows\system32\Drivers\ec55e6b546b6bca3.sys
2014-01-01 19:51 - 2014-01-03 18:31 - 00000000 ____D C:\Users\highend-outlets\AppData\Local\ATworks
2014-01-01 19:39 - 2014-01-01 19:39 - 00485376 _____ (Microsoft Corporation) C:\Users\highend-outlets\Downloads\Nicht bestätigt 40043.crdownload
2013-12-31 20:20 - 2014-01-03 18:28 - 00000000 ____D C:\SIERRA
2013-12-31 20:20 - 2013-12-31 20:22 - 00000283 _____ C:\Windows\SIERRA.INI
2013-12-31 20:20 - 2013-12-31 20:20 - 00000000 __RSH C:\MSDOS.SYS
2013-12-31 20:20 - 2013-12-31 20:20 - 00000000 __RSH C:\IO.SYS
2013-12-30 13:29 - 2014-01-04 14:39 - 00000000 ____D C:\Program Files\Tales of Pirates II
2013-12-29 22:17 - 2012-10-31 22:13 - 00245612 _____ C:\Program Files\CharacterAction.tx
2013-12-29 22:15 - 2013-12-29 22:15 - 00241923 _____ C:\Users\highend-outlets\Downloads\CharacterAction (4).tx
2013-12-28 02:52 - 2013-12-28 02:52 - 02848968 _____ C:\Users\highend-outlets\Downloads\Black Skin Ver. 3.1.1.rar
2013-12-27 18:00 - 2013-12-27 18:00 - 00000000 _____ C:\Windows\setuperr.log
2013-12-27 18:00 - 2013-12-27 18:00 - 00000000 _____ C:\Windows\setupact.log
2013-12-17 22:19 - 2013-12-17 22:19 - 00168816 _____ C:\Users\highend-outlets\Downloads\lethal_league.zip
2013-12-15 19:20 - 2013-12-15 19:20 - 00030022 _____ C:\Users\highend-outlets\Downloads\M14 (1).zip
2013-12-15 14:55 - 2013-12-15 14:55 - 00110484 _____ C:\Users\highend-outlets\Downloads\Metroid II - Return of Samus (World).zip
2013-12-15 14:52 - 2013-12-15 14:52 - 00296339 _____ C:\Users\highend-outlets\Downloads\Legend of Zelda, The - Link's Awakening (USA, Europe).zip
2013-12-15 14:51 - 2013-12-15 14:51 - 00331754 _____ C:\Users\highend-outlets\Downloads\Kirby's Dream Land 2 (USA, Europe).zip
2013-12-15 14:49 - 2013-12-15 14:50 - 00378607 _____ C:\Users\highend-outlets\Downloads\Pokemon - Red Version (USA, Europe).zip
2013-12-15 14:24 - 2013-12-15 14:25 - 32551762 _____ C:\Users\highend-outlets\Downloads\OFW 660.zip
2013-12-10 20:54 - 2013-12-29 13:23 - 00000000 ____D C:\Users\highend-outlets\Programme
2013-12-10 20:52 - 2013-12-10 20:53 - 00985720 _____ C:\Users\highend-outlets\Downloads\ElophantClient.zip
2013-12-08 15:01 - 2014-01-06 11:51 - 00103614 _____ C:\Windows\PFRO.log

==================== One Month Modified Files and Folders =======

2014-01-06 12:44 - 2014-01-03 11:20 - 00040577 _____ C:\Users\highend-outlets\Downloads\FRST.txt
2014-01-06 12:17 - 2014-01-06 12:17 - 00001008 _____ C:\Users\highend-outlets\Desktop\JRT.txt
2014-01-06 12:13 - 2014-01-06 12:13 - 00000000 ____D C:\Windows\ERUNT
2014-01-06 12:10 - 2013-01-08 19:13 - 00000000 ____D C:\Users\highend-outlets\AppData\Roaming\Skype
2014-01-06 11:54 - 2014-01-06 11:54 - 00000000 ____D C:\Users\highend-outlets\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD
2014-01-06 11:53 - 2013-07-19 14:33 - 00008888 _____ C:\autoupdate.log
2014-01-06 11:52 - 2012-06-17 20:24 - 00001112 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-06 11:52 - 2006-11-02 14:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-06 11:52 - 2006-11-02 13:47 - 00003424 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-06 11:52 - 2006-11-02 13:47 - 00003424 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-06 11:51 - 2014-01-06 11:49 - 00000000 ____D C:\AdwCleaner
2014-01-06 11:51 - 2013-12-08 15:01 - 00103614 _____ C:\Windows\PFRO.log
2014-01-06 11:51 - 2006-11-02 14:01 - 00032594 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2014-01-06 11:42 - 2006-11-02 13:37 - 00000000 ____D C:\Windows\twain_32
2014-01-06 11:21 - 2012-06-17 20:24 - 00001116 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-06 10:59 - 2012-04-13 10:51 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-01-05 22:53 - 2013-06-09 21:01 - 00000000 ____D C:\Users\highend-outlets\AppData\Local\PMB Files
2014-01-05 22:53 - 2013-06-09 21:01 - 00000000 ____D C:\ProgramData\PMB Files
2014-01-05 22:31 - 2012-09-02 12:26 - 00000968 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-76954294-2760295059-2378521770-1000UA.job
2014-01-05 18:27 - 2014-01-05 18:26 - 01233962 _____ C:\Users\highend-outlets\Downloads\adwcleaner.exe
2014-01-05 18:26 - 2014-01-05 18:26 - 01036305 _____ (Thisisu) C:\Users\highend-outlets\Downloads\JRT.exe
2014-01-05 18:10 - 2011-05-06 17:05 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-76954294-2760295059-2378521770-1000Core.job
2014-01-05 13:31 - 2012-09-02 12:26 - 00000946 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-76954294-2760295059-2378521770-1000Core.job
2014-01-04 19:36 - 2013-04-30 17:47 - 00000000 ____D C:\Users\highend-outlets\AppData\Roaming\Spotify
2014-01-04 18:48 - 2014-01-04 18:48 - 00017223 _____ C:\ComboFix.txt
2014-01-04 18:48 - 2014-01-04 18:03 - 00000000 ____D C:\Qoobox
2014-01-04 18:48 - 2006-11-02 12:18 - 00000000 __RHD C:\Users\Default
2014-01-04 18:48 - 2006-11-02 12:18 - 00000000 ___RD C:\Users\Public
2014-01-04 18:46 - 2014-01-04 18:01 - 00000000 ____D C:\Windows\erdnt
2014-01-04 18:43 - 2006-11-02 11:23 - 00000215 _____ C:\Windows\system.ini
2014-01-04 18:36 - 2013-03-15 19:16 - 00000000 ____D C:\Users\highend-outlets\AppData\Local\CrashDumps
2014-01-04 14:39 - 2013-12-30 13:29 - 00000000 ____D C:\Program Files\Tales of Pirates II
2014-01-03 20:49 - 2006-11-02 11:33 - 00769188 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-03 20:16 - 2012-03-13 10:37 - 01634014 _____ C:\Windows\WindowsUpdate.log
2014-01-03 18:31 - 2014-01-01 19:51 - 00000000 ____D C:\Users\highend-outlets\AppData\Local\ATworks
2014-01-03 18:31 - 2010-01-11 21:00 - 00000000 ____D C:\ProgramData\McAfee Security Scan
2014-01-03 18:31 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\system32\spool
2014-01-03 18:31 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\system32\Msdtc
2014-01-03 18:31 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\registration
2014-01-03 18:31 - 2006-11-02 11:22 - 54263808 _____ C:\Windows\system32\config\software_previous
2014-01-03 18:31 - 2006-11-02 11:22 - 25427968 _____ C:\Windows\system32\config\system_previous
2014-01-03 18:28 - 2013-12-31 20:20 - 00000000 ____D C:\SIERRA
2014-01-03 18:27 - 2006-11-02 11:22 - 31195136 _____ C:\Windows\system32\config\components_previous
2014-01-03 18:27 - 2006-11-02 11:22 - 00262144 _____ C:\Windows\system32\config\security_previous
2014-01-03 18:27 - 2006-11-02 11:22 - 00262144 _____ C:\Windows\system32\config\default_previous
2014-01-03 18:27 - 2006-11-02 11:22 - 00053248 _____ C:\Windows\system32\config\sam_previous
2014-01-03 18:01 - 2014-01-03 18:01 - 00000910 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-01-03 18:01 - 2014-01-03 18:01 - 00000000 ____D C:\Users\highend-outlets\AppData\Roaming\Malwarebytes
2014-01-03 18:01 - 2014-01-03 18:01 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-03 18:01 - 2014-01-03 18:01 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2014-01-03 18:00 - 2014-01-03 18:00 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\highend-outlets\Downloads\mbam-setup-1.75.0.1300.exe
2014-01-03 14:10 - 2014-01-03 11:19 - 00014038 _____ C:\Users\highend-outlets\Downloads\defogger_disable.log
2014-01-03 11:22 - 2014-01-03 11:21 - 00034965 _____ C:\Users\highend-outlets\Downloads\Addition.txt
2014-01-03 11:19 - 2014-01-03 11:19 - 00000000 ____D C:\FRST
2014-01-03 11:19 - 2014-01-03 11:19 - 00000000 _____ C:\Users\highend-outlets\defogger_reenable
2014-01-03 11:19 - 2009-12-10 12:06 - 00000000 ____D C:\Users\highend-outlets
2014-01-03 11:18 - 2014-01-03 11:18 - 00377856 _____ C:\Users\highend-outlets\Downloads\gmer_2.1.19163.exe
2014-01-03 11:18 - 2014-01-03 11:17 - 01064581 _____ (Farbar) C:\Users\highend-outlets\Downloads\FRST.exe
2014-01-03 11:17 - 2014-01-03 11:17 - 00050477 _____ C:\Users\highend-outlets\Downloads\Defogger.exe
2014-01-03 09:54 - 2012-12-09 12:17 - 00000000 ____D C:\ProgramData\Avira
2014-01-03 09:48 - 2014-01-03 09:45 - 129598176 _____ C:\Users\highend-outlets\Downloads\avira_free_antivirus_de.exe
2014-01-03 09:37 - 2014-01-03 09:37 - 00060544 _____ C:\Windows\system32\Drivers\ec55e6b546b6bca3.sys
2014-01-03 09:04 - 2013-12-04 16:01 - 227684352 _____ C:\Users\highend-outlets\Downloads\PR_GAWM_TE.7z
2014-01-02 18:27 - 2013-04-30 17:48 - 00000000 ____D C:\Users\highend-outlets\AppData\Local\Spotify
2014-01-02 01:23 - 2013-08-28 18:27 - 00000000 ____D C:\Program Files\DevPro
2014-01-01 19:39 - 2014-01-01 19:39 - 00485376 _____ (Microsoft Corporation) C:\Users\highend-outlets\Downloads\Nicht bestätigt 40043.crdownload
2013-12-31 20:22 - 2013-12-31 20:20 - 00000283 _____ C:\Windows\SIERRA.INI
2013-12-31 20:20 - 2013-12-31 20:20 - 00000000 __RSH C:\MSDOS.SYS
2013-12-31 20:20 - 2013-12-31 20:20 - 00000000 __RSH C:\IO.SYS
2013-12-30 13:26 - 2013-03-26 10:45 - 00000000 ____D C:\Program Files\Tales of Pirates Tweak
2013-12-29 22:15 - 2013-12-29 22:15 - 00241923 _____ C:\Users\highend-outlets\Downloads\CharacterAction (4).tx
2013-12-29 13:23 - 2013-12-10 20:54 - 00000000 ____D C:\Users\highend-outlets\Programme
2013-12-28 16:30 - 2012-06-30 19:28 - 00000000 ____D C:\Users\highend-outlets\AppData\Local\Eraser 6
2013-12-28 15:45 - 2006-11-02 13:47 - 00424896 _____ C:\Windows\system32\FNTCACHE.DAT
2013-12-28 02:52 - 2013-12-28 02:52 - 02848968 _____ C:\Users\highend-outlets\Downloads\Black Skin Ver. 3.1.1.rar
2013-12-27 18:00 - 2013-12-27 18:00 - 00000000 _____ C:\Windows\setuperr.log
2013-12-27 18:00 - 2013-12-27 18:00 - 00000000 _____ C:\Windows\setupact.log
2013-12-18 10:01 - 2012-12-09 12:17 - 00135648 _____ C:\Windows\system32\Drivers\avipbb.sys
2013-12-18 10:01 - 2012-12-09 12:17 - 00090400 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-12-18 10:00 - 2009-12-10 12:08 - 00117104 _____ C:\Users\highend-outlets\AppData\Local\GDIPFONTCACHEV1.DAT
2013-12-17 22:19 - 2013-12-17 22:19 - 00168816 _____ C:\Users\highend-outlets\Downloads\lethal_league.zip
2013-12-15 19:20 - 2013-12-15 19:20 - 00030022 _____ C:\Users\highend-outlets\Downloads\M14 (1).zip
2013-12-15 14:55 - 2013-12-15 14:55 - 00110484 _____ C:\Users\highend-outlets\Downloads\Metroid II - Return of Samus (World).zip
2013-12-15 14:52 - 2013-12-15 14:52 - 00296339 _____ C:\Users\highend-outlets\Downloads\Legend of Zelda, The - Link's Awakening (USA, Europe).zip
2013-12-15 14:51 - 2013-12-15 14:51 - 00331754 _____ C:\Users\highend-outlets\Downloads\Kirby's Dream Land 2 (USA, Europe).zip
2013-12-15 14:50 - 2013-12-15 14:49 - 00378607 _____ C:\Users\highend-outlets\Downloads\Pokemon - Red Version (USA, Europe).zip
2013-12-15 14:25 - 2013-12-15 14:24 - 32551762 _____ C:\Users\highend-outlets\Downloads\OFW 660.zip
2013-12-15 11:24 - 2009-12-10 12:07 - 00000000 ____D C:\Program Files\Google
2013-12-13 00:00 - 2009-04-08 19:26 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-12-12 23:58 - 2013-08-15 00:25 - 00000000 ____D C:\Windows\system32\MRT
2013-12-12 23:44 - 2006-11-02 11:24 - 88123800 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2013-12-11 18:59 - 2012-04-13 10:51 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-12-11 18:59 - 2011-05-26 14:26 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-12-10 20:53 - 2013-12-10 20:52 - 00985720 _____ C:\Users\highend-outlets\Downloads\ElophantClient.zip
2013-12-08 15:52 - 2009-12-16 00:17 - 00000000 ____D C:\Users\highend-outlets\AppData\Local\Adobe

Some content of TEMP:
====================
C:\Users\highend-outlets\AppData\Local\temp\avgnt.exe
C:\Users\highend-outlets\AppData\Local\temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys
[2008-01-21 03:23] - [2008-01-21 03:23] - 0227896 ____A () D41D8CD98F00B204E9800998ECF8427E

C:\Windows\System32\Drivers\volsnap.sys IS INFECTED. <===== ATTENTION!



LastRegBack: 2014-01-06 11:59

==================== End Of Log ============================
         
--- --- ---


Addition:
Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x86) Version: 02-01-2014 01
Ran by highend-outlets at 2014-01-06 12:44:59
Running from C:\Users\highend-outlets\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Disabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Disabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

 Update for Microsoft Office 2007 (KB2508958) (Version:  - Microsoft)
1und1 Internet Explorer Add-On (Version: 1.0 - 1&1 Internet AG) Hidden
A Ruler for Windows (Version: 2.5 - Latour)
Acer Backup Manager (Version: 1.1.0.72 - NewTech Infosystems)
Acer Crystal Eye Webcam (Version: 5.2.5.3 - Suyin Optronics Corp)
Acer eRecovery Management (Version: 4.00.3008 - Acer Incorporated)
Acer GridVista (Version: 2.75.825 - Acer Inc.)
Acer PowerSmart Manager (Version: 4.02.3006 - Acer Incorporated)
Acer Product Registration (Version: 3.0.0.10 - Acer Incorporated)
Acer ScreenSaver (Version: 1.0.5.0511 - Acer)
Acer VCM (Version: 4.00.3006 - Acer Incorporated)
Adobe Bridge 1.0 (Version: 001.000.001 - Adobe Systems) Hidden
Adobe Common File Installer (Version: 1.00.001 - Adobe System Incorporated) Hidden
Adobe Flash Player 11 ActiveX (Version: 11.9.900.170 - Adobe Systems Incorporated)
Adobe Flash Player 11 Plugin (Version: 11.9.900.170 - Adobe Systems Incorporated)
Adobe Help Center 1.0 (Version: 1.0.1 - Adobe Systems) Hidden
Adobe Photoshop CS2 (Version: 9.0 - Adobe Systems, Inc.)
Adobe Photoshop CS2 (Version: 9.0 - Adobe Systems, Inc.) Hidden
Adobe Reader X (10.1.1) - Deutsch (Version: 10.1.1 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.0 (Version: 12.0.3.133 - Adobe Systems, Inc.)
Adobe Stock Photos 1.0 (Version: 1.0.1 - Adobe Systems) Hidden
Any Video Converter 5 5.0.4 (Version:  - Any-Video-Converter.com)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (Version: 1.0.0.18 - Atheros Communications Inc.)
Audials (Version: 10.1.514.1400 - Audials AG)
Avira Free Antivirus (Version: 14.0.2.286 - Avira)
Backup Manager Basic (Version: 1.1.0.72 - NewTech Infosystems) Hidden
BattleForge™ (Version: 1.0.0.0 - Electronic Arts)
Camtasia Studio 8 (Version: 8.0.4.1060 - TechSmith Corporation)
CCleaner (Version: 3.10 - Piriform)
Dev-C++ 5 beta 9 release (4.9.9.2) (Version:  - )
Elsword_DE (Version:  - )
EPSON BX620FWD Series Handbuch (Version:  - )
EPSON BX620FWD Series Netzwerk-Handbuch (Version:  - )
EPSON BX620FWD Series Printer Uninstall (Version:  - SEIKO EPSON Corporation)
Epson Customer Research Participation (Version: 1.30.0000 - EPSON)
Epson Easy Photo Print 2 (Version: 2.2.0.0 - SEIKO EPSON CORPORATION)
Epson Easy Photo Print Plug-in for PMB(Picture Motion Browser) (Version: 1.00.0000 - SEIKO EPSON CORPORATION)
Epson Event Manager (Version: 2.40.0001 - SEIKO EPSON CORPORATION)
Epson FAX Utility (Version: 1.10.00 - SEIKO EPSON CORPORATION)
Epson PC-FAX Driver (Version:  - )
EPSON Scan (Version:  - Seiko Epson Corporation)
EpsonNet Print (Version: 2.4i - SEIKO EPSON CORPORATION)
EpsonNet Setup 3.3 (Version: 3.3a - SEIKO EPSON CORPORATION)
Eraser 6.0.10.2620 (Version: 6.0.2620 - The Eraser Project)
Façade (Version: 1.1.2 - Procedural Arts)
Facebook Video Calling 1.2.0.287 (Version: 1.2.287 - Skype Limited)
FormatFactory 3.0.1 (Version: 3.0.1 - Free Time)
Free YouTube to MP3 Converter version 3.12.0.128 (Version: 3.12.0.128 - DVDVideoSoft Ltd.)
GIMP 2.8.4 (Version: 2.8.4 - The GIMP Team)
Google Chrome (Version: 31.0.1650.63 - Google Inc.)
Google Earth (Version: 7.1.2.2041 - Google)
Google Toolbar for Internet Explorer (Version: 1.0.0 - Google Inc.) Hidden
Google Toolbar for Internet Explorer (Version: 7.5.4805.320 - Google Inc.)
Google Update Helper (Version: 1.3.22.3 - Google Inc.) Hidden
GS Auto Clicker (Version: V3.1.2 - goldensoft.org)
Intel PROSet Wireless (Version:  - ) Hidden
Intel(R) Graphics Media Accelerator Driver (Version:  - Intel Corporation)
Intel(R) PROSet/Wireless WiFi-Software (Version: 12.02.0000 - Intel(R) Corporation)
Intel® Matrix Storage Manager (Version:  - Intel Corporation)
Java 7 Update 45 (Version: 7.0.450 - Oracle)
Java Auto Updater (Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
JDownloader 0.9 (Version: 0.9 - AppWork GmbH)
Junk Mail filter update (Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Launch Manager (Version: 2.0.03 - Acer Inc.)
League of Legends (Version: 1.3 - Riot Games)
Malwarebytes Anti-Malware Version 1.75.0.1300 (Version: 1.75.0.1300 - Malwarebytes Corporation)
McAfee Security Scan Plus (Version: 3.8.130.10 - McAfee, Inc.)
Metin2 (Version:  - Gameforge 4D GmbH)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 Language Pack SP1 - deu (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 3.5 SP1 (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5 (Version: 4.5.50709 - Microsoft Corporation)
Microsoft .NET Framework 4.5 (Version: 4.5.50709 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5 DEU Language Pack (Version: 4.5.50709 - Microsoft Corporation)
Microsoft .NET Framework 4.5 DEU Language Pack (Version: 4.5.50709 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6012.5000 - Microsoft Corporation) Hidden
Microsoft Choice Guard (Version: 2.0.48.0 - Microsoft Corporation) Hidden
Microsoft Office 2007 Service Pack 3 (SP3) (Version:  - Microsoft) Hidden
Microsoft Office Access MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Enterprise 2007 (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office FrontPage 2003 (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Office Groove MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Live Add-in 1.5 (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office OneNote MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (Version:  - Microsoft) Hidden
Microsoft Office Publisher MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office SharePoint Designer 2007 (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office SharePoint Designer 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office SharePoint Designer 2007 Service Pack 3 (SP3) (Version:  - Microsoft)
Microsoft Office SharePoint Designer 2007 Service Pack 3 (SP3) (Version:  - Microsoft) Hidden
Microsoft Office SharePoint Designer MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Sync Framework Runtime Native v1.0 (x86) (Version: 1.0.1215.0 - Microsoft Corporation)
Microsoft Sync Framework Services Native v1.0 (x86) (Version: 1.0.1215.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Works (Version: 9.7.0621 - Microsoft Corporation)
MinecraftAlpha (Version:  - )
Moo0 VoiceRecorder 1.32 (Version:  - )
MSVC80_x86_v2 (Version: 1.0.3.0 - Nokia) Hidden
MSVC90_x86 (Version: 1.0.1.2 - Nokia) Hidden
MSVCRT (Version: 14.0.1468.721 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0 - Microsoft Corporation)
MyWinLocker (Version: 3.1.59.0 - Egis Technology Inc.)
No23 Recorder (Version: 2.1.0.3 - No23)
Nokia Connectivity Cable Driver (Version: 7.1.41.0 - Nokia)
Nokia Ovi Player (Version: 2.0.1106 - Nokia Ovi Player)
Nokia Ovi Suite (Version: 3.1.0.84 - Nokia)
Nokia Ovi Suite (Version: 3.1.0.84 - Nokia) Hidden
Nokia Ovi Suite Software Updater (Version: 02.07.004.45780 - Nokia Corporation)
Nokia_Multimedia_Common_Components_2_5 (Version: 2.5.197 - Nokia)
NTI Backup Now 5 (Version: 5.1.2.616 - NewTech Infosystems)
NTI Backup Now Standard (Version: 5.1.2.616 - NewTech Infosystems) Hidden
NTI Media Maker 8 (Version: 8.0.2.6509 - NewTech Infosystems)
NTI Media Maker 8 (Version: 8.0.2.6509 - NewTech Infosystems) Hidden
Ocean Express (Version:  - Oberon Media)
OpenOffice.org 3.4.1 (Version: 3.41.9593 - Apache Software Foundation)
Optical Drive Power Management (Version: 1.00.3006 - Acer Incorporated)
Orion (Version: 2.5.0 - Convesoft)
osu! (Version: 0.0.0.0 - peppy)
Overwolf (Version: 0.44.256 - Overwolf)
Ovi Desktop Sync Engine (Version: 1.5.257.0 - Nokia) Hidden
OviMPlatform (Version: 2.7.66.0 - Nokia) Hidden
Paint.NET v3.5.10 (Version: 3.60.0 - dotPDN LLC)
Pando Media Booster (Version: 2.6.0.9 - Pando Networks Inc.)
PC Connectivity Solution (Version: 11.4.15.0 - Nokia)
PHANTASY STAR UNIVERSE (Version:  - SEGA SONIC TEAM)
Pinnacle VideoSpin (Version: 2.0.0.669 - Pinnacle Systems)
Pokemon Online 2.2.4c (Version:  - Dreambelievers)
PowerDVD (Version: 7.0.4028.0 - CyberLink Corp.)
Project64 1.6 (Version: 1.6 - Project64)
PSPdisp v0.6 (Version: v0.6 - JJS)
Puzzle Express (Version:  - Oberon Media)
RaidCall (Version: 7.1.8-1.0.4843.13 - raidcall.com)
Razer Game Booster (Version: 3.7 - Razer USA Ltd)
Realtek High Definition Audio Driver (Version: 6.0.1.5830 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (Version: 6.0.6000.20113 - Realtek Semiconductor Corp.)
S4 League_EU (Version: 1.00.0000 - )
Sierra Utilities (Version:  - )
Skype™ 6.11 (Version: 6.11.102 - Skype Technologies S.A.)
Softwarenetz Kassenbuch4 (Version:  - )
Softwarenetz Rechnung3 (Version:  - )
Spotify (Version: 0.9.6.81.gd359a796 - Spotify AB)
swMSM (Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Synaptics Pointing Device Driver (Version: 12.2.2.0 - Synaptics Incorporated)
Tales of Pirates II (Version: 1.0.63 - IGG,Inc.)
Tales of Pirates Online (Version: 2.00 - IGG,Inc.)
TeamSpeak 3 Client (Version: 3.0.13 - TeamSpeak Systems GmbH)
Tri-Peaks Solitaire To Go (Version:  - Oberon Media)
Unity Web Player (Version:  - Unity Technologies ApS)
Update for 2007 Microsoft Office System (KB967642) (Version:  - Microsoft)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (Version: 1 - Microsoft Corporation)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2850085) 32-Bit Edition (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (Version:  - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (Version:  - Microsoft)
Windows Live Call (Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live Communications Platform (Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Windows Live Essentials (Version: 14.0.8117.0416 - Microsoft Corporation)
Windows Live Essentials (Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Windows Live ID-Anmelde-Assistent (Version: 6.500.3165.0 - Microsoft Corporation)
Windows Live Mail (Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live Messenger (Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live Movie Maker (Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live OneCare safety scanner (Version:  - Microsoft Corporation)
Windows Live OneCare safety scanner (Version: 1.0.0.0 - Microsoft Corporation) Hidden
Windows Live Sync (Version: 14.0.8117.416 - Microsoft Corporation)
Windows Live Writer (Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live-Uploadtool (Version: 14.0.8014.1029 - Microsoft Corporation)
Windows Media Encoder 9-Reihe (Version:  - )
Windows Media Encoder 9-Reihe (Version: 9.00.3374 - Microsoft Corporation) Hidden
Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0) (Version: 08/22/2008 7.0.0.0 - Nokia)
WinRAR (Version:  - )
YGOPro DevPro Version 1.9.6 r0 (Version: 1.9.6 r0 - YGOPro DevPro Online)

==================== Restore Points  =========================


==================== Hosts content: ==========================

2006-11-02 11:23 - 2014-01-04 18:42 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {1CC81347-6204-4B83-900C-01E02F50F067} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {320124A7-D70F-41DE-A9D1-D5E8E19D5D91} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {3BCDF251-CA5C-4045-A1FC-8FCEF9FBDC93} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {44980BEE-7809-44A9-AC24-D6E578A3B7DF} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\System32\RacAgent.exe [2008-01-21] (Microsoft Corporation)
Task: {66F4192C-CB24-483F-9921-4419A21887F1} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance => C:\Program Files\TuneUp Utilities 2010\OneClick.exe
Task: {934DCA32-97E5-44D7-9D50-F59EA48F6F05} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-11] (Adobe Systems Incorporated)
Task: {9F19DC2B-EF0B-4D5C-B441-F7E52C62CE00} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2012-06-17] (Google Inc.)
Task: {B2EAB7F6-35B6-4799-AD32-E035961E7FFF} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Signature Update => C:\Program Files\Windows Defender\MpCmdRun.exe [2008-01-21] (Microsoft Corporation)
Task: {B71A2F7D-B177-4953-8E43-E2A87B54E842} - System32\Tasks\Razer_Game_Booster_AutoUpdate => C:\Program Files\Razer\Razer Game Booster\AutoUpdate.exe [2013-06-05] ()
Task: {C563A681-F725-4797-A49A-3CF91A72630B} - System32\Tasks\Microsoft\Windows\RestartManager\{89FF3A27-10E6-4625-A0C3-C87A29BD3920} => C:\Windows\System32\RmClient.exe [2006-11-02] (Microsoft Corporation)
Task: {CB86B84B-8BA3-4309-830A-B4A8D36F94FF} - System32\Tasks\Microsoft\Windows\RestartManager\{F1DAADE9-048D-4c73-AB80-23FE9E867D86} => C:\Windows\System32\RmClient.exe [2006-11-02] (Microsoft Corporation)
Task: {CD5EFA92-F851-4E18-A578-6C147CC39750} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-76954294-2760295059-2378521770-1000UA => C:\Users\highend-outlets\AppData\Local\Google\Update\GoogleUpdate.exe [2011-05-06] (Google Inc.)
Task: {E5150B95-F9B4-4D5D-95A2-7EC1ACBA95F8} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\System32\gatherWirelessInfo.vbs [2008-01-21] ()
Task: {E56B1436-3183-444C-B2DF-AC953488D3CB} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2012-06-17] (Google Inc.)
Task: {ECFD679D-C93F-4B61-A36A-22657793F7EA} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-76954294-2760295059-2378521770-1000Core => C:\Users\highend-outlets\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-09-02] (Facebook Inc.)
Task: {EDECC2FA-CDF1-4E4D-9512-91877876D395} - System32\Tasks\Java Update Scheduler => C:\Program Files\Common Files\Java\Java Update\jusched.exe [2013-07-02] (Oracle Corporation)
Task: {F07446DC-AB25-47C8-BFB7-8ADF973A0FF8} - System32\Tasks\Adobe Reader and Acrobat Manager => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2011-06-06] (Adobe Systems Incorporated)
Task: {F0F13B91-2E61-4F83-92F9-D051598F9CB2} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-76954294-2760295059-2378521770-1000Core => C:\Users\highend-outlets\AppData\Local\Google\Update\GoogleUpdate.exe [2011-05-06] (Google Inc.)
Task: {F30C6B22-2347-460B-A064-5116DEF5E245} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-76954294-2760295059-2378521770-1000UA => C:\Users\highend-outlets\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-09-02] (Facebook Inc.)
Task: {FD7B84A3-1A67-4505-B821-27E689A7FA9E} - System32\Tasks\Game_Booster_AutoUpdate => C:\Program Files\IObit\Game Booster 3\AutoUpdate.exe
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-76954294-2760295059-2378521770-1000Core.job => C:\Users\highend-outlets\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-76954294-2760295059-2378521770-1000UA.job => C:\Users\highend-outlets\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-76954294-2760295059-2378521770-1000Core.job => C:\Users\highend-outlets\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-76954294-2760295059-2378521770-1000UA.job => C:\Users\highend-outlets\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\User_Feed_Synchronization-{96A8A4AD-CD8F-4D37-8F51-72C50F28B58B}.job => C:\Windows\system32\msfeedssync.exe

==================== Loaded Modules (whitelisted) =============

2014-01-01 19:51 - 2014-01-01 19:51 - 00025600 _____ () C:\Users\highend-outlets\AppData\Local\ATworks\CompatObjclass16.dll
2009-07-16 08:27 - 2003-06-07 22:30 - 00057344 _____ () C:\Program Files\Launch Manager\PowerUtl.dll
2009-02-02 16:33 - 2009-02-02 16:33 - 00460199 _____ () C:\Program Files\NewTech Infosystems\Acer Backup Manager\sqlite3.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\ProgramData\TEMP:3B3A35EC
AlternateDataStreams: C:\ProgramData\TEMP:4F636E25
AlternateDataStreams: C:\ProgramData\TEMP:798A3728
AlternateDataStreams: C:\ProgramData\TEMP:814B9485
AlternateDataStreams: C:\ProgramData\TEMP:8750DCE4
AlternateDataStreams: C:\ProgramData\TEMP:9E22BBE8
AlternateDataStreams: C:\ProgramData\TEMP:ABE89FFE
AlternateDataStreams: C:\ProgramData\TEMP:ADE16379
AlternateDataStreams: C:\ProgramData\TEMP:B203B914
AlternateDataStreams: C:\ProgramData\TEMP:B623B5B8
AlternateDataStreams: C:\ProgramData\TEMP:BB24555F
AlternateDataStreams: C:\ProgramData\TEMP:CDFF58FE
AlternateDataStreams: C:\ProgramData\TEMP:CE0A077E

==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MpfService => ""="Service"

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============
Error: (01/06/2014 00:44:10 PM) (Source: Service Control Manager) (User: )
Description: 30000stisvc


Microsoft Office Sessions:
=========================
Error: (01/21/2013 08:37:04 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 156 seconds with 120 seconds of active time.  This session ended with a crash.

Error: (12/06/2012 09:28:27 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 12 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (10/26/2012 03:59:23 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6661.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 20 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (08/19/2012 09:57:53 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6661.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 218 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (08/18/2012 02:41:14 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6661.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 3 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (08/10/2012 10:42:21 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6661.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 7 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (08/06/2012 02:35:26 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6661.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 9 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (08/04/2012 02:38:04 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6661.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 4 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (08/02/2012 08:49:26 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6661.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 18 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (08/01/2012 07:40:24 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6661.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 265 seconds with 120 seconds of active time.  This session ended with a crash.


CodeIntegrity Errors:
===================================
  Date: 2014-01-06 11:35:44.393
  Description: N/A

  Date: 2014-01-06 11:35:44.199
  Description: N/A

  Date: 2014-01-06 11:35:44.006
  Description: N/A

  Date: 2014-01-06 11:35:43.822
  Description: N/A

  Date: 2014-01-06 11:35:43.647
  Description: N/A

  Date: 2014-01-06 11:35:43.454
  Description: N/A

  Date: 2014-01-06 11:35:43.177
  Description: N/A

  Date: 2014-01-06 11:35:42.993
  Description: N/A

  Date: 2014-01-06 11:35:42.804
  Description: N/A

  Date: 2014-01-06 11:35:42.620
  Description: N/A
         
Adw-Cleaner:
Code:
ATTFilter
# AdwCleaner v3.016 - Bericht erstellt am 06/01/2014 um 11:49:26
# Aktualisiert 23/12/2013 von Xplode
# Betriebssystem : Windows Vista (TM) Home Premium Service Pack 1 (32 bits)
# Benutzername : highend-outlets - HIGHEND-OUTL-PC
# Gestartet von : C:\Users\Public\Roaming\Intel\Wireless\sessions\Desktop\adwcleaner.exe
# Option : Suchen

***** [ Dienste ] *****

Dienst Gefunden : StumbleUponUpdater

***** [ Dateien / Ordner ] *****

Datei Gefunden : C:\Users\highend-outlets\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.softonic.de_0.localstorage-journal
Datei Gefunden : C:\Users\highend-outlets\AppData\Roaming\Microsoft\Windows\Start Menu\QuickStores.url
Ordner Gefunden C:\ProgramData\Ask
Ordner Gefunden C:\ProgramData\Tarma Installer
Ordner Gefunden C:\Users\highend-outlets\AppData\Local\b1e
Ordner Gefunden C:\Users\highend-outlets\AppData\LocalLow\Conduit
Ordner Gefunden C:\Users\highend-outlets\AppData\LocalLow\StumbleUpon
Ordner Gefunden C:\Users\highend-outlets\AppData\Roaming\B1Toolbar
Ordner Gefunden C:\Users\highend-outlets\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gefunden C:\Users\highend-outlets\AppData\Roaming\iWin
Ordner Gefunden C:\Windows\assembly\GAC_MSIL\QuickStoresToolbar

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gefunden : HKCU\Software\APN PIP
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\StumbleUpon
Schlüssel Gefunden : HKCU\Software\InstallCore
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{79A765E1-C399-405B-85AF-466F52E918B0}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Updater Service
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{10EDB994-47F8-43F7-AE96-F2EA63E9F90F}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{83FF80F4-8C74-4B80-B5BA-C8DDD434E5C4}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{DB616CFF-D989-48A8-9C85-E2A8D56AB2CA}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{10EDB994-47F8-43F7-AE96-F2EA63E9F90F}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{83FF80F4-8C74-4B80-B5BA-C8DDD434E5C4}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DB616CFF-D989-48A8-9C85-E2A8D56AB2CA}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Schlüssel Gefunden : HKCU\Software\Softonic
Schlüssel Gefunden : HKCU\Software\StumbleUpon
Schlüssel Gefunden : HKCU\Software\YahooPartnerToolbar
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{50F7F0BE-31BA-4145-BD8B-6B0DECFED804}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\StumbleUpon.DLL
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\WLXQuickTimeShellExt.DLL
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{007EFBDF-8A5D-4930-97CC-A4B437CBA777}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{DB616CFF-D989-48A8-9C85-E2A8D56AB2CA}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\protector_dll.protectorbho
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\StumbleUpon.QTimeCpio
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\StumbleUpon.QTimeCpio.1
Schlüssel Gefunden : HKLM\SOFTWARE\Google\Chrome\Extensions\pgifblbjgdjhcelbanblbhkhmbnnmhfg
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{23DD560C-243A-445D-832A-1C5D000E14C3}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DB616CFF-D989-48A8-9C85-E2A8D56AB2CA}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08121C32A9C319F4CB0C11FF059552A4
Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0FF2AEFF45EEA0A48A4B33C1973B6094
Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536
Schlüssel Gefunden : HKLM\Software\PIP
Wert Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{10EDB994-47F8-43F7-AE96-F2EA63E9F90F}]

***** [ Browser ] *****

-\\ Internet Explorer v8.0.6001.19088

Einstellung Gefunden : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page] - hxxp://search.b1.org/?bsrc=hmior&chid=c167991

-\\ Mozilla Firefox v

-\\ Google Chrome v31.0.1650.63

[ Datei : C:\Users\highend-outlets\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Gefunden : homepage

*************************

AdwCleaner[R0].txt - [6378 octets] - [06/01/2014 11:49:26]

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [6438 octets] ##########
         
JRT:

Code:
ATTFilter
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.9 (01.01.2014:1)
OS: Windows Vista (TM) Home Premium x86
Ran by highend-outlets on 06.01.2014 at 12:13:12,11
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00000000-6E41-4FD3-8538-502F5495E5FC}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{18C99010-B9BE-4B7A-BA93-CB181559E261}



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\Windows\system32\ai_recyclebin"



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 06.01.2014 at 12:17:19,18
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         

Alt 07.01.2014, 09:43   #8
schrauber
/// the machine
/// TB-Ausbilder
 

Vista: schwerwiegender Trojanerbefall von Necrus!A und ähnlichem - Standard

Vista: schwerwiegender Trojanerbefall von Necrus!A und ähnlichem




ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 08.01.2014, 13:30   #9
Singed
 
Vista: schwerwiegender Trojanerbefall von Necrus!A und ähnlichem - Standard

Vista: schwerwiegender Trojanerbefall von Necrus!A und ähnlichem



SecurityCheck:
Code:
ATTFilter
 Results of screen317's Security Check version 0.99.78  
 Windows Vista Service Pack 1 x86   
 Out of date service pack!! 
 Internet Explorer 8 Out of date! 
 Internet Explorer 8  
``````````````Antivirus/Firewall Check:`````````````` 
Avira Desktop   
 Antivirus up to date!  (On Access scanning disabled!) 
`````````Anti-malware/Other Utilities Check:````````` 
 Malwarebytes Anti-Malware Version 1.75.0.1300  
 CCleaner     
 Java 7 Update 45  
 Adobe Flash Player 	11.9.900.170  
 Adobe Reader 10.1.1 Adobe Reader out of Date!  
 Google Chrome 31.0.1650.57  
 Google Chrome 31.0.1650.63  
````````Process Check: objlist.exe by Laurent````````  
 Avira Antivir avgnt.exe 
 Avira Antivir avguard.exe 
 Malwarebytes' Anti-Malware mbamscheduler.exe   
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  % 
````````````````````End of Log``````````````````````
         
ESET:
Code:
ATTFilter
ESETSmartInstaller@High as downloader log:
Can not open internetESETSmartInstaller@High as downloader log:
Can not open internetESETSmartInstaller@High as downloader log:
Can not open internetCan not open internetESETSmartInstaller@High as downloader log:
Can not open internetesets_scanner_update returned -1 esets_gle=1
esets_scanner_update returned -1 esets_gle=1
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=3f00d7a243e8924ead8aad0c6cb9d58e
# engine=16550
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-01-07 07:27:13
# local_time=2014-01-07 08:27:13 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.0.6001 NT Service Pack 1
# compatibility_mode=1799 16775165 100 97 21115 211027072 13715 0
# compatibility_mode=5892 16776574 100 100 0 226655561 0 0
# scanned=306877
# found=1
# cleaned=0
# scan_time=12159
sh=3AEF532A0211CE7869F0EB51E940D9E0C7CAE321 ft=1 fh=c7560653d3ee2314 vn="a variant of Win32/Adware.Yontoo.B application" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\_Setupx.dll.vir"
         


FRST:


FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 02-01-2014 01
Ran by highend-outlets (administrator) on HIGHEND-OUTL-PC on 08-01-2014 12:50:10
Running from C:\Users\highend-outlets\Downloads
Microsoft® Windows Vista™ Home Premium  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EBAPI\eEBSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Dritek System Inc.) C:\Program Files\Launch Manager\dsiwmis.exe
(Acer Incorporated) C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe
(SEIKO EPSON CORPORATION) C:\Program Files\epson\EpsonCustomerResearchParticipation\EPCP.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50ST7.EXE
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RP7.EXE
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Egis Technology Inc.) C:\Program Files\EgisTec\MyWinLocker 3\x86\MWLService.exe
(NewTech Infosystems, Inc.) C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
(NewTech Infosystems, Inc.) C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
(Acer Incorporated) C:\Program Files\Acer\Optical Drive Power Management\ODDPWRSvc.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
() C:\Windows\PLFSetI.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Acer Incorporated) C:\Program Files\Acer\Acer VCM\RS_Service.exe
() C:\Windows\System32\ieconfig_1und1_svc.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Dritek System Inc.) C:\Program Files\Launch Manager\LManager.exe
(NewTech Infosystems, Inc.) C:\Program Files\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
(Acer Incorporated) C:\Program Files\Acer\Optical Drive Power Management\ODDPWR.exe
(Egis Technology Inc.) C:\Program Files\EgisTec Egis Software Update\EgisUpdate.exe
(Egis Technology Inc.) C:\Program Files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Epson Software\Event Manager\EEventManager.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(The Eraser Project) C:\Program Files\Eraser\Eraser.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Spotify Ltd) C:\Users\highend-outlets\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Microsoft Corporation) C:\Windows\System32\regsvr32.exe
(Acer Incorporated) C:\Program Files\Acer\Acer VCM\AcerVCM.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.130\SSScheduler.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Acer Incorporated) C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTray.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Acer Incorporated) C:\Program Files\Acer\Acer PowerSmart Manager\ePowerEvent.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil32_11_9_900_170_ActiveX.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [IAAnotif] - C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe [186904 2009-02-12] (Intel Corporation)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [7399968 2009-04-11] (Realtek Semiconductor)
HKLM\...\Run: [Skytel] - C:\Program Files\Realtek\Audio\HDA\SkyTel.exe [1833504 2009-04-11] (Realtek Semiconductor Corp.)
HKLM\...\Run: [PLFSetI] - C:\Windows\PLFSetI.exe [200704 2008-07-29] ()
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1430824 2009-02-06] (Synaptics Incorporated)
HKLM\...\Run: [LManager] - C:\Program Files\Launch Manager\LManager.exe [1071624 2009-04-09] (Dritek System Inc.)
HKLM\...\Run: [BackupManagerTray] - C:\Program Files\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [253696 2009-05-26] (NewTech Infosystems, Inc.)
HKLM\...\Run: [LanguageShortcut] - C:\Program Files\CyberLink\PowerDVD\Language\Language.exe [62760 2009-03-30] ()
HKLM\...\Run: [Acer ePower Management] - C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTrayLauncher.exe [440864 2009-05-15] (Acer Incorporated)
HKLM\...\Run: [ODDPwr] - C:\Program Files\Acer\Optical Drive Power Management\ODDPWR.exe [176128 2009-04-29] (Acer Incorporated)
HKLM\...\Run: [EgisTecLiveUpdate] - C:\Program Files\EgisTec Egis Software Update\EgisUpdate.exe [199464 2009-05-13] (Egis Technology Inc.)
HKLM\...\Run: [mwlDaemon] - C:\Program Files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe [345384 2009-05-14] (Egis Technology Inc.)
HKLM\...\Run: [GrooveMonitor] - C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM\...\Run: [FUFAXSTM] - C:\Program Files\Epson Software\FAX Utility\FUFAXSTM.exe [847872 2009-12-03] (SEIKO EPSON CORPORATION)
HKLM\...\Run: [EEventManager] - C:\Program Files\Epson Software\Event Manager\EEventManager.exe [976320 2009-12-03] (SEIKO EPSON CORPORATION)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [937920 2011-06-06] (Adobe Systems Incorporated)
HKLM\...\Run: [Eraser] - C:\Program Files\Eraser\Eraser.exe [980920 2012-05-22] (The Eraser Project)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-18] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKCU\...\Run: [ehTray.exe] - C:\Windows\ehome\ehtray.exe [125952 2008-01-21] (Microsoft Corporation)
HKCU\...\Run: [swg] - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2012-08-23] (Google Inc.)
HKCU\...\Run: [Skype] - C:\Program Files\Skype\Phone\Skype.exe [20584608 2013-11-14] (Skype Technologies S.A.)
HKCU\...\Run: [Spotify Web Helper] - C:\Users\highend-outlets\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1168896 2013-12-03] (Spotify Ltd)
HKCU\...\Run: [ATworks] - regsvr32.exe C:\Users\highend-outlets\AppData\Local\ATworks\CompatObjclass16.dll <===== ATTENTION
HKU\Default\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Default\...\Run: [ProductReg] - C:\Program Files\Acer\WR_PopUp\ProductReg.exe [ 2008-11-17] (Acer)
HKU\Default\...\RunOnce: [ScrSav] - C:\Windows\Screensavers\Acer\run_Acer.exe [ 2009-04-03] ()
HKU\Default User\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Default User\...\Run: [ProductReg] - C:\Program Files\Acer\WR_PopUp\ProductReg.exe [ 2008-11-17] (Acer)
HKU\Default User\...\RunOnce: [ScrSav] - C:\Windows\Screensavers\Acer\run_Acer.exe [ 2009-04-03] ()
Startup: C:\Users\highend-outlets\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk
ShortcutTarget: Adobe Gamma.lnk -> C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Before = hxxp://www.google.de/
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yahoo.com
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
SearchScopes: HKCU - {14D5D798-17F3-45C5-B0AB-2A4CC6ED9858} URL = hxxp://go.web.de/suchbox/ebay?query={searchTerms}
SearchScopes: HKCU - {2AB03437-A933-4AB1-BC95-C24C4EDABA12} URL = hxxp://go.1und1.de/suchbox/amazon?tag=1und1icon-21&field-keywords={searchTerms}
SearchScopes: HKCU - {3293CBE3-FE02-4EDE-894F-4262A6ECB575} URL = hxxp://go.1und1.de/suchbox/1und1suche?su={searchTerms}
SearchScopes: HKCU - {66CF46B7-0878-4292-95F5-70B05FC496D3} URL = hxxp://go.web.de/suchbox/google?q={searchTerms}
BHO: No Name - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -  No File
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.9012.1008\swg.dll (Google Inc.)
BHO: 1&&1 Internet AG Browser Configuration by mquadr.at - {D48FF4B4-E68F-47D1-8E25-81A0F0EEB341} - C:\Windows\System32\ieconfig_1und1.dll (mquadr.at software engineering und consulting GmbH)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} hxxp://www.ipix.com/download/ipixx.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog9 01 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 02 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 03 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 04 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 05 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 06 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 07 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 08 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 20 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
Tcpip\..\Interfaces\{1270B9F4-11CF-4ED7-8A0C-36D3CED1DD4C}: [NameServer]8.8.8.8,8.8.4.4

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw_1203133.dll (Adobe Systems, Inc.)
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.130\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin: @raidcall.en/RCplugin - C:\Users\highend-outlets\AppData\Roaming\raidcall\plugins\nprcplugin.dll (Raidcall)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\highend-outlets\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\highend-outlets\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF HKLM\...\Firefox\Extensions: [{A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}] - C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\
FF Extension: Firefox Synchronisation Extension - C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\
FF HKLM\...\Thunderbird\Extensions: [{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}] - C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\
FF Extension: Thunderbird Address Book Synchronisation Extension - C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\

Chrome: 
=======
CHR HomePage: hxxp://www.google.com
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\31.0.1650.63\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\31.0.1650.63\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\31.0.1650.63\pdf.dll ()
CHR Plugin: (Screen Capture Plugin) - C:\Users\highend-outlets\AppData\Local\Google\Chrome\User Data\Default\Extensions\alelhddbbhepgpmgidjdcjakblofbmce\3.4.5_0\plugins/screen_capture.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Google Earth Plugin) - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 7 U25) - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (McAfee Security Scanner +) - C:\Program Files\McAfee Security Scan\3.0.318\npMcAfeeMss.dll No File
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
CHR Plugin: (Pando Web Plugin) - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
CHR Plugin: (Windows Live\u00AE Photo Gallery) - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Unity Player) - C:\Users\highend-outlets\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
CHR Plugin: (Facebook Video Calling Plugin) - C:\Users\highend-outlets\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
CHR Plugin: (Raidcall plugin) - C:\Users\highend-outlets\AppData\Roaming\raidcall\plugins\nprcplugin.dll (Raidcall)
CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw_1203133.dll (Adobe Systems, Inc.)
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32_11_8_800_168.dll No File
CHR Plugin: (Java Deployment Toolkit 7.0.250.17) - C:\Windows\system32\npDeployJava1.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll No File
CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Extension: (Awesome Screenshot: Capture & Annotate) - C:\Users\highend-outlets\AppData\Local\Google\Chrome\User Data\Default\Extensions\alelhddbbhepgpmgidjdcjakblofbmce\3.5.10_0
CHR Extension: (Google Docs) - C:\Users\highend-outlets\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0
CHR Extension: (Google Drive) - C:\Users\highend-outlets\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (Turn Off the Lights) - C:\Users\highend-outlets\AppData\Local\Google\Chrome\User Data\Default\Extensions\bfbmjmiodbnnpllbbbfblcplfjjepjdn\2.3.0.5_0
CHR Extension: (YouTube) - C:\Users\highend-outlets\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Adblock Plus) - C:\Users\highend-outlets\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.7.2_0
CHR Extension: (Google Search) - C:\Users\highend-outlets\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (Photovisi - Photo Collage Maker) - C:\Users\highend-outlets\AppData\Local\Google\Chrome\User Data\Default\Extensions\emkkfkcbnpdnhgeolpbggbdogfngiadf\1.2_0
CHR Extension: (AdBlock) - C:\Users\highend-outlets\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.6.16_0
CHR Extension: (Quick Note) - C:\Users\highend-outlets\AppData\Local\Google\Chrome\User Data\Default\Extensions\mijlebbfndhelmdpmllgcfadlkankhok\1.6.3_0
CHR Extension: (DVDVideoSoft Browser Extension) - C:\Users\highend-outlets\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0
CHR Extension: (Google Wallet) - C:\Users\highend-outlets\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0
CHR Extension: (Gmail) - C:\Users\highend-outlets\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440376 2013-12-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-25] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1011768 2013-12-18] (Avira Operations GmbH & Co. KG)
R2 ePowerSvc; C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe [703008 2009-05-15] (Acer Incorporated)
R2 EpsonBidirectionalService; C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe [94208 2006-12-19] (SEIKO EPSON CORPORATION)
R2 EpsonCustomerResearchParticipation; C:\Program Files\EPSON\EpsonCustomerResearchParticipation\EPCP.exe [547936 2011-10-06] (SEIKO EPSON CORPORATION)
R2 EPSON_EB_RPCV4_04; C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50ST7.EXE [153600 2009-09-14] (SEIKO EPSON CORPORATION)
R2 EPSON_PM_RPCV4_04; C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RP7.EXE [121856 2009-09-14] (SEIKO EPSON CORPORATION)
R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe [235216 2013-09-06] (McAfee, Inc.)
R2 MWLService; C:\Program Files\EgisTec\MyWinLocker 3\x86\\MWLService.exe [305448 2009-05-14] (Egis Technology Inc.)
S3 npggsvc; C:\Windows\system32\GameMon.des [4121080 2011-06-13] (INCA Internet Co., Ltd.)
R2 NTI IScheduleSvc; C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [62208 2009-05-26] (NewTech Infosystems, Inc.)
R2 NTISchedulerSvc; C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [144632 2008-09-23] (NewTech Infosystems, Inc.)
R2 ODDPwrSvc; C:\Program Files\Acer\Optical Drive Power Management\ODDPWRSvc.exe [118784 2009-04-29] (Acer Incorporated)
S3 OverwolfUpdaterService; C:\Program Files\Overwolf\OverwolfUpdater.exe [18360 2013-08-22] (Overwolf Ltd)
R2 RS_Service; C:\Program Files\Acer\Acer VCM\RS_Service.exe [237568 2009-02-05] (Acer Incorporated)
R2 serviceIEConfig; C:\Windows\System32\ieconfig_1und1_svc.exe [1053848 2012-04-11] ()

==================== Drivers (All) ==========================

R0 ACPI; C:\Windows\System32\drivers\acpi.sys [266808 2008-01-21] (Microsoft Corporation)
S4 adp94xx; C:\Windows\system32\drivers\adp94xx.sys [422968 2008-01-21] (Adaptec, Inc.)
S4 adpahci; C:\Windows\system32\drivers\adpahci.sys [300600 2008-01-21] (Adaptec, Inc.)
S4 adpu160m; C:\Windows\system32\drivers\adpu160m.sys [101432 2008-01-21] (Adaptec, Inc.)
S4 adpu320; C:\Windows\system32\drivers\adpu320.sys [149560 2008-01-21] (Adaptec, Inc.)
R1 AFD; C:\Windows\system32\drivers\afd.sys [273408 2011-04-21] (Microsoft Corporation)
S3 agp440; C:\Windows\system32\drivers\agp440.sys [56376 2008-01-21] (Microsoft Corporation)
S4 aic78xx; C:\Windows\system32\drivers\djsvs.sys [71272 2006-11-02] (Adaptec, Inc.)
S4 aliide; C:\Windows\system32\drivers\aliide.sys [17464 2008-01-21] (Acer Laboratories Inc.)
S3 amdagp; C:\Windows\system32\drivers\amdagp.sys [57400 2008-01-21] (Microsoft Corporation)
S4 amdide; C:\Windows\system32\drivers\amdide.sys [17976 2008-01-21] (Microsoft Corporation)
S4 AmdK7; C:\Windows\system32\drivers\amdk7.sys [41472 2008-01-21] (Microsoft Corporation)
S4 AmdK8; C:\Windows\system32\drivers\amdk8.sys [44032 2008-01-21] (Microsoft Corporation)
S4 arc; C:\Windows\system32\drivers\arc.sys [79416 2008-01-21] (Adaptec, Inc.)
S4 arcsas; C:\Windows\system32\drivers\arcsas.sys [79928 2008-01-21] (Adaptec, Inc.)
S3 AsyncMac; C:\Windows\System32\DRIVERS\asyncmac.sys [17408 2008-01-21] (Microsoft Corporation)
R0 atapi; C:\Windows\System32\drivers\atapi.sys [21560 2008-01-21] (Microsoft Corporation)
S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [90400 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135648 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-25] (Avira Operations GmbH & Co. KG)
S3 b57nd60x; C:\Windows\System32\DRIVERS\b57nd60x.sys [179712 2008-01-21] (Broadcom Corporation)
R1 Beep; C:\Windows\System32\Drivers\Beep.sys [6144 2008-01-21] (Microsoft Corporation)
S4 blbdrive; C:\Windows\system32\drivers\blbdrive.sys [45568 2008-01-21] (Microsoft Corporation)
R3 bowser; C:\Windows\System32\DRIVERS\bowser.sys [69632 2011-02-22] (Microsoft Corporation)
S3 BrFiltLo; C:\Windows\system32\drivers\brfiltlo.sys [13568 2006-11-02] (Brother Industries, Ltd.)
S3 BrFiltUp; C:\Windows\system32\drivers\brfiltup.sys [5248 2006-11-02] (Brother Industries, Ltd.)
S4 Brserid; C:\Windows\system32\drivers\brserid.sys [71808 2006-11-02] (Brother Industries Ltd.)
S4 BrSerWdm; C:\Windows\system32\drivers\brserwdm.sys [62336 2006-11-02] (Brother Industries Ltd.)
S4 BrUsbMdm; C:\Windows\system32\drivers\brusbmdm.sys [12160 2006-11-02] (Brother Industries Ltd.)
S3 BrUsbSer; C:\Windows\system32\drivers\brusbser.sys [11904 2006-11-02] (Brother Industries Ltd.)
S4 BTHMODEM; C:\Windows\system32\drivers\bthmodem.sys [39936 2006-11-02] (Microsoft Corporation)
R4 cdfs; C:\Windows\System32\DRIVERS\cdfs.sys [70144 2008-01-21] (Microsoft Corporation)
R1 cdrom; C:\Windows\System32\DRIVERS\cdrom.sys [67072 2008-01-21] (Microsoft Corporation)
S4 circlass; C:\Windows\system32\drivers\circlass.sys [35328 2008-01-21] (Microsoft Corporation)
R0 CLFS; C:\Windows\System32\CLFS.sys [247352 2008-01-21] (Microsoft Corporation)
R3 CmBatt; C:\Windows\System32\DRIVERS\CmBatt.sys [14208 2008-01-21] (Microsoft Corporation)
S4 cmdide; C:\Windows\system32\drivers\cmdide.sys [19000 2008-01-21] (CMD Technology, Inc.)
R0 Compbatt; C:\Windows\System32\DRIVERS\compbatt.sys [20792 2008-01-21] (Microsoft Corporation)
R0 crcdisk; C:\Windows\System32\drivers\crcdisk.sys [24632 2008-01-21] (Microsoft Corporation)
S4 Crusoe; C:\Windows\system32\drivers\crusoe.sys [40960 2008-01-21] (Microsoft Corporation)
R1 DfsC; C:\Windows\System32\Drivers\dfsc.sys [75264 2011-04-14] (Microsoft Corporation)
R0 disk; C:\Windows\System32\drivers\disk.sys [55352 2008-01-21] (Microsoft Corporation)
R3 DKbFltr; C:\Windows\System32\DRIVERS\DKbFltr.sys [21000 2009-03-26] (Dritek System Inc.)
S3 drmkaud; C:\Windows\System32\drivers\drmkaud.sys [5632 2008-01-21] (Microsoft Corporation)
R3 DXGKrnl; C:\Windows\System32\drivers\dxgkrnl.sys [625152 2008-08-02] (Microsoft Corporation)
S3 E1G60; C:\Windows\System32\DRIVERS\E1G60I32.sys [118784 2008-01-21] (Intel Corporation)
R0 Ecache; C:\Windows\System32\drivers\ecache.sys [143416 2008-01-21] (Microsoft Corporation)
S4 elxstor; C:\Windows\system32\drivers\elxstor.sys [342584 2008-01-21] (Emulex)
S4 ErrDev; C:\Windows\system32\drivers\errdev.sys [6656 2008-01-21] (Microsoft Corporation)
S3 exfat; C:\Windows\System32\Drivers\exfat.sys [136192 2008-01-21] (Microsoft Corporation)
R3 fastfat; C:\Windows\System32\Drivers\fastfat.sys [143360 2008-01-21] (Microsoft Corporation)
S4 fdc; C:\Windows\System32\DRIVERS\fdc.sys [25088 2008-01-21] (Microsoft Corporation)
R0 FileInfo; C:\Windows\System32\drivers\fileinfo.sys [58936 2008-01-21] (Microsoft Corporation)
S3 Filetrace; C:\Windows\System32\drivers\filetrace.sys [27648 2008-01-21] (Microsoft Corporation)
S4 flpydisk; C:\Windows\System32\DRIVERS\flpydisk.sys [20480 2008-01-21] (Microsoft Corporation)
R0 FltMgr; C:\Windows\System32\drivers\fltmgr.sys [192056 2008-01-21] (Microsoft Corporation)
U1 Fs_Rec; C:\Windows\System32\Drivers\Fs_Rec.sys [12800 2008-01-21] (Microsoft Corporation)
S3 gagp30kx; C:\Windows\system32\drivers\gagp30kx.sys [61496 2008-01-21] (Microsoft Corporation)
S3 HdAudAddService; C:\Windows\System32\drivers\HdAudio.sys [235520 2006-11-02] (Microsoft Corporation)
R3 HDAudBus; C:\Windows\System32\DRIVERS\HDAudBus.sys [53760 2008-01-21] (Microsoft Corporation)
S4 HidBth; C:\Windows\system32\drivers\hidbth.sys [29184 2006-11-02] (Microsoft Corporation)
S4 HidIr; C:\Windows\system32\drivers\hidir.sys [21504 2006-11-02] (Microsoft Corporation)
R3 HidUsb; C:\Windows\System32\DRIVERS\hidusb.sys [12288 2009-07-16] (Microsoft Corporation)
S4 HpCISSs; C:\Windows\system32\drivers\hpcisss.sys [40504 2008-01-21] (Hewlett-Packard Company)
R3 HTTP; C:\Windows\System32\drivers\HTTP.sys [411136 2010-02-20] (Microsoft Corporation)
S4 i2omp; C:\Windows\system32\drivers\i2omp.sys [30264 2008-01-21] (Microsoft Corporation)
R1 i8042prt; C:\Windows\System32\DRIVERS\i8042prt.sys [54784 2008-01-21] (Microsoft Corporation)
R0 iaStor; C:\Windows\System32\DRIVERS\iaStor.sys [329752 2009-02-12] (Intel Corporation)
S4 iaStorV; C:\Windows\system32\drivers\iastorv.sys [235064 2008-01-21] (Intel Corporation)
R3 igfx; C:\Windows\System32\DRIVERS\igdkmd32.sys [9024512 2010-08-25] (Intel Corporation)
S4 iirsp; C:\Windows\system32\drivers\iirsp.sys [41576 2006-11-02] (Intel Corp./ICP vortex GmbH)
R3 IntcAzAudAddService; C:\Windows\System32\drivers\RTKVHDA.sys [2358112 2009-04-11] (Realtek Semiconductor Corp.)
R3 IntcHdmiAddService; C:\Windows\System32\drivers\IntcHdmi.sys [112640 2008-12-05] (Intel(R) Corporation)
S4 intelide; C:\Windows\system32\drivers\intelide.sys [17976 2008-01-21] (Microsoft Corporation)
R3 intelppm; C:\Windows\System32\DRIVERS\intelppm.sys [41472 2008-01-21] (Microsoft Corporation)
S3 IpFilterDriver; C:\Windows\System32\DRIVERS\ipfltdrv.sys [47616 2008-01-21] (Microsoft Corporation)
S4 IPMIDRV; C:\Windows\system32\drivers\ipmidrv.sys [64512 2008-01-21] (Microsoft Corporation)
S3 IPNAT; C:\Windows\System32\DRIVERS\ipnat.sys [100864 2008-01-21] (Microsoft Corporation)
R2 irda; C:\Windows\System32\DRIVERS\irda.sys [95744 2008-01-21] (Microsoft Corporation)
S3 IRENUM; C:\Windows\System32\drivers\irenum.sys [13312 2008-01-21] (Microsoft Corporation)
S4 isapnp; C:\Windows\system32\drivers\isapnp.sys [49720 2008-01-21] (Microsoft Corporation)
R3 iScsiPrt; C:\Windows\System32\DRIVERS\msiscsi.sys [181304 2008-01-21] (Microsoft Corporation)
S4 iteatapi; C:\Windows\system32\drivers\iteatapi.sys [35944 2006-11-02] (Integrated Technology Express, Inc.)
S4 iteraid; C:\Windows\system32\drivers\iteraid.sys [35944 2006-11-02] (Integrated Technology Express, Inc.)
R1 kbdclass; C:\Windows\System32\DRIVERS\kbdclass.sys [35384 2008-01-21] (Microsoft Corporation)
R1 kbdhid; C:\Windows\System32\DRIVERS\kbdhid.sys [15872 2008-01-21] (Microsoft Corporation)
R0 KSecDD; C:\Windows\System32\Drivers\ksecdd.sys [439896 2009-06-15] (Microsoft Corporation)
R3 L1C; C:\Windows\System32\DRIVERS\L1C60x86.sys [57344 2009-11-13] (Atheros Communications, Inc.)
S3 libusb0; C:\Windows\System32\DRIVERS\libusb0.sys [35392 2010-10-02] (hxxp://libusb-win32.sourceforge.net)
R2 lltdio; C:\Windows\System32\DRIVERS\lltdio.sys [47104 2008-01-21] (Microsoft Corporation)
S4 LSI_FC; C:\Windows\system32\drivers\lsi_fc.sys [96312 2008-01-21] (LSI Logic)
S4 LSI_SAS; C:\Windows\system32\drivers\lsi_sas.sys [89656 2008-01-21] (LSI Logic)
S4 LSI_SCSI; C:\Windows\system32\drivers\lsi_scsi.sys [96312 2008-01-21] (LSI Logic)
R2 luafv; C:\Windows\system32\drivers\luafv.sys [84480 2008-01-21] (Microsoft Corporation)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
S4 megasas; C:\Windows\system32\drivers\megasas.sys [31288 2008-01-21] (LSI Corporation)
S4 MegaSR; C:\Windows\system32\drivers\megasr.sys [386616 2008-01-21] (LSI Corporation, Inc.)
S3 Modem; C:\Windows\System32\drivers\modem.sys [31744 2008-01-21] (Microsoft Corporation)
R3 monitor; C:\Windows\System32\DRIVERS\monitor.sys [41984 2008-01-21] (Microsoft Corporation)
R1 mouclass; C:\Windows\System32\DRIVERS\mouclass.sys [34360 2008-01-21] (Microsoft Corporation)
R3 mouhid; C:\Windows\System32\DRIVERS\mouhid.sys [15872 2008-01-21] (Microsoft Corporation)
R0 MountMgr; C:\Windows\System32\drivers\mountmgr.sys [57400 2008-01-21] (Microsoft Corporation)
S4 mpio; C:\Windows\system32\drivers\mpio.sys [105016 2008-01-21] (Microsoft Corporation)
R3 mpsdrv; C:\Windows\System32\drivers\mpsdrv.sys [64000 2008-01-21] (Microsoft Corporation)
S4 Mraid35x; C:\Windows\system32\drivers\mraid35x.sys [33384 2006-11-02] (LSI Logic Corporation)
S3 MRxDAV; C:\Windows\system32\drivers\mrxdav.sys [110080 2008-01-21] (Microsoft Corporation)
R3 mrxsmb; C:\Windows\System32\DRIVERS\mrxsmb.sys [105984 2011-04-29] (Microsoft Corporation)
R3 mrxsmb10; C:\Windows\System32\DRIVERS\mrxsmb10.sys [213504 2011-07-06] (Microsoft Corporation)
R3 mrxsmb20; C:\Windows\System32\DRIVERS\mrxsmb20.sys [79360 2011-04-29] (Microsoft Corporation)
S4 msahci; C:\Windows\system32\drivers\msahci.sys [28728 2008-01-21] (Microsoft Corporation)
S4 msdsm; C:\Windows\system32\drivers\msdsm.sys [94776 2008-01-21] (Microsoft Corporation)
R1 Msfs; C:\Windows\System32\Drivers\Msfs.sys [22528 2008-01-21] (Microsoft Corporation)
R0 msisadrv; C:\Windows\System32\drivers\msisadrv.sys [16440 2008-01-21] (Microsoft Corporation)
S3 MSKSSRV; C:\Windows\System32\drivers\MSKSSRV.sys [8192 2008-01-21] (Microsoft Corporation)
S3 MSPCLOCK; C:\Windows\System32\drivers\MSPCLOCK.sys [5888 2008-01-21] (Microsoft Corporation)
S3 MSPQM; C:\Windows\System32\drivers\MSPQM.sys [5504 2008-01-21] (Microsoft Corporation)
S3 MsRPC; C:\Windows\System32\Drivers\MsRPC.sys [163384 2008-01-21] (Microsoft Corporation)
R3 mssmbios; C:\Windows\System32\DRIVERS\mssmbios.sys [31288 2008-01-21] (Microsoft Corporation)
S3 MSTEE; C:\Windows\System32\drivers\MSTEE.sys [6016 2008-01-21] (Microsoft Corporation)
R0 Mup; C:\Windows\System32\Drivers\mup.sys [49720 2008-01-21] (Microsoft Corporation)
R1 mwlPSDFilter; C:\Windows\System32\DRIVERS\mwlPSDFilter.sys [19504 2008-12-04] (Egis Incorporated.)
R1 mwlPSDNServ; C:\Windows\System32\DRIVERS\mwlPSDNServ.sys [16432 2008-12-04] (Egis Incorporated.)
R1 mwlPSDVDisk; C:\Windows\System32\DRIVERS\mwlPSDVDisk.sys [59952 2008-12-04] (Egis Incorporated.)
R3 NativeWifiP; C:\Windows\System32\DRIVERS\nwifi.sys [148480 2008-05-20] (Microsoft Corporation)
R0 NDIS; C:\Windows\System32\drivers\ndis.sys [529464 2009-07-16] (Microsoft Corporation)
R3 NdisTapi; C:\Windows\System32\DRIVERS\ndistapi.sys [20992 2008-01-21] (Microsoft Corporation)
R3 Ndisuio; C:\Windows\System32\DRIVERS\ndisuio.sys [16896 2008-01-21] (Microsoft Corporation)
R3 NdisWan; C:\Windows\System32\DRIVERS\ndiswan.sys [121344 2008-01-21] (Microsoft Corporation)
R3 NDProxy; C:\Windows\System32\Drivers\NDProxy.sys [49664 2008-01-21] (Microsoft Corporation)
R1 NetBIOS; C:\Windows\System32\DRIVERS\netbios.sys [35840 2008-01-21] (Microsoft Corporation)
R1 netbt; C:\Windows\System32\DRIVERS\netbt.sys [184320 2008-01-21] (Microsoft Corporation)
R3 NETw5v32; C:\Windows\System32\DRIVERS\NETw5v32.sys [3668480 2008-11-17] (Intel Corporation)
S4 nfrd960; C:\Windows\system32\drivers\nfrd960.sys [45160 2006-11-02] (IBM Corporation)
S3 nmwcd; C:\Windows\System32\drivers\ccdcmb.sys [18304 2010-12-02] (Nokia)
S3 nmwcdc; C:\Windows\System32\drivers\ccdcmbo.sys [23168 2010-12-02] (Nokia)
S3 nmwcdnsu; C:\Windows\System32\drivers\nmwcdnsu.sys [137600 2010-12-02] (Nokia)
S3 nmwcdnsuc; C:\Windows\System32\drivers\nmwcdnsuc.sys [8576 2010-12-02] (Nokia)
R1 Npfs; C:\Windows\System32\Drivers\Npfs.sys [34816 2008-01-21] (Microsoft Corporation)
S3 NSCIRDA; C:\Windows\System32\DRIVERS\nscirda.sys [30720 2008-01-21] (National Semiconductor Corporation)
R1 nsiproxy; C:\Windows\System32\drivers\nsiproxy.sys [16384 2008-01-21] (Microsoft Corporation)
R3 Ntfs; C:\Windows\System32\Drivers\Ntfs.sys [1081912 2008-01-21] (Microsoft Corporation)
R3 NTIDrvr; C:\Windows\system32\drivers\NTIDrvr.sys [15360 2009-05-05] (NewTech Infosystems, Inc.)
S4 ntrigdigi; C:\Windows\system32\drivers\ntrigdigi.sys [20608 2006-11-02] (N-trig Innovative Technologies)
R1 Null; C:\Windows\System32\Drivers\Null.sys [4608 2008-01-21] (Microsoft Corporation)
S4 nvraid; C:\Windows\system32\drivers\nvraid.sys [102968 2008-01-21] (NVIDIA Corporation)
S4 nvstor; C:\Windows\system32\drivers\nvstor.sys [45112 2008-01-21] (NVIDIA Corporation)
S3 nv_agp; C:\Windows\system32\drivers\nv_agp.sys [109112 2008-01-21] (Microsoft Corporation)
S4 ohci1394; C:\Windows\System32\DRIVERS\ohci1394.sys [61952 2008-01-21] (Microsoft Corporation)
S4 Parport; C:\Windows\system32\drivers\parport.sys [79360 2006-11-02] (Microsoft Corporation)
R0 partmgr; C:\Windows\System32\drivers\partmgr.sys [56376 2008-01-21] (Microsoft Corporation)
S2 Parvdm; C:\Windows\system32\drivers\parvdm.sys [8704 2006-11-02] (Microsoft Corporation)
S3 pccsmcfd; C:\Windows\System32\DRIVERS\pccsmcfd.sys [18816 2008-08-26] (Nokia)
R0 pci; C:\Windows\System32\drivers\pci.sys [151096 2008-01-21] (Microsoft Corporation)
S4 pciide; C:\Windows\system32\drivers\pciide.sys [16440 2008-01-21] (Microsoft Corporation)
S4 pcmcia; C:\Windows\system32\DRIVERS\pcmcia.sys [179256 2008-01-21] (Microsoft Corporation)
R2 PEAUTH; C:\Windows\System32\drivers\peauth.sys [878080 2006-11-02] (Microsoft Corporation)
R3 PptpMiniport; C:\Windows\System32\DRIVERS\raspptp.sys [62976 2008-01-21] (Microsoft Corporation)
S4 Processor; C:\Windows\system32\drivers\processr.sys [40960 2008-01-21] (Microsoft Corporation)
R1 PSched; C:\Windows\System32\DRIVERS\pacer.sys [72192 2008-04-05] (Microsoft Corporation)
R3 pspdisp; C:\Windows\System32\DRIVERS\pspdisp.sys [3072 2011-01-18] (JJS)
S4 ql2300; C:\Windows\system32\drivers\ql2300.sys [1122360 2008-01-21] (QLogic Corporation)
S4 ql40xx; C:\Windows\system32\drivers\ql40xx.sys [106088 2006-11-02] (QLogic Corporation)
S3 QWAVEdrv; C:\Windows\system32\drivers\qwavedrv.sys [31232 2008-01-21] (Microsoft Corporation)
R1 RasAcd; C:\Windows\System32\DRIVERS\rasacd.sys [11776 2008-01-21] (Microsoft Corporation)
R3 Rasl2tp; C:\Windows\System32\DRIVERS\rasl2tp.sys [76288 2008-01-21] (Microsoft Corporation)
R3 RasPppoe; C:\Windows\System32\DRIVERS\raspppoe.sys [41472 2008-01-21] (Microsoft Corporation)
R3 RasSstp; C:\Windows\System32\DRIVERS\rassstp.sys [69120 2008-01-21] (Microsoft Corporation)
R1 rdbss; C:\Windows\System32\DRIVERS\rdbss.sys [224768 2008-01-21] (Microsoft Corporation)
R1 RDPCDD; C:\Windows\System32\DRIVERS\RDPCDD.sys [6144 2008-01-21] (Microsoft Corporation)
S4 rdpdr; C:\Windows\system32\drivers\rdpdr.sys [248832 2008-01-21] (Microsoft Corporation)
R1 RDPENCDD; C:\Windows\System32\drivers\rdpencdd.sys [6144 2008-01-21] (Microsoft Corporation)
S3 RDPWD; C:\Windows\System32\Drivers\RDPWD.sys [181248 2008-01-21] (Microsoft Corporation)
S3 RRNetCap; C:\Windows\System32\DRIVERS\rrnetcap.sys [31848 2012-12-18] (RapidSolution Software AG)
R3 RRNetCapMP; C:\Windows\System32\DRIVERS\rrnetcap.sys [31848 2012-12-18] (RapidSolution Software AG)
R2 rspndr; C:\Windows\System32\DRIVERS\rspndr.sys [60416 2008-01-21] (Microsoft Corporation)
S3 RTSTOR; C:\Windows\System32\drivers\RTSTOR.SYS [62976 2008-12-02] (Realtek Semiconductor Corp.)
S4 sbp2port; C:\Windows\system32\drivers\sbp2port.sys [76392 2006-11-02] (Microsoft Corporation)
S4 sdbus; C:\Windows\System32\DRIVERS\sdbus.sys [88576 2008-01-21] (Microsoft Corporation)
R2 secdrv; C:\Windows\System32\Drivers\secdrv.sys [20480 2006-11-02] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
S3 Serenum; C:\Windows\system32\drivers\serenum.sys [17920 2006-11-02] (Microsoft Corporation)
S3 Serial; C:\Windows\system32\drivers\serial.sys [83456 2006-11-02] (Microsoft Corporation)
S4 sermouse; C:\Windows\system32\drivers\sermouse.sys [19968 2008-01-21] (Microsoft Corporation)
S4 sffdisk; C:\Windows\system32\drivers\sffdisk.sys [13312 2008-01-21] (Microsoft Corporation)
S3 sffp_mmc; C:\Windows\system32\drivers\sffp_mmc.sys [12288 2008-01-21] (Microsoft Corporation)
S3 sffp_sd; C:\Windows\system32\drivers\sffp_sd.sys [11776 2008-01-21] (Microsoft Corporation)
S4 sfloppy; C:\Windows\system32\drivers\sfloppy.sys [13312 2006-11-02] (Microsoft Corporation)
S3 sisagp; C:\Windows\system32\drivers\sisagp.sys [55864 2008-01-21] (Microsoft Corporation)
S4 SiSRaid2; C:\Windows\system32\drivers\sisraid2.sys [41016 2008-01-21] (Microsoft Corporation)
S4 SiSRaid4; C:\Windows\system32\drivers\sisraid4.sys [74808 2008-01-21] (Silicon Integrated Systems)
R1 Smb; C:\Windows\System32\DRIVERS\smb.sys [66560 2008-01-21] (Microsoft Corporation)
R0 spldr; C:\Windows\System32\Drivers\spldr.sys [21048 2008-01-21] (Microsoft Corporation)
R3 srv; C:\Windows\System32\DRIVERS\srv.sys [304640 2011-02-18] (Microsoft Corporation)
R3 srv2; C:\Windows\System32\DRIVERS\srv2.sys [146432 2011-04-29] (Microsoft Corporation)
R3 srvnet; C:\Windows\System32\DRIVERS\srvnet.sys [102400 2011-04-29] (Microsoft Corporation)
S1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-12-09] (Avira GmbH)
R3 swenum; C:\Windows\System32\DRIVERS\swenum.sys [15288 2008-01-21] (Microsoft Corporation)
S4 Symc8xx; C:\Windows\system32\drivers\symc8xx.sys [35944 2006-11-02] (LSI Logic)
S4 Sym_hi; C:\Windows\system32\drivers\sym_hi.sys [31848 2006-11-02] (LSI Logic)
S4 Sym_u3; C:\Windows\system32\drivers\sym_u3.sys [34920 2006-11-02] (LSI Logic)
R3 SynTP; C:\Windows\System32\DRIVERS\SynTP.sys [205232 2009-02-06] (Synaptics Incorporated)
R3 tbhsd; C:\Windows\System32\drivers\tbhsd.sys [39048 2012-12-18] (RapidSolution Software AG)
R1 Tcpip; C:\Windows\System32\drivers\tcpip.sys [898952 2010-06-16] (Microsoft Corporation)
S3 Tcpip6; C:\Windows\System32\DRIVERS\tcpip.sys [898952 2010-06-16] (Microsoft Corporation)
R2 tcpipreg; C:\Windows\System32\drivers\tcpipreg.sys [30208 2008-01-21] (Microsoft Corporation)
S3 TDPIPE; C:\Windows\System32\drivers\tdpipe.sys [17920 2008-01-21] (Microsoft Corporation)
S3 TDTCP; C:\Windows\System32\drivers\tdtcp.sys [29184 2008-01-21] (Microsoft Corporation)
R1 tdx; C:\Windows\System32\DRIVERS\tdx.sys [71680 2008-01-21] (Microsoft Corporation)
R1 TermDD; C:\Windows\System32\DRIVERS\termdd.sys [54328 2008-01-21] (Microsoft Corporation)
S3 tssecsrv; C:\Windows\System32\DRIVERS\tssecsrv.sys [23552 2008-01-21] (Microsoft Corporation)
R3 tunmp; C:\Windows\System32\DRIVERS\tunmp.sys [15360 2008-01-21] (Microsoft Corporation)
R3 tunnel; C:\Windows\System32\DRIVERS\tunnel.sys [25088 2010-02-18] (Microsoft Corporation)
S3 uagp35; C:\Windows\system32\drivers\uagp35.sys [59448 2008-01-21] (Microsoft Corporation)
R3 UBHelper; C:\Windows\system32\drivers\UBHelper.sys [14336 2009-05-05] (NewTech Infosystems Corporation)
S4 udfs; C:\Windows\System32\DRIVERS\udfs.sys [226816 2008-01-21] (Microsoft Corporation)
S3 uliagpkx; C:\Windows\system32\drivers\uliagpkx.sys [60984 2008-01-21] (Microsoft Corporation)
S4 uliahci; C:\Windows\system32\drivers\uliahci.sys [238648 2008-01-21] (ULi Electronics Inc.)
S4 UlSata; C:\Windows\system32\drivers\ulsata.sys [98408 2006-11-02] (Promise Technology, Inc.)
S4 ulsata2; C:\Windows\system32\drivers\ulsata2.sys [115816 2008-01-21] (Promise Technology, Inc.)
R3 umbus; C:\Windows\System32\DRIVERS\umbus.sys [34816 2008-01-21] (Microsoft Corporation)
S3 upperdev; C:\Windows\System32\DRIVERS\usbser_lowerflt.sys [8192 2010-12-02] (Nokia)
R3 usbccgp; C:\Windows\System32\DRIVERS\usbccgp.sys [73216 2009-07-16] (Microsoft Corporation)
S4 usbcir; C:\Windows\system32\drivers\usbcir.sys [68608 2006-11-02] (Microsoft Corporation)
R3 usbehci; C:\Windows\System32\DRIVERS\usbehci.sys [39936 2009-07-16] (Microsoft Corporation)
R3 usbhub; C:\Windows\System32\DRIVERS\usbhub.sys [194560 2009-07-16] (Microsoft Corporation)
S4 usbohci; C:\Windows\system32\drivers\usbohci.sys [19456 2006-11-02] (Microsoft Corporation)
S3 usbprint; C:\Windows\System32\DRIVERS\usbprint.sys [18944 2008-01-21] (Microsoft Corporation)
S3 usbscan; C:\Windows\System32\DRIVERS\usbscan.sys [35328 2008-01-21] (Microsoft Corporation)
S3 usbser; C:\Windows\System32\drivers\usbser.sys [28160 2008-01-21] (Microsoft Corporation)
S3 UsbserFilt; C:\Windows\System32\DRIVERS\usbser_lowerfltj.sys [8192 2010-12-02] (Nokia)
S3 USBSTOR; C:\Windows\System32\DRIVERS\USBSTOR.SYS [55296 2008-01-21] (Microsoft Corporation)
R3 usbuhci; C:\Windows\System32\DRIVERS\usbuhci.sys [23552 2009-07-16] (Microsoft Corporation)
R3 usbvideo; C:\Windows\System32\Drivers\usbvideo.sys [134016 2008-01-21] (Microsoft Corporation)
S3 vga; C:\Windows\System32\DRIVERS\vgapnp.sys [26112 2008-01-21] (Microsoft Corporation)
R1 VgaSave; C:\Windows\System32\drivers\vga.sys [25088 2008-01-21] (Microsoft Corporation)
S3 viaagp; C:\Windows\system32\drivers\viaagp.sys [56888 2008-01-21] (Microsoft Corporation)
S4 ViaC7; C:\Windows\system32\drivers\viac7.sys [41472 2008-01-21] (Microsoft Corporation)
S4 viaide; C:\Windows\system32\drivers\viaide.sys [20024 2008-01-21] (VIA Technologies, Inc.)
R0 volmgr; C:\Windows\System32\drivers\volmgr.sys [52792 2008-01-21] (Microsoft Corporation)
R0 volmgrx; C:\Windows\System32\drivers\volmgrx.sys [294456 2008-01-21] ()
R0 volsnap; C:\Windows\System32\drivers\volsnap.sys [227896 2008-01-21] ()
S4 vsmraid; C:\Windows\system32\drivers\vsmraid.sys [130616 2008-01-21] ()
S3 w800bus; C:\Windows\System32\DRIVERS\w800bus.sys [60768 2005-06-13] ()
S4 WacomPen; C:\Windows\system32\drivers\wacompen.sys [20608 2006-11-02] ()
S3 Wanarp; C:\Windows\System32\DRIVERS\wanarp.sys [62464 2008-01-21] ()
R1 Wanarpv6; C:\Windows\System32\DRIVERS\wanarp.sys [62464 2008-01-21] ()
S4 Wd; C:\Windows\system32\drivers\wd.sys [22072 2008-01-21] ()
R0 Wdf01000; C:\Windows\System32\drivers\Wdf01000.sys [445008 2009-07-14] ()
S3 WinRing0_1_2_0; C:\Program Files\Razer\Razer Game Booster\Driver\WinRing0.sys [14416 2012-08-01] (OpenLibSys.org)
U3 Winsock; No ImagePath
S3 WinUSB; C:\Windows\System32\DRIVERS\WinUSB.sys [31616 2008-01-21] ()
R3 WmiAcpi; C:\Windows\System32\DRIVERS\wmiacpi.sys [11264 2008-01-21] ()
S3 WpdUsb; C:\Windows\System32\DRIVERS\wpdusb.sys [39936 2008-01-21] ()
R1 ws2ifsl; C:\Windows\system32\drivers\ws2ifsl.sys [15872 2008-01-21] ()
S3 WSDPrintDevice; C:\Windows\System32\DRIVERS\WSDPrint.sys [16896 2008-01-21] ()
S3 WSDScan; C:\Windows\System32\DRIVERS\WSDScan.sys [19968 2008-01-21] ()
R3 WudfPf; C:\Windows\System32\drivers\WudfPf.sys [92672 2009-07-14] ()
R3 WUDFRd; C:\Windows\System32\DRIVERS\WUDFRd.sys [132224 2009-07-14] ()
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-21] (Microsoft Corporation)
U5 BattC; C:\Windows\System32\Drivers\BattC.sys [28216 2008-01-21] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 EagleXNt; \??\C:\Windows\system32\drivers\EagleXNt.sys [x]
U5 ec55e6b546b6bca3; C:\Windows\System32\Drivers\ec55e6b546b6bca3.sys [60544 2014-01-03] ()
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
S3 XDva402; \??\C:\Windows\system32\XDva402.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-01-07 16:53 - 2014-01-07 16:53 - 00000000 ____D C:\Program Files\ESET
2014-01-07 16:50 - 2014-01-07 16:50 - 02347384 _____ (ESET) C:\Users\highend-outlets\Downloads\esetsmartinstaller_enu.exe
2014-01-07 16:47 - 2014-01-07 16:47 - 00000000 ____D C:\Users\highend-outlets\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD
2014-01-07 16:44 - 2014-01-07 16:44 - 00000348 _____ C:\Windows\PFRO.log
2014-01-06 21:45 - 2014-01-06 21:45 - 00410528 _____ (AVAST Software) C:\Windows\system32\Drivers\vxqrmluf.sys
2014-01-06 21:45 - 2014-01-06 21:45 - 00410528 _____ (AVAST Software) C:\Windows\system32\Drivers\tarvowla.sys
2014-01-06 21:45 - 2014-01-06 21:45 - 00410528 _____ (AVAST Software) C:\Windows\system32\Drivers\czdmwyqx.sys
2014-01-06 21:43 - 2014-01-06 21:43 - 00410528 _____ (AVAST Software) C:\Windows\system32\Drivers\edhiwysm.sys
2014-01-06 21:29 - 2014-01-06 21:29 - 00410528 _____ (AVAST Software) C:\Windows\system32\Drivers\bcvzxmte.sys
2014-01-06 16:52 - 2014-01-06 16:52 - 00000406 _____ C:\Windows\WindowsUpdate.log
2014-01-06 15:38 - 2014-01-06 15:38 - 00410528 _____ (AVAST Software) C:\Windows\system32\Drivers\knikxjfp.sys
2014-01-06 15:35 - 2014-01-06 15:35 - 00410528 _____ (AVAST Software) C:\Windows\system32\Drivers\rwuxdyqw.sys
2014-01-06 13:59 - 2014-01-06 13:59 - 00410528 _____ (AVAST Software) C:\Windows\system32\Drivers\dnotgmyj.sys
2014-01-06 13:57 - 2014-01-06 13:57 - 00410528 _____ (AVAST Software) C:\Windows\system32\Drivers\kpawwwrb.sys
2014-01-06 13:33 - 2014-01-06 13:33 - 00410528 _____ (AVAST Software) C:\Windows\system32\Drivers\uykbixwg.sys
2014-01-06 13:33 - 2014-01-06 13:33 - 00000000 ____D C:\ProgramData\AVAST Software
2014-01-06 13:28 - 2014-01-06 13:29 - 91412976 _____ (AVAST Software) C:\Users\highend-outlets\Downloads\avast_free_antivirus_setup.exe
2014-01-06 12:17 - 2014-01-06 12:17 - 00001008 _____ C:\Users\highend-outlets\Desktop\JRT.txt
2014-01-06 12:13 - 2014-01-06 12:13 - 00000000 ____D C:\Windows\ERUNT
2014-01-06 11:49 - 2014-01-06 11:51 - 00000000 ____D C:\AdwCleaner
2014-01-05 18:26 - 2014-01-05 18:27 - 01233962 _____ C:\Users\highend-outlets\Downloads\adwcleaner.exe
2014-01-05 18:26 - 2014-01-05 18:26 - 01036305 _____ (Thisisu) C:\Users\highend-outlets\Downloads\JRT.exe
2014-01-04 18:48 - 2014-01-04 18:48 - 00017223 _____ C:\ComboFix.txt
2014-01-04 18:22 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe
2014-01-04 18:22 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe
2014-01-04 18:22 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-01-04 18:22 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-01-04 18:22 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-01-04 18:22 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe
2014-01-04 18:22 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe
2014-01-04 18:22 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe
2014-01-04 18:03 - 2014-01-04 18:48 - 00000000 ____D C:\Qoobox
2014-01-04 18:01 - 2014-01-04 18:46 - 00000000 ____D C:\Windows\erdnt
2014-01-03 18:01 - 2014-01-03 18:01 - 00000910 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-01-03 18:01 - 2014-01-03 18:01 - 00000000 ____D C:\Users\highend-outlets\AppData\Roaming\Malwarebytes
2014-01-03 18:01 - 2014-01-03 18:01 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-03 18:01 - 2014-01-03 18:01 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2014-01-03 18:01 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-01-03 18:00 - 2014-01-03 18:00 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\highend-outlets\Downloads\mbam-setup-1.75.0.1300.exe
2014-01-03 11:21 - 2014-01-06 12:45 - 00026537 _____ C:\Users\highend-outlets\Downloads\Addition.txt
2014-01-03 11:20 - 2014-01-08 12:50 - 00049351 _____ C:\Users\highend-outlets\Downloads\FRST.txt
2014-01-03 11:19 - 2014-01-03 14:10 - 00014038 _____ C:\Users\highend-outlets\Downloads\defogger_disable.log
2014-01-03 11:19 - 2014-01-03 11:19 - 00000000 ____D C:\FRST
2014-01-03 11:19 - 2014-01-03 11:19 - 00000000 _____ C:\Users\highend-outlets\defogger_reenable
2014-01-03 11:18 - 2014-01-03 11:18 - 00377856 _____ C:\Users\highend-outlets\Downloads\gmer_2.1.19163.exe
2014-01-03 11:17 - 2014-01-03 11:18 - 01064581 _____ (Farbar) C:\Users\highend-outlets\Downloads\FRST.exe
2014-01-03 11:17 - 2014-01-03 11:17 - 00050477 _____ C:\Users\highend-outlets\Downloads\Defogger.exe
2014-01-03 09:45 - 2014-01-03 09:48 - 129598176 _____ C:\Users\highend-outlets\Downloads\avira_free_antivirus_de.exe
2014-01-03 09:37 - 2014-01-03 09:37 - 00060544 _____ C:\Windows\system32\Drivers\ec55e6b546b6bca3.sys
2014-01-01 19:51 - 2014-01-03 18:31 - 00000000 ____D C:\Users\highend-outlets\AppData\Local\ATworks
2014-01-01 19:39 - 2014-01-01 19:39 - 00485376 _____ (Microsoft Corporation) C:\Users\highend-outlets\Downloads\Nicht bestätigt 40043.crdownload
2013-12-31 20:20 - 2014-01-03 18:28 - 00000000 ____D C:\SIERRA
2013-12-31 20:20 - 2013-12-31 20:22 - 00000283 _____ C:\Windows\SIERRA.INI
2013-12-31 20:20 - 2013-12-31 20:20 - 00000000 __RSH C:\MSDOS.SYS
2013-12-31 20:20 - 2013-12-31 20:20 - 00000000 __RSH C:\IO.SYS
2013-12-30 13:29 - 2014-01-07 23:37 - 00000000 ____D C:\Program Files\Tales of Pirates II
2013-12-29 22:17 - 2012-10-31 22:13 - 00245612 _____ C:\Program Files\CharacterAction.tx
2013-12-29 22:15 - 2013-12-29 22:15 - 00241923 _____ C:\Users\highend-outlets\Downloads\CharacterAction (4).tx
2013-12-28 02:52 - 2013-12-28 02:52 - 02848968 _____ C:\Users\highend-outlets\Downloads\Black Skin Ver. 3.1.1.rar
2013-12-17 22:19 - 2013-12-17 22:19 - 00168816 _____ C:\Users\highend-outlets\Downloads\lethal_league.zip
2013-12-15 19:20 - 2013-12-15 19:20 - 00030022 _____ C:\Users\highend-outlets\Downloads\M14 (1).zip
2013-12-15 14:55 - 2013-12-15 14:55 - 00110484 _____ C:\Users\highend-outlets\Downloads\Metroid II - Return of Samus (World).zip
2013-12-15 14:52 - 2013-12-15 14:52 - 00296339 _____ C:\Users\highend-outlets\Downloads\Legend of Zelda, The - Link's Awakening (USA, Europe).zip
2013-12-15 14:51 - 2013-12-15 14:51 - 00331754 _____ C:\Users\highend-outlets\Downloads\Kirby's Dream Land 2 (USA, Europe).zip
2013-12-15 14:49 - 2013-12-15 14:50 - 00378607 _____ C:\Users\highend-outlets\Downloads\Pokemon - Red Version (USA, Europe).zip
2013-12-15 14:24 - 2013-12-15 14:25 - 32551762 _____ C:\Users\highend-outlets\Downloads\OFW 660.zip
2013-12-10 20:54 - 2013-12-29 13:23 - 00000000 ____D C:\Users\highend-outlets\Programme
2013-12-10 20:52 - 2013-12-10 20:53 - 00985720 _____ C:\Users\highend-outlets\Downloads\ElophantClient.zip

==================== One Month Modified Files and Folders =======

2014-01-08 12:50 - 2014-01-03 11:20 - 00049351 _____ C:\Users\highend-outlets\Downloads\FRST.txt
2014-01-08 12:26 - 2013-06-09 21:01 - 00000000 ____D C:\Users\highend-outlets\AppData\Local\PMB Files
2014-01-08 12:26 - 2013-06-09 21:01 - 00000000 ____D C:\ProgramData\PMB Files
2014-01-08 12:07 - 2006-11-02 13:47 - 00003424 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-08 12:07 - 2006-11-02 13:47 - 00003424 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-07 23:37 - 2013-12-30 13:29 - 00000000 ____D C:\Program Files\Tales of Pirates II
2014-01-07 20:21 - 2012-06-17 20:24 - 00001112 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-07 16:53 - 2014-01-07 16:53 - 00000000 ____D C:\Program Files\ESET
2014-01-07 16:52 - 2006-11-02 11:33 - 00769188 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-07 16:50 - 2014-01-07 16:50 - 02347384 _____ (ESET) C:\Users\highend-outlets\Downloads\esetsmartinstaller_enu.exe
2014-01-07 16:49 - 2013-01-08 19:13 - 00000000 ____D C:\Users\highend-outlets\AppData\Roaming\Skype
2014-01-07 16:47 - 2014-01-07 16:47 - 00000000 ____D C:\Users\highend-outlets\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD
2014-01-07 16:47 - 2013-07-19 14:33 - 00009788 _____ C:\autoupdate.log
2014-01-07 16:45 - 2006-11-02 14:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-07 16:44 - 2014-01-07 16:44 - 00000348 _____ C:\Windows\PFRO.log
2014-01-06 21:54 - 2006-11-02 14:01 - 00032594 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2014-01-06 21:45 - 2014-01-06 21:45 - 00410528 _____ (AVAST Software) C:\Windows\system32\Drivers\vxqrmluf.sys
2014-01-06 21:45 - 2014-01-06 21:45 - 00410528 _____ (AVAST Software) C:\Windows\system32\Drivers\tarvowla.sys
2014-01-06 21:45 - 2014-01-06 21:45 - 00410528 _____ (AVAST Software) C:\Windows\system32\Drivers\czdmwyqx.sys
2014-01-06 21:43 - 2014-01-06 21:43 - 00410528 _____ (AVAST Software) C:\Windows\system32\Drivers\edhiwysm.sys
2014-01-06 21:29 - 2014-01-06 21:29 - 00410528 _____ (AVAST Software) C:\Windows\system32\Drivers\bcvzxmte.sys
2014-01-06 17:05 - 2013-04-30 17:47 - 00000000 ____D C:\Users\highend-outlets\AppData\Roaming\Spotify
2014-01-06 16:52 - 2014-01-06 16:52 - 00000406 _____ C:\Windows\WindowsUpdate.log
2014-01-06 15:38 - 2014-01-06 15:38 - 00410528 _____ (AVAST Software) C:\Windows\system32\Drivers\knikxjfp.sys
2014-01-06 15:35 - 2014-01-06 15:35 - 00410528 _____ (AVAST Software) C:\Windows\system32\Drivers\rwuxdyqw.sys
2014-01-06 13:59 - 2014-01-06 13:59 - 00410528 _____ (AVAST Software) C:\Windows\system32\Drivers\dnotgmyj.sys
2014-01-06 13:57 - 2014-01-06 13:57 - 00410528 _____ (AVAST Software) C:\Windows\system32\Drivers\kpawwwrb.sys
2014-01-06 13:33 - 2014-01-06 13:33 - 00410528 _____ (AVAST Software) C:\Windows\system32\Drivers\uykbixwg.sys
2014-01-06 13:33 - 2014-01-06 13:33 - 00000000 ____D C:\ProgramData\AVAST Software
2014-01-06 13:29 - 2014-01-06 13:28 - 91412976 _____ (AVAST Software) C:\Users\highend-outlets\Downloads\avast_free_antivirus_setup.exe
2014-01-06 12:45 - 2014-01-03 11:21 - 00026537 _____ C:\Users\highend-outlets\Downloads\Addition.txt
2014-01-06 12:17 - 2014-01-06 12:17 - 00001008 _____ C:\Users\highend-outlets\Desktop\JRT.txt
2014-01-06 12:13 - 2014-01-06 12:13 - 00000000 ____D C:\Windows\ERUNT
2014-01-06 11:51 - 2014-01-06 11:49 - 00000000 ____D C:\AdwCleaner
2014-01-06 11:43 - 2006-11-02 13:37 - 00000000 ____D C:\Windows\twain_32
2014-01-06 11:21 - 2012-06-17 20:24 - 00001116 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-06 10:59 - 2012-04-13 10:51 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-01-05 22:31 - 2012-09-02 12:26 - 00000968 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-76954294-2760295059-2378521770-1000UA.job
2014-01-05 18:27 - 2014-01-05 18:26 - 01233962 _____ C:\Users\highend-outlets\Downloads\adwcleaner.exe
2014-01-05 18:26 - 2014-01-05 18:26 - 01036305 _____ (Thisisu) C:\Users\highend-outlets\Downloads\JRT.exe
2014-01-05 18:10 - 2011-05-06 17:05 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-76954294-2760295059-2378521770-1000Core.job
2014-01-05 13:31 - 2012-09-02 12:26 - 00000946 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-76954294-2760295059-2378521770-1000Core.job
2014-01-04 18:48 - 2014-01-04 18:48 - 00017223 _____ C:\ComboFix.txt
2014-01-04 18:48 - 2014-01-04 18:03 - 00000000 ____D C:\Qoobox
2014-01-04 18:48 - 2006-11-02 12:18 - 00000000 __RHD C:\Users\Default
2014-01-04 18:48 - 2006-11-02 12:18 - 00000000 ___RD C:\Users\Public
2014-01-04 18:46 - 2014-01-04 18:01 - 00000000 ____D C:\Windows\erdnt
2014-01-04 18:43 - 2006-11-02 11:23 - 00000215 _____ C:\Windows\system.ini
2014-01-04 18:36 - 2013-03-15 19:16 - 00000000 ____D C:\Users\highend-outlets\AppData\Local\CrashDumps
2014-01-03 18:31 - 2014-01-01 19:51 - 00000000 ____D C:\Users\highend-outlets\AppData\Local\ATworks
2014-01-03 18:31 - 2010-01-11 21:00 - 00000000 ____D C:\ProgramData\McAfee Security Scan
2014-01-03 18:31 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\system32\spool
2014-01-03 18:31 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\system32\Msdtc
2014-01-03 18:31 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\registration
2014-01-03 18:31 - 2006-11-02 11:22 - 54263808 _____ C:\Windows\system32\config\software_previous
2014-01-03 18:31 - 2006-11-02 11:22 - 25427968 _____ C:\Windows\system32\config\system_previous
2014-01-03 18:28 - 2013-12-31 20:20 - 00000000 ____D C:\SIERRA
2014-01-03 18:27 - 2006-11-02 11:22 - 31195136 _____ C:\Windows\system32\config\components_previous
2014-01-03 18:27 - 2006-11-02 11:22 - 00262144 _____ C:\Windows\system32\config\security_previous
2014-01-03 18:27 - 2006-11-02 11:22 - 00262144 _____ C:\Windows\system32\config\default_previous
2014-01-03 18:27 - 2006-11-02 11:22 - 00053248 _____ C:\Windows\system32\config\sam_previous
2014-01-03 18:01 - 2014-01-03 18:01 - 00000910 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-01-03 18:01 - 2014-01-03 18:01 - 00000000 ____D C:\Users\highend-outlets\AppData\Roaming\Malwarebytes
2014-01-03 18:01 - 2014-01-03 18:01 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-03 18:01 - 2014-01-03 18:01 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2014-01-03 18:00 - 2014-01-03 18:00 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\highend-outlets\Downloads\mbam-setup-1.75.0.1300.exe
2014-01-03 14:10 - 2014-01-03 11:19 - 00014038 _____ C:\Users\highend-outlets\Downloads\defogger_disable.log
2014-01-03 11:19 - 2014-01-03 11:19 - 00000000 ____D C:\FRST
2014-01-03 11:19 - 2014-01-03 11:19 - 00000000 _____ C:\Users\highend-outlets\defogger_reenable
2014-01-03 11:19 - 2009-12-10 12:06 - 00000000 ____D C:\Users\highend-outlets
2014-01-03 11:18 - 2014-01-03 11:18 - 00377856 _____ C:\Users\highend-outlets\Downloads\gmer_2.1.19163.exe
2014-01-03 11:18 - 2014-01-03 11:17 - 01064581 _____ (Farbar) C:\Users\highend-outlets\Downloads\FRST.exe
2014-01-03 11:17 - 2014-01-03 11:17 - 00050477 _____ C:\Users\highend-outlets\Downloads\Defogger.exe
2014-01-03 09:54 - 2012-12-09 12:17 - 00000000 ____D C:\ProgramData\Avira
2014-01-03 09:48 - 2014-01-03 09:45 - 129598176 _____ C:\Users\highend-outlets\Downloads\avira_free_antivirus_de.exe
2014-01-03 09:37 - 2014-01-03 09:37 - 00060544 _____ C:\Windows\system32\Drivers\ec55e6b546b6bca3.sys
2014-01-03 09:04 - 2013-12-04 16:01 - 227684352 _____ C:\Users\highend-outlets\Downloads\PR_GAWM_TE.7z
2014-01-02 18:27 - 2013-04-30 17:48 - 00000000 ____D C:\Users\highend-outlets\AppData\Local\Spotify
2014-01-02 01:23 - 2013-08-28 18:27 - 00000000 ____D C:\Program Files\DevPro
2014-01-01 19:39 - 2014-01-01 19:39 - 00485376 _____ (Microsoft Corporation) C:\Users\highend-outlets\Downloads\Nicht bestätigt 40043.crdownload
2013-12-31 20:22 - 2013-12-31 20:20 - 00000283 _____ C:\Windows\SIERRA.INI
2013-12-31 20:20 - 2013-12-31 20:20 - 00000000 __RSH C:\MSDOS.SYS
2013-12-31 20:20 - 2013-12-31 20:20 - 00000000 __RSH C:\IO.SYS
2013-12-30 13:26 - 2013-03-26 10:45 - 00000000 ____D C:\Program Files\Tales of Pirates Tweak
2013-12-29 22:15 - 2013-12-29 22:15 - 00241923 _____ C:\Users\highend-outlets\Downloads\CharacterAction (4).tx
2013-12-29 13:23 - 2013-12-10 20:54 - 00000000 ____D C:\Users\highend-outlets\Programme
2013-12-28 16:30 - 2012-06-30 19:28 - 00000000 ____D C:\Users\highend-outlets\AppData\Local\Eraser 6
2013-12-28 15:45 - 2006-11-02 13:47 - 00424896 _____ C:\Windows\system32\FNTCACHE.DAT
2013-12-28 02:52 - 2013-12-28 02:52 - 02848968 _____ C:\Users\highend-outlets\Downloads\Black Skin Ver. 3.1.1.rar
2013-12-18 10:01 - 2012-12-09 12:17 - 00135648 _____ C:\Windows\system32\Drivers\avipbb.sys
2013-12-18 10:01 - 2012-12-09 12:17 - 00090400 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-12-18 10:00 - 2009-12-10 12:08 - 00117104 _____ C:\Users\highend-outlets\AppData\Local\GDIPFONTCACHEV1.DAT
2013-12-17 22:19 - 2013-12-17 22:19 - 00168816 _____ C:\Users\highend-outlets\Downloads\lethal_league.zip
2013-12-15 19:20 - 2013-12-15 19:20 - 00030022 _____ C:\Users\highend-outlets\Downloads\M14 (1).zip
2013-12-15 14:55 - 2013-12-15 14:55 - 00110484 _____ C:\Users\highend-outlets\Downloads\Metroid II - Return of Samus (World).zip
2013-12-15 14:52 - 2013-12-15 14:52 - 00296339 _____ C:\Users\highend-outlets\Downloads\Legend of Zelda, The - Link's Awakening (USA, Europe).zip
2013-12-15 14:51 - 2013-12-15 14:51 - 00331754 _____ C:\Users\highend-outlets\Downloads\Kirby's Dream Land 2 (USA, Europe).zip
2013-12-15 14:50 - 2013-12-15 14:49 - 00378607 _____ C:\Users\highend-outlets\Downloads\Pokemon - Red Version (USA, Europe).zip
2013-12-15 14:25 - 2013-12-15 14:24 - 32551762 _____ C:\Users\highend-outlets\Downloads\OFW 660.zip
2013-12-15 11:24 - 2009-12-10 12:07 - 00000000 ____D C:\Program Files\Google
2013-12-13 00:00 - 2009-04-08 19:26 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-12-12 23:58 - 2013-08-15 00:25 - 00000000 ____D C:\Windows\system32\MRT
2013-12-12 23:44 - 2006-11-02 11:24 - 88123800 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2013-12-11 18:59 - 2012-04-13 10:51 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-12-11 18:59 - 2011-05-26 14:26 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-12-10 20:53 - 2013-12-10 20:52 - 00985720 _____ C:\Users\highend-outlets\Downloads\ElophantClient.zip

Some content of TEMP:
====================
C:\Users\highend-outlets\AppData\Local\temp\avgnt.exe
C:\Users\highend-outlets\AppData\Local\temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys
[2008-01-21 03:23] - [2008-01-21 03:23] - 0227896 ____A () D41D8CD98F00B204E9800998ECF8427E

C:\Windows\System32\Drivers\volsnap.sys IS INFECTED. <===== ATTENTION!



LastRegBack: 2014-01-07 16:52

==================== End Of Log ============================
         
--- --- ---

--- --- ---



Noch Probleme? Ja.
[IMG][1][/IMG]

[IMG][/IMG]


Geändert von Singed (08.01.2014 um 14:27 Uhr)

Alt 09.01.2014, 10:55   #10
schrauber
/// the machine
/// TB-Ausbilder
 

Vista: schwerwiegender Trojanerbefall von Necrus!A und ähnlichem - Standard

Vista: schwerwiegender Trojanerbefall von Necrus!A und ähnlichem



Avira neu installieren. Adobe updaten.
Nachher unbedingt Windows updaten, da fehlen 4 Jahre Updates!

FRST öffnen, folgendes in die Searchbox kopieren:

volsnap.*

Jetzt auf Search klicken und die Search.txt posten.


Downloade dir bitte Farbar Service Scanner Farbar Service Scanner
  • Starte das Tool mit Doppelklick auf die FSS.exe
  • Gehe sicher, dass folgende Optionen angehakt sind.
    • Internet Services
    • Windows Firewall
    • System Restore
    • Security Center/Action Center
    • Windows Update
    • Windows Defender
    • Other Services
  • Klicke auf Scan.
  • Wenn das Tool fertig ist, wird es eine FSS.txt in dem Verzeichnis erstellen, wo das Tool gelaufen ist.

Poste bitte den Inhalt hier.


__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 09.01.2014, 13:23   #11
Singed
 
Vista: schwerwiegender Trojanerbefall von Necrus!A und ähnlichem - Standard

Vista: schwerwiegender Trojanerbefall von Necrus!A und ähnlichem



hilft alles nichts ...
Ich denke ich muss das verdammte Teil komplett neu aufsetzen

Code:
ATTFilter
Farbar Service Scanner Version: 08-01-2014
Ran by highend-outlets (administrator) on 09-01-2014 at 13:20:55
Running from "C:\Users\highend-outlets\Downloads"
Microsoft® Windows Vista™ Home Premium  Service Pack 1 (X86)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.


Other Services:
==============


File Check:
========
C:\Windows\system32\nsisvc.dll => MD5 is legit
C:\Windows\system32\Drivers\nsiproxy.sys => MD5 is legit
C:\Windows\system32\dhcpcsvc.dll => MD5 is legit
C:\Windows\system32\Drivers\afd.sys
[2011-06-15 06:12] - [2011-04-21 14:16] - 0273408 ____A (Microsoft Corporation) 48EB99503533C27AC6135648E5474457

C:\Windows\system32\Drivers\tdx.sys => MD5 is legit
C:\Windows\system32\Drivers\tcpip.sys
[2010-08-11 11:08] - [2010-06-16 16:59] - 0898952 ____A (Microsoft Corporation) 782568AB6A43160A159B6215B70BCCE9

C:\Windows\system32\dnsrslvr.dll
[2011-04-13 10:28] - [2011-03-02 15:49] - 0086528 ____A (Microsoft Corporation) 4805D9A6D281C7A7DEFD9094DEC6AF7D

C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\rpcss.dll
[2009-07-16 08:31] - [2009-07-16 08:31] - 0551424 ____A (Microsoft Corporation) 301AE00E12408650BADDC04DBC832830



**** End of log ****
         

Alt 10.01.2014, 09:45   #12
schrauber
/// the machine
/// TB-Ausbilder
 

Vista: schwerwiegender Trojanerbefall von Necrus!A und ähnlichem - Standard

Vista: schwerwiegender Trojanerbefall von Necrus!A und ähnlichem



Zitat:
hilft alles nichts ...
geht das genauer? Das sind Scans, der Scan mit FRST fehlt.
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 10.01.2014, 14:20   #13
Singed
 
Vista: schwerwiegender Trojanerbefall von Necrus!A und ähnlichem - Standard

Vista: schwerwiegender Trojanerbefall von Necrus!A und ähnlichem



Eigentlich ist alles wie vorher, nur dass ich glücklicherweise nicht permanent Virusmeldungen bekomme. Avira und Windowsupdate lassen sich dennoch nicht vernüntig aktivieren-


Frst:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 10-01-2014
Ran by highend-outlets (administrator) on HIGHEND-OUTL-PC on 10-01-2014 14:13:14
Running from C:\Users\highend-outlets\Downloads
Microsoft® Windows Vista™ Home Premium  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EBAPI\eEBSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Dritek System Inc.) C:\Program Files\Launch Manager\dsiwmis.exe
(Acer Incorporated) C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe
(SEIKO EPSON CORPORATION) C:\Program Files\epson\EpsonCustomerResearchParticipation\EPCP.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50ST7.EXE
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RP7.EXE
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Egis Technology Inc.) C:\Program Files\EgisTec\MyWinLocker 3\x86\MWLService.exe
(NewTech Infosystems, Inc.) C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
(NewTech Infosystems, Inc.) C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
(Acer Incorporated) C:\Program Files\Acer\Optical Drive Power Management\ODDPWRSvc.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Acer Incorporated) C:\Program Files\Acer\Acer VCM\RS_Service.exe
() C:\Windows\System32\ieconfig_1und1_svc.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
() C:\Windows\PLFSetI.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Dritek System Inc.) C:\Program Files\Launch Manager\LManager.exe
(NewTech Infosystems, Inc.) C:\Program Files\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
(Acer Incorporated) C:\Program Files\Acer\Optical Drive Power Management\ODDPWR.exe
(Egis Technology Inc.) C:\Program Files\EgisTec Egis Software Update\EgisUpdate.exe
(Egis Technology Inc.) C:\Program Files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Epson Software\Event Manager\EEventManager.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(The Eraser Project) C:\Program Files\Eraser\Eraser.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Spotify Ltd) C:\Users\highend-outlets\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Microsoft Corporation) C:\Windows\System32\regsvr32.exe
(Acer Incorporated) C:\Program Files\Acer\Acer VCM\AcerVCM.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.130\SSScheduler.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Acer Incorporated) C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTray.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Acer Incorporated) C:\Program Files\Acer\Acer PowerSmart Manager\ePowerEvent.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Razer USA Ltd) C:\Program Files\Razer\Razer Game Booster\gbtray.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil32_11_9_900_170_ActiveX.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [IAAnotif] - C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe [186904 2009-02-12] (Intel Corporation)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [7399968 2009-04-11] (Realtek Semiconductor)
HKLM\...\Run: [Skytel] - C:\Program Files\Realtek\Audio\HDA\SkyTel.exe [1833504 2009-04-11] (Realtek Semiconductor Corp.)
HKLM\...\Run: [PLFSetI] - C:\Windows\PLFSetI.exe [200704 2008-07-29] ()
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1430824 2009-02-06] (Synaptics Incorporated)
HKLM\...\Run: [LManager] - C:\Program Files\Launch Manager\LManager.exe [1071624 2009-04-09] (Dritek System Inc.)
HKLM\...\Run: [BackupManagerTray] - C:\Program Files\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [253696 2009-05-26] (NewTech Infosystems, Inc.)
HKLM\...\Run: [LanguageShortcut] - C:\Program Files\CyberLink\PowerDVD\Language\Language.exe [62760 2009-03-30] ()
HKLM\...\Run: [Acer ePower Management] - C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTrayLauncher.exe [440864 2009-05-15] (Acer Incorporated)
HKLM\...\Run: [ODDPwr] - C:\Program Files\Acer\Optical Drive Power Management\ODDPWR.exe [176128 2009-04-29] (Acer Incorporated)
HKLM\...\Run: [EgisTecLiveUpdate] - C:\Program Files\EgisTec Egis Software Update\EgisUpdate.exe [199464 2009-05-13] (Egis Technology Inc.)
HKLM\...\Run: [mwlDaemon] - C:\Program Files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe [345384 2009-05-14] (Egis Technology Inc.)
HKLM\...\Run: [GrooveMonitor] - C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM\...\Run: [FUFAXSTM] - C:\Program Files\Epson Software\FAX Utility\FUFAXSTM.exe [847872 2009-12-03] (SEIKO EPSON CORPORATION)
HKLM\...\Run: [EEventManager] - C:\Program Files\Epson Software\Event Manager\EEventManager.exe [976320 2009-12-03] (SEIKO EPSON CORPORATION)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [937920 2011-06-06] (Adobe Systems Incorporated)
HKLM\...\Run: [Eraser] - C:\Program Files\Eraser\Eraser.exe [980920 2012-05-22] (The Eraser Project)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-09] (Avira Operations GmbH & Co. KG)
HKCU\...\Run: [ehTray.exe] - C:\Windows\ehome\ehtray.exe [125952 2008-01-21] (Microsoft Corporation)
HKCU\...\Run: [swg] - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2012-08-23] (Google Inc.)
HKCU\...\Run: [Skype] - C:\Program Files\Skype\Phone\Skype.exe [20584608 2013-11-14] (Skype Technologies S.A.)
HKCU\...\Run: [Spotify Web Helper] - C:\Users\highend-outlets\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1168896 2013-12-03] (Spotify Ltd)
HKCU\...\Run: [ATworks] - regsvr32.exe C:\Users\highend-outlets\AppData\Local\ATworks\CompatObjclass16.dll <===== ATTENTION
HKU\Default\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [ 2008-01-21] (Microsoft Corporation)
HKU\Default\...\Run: [ProductReg] - C:\Program Files\Acer\WR_PopUp\ProductReg.exe [ 2008-11-17] (Acer)
HKU\Default\...\RunOnce: [ScrSav] - C:\Windows\Screensavers\Acer\run_Acer.exe [ 2009-04-03] ()
Startup: C:\Users\highend-outlets\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk
ShortcutTarget: Adobe Gamma.lnk -> C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=2&o=vp32&d=0709&m=aspire_5810t
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Before = hxxp://www.google.de/
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yahoo.com
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
SearchScopes: HKCU - DefaultScope {66CF46B7-0878-4292-95F5-70B05FC496D3} URL = hxxp://go.web.de/suchbox/google?q={searchTerms}
SearchScopes: HKCU - {14D5D798-17F3-45C5-B0AB-2A4CC6ED9858} URL = hxxp://go.web.de/suchbox/ebay?query={searchTerms}
SearchScopes: HKCU - {2AB03437-A933-4AB1-BC95-C24C4EDABA12} URL = hxxp://go.1und1.de/suchbox/amazon?tag=1und1icon-21&field-keywords={searchTerms}
SearchScopes: HKCU - {3293CBE3-FE02-4EDE-894F-4262A6ECB575} URL = hxxp://go.1und1.de/suchbox/1und1suche?su={searchTerms}
SearchScopes: HKCU - {66CF46B7-0878-4292-95F5-70B05FC496D3} URL = hxxp://go.web.de/suchbox/google?q={searchTerms}
BHO: No Name - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -  No File
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.9012.1008\swg.dll (Google Inc.)
BHO: 1&&1 Internet AG Browser Configuration by mquadr.at - {D48FF4B4-E68F-47D1-8E25-81A0F0EEB341} - C:\Windows\System32\ieconfig_1und1.dll (mquadr.at software engineering und consulting GmbH)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} hxxp://www.ipix.com/download/ipixx.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog9 01 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 02 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 03 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 04 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 05 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 06 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 07 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 08 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 20 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
Tcpip\..\Interfaces\{1270B9F4-11CF-4ED7-8A0C-36D3CED1DD4C}: [NameServer]8.8.8.8,8.8.4.4

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw_1203133.dll (Adobe Systems, Inc.)
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.130\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin: @raidcall.en/RCplugin - C:\Users\highend-outlets\AppData\Roaming\raidcall\plugins\nprcplugin.dll (Raidcall)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\highend-outlets\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\highend-outlets\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF HKLM\...\Firefox\Extensions: [{A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}] - C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\
FF Extension: Firefox Synchronisation Extension - C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\
FF HKLM\...\Thunderbird\Extensions: [{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}] - C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\
FF Extension: Thunderbird Address Book Synchronisation Extension - C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\

Chrome: 
=======
CHR HomePage: hxxp://www.google.com
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\31.0.1650.63\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\31.0.1650.63\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\31.0.1650.63\pdf.dll ()
CHR Plugin: (Screen Capture Plugin) - C:\Users\highend-outlets\AppData\Local\Google\Chrome\User Data\Default\Extensions\alelhddbbhepgpmgidjdcjakblofbmce\3.4.5_0\plugins/screen_capture.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Google Earth Plugin) - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 7 U25) - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (McAfee Security Scanner +) - C:\Program Files\McAfee Security Scan\3.0.318\npMcAfeeMss.dll No File
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
CHR Plugin: (Pando Web Plugin) - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
CHR Plugin: (Windows Live\u00AE Photo Gallery) - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Unity Player) - C:\Users\highend-outlets\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
CHR Plugin: (Facebook Video Calling Plugin) - C:\Users\highend-outlets\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
CHR Plugin: (Raidcall plugin) - C:\Users\highend-outlets\AppData\Roaming\raidcall\plugins\nprcplugin.dll (Raidcall)
CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw_1203133.dll (Adobe Systems, Inc.)
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32_11_8_800_168.dll No File
CHR Plugin: (Java Deployment Toolkit 7.0.250.17) - C:\Windows\system32\npDeployJava1.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll No File
CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Extension: (Awesome Screenshot: Capture & Annotate) - C:\Users\highend-outlets\AppData\Local\Google\Chrome\User Data\Default\Extensions\alelhddbbhepgpmgidjdcjakblofbmce\3.5.10_0
CHR Extension: (Google Docs) - C:\Users\highend-outlets\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0
CHR Extension: (Google Drive) - C:\Users\highend-outlets\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (Turn Off the Lights) - C:\Users\highend-outlets\AppData\Local\Google\Chrome\User Data\Default\Extensions\bfbmjmiodbnnpllbbbfblcplfjjepjdn\2.3.0.5_0
CHR Extension: (YouTube) - C:\Users\highend-outlets\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Adblock Plus) - C:\Users\highend-outlets\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.7.2_0
CHR Extension: (Google Search) - C:\Users\highend-outlets\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (Photovisi - Photo Collage Maker) - C:\Users\highend-outlets\AppData\Local\Google\Chrome\User Data\Default\Extensions\emkkfkcbnpdnhgeolpbggbdogfngiadf\1.2_0
CHR Extension: (AdBlock) - C:\Users\highend-outlets\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.6.16_0
CHR Extension: (Quick Note) - C:\Users\highend-outlets\AppData\Local\Google\Chrome\User Data\Default\Extensions\mijlebbfndhelmdpmllgcfadlkankhok\1.6.3_0
CHR Extension: (DVDVideoSoft Browser Extension) - C:\Users\highend-outlets\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0
CHR Extension: (Google Wallet) - C:\Users\highend-outlets\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0
CHR Extension: (Gmail) - C:\Users\highend-outlets\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
CHR HKCU\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Program Files\Common Files\DVDVideoSoft\plugins\DVDVideoSoftBrowserExtension.crx

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440376 2013-12-09] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440376 2013-12-09] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1011768 2013-12-09] (Avira Operations GmbH & Co. KG)
R2 ePowerSvc; C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe [703008 2009-05-15] (Acer Incorporated)
R2 EpsonBidirectionalService; C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe [94208 2006-12-19] (SEIKO EPSON CORPORATION)
R2 EpsonCustomerResearchParticipation; C:\Program Files\EPSON\EpsonCustomerResearchParticipation\EPCP.exe [547936 2011-10-06] (SEIKO EPSON CORPORATION)
R2 EPSON_EB_RPCV4_04; C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50ST7.EXE [153600 2009-09-14] (SEIKO EPSON CORPORATION)
R2 EPSON_PM_RPCV4_04; C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RP7.EXE [121856 2009-09-14] (SEIKO EPSON CORPORATION)
R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe [235216 2013-09-06] (McAfee, Inc.)
R2 MWLService; C:\Program Files\EgisTec\MyWinLocker 3\x86\\MWLService.exe [305448 2009-05-14] (Egis Technology Inc.)
S3 npggsvc; C:\Windows\system32\GameMon.des [4121080 2011-06-13] (INCA Internet Co., Ltd.)
R2 NTI IScheduleSvc; C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [62208 2009-05-26] (NewTech Infosystems, Inc.)
R2 NTISchedulerSvc; C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [144632 2008-09-23] (NewTech Infosystems, Inc.)
R2 ODDPwrSvc; C:\Program Files\Acer\Optical Drive Power Management\ODDPWRSvc.exe [118784 2009-04-29] (Acer Incorporated)
S3 OverwolfUpdaterService; C:\Program Files\Overwolf\OverwolfUpdater.exe [18360 2013-08-22] (Overwolf Ltd)
R2 RS_Service; C:\Program Files\Acer\Acer VCM\RS_Service.exe [237568 2009-02-05] (Acer Incorporated)
R2 serviceIEConfig; C:\Windows\System32\ieconfig_1und1_svc.exe [1053848 2012-04-11] ()

==================== Drivers (Whitelisted) ====================

S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [90400 2013-12-09] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135648 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-25] (Avira Operations GmbH & Co. KG)
R3 L1C; C:\Windows\System32\DRIVERS\L1C60x86.sys [57344 2009-11-13] (Atheros Communications, Inc.)
S3 libusb0; C:\Windows\System32\DRIVERS\libusb0.sys [35392 2010-10-02] (hxxp://libusb-win32.sourceforge.net)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
R1 mwlPSDFilter; C:\Windows\System32\DRIVERS\mwlPSDFilter.sys [19504 2008-12-04] (Egis Incorporated.)
R1 mwlPSDNServ; C:\Windows\System32\DRIVERS\mwlPSDNServ.sys [16432 2008-12-04] (Egis Incorporated.)
R1 mwlPSDVDisk; C:\Windows\System32\DRIVERS\mwlPSDVDisk.sys [59952 2008-12-04] (Egis Incorporated.)
R3 pspdisp; C:\Windows\System32\DRIVERS\pspdisp.sys [3072 2011-01-18] (JJS)
S3 RRNetCap; C:\Windows\System32\DRIVERS\rrnetcap.sys [31848 2012-12-18] (RapidSolution Software AG)
R3 RRNetCapMP; C:\Windows\System32\DRIVERS\rrnetcap.sys [31848 2012-12-18] (RapidSolution Software AG)
S1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-12-09] (Avira GmbH)
R3 tbhsd; C:\Windows\System32\drivers\tbhsd.sys [39048 2012-12-18] (RapidSolution Software AG)
S3 w800bus; C:\Windows\System32\DRIVERS\w800bus.sys [60768 2005-06-13] (MCCI)
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-21] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 EagleXNt; \??\C:\Windows\system32\drivers\EagleXNt.sys [x]
U5 ec55e6b546b6bca3; C:\Windows\System32\Drivers\ec55e6b546b6bca3.sys [60544 2014-01-03] ()
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
S3 XDva402; \??\C:\Windows\system32\XDva402.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-01-10 14:06 - 2014-01-10 14:06 - 00000000 ____D C:\Users\highend-outlets\Downloads\FRST-OlderVersion
2014-01-09 22:38 - 2014-01-09 22:38 - 00347816 _____ (Microsoft Corporation) C:\Users\highend-outlets\Downloads\MicrosoftFixit.wu.Run.exe
2014-01-09 13:20 - 2014-01-09 13:21 - 00001454 _____ C:\Users\highend-outlets\Downloads\FSS.txt
2014-01-09 13:00 - 2014-01-09 13:00 - 00000000 ____D C:\Users\highend-outlets\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD
2014-01-09 12:55 - 2014-01-09 12:55 - 00001851 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2014-01-09 12:55 - 2014-01-09 12:55 - 00000000 ____D C:\Users\highend-outlets\AppData\Roaming\Avira
2014-01-09 12:54 - 2014-01-09 12:54 - 00000000 ____D C:\Program Files\Avira
2014-01-09 12:54 - 2013-12-09 11:37 - 00090400 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-01-09 12:44 - 2014-01-09 12:44 - 00410528 _____ (AVAST Software) C:\Windows\system32\Drivers\wyytnkxo.sys
2014-01-09 12:41 - 2014-01-09 12:41 - 00000000 ____D C:\Program Files\Common Files\Adobe AIR
2014-01-09 12:40 - 2014-01-09 12:40 - 18101704 _____ (Adobe Systems Inc.) C:\Users\highend-outlets\Downloads\AdobeAIRInstaller.exe
2014-01-09 12:36 - 2014-01-09 12:36 - 00361185 _____ (Farbar) C:\Users\highend-outlets\Downloads\FSS.exe
2014-01-08 13:50 - 2014-01-08 13:50 - 00410528 _____ (AVAST Software) C:\Windows\system32\Drivers\xfkeassb.sys
2014-01-08 13:49 - 2014-01-08 13:49 - 00410528 _____ (AVAST Software) C:\Windows\system32\Drivers\hiwgsrwb.sys
2014-01-07 16:53 - 2014-01-07 16:53 - 00000000 ____D C:\Program Files\ESET
2014-01-07 16:50 - 2014-01-07 16:50 - 02347384 _____ (ESET) C:\Users\highend-outlets\Downloads\esetsmartinstaller_enu.exe
2014-01-07 16:44 - 2014-01-09 12:57 - 00207236 _____ C:\Windows\PFRO.log
2014-01-06 21:45 - 2014-01-06 21:45 - 00410528 _____ (AVAST Software) C:\Windows\system32\Drivers\vxqrmluf.sys
2014-01-06 21:45 - 2014-01-06 21:45 - 00410528 _____ (AVAST Software) C:\Windows\system32\Drivers\tarvowla.sys
2014-01-06 21:45 - 2014-01-06 21:45 - 00410528 _____ (AVAST Software) C:\Windows\system32\Drivers\czdmwyqx.sys
2014-01-06 21:43 - 2014-01-06 21:43 - 00410528 _____ (AVAST Software) C:\Windows\system32\Drivers\edhiwysm.sys
2014-01-06 21:29 - 2014-01-06 21:29 - 00410528 _____ (AVAST Software) C:\Windows\system32\Drivers\bcvzxmte.sys
2014-01-06 16:52 - 2014-01-06 16:52 - 00000406 _____ C:\Windows\WindowsUpdate.log
2014-01-06 15:38 - 2014-01-06 15:38 - 00410528 _____ (AVAST Software) C:\Windows\system32\Drivers\knikxjfp.sys
2014-01-06 15:35 - 2014-01-06 15:35 - 00410528 _____ (AVAST Software) C:\Windows\system32\Drivers\rwuxdyqw.sys
2014-01-06 13:59 - 2014-01-06 13:59 - 00410528 _____ (AVAST Software) C:\Windows\system32\Drivers\dnotgmyj.sys
2014-01-06 13:57 - 2014-01-06 13:57 - 00410528 _____ (AVAST Software) C:\Windows\system32\Drivers\kpawwwrb.sys
2014-01-06 13:33 - 2014-01-06 13:33 - 00410528 _____ (AVAST Software) C:\Windows\system32\Drivers\uykbixwg.sys
2014-01-06 13:33 - 2014-01-06 13:33 - 00000000 ____D C:\ProgramData\AVAST Software
2014-01-06 13:28 - 2014-01-06 13:29 - 91412976 _____ (AVAST Software) C:\Users\highend-outlets\Downloads\avast_free_antivirus_setup.exe
2014-01-06 12:17 - 2014-01-06 12:17 - 00001008 _____ C:\Users\highend-outlets\Desktop\JRT.txt
2014-01-06 12:13 - 2014-01-06 12:13 - 00000000 ____D C:\Windows\ERUNT
2014-01-06 11:49 - 2014-01-06 11:51 - 00000000 ____D C:\AdwCleaner
2014-01-05 18:26 - 2014-01-05 18:27 - 01233962 _____ C:\Users\highend-outlets\Downloads\adwcleaner.exe
2014-01-05 18:26 - 2014-01-05 18:26 - 01036305 _____ (Thisisu) C:\Users\highend-outlets\Downloads\JRT.exe
2014-01-04 18:48 - 2014-01-04 18:48 - 00017223 _____ C:\ComboFix.txt
2014-01-04 18:22 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe
2014-01-04 18:22 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe
2014-01-04 18:22 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-01-04 18:22 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-01-04 18:22 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-01-04 18:22 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe
2014-01-04 18:22 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe
2014-01-04 18:22 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe
2014-01-04 18:03 - 2014-01-04 18:48 - 00000000 ____D C:\Qoobox
2014-01-04 18:01 - 2014-01-04 18:46 - 00000000 ____D C:\Windows\erdnt
2014-01-03 18:01 - 2014-01-03 18:01 - 00000910 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-01-03 18:01 - 2014-01-03 18:01 - 00000000 ____D C:\Users\highend-outlets\AppData\Roaming\Malwarebytes
2014-01-03 18:01 - 2014-01-03 18:01 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-03 18:01 - 2014-01-03 18:01 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2014-01-03 18:01 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-01-03 18:00 - 2014-01-03 18:00 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\highend-outlets\Downloads\mbam-setup-1.75.0.1300.exe
2014-01-03 11:21 - 2014-01-06 12:45 - 00026537 _____ C:\Users\highend-outlets\Downloads\Addition.txt
2014-01-03 11:20 - 2014-01-10 14:13 - 00027104 _____ C:\Users\highend-outlets\Downloads\FRST.txt
2014-01-03 11:19 - 2014-01-10 14:06 - 00000000 ____D C:\FRST
2014-01-03 11:19 - 2014-01-03 14:10 - 00014038 _____ C:\Users\highend-outlets\Downloads\defogger_disable.log
2014-01-03 11:19 - 2014-01-03 11:19 - 00000000 _____ C:\Users\highend-outlets\defogger_reenable
2014-01-03 11:18 - 2014-01-03 11:18 - 00377856 _____ C:\Users\highend-outlets\Downloads\gmer_2.1.19163.exe
2014-01-03 11:17 - 2014-01-10 14:06 - 01066141 _____ (Farbar) C:\Users\highend-outlets\Downloads\FRST.exe
2014-01-03 11:17 - 2014-01-03 11:17 - 00050477 _____ C:\Users\highend-outlets\Downloads\Defogger.exe
2014-01-03 09:45 - 2014-01-03 09:48 - 129598176 _____ C:\Users\highend-outlets\Downloads\avira_free_antivirus_de.exe
2014-01-03 09:37 - 2014-01-03 09:37 - 00060544 _____ C:\Windows\system32\Drivers\ec55e6b546b6bca3.sys
2014-01-01 19:51 - 2014-01-03 18:31 - 00000000 ____D C:\Users\highend-outlets\AppData\Local\ATworks
2014-01-01 19:39 - 2014-01-01 19:39 - 00485376 _____ (Microsoft Corporation) C:\Users\highend-outlets\Downloads\Nicht bestätigt 40043.crdownload
2013-12-31 20:20 - 2014-01-03 18:28 - 00000000 ____D C:\SIERRA
2013-12-31 20:20 - 2013-12-31 20:22 - 00000283 _____ C:\Windows\SIERRA.INI
2013-12-31 20:20 - 2013-12-31 20:20 - 00000000 __RSH C:\MSDOS.SYS
2013-12-31 20:20 - 2013-12-31 20:20 - 00000000 __RSH C:\IO.SYS
2013-12-30 13:29 - 2014-01-09 17:33 - 00000000 ____D C:\Program Files\Tales of Pirates II
2013-12-29 22:17 - 2012-10-31 22:13 - 00245612 _____ C:\Program Files\CharacterAction.tx
2013-12-29 22:15 - 2013-12-29 22:15 - 00241923 _____ C:\Users\highend-outlets\Downloads\CharacterAction (4).tx
2013-12-28 02:52 - 2013-12-28 02:52 - 02848968 _____ C:\Users\highend-outlets\Downloads\Black Skin Ver. 3.1.1.rar
2013-12-17 22:19 - 2013-12-17 22:19 - 00168816 _____ C:\Users\highend-outlets\Downloads\lethal_league.zip
2013-12-15 19:20 - 2013-12-15 19:20 - 00030022 _____ C:\Users\highend-outlets\Downloads\M14 (1).zip
2013-12-15 14:55 - 2013-12-15 14:55 - 00110484 _____ C:\Users\highend-outlets\Downloads\Metroid II - Return of Samus (World).zip
2013-12-15 14:52 - 2013-12-15 14:52 - 00296339 _____ C:\Users\highend-outlets\Downloads\Legend of Zelda, The - Link's Awakening (USA, Europe).zip
2013-12-15 14:51 - 2013-12-15 14:51 - 00331754 _____ C:\Users\highend-outlets\Downloads\Kirby's Dream Land 2 (USA, Europe).zip
2013-12-15 14:49 - 2013-12-15 14:50 - 00378607 _____ C:\Users\highend-outlets\Downloads\Pokemon - Red Version (USA, Europe).zip
2013-12-15 14:24 - 2013-12-15 14:25 - 32551762 _____ C:\Users\highend-outlets\Downloads\OFW 660.zip

==================== One Month Modified Files and Folders =======

2014-01-10 14:13 - 2014-01-03 11:20 - 00027104 _____ C:\Users\highend-outlets\Downloads\FRST.txt
2014-01-10 14:06 - 2014-01-10 14:06 - 00000000 ____D C:\Users\highend-outlets\Downloads\FRST-OlderVersion
2014-01-10 14:06 - 2014-01-03 11:19 - 00000000 ____D C:\FRST
2014-01-10 14:06 - 2014-01-03 11:17 - 01066141 _____ (Farbar) C:\Users\highend-outlets\Downloads\FRST.exe
2014-01-10 13:17 - 2006-11-02 13:47 - 00003424 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-10 13:17 - 2006-11-02 13:47 - 00003424 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-10 01:34 - 2013-06-09 21:01 - 00000000 ____D C:\Users\highend-outlets\AppData\Local\PMB Files
2014-01-10 01:34 - 2013-06-09 21:01 - 00000000 ____D C:\ProgramData\PMB Files
2014-01-09 22:38 - 2014-01-09 22:38 - 00347816 _____ (Microsoft Corporation) C:\Users\highend-outlets\Downloads\MicrosoftFixit.wu.Run.exe
2014-01-09 22:37 - 2013-03-15 19:16 - 00000000 ____D C:\Users\highend-outlets\AppData\Local\CrashDumps
2014-01-09 20:21 - 2012-06-17 20:24 - 00001112 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-09 17:33 - 2013-12-30 13:29 - 00000000 ____D C:\Program Files\Tales of Pirates II
2014-01-09 13:21 - 2014-01-09 13:20 - 00001454 _____ C:\Users\highend-outlets\Downloads\FSS.txt
2014-01-09 13:01 - 2013-01-08 19:13 - 00000000 ____D C:\Users\highend-outlets\AppData\Roaming\Skype
2014-01-09 13:00 - 2014-01-09 13:00 - 00000000 ____D C:\Users\highend-outlets\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD
2014-01-09 12:58 - 2013-07-19 14:33 - 00010538 _____ C:\autoupdate.log
2014-01-09 12:57 - 2014-01-07 16:44 - 00207236 _____ C:\Windows\PFRO.log
2014-01-09 12:57 - 2006-11-02 14:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-09 12:56 - 2006-11-02 14:01 - 00032594 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2014-01-09 12:55 - 2014-01-09 12:55 - 00001851 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2014-01-09 12:55 - 2014-01-09 12:55 - 00000000 ____D C:\Users\highend-outlets\AppData\Roaming\Avira
2014-01-09 12:54 - 2014-01-09 12:54 - 00000000 ____D C:\Program Files\Avira
2014-01-09 12:54 - 2012-12-09 12:17 - 00000000 ____D C:\ProgramData\Avira
2014-01-09 12:50 - 2010-11-22 11:56 - 00000680 _____ C:\Users\highend-outlets\AppData\Local\d3d9caps.dat
2014-01-09 12:48 - 2012-04-13 10:51 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-01-09 12:44 - 2014-01-09 12:44 - 00410528 _____ (AVAST Software) C:\Windows\system32\Drivers\wyytnkxo.sys
2014-01-09 12:41 - 2014-01-09 12:41 - 00000000 ____D C:\Program Files\Common Files\Adobe AIR
2014-01-09 12:41 - 2011-06-16 18:52 - 00000000 ____D C:\Program Files\Adobe
2014-01-09 12:41 - 2009-12-16 00:17 - 00000000 ____D C:\Users\highend-outlets\AppData\Local\Adobe
2014-01-09 12:41 - 2009-12-10 12:15 - 00000000 ____D C:\Users\highend-outlets\AppData\Roaming\Adobe
2014-01-09 12:41 - 2009-04-08 19:42 - 00000000 ____D C:\ProgramData\Adobe
2014-01-09 12:40 - 2014-01-09 12:40 - 18101704 _____ (Adobe Systems Inc.) C:\Users\highend-outlets\Downloads\AdobeAIRInstaller.exe
2014-01-09 12:39 - 2012-04-13 10:51 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-01-09 12:39 - 2011-05-26 14:26 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-01-09 12:36 - 2014-01-09 12:36 - 00361185 _____ (Farbar) C:\Users\highend-outlets\Downloads\FSS.exe
2014-01-08 21:12 - 2013-04-30 17:47 - 00000000 ____D C:\Users\highend-outlets\AppData\Roaming\Spotify
2014-01-08 19:30 - 2013-04-30 17:48 - 00000000 ____D C:\Users\highend-outlets\AppData\Local\Spotify
2014-01-08 13:50 - 2014-01-08 13:50 - 00410528 _____ (AVAST Software) C:\Windows\system32\Drivers\xfkeassb.sys
2014-01-08 13:49 - 2014-01-08 13:49 - 00410528 _____ (AVAST Software) C:\Windows\system32\Drivers\hiwgsrwb.sys
2014-01-08 13:43 - 2006-11-02 11:33 - 00769188 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-07 16:53 - 2014-01-07 16:53 - 00000000 ____D C:\Program Files\ESET
2014-01-07 16:50 - 2014-01-07 16:50 - 02347384 _____ (ESET) C:\Users\highend-outlets\Downloads\esetsmartinstaller_enu.exe
2014-01-06 21:45 - 2014-01-06 21:45 - 00410528 _____ (AVAST Software) C:\Windows\system32\Drivers\vxqrmluf.sys
2014-01-06 21:45 - 2014-01-06 21:45 - 00410528 _____ (AVAST Software) C:\Windows\system32\Drivers\tarvowla.sys
2014-01-06 21:45 - 2014-01-06 21:45 - 00410528 _____ (AVAST Software) C:\Windows\system32\Drivers\czdmwyqx.sys
2014-01-06 21:43 - 2014-01-06 21:43 - 00410528 _____ (AVAST Software) C:\Windows\system32\Drivers\edhiwysm.sys
2014-01-06 21:29 - 2014-01-06 21:29 - 00410528 _____ (AVAST Software) C:\Windows\system32\Drivers\bcvzxmte.sys
2014-01-06 16:52 - 2014-01-06 16:52 - 00000406 _____ C:\Windows\WindowsUpdate.log
2014-01-06 15:38 - 2014-01-06 15:38 - 00410528 _____ (AVAST Software) C:\Windows\system32\Drivers\knikxjfp.sys
2014-01-06 15:35 - 2014-01-06 15:35 - 00410528 _____ (AVAST Software) C:\Windows\system32\Drivers\rwuxdyqw.sys
2014-01-06 13:59 - 2014-01-06 13:59 - 00410528 _____ (AVAST Software) C:\Windows\system32\Drivers\dnotgmyj.sys
2014-01-06 13:57 - 2014-01-06 13:57 - 00410528 _____ (AVAST Software) C:\Windows\system32\Drivers\kpawwwrb.sys
2014-01-06 13:33 - 2014-01-06 13:33 - 00410528 _____ (AVAST Software) C:\Windows\system32\Drivers\uykbixwg.sys
2014-01-06 13:33 - 2014-01-06 13:33 - 00000000 ____D C:\ProgramData\AVAST Software
2014-01-06 13:29 - 2014-01-06 13:28 - 91412976 _____ (AVAST Software) C:\Users\highend-outlets\Downloads\avast_free_antivirus_setup.exe
2014-01-06 12:45 - 2014-01-03 11:21 - 00026537 _____ C:\Users\highend-outlets\Downloads\Addition.txt
2014-01-06 12:17 - 2014-01-06 12:17 - 00001008 _____ C:\Users\highend-outlets\Desktop\JRT.txt
2014-01-06 12:13 - 2014-01-06 12:13 - 00000000 ____D C:\Windows\ERUNT
2014-01-06 11:51 - 2014-01-06 11:49 - 00000000 ____D C:\AdwCleaner
2014-01-06 11:43 - 2006-11-02 13:37 - 00000000 ____D C:\Windows\twain_32
2014-01-06 11:21 - 2012-06-17 20:24 - 00001116 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-05 22:31 - 2012-09-02 12:26 - 00000968 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-76954294-2760295059-2378521770-1000UA.job
2014-01-05 18:27 - 2014-01-05 18:26 - 01233962 _____ C:\Users\highend-outlets\Downloads\adwcleaner.exe
2014-01-05 18:26 - 2014-01-05 18:26 - 01036305 _____ (Thisisu) C:\Users\highend-outlets\Downloads\JRT.exe
2014-01-05 18:10 - 2011-05-06 17:05 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-76954294-2760295059-2378521770-1000Core.job
2014-01-05 13:31 - 2012-09-02 12:26 - 00000946 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-76954294-2760295059-2378521770-1000Core.job
2014-01-04 18:48 - 2014-01-04 18:48 - 00017223 _____ C:\ComboFix.txt
2014-01-04 18:48 - 2014-01-04 18:03 - 00000000 ____D C:\Qoobox
2014-01-04 18:48 - 2006-11-02 12:18 - 00000000 __RHD C:\Users\Default
2014-01-04 18:48 - 2006-11-02 12:18 - 00000000 ___RD C:\Users\Public
2014-01-04 18:46 - 2014-01-04 18:01 - 00000000 ____D C:\Windows\erdnt
2014-01-04 18:43 - 2006-11-02 11:23 - 00000215 _____ C:\Windows\system.ini
2014-01-03 18:31 - 2014-01-01 19:51 - 00000000 ____D C:\Users\highend-outlets\AppData\Local\ATworks
2014-01-03 18:31 - 2010-01-11 21:00 - 00000000 ____D C:\ProgramData\McAfee Security Scan
2014-01-03 18:31 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\system32\spool
2014-01-03 18:31 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\system32\Msdtc
2014-01-03 18:31 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\registration
2014-01-03 18:31 - 2006-11-02 11:22 - 54263808 _____ C:\Windows\system32\config\software_previous
2014-01-03 18:31 - 2006-11-02 11:22 - 25427968 _____ C:\Windows\system32\config\system_previous
2014-01-03 18:28 - 2013-12-31 20:20 - 00000000 ____D C:\SIERRA
2014-01-03 18:27 - 2006-11-02 11:22 - 31195136 _____ C:\Windows\system32\config\components_previous
2014-01-03 18:27 - 2006-11-02 11:22 - 00262144 _____ C:\Windows\system32\config\security_previous
2014-01-03 18:27 - 2006-11-02 11:22 - 00262144 _____ C:\Windows\system32\config\default_previous
2014-01-03 18:27 - 2006-11-02 11:22 - 00053248 _____ C:\Windows\system32\config\sam_previous
2014-01-03 18:01 - 2014-01-03 18:01 - 00000910 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-01-03 18:01 - 2014-01-03 18:01 - 00000000 ____D C:\Users\highend-outlets\AppData\Roaming\Malwarebytes
2014-01-03 18:01 - 2014-01-03 18:01 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-03 18:01 - 2014-01-03 18:01 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2014-01-03 18:00 - 2014-01-03 18:00 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\highend-outlets\Downloads\mbam-setup-1.75.0.1300.exe
2014-01-03 14:10 - 2014-01-03 11:19 - 00014038 _____ C:\Users\highend-outlets\Downloads\defogger_disable.log
2014-01-03 11:19 - 2014-01-03 11:19 - 00000000 _____ C:\Users\highend-outlets\defogger_reenable
2014-01-03 11:19 - 2009-12-10 12:06 - 00000000 ____D C:\Users\highend-outlets
2014-01-03 11:18 - 2014-01-03 11:18 - 00377856 _____ C:\Users\highend-outlets\Downloads\gmer_2.1.19163.exe
2014-01-03 11:17 - 2014-01-03 11:17 - 00050477 _____ C:\Users\highend-outlets\Downloads\Defogger.exe
2014-01-03 09:48 - 2014-01-03 09:45 - 129598176 _____ C:\Users\highend-outlets\Downloads\avira_free_antivirus_de.exe
2014-01-03 09:37 - 2014-01-03 09:37 - 00060544 _____ C:\Windows\system32\Drivers\ec55e6b546b6bca3.sys
2014-01-03 09:04 - 2013-12-04 16:01 - 227684352 _____ C:\Users\highend-outlets\Downloads\PR_GAWM_TE.7z
2014-01-02 01:23 - 2013-08-28 18:27 - 00000000 ____D C:\Program Files\DevPro
2014-01-01 19:39 - 2014-01-01 19:39 - 00485376 _____ (Microsoft Corporation) C:\Users\highend-outlets\Downloads\Nicht bestätigt 40043.crdownload
2013-12-31 20:22 - 2013-12-31 20:20 - 00000283 _____ C:\Windows\SIERRA.INI
2013-12-31 20:20 - 2013-12-31 20:20 - 00000000 __RSH C:\MSDOS.SYS
2013-12-31 20:20 - 2013-12-31 20:20 - 00000000 __RSH C:\IO.SYS
2013-12-30 13:26 - 2013-03-26 10:45 - 00000000 ____D C:\Program Files\Tales of Pirates Tweak
2013-12-29 22:15 - 2013-12-29 22:15 - 00241923 _____ C:\Users\highend-outlets\Downloads\CharacterAction (4).tx
2013-12-29 13:23 - 2013-12-10 20:54 - 00000000 ____D C:\Users\highend-outlets\Programme
2013-12-28 16:30 - 2012-06-30 19:28 - 00000000 ____D C:\Users\highend-outlets\AppData\Local\Eraser 6
2013-12-28 15:45 - 2006-11-02 13:47 - 00424896 _____ C:\Windows\system32\FNTCACHE.DAT
2013-12-28 02:52 - 2013-12-28 02:52 - 02848968 _____ C:\Users\highend-outlets\Downloads\Black Skin Ver. 3.1.1.rar
2013-12-18 10:01 - 2012-12-09 12:17 - 00135648 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-12-18 10:00 - 2009-12-10 12:08 - 00117104 _____ C:\Users\highend-outlets\AppData\Local\GDIPFONTCACHEV1.DAT
2013-12-17 22:19 - 2013-12-17 22:19 - 00168816 _____ C:\Users\highend-outlets\Downloads\lethal_league.zip
2013-12-15 19:20 - 2013-12-15 19:20 - 00030022 _____ C:\Users\highend-outlets\Downloads\M14 (1).zip
2013-12-15 14:55 - 2013-12-15 14:55 - 00110484 _____ C:\Users\highend-outlets\Downloads\Metroid II - Return of Samus (World).zip
2013-12-15 14:52 - 2013-12-15 14:52 - 00296339 _____ C:\Users\highend-outlets\Downloads\Legend of Zelda, The - Link's Awakening (USA, Europe).zip
2013-12-15 14:51 - 2013-12-15 14:51 - 00331754 _____ C:\Users\highend-outlets\Downloads\Kirby's Dream Land 2 (USA, Europe).zip
2013-12-15 14:50 - 2013-12-15 14:49 - 00378607 _____ C:\Users\highend-outlets\Downloads\Pokemon - Red Version (USA, Europe).zip
2013-12-15 14:25 - 2013-12-15 14:24 - 32551762 _____ C:\Users\highend-outlets\Downloads\OFW 660.zip
2013-12-15 11:24 - 2009-12-10 12:07 - 00000000 ____D C:\Program Files\Google
2013-12-13 00:00 - 2009-04-08 19:26 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-12-12 23:58 - 2013-08-15 00:25 - 00000000 ____D C:\Windows\system32\MRT
2013-12-12 23:44 - 2006-11-02 11:24 - 88123800 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe

Some content of TEMP:
====================
C:\Users\highend-outlets\AppData\Local\temp\avgnt.exe
C:\Users\highend-outlets\AppData\Local\temp\Offercast_AVIRAV7_.exe
C:\Users\highend-outlets\AppData\Local\temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll
[2009-07-16 08:31] - [2009-07-16 08:31] - 0551424 ____A (Microsoft Corporation) 301AE00E12408650BADDC04DBC832830

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-01-10 01:08

==================== End Of Log ============================
         
--- --- ---


Addition:
Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x86) Version: 10-01-2014
Ran by highend-outlets at 2014-01-10 14:14:26
Running from C:\Users\highend-outlets\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Disabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Disabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

 Update for Microsoft Office 2007 (KB2508958) (Version:  - Microsoft)
1und1 Internet Explorer Add-On (Version: 1.0 - 1&1 Internet AG) Hidden
A Ruler for Windows (Version: 2.5 - Latour)
Acer Backup Manager (Version: 1.1.0.72 - NewTech Infosystems)
Acer Crystal Eye Webcam (Version: 5.2.5.3 - Suyin Optronics Corp)
Acer eRecovery Management (Version: 4.00.3008 - Acer Incorporated)
Acer GridVista (Version: 2.75.825 - Acer Inc.)
Acer PowerSmart Manager (Version: 4.02.3006 - Acer Incorporated)
Acer Product Registration (Version: 3.0.0.10 - Acer Incorporated)
Acer ScreenSaver (Version: 1.0.5.0511 - Acer)
Acer VCM (Version: 4.00.3006 - Acer Incorporated)
Adobe AIR (Version: 3.9.0.1380 - Adobe Systems Incorporated)
Adobe AIR (Version: 3.9.0.1380 - Adobe Systems Incorporated) Hidden
Adobe Bridge 1.0 (Version: 001.000.001 - Adobe Systems) Hidden
Adobe Common File Installer (Version: 1.00.001 - Adobe System Incorporated) Hidden
Adobe Flash Player 11 ActiveX (Version: 11.9.900.170 - Adobe Systems Incorporated)
Adobe Flash Player 11 Plugin (Version: 11.9.900.170 - Adobe Systems Incorporated)
Adobe Help Center 1.0 (Version: 1.0.1 - Adobe Systems) Hidden
Adobe Photoshop CS2 (Version: 9.0 - Adobe Systems, Inc.)
Adobe Photoshop CS2 (Version: 9.0 - Adobe Systems, Inc.) Hidden
Adobe Reader X (10.1.1) - Deutsch (Version: 10.1.1 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.0 (Version: 12.0.3.133 - Adobe Systems, Inc.)
Adobe Stock Photos 1.0 (Version: 1.0.1 - Adobe Systems) Hidden
Any Video Converter 5 5.0.4 (Version:  - Any-Video-Converter.com)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (Version: 1.0.0.18 - Atheros Communications Inc.)
Audials (Version: 10.1.514.1400 - Audials AG)
Avira Free Antivirus (Version: 14.0.2.286 - Avira)
Backup Manager Basic (Version: 1.1.0.72 - NewTech Infosystems) Hidden
BattleForge™ (Version: 1.0.0.0 - Electronic Arts)
Camtasia Studio 8 (Version: 8.0.4.1060 - TechSmith Corporation)
CCleaner (Version: 3.10 - Piriform)
Dev-C++ 5 beta 9 release (4.9.9.2) (Version:  - )
Elsword_DE (Version:  - )
EPSON BX620FWD Series Handbuch (Version:  - )
EPSON BX620FWD Series Netzwerk-Handbuch (Version:  - )
EPSON BX620FWD Series Printer Uninstall (Version:  - SEIKO EPSON Corporation)
Epson Customer Research Participation (Version: 1.30.0000 - EPSON)
Epson Easy Photo Print 2 (Version: 2.2.0.0 - SEIKO EPSON CORPORATION)
Epson Easy Photo Print Plug-in for PMB(Picture Motion Browser) (Version: 1.00.0000 - SEIKO EPSON CORPORATION)
Epson Event Manager (Version: 2.40.0001 - SEIKO EPSON CORPORATION)
Epson FAX Utility (Version: 1.10.00 - SEIKO EPSON CORPORATION)
Epson PC-FAX Driver (Version:  - )
EPSON Scan (Version:  - Seiko Epson Corporation)
EpsonNet Print (Version: 2.4i - SEIKO EPSON CORPORATION)
EpsonNet Setup 3.3 (Version: 3.3a - SEIKO EPSON CORPORATION)
Eraser 6.0.10.2620 (Version: 6.0.2620 - The Eraser Project)
ESET Online Scanner v3 (Version:  - )
Façade (Version: 1.1.2 - Procedural Arts)
Facebook Video Calling 1.2.0.287 (Version: 1.2.287 - Skype Limited)
FormatFactory 3.0.1 (Version: 3.0.1 - Free Time)
Free YouTube to MP3 Converter version 3.12.0.128 (Version: 3.12.0.128 - DVDVideoSoft Ltd.)
GIMP 2.8.4 (Version: 2.8.4 - The GIMP Team)
Google Chrome (Version: 31.0.1650.63 - Google Inc.)
Google Earth (Version: 7.1.2.2041 - Google)
Google Toolbar for Internet Explorer (Version: 1.0.0 - Google Inc.) Hidden
Google Toolbar for Internet Explorer (Version: 7.5.4805.320 - Google Inc.)
Google Update Helper (Version: 1.3.22.3 - Google Inc.) Hidden
GS Auto Clicker (Version: V3.1.2 - goldensoft.org)
Intel PROSet Wireless (Version:  - ) Hidden
Intel(R) Graphics Media Accelerator Driver (Version:  - Intel Corporation)
Intel(R) PROSet/Wireless WiFi-Software (Version: 12.02.0000 - Intel(R) Corporation)
Intel® Matrix Storage Manager (Version:  - Intel Corporation)
Java 7 Update 45 (Version: 7.0.450 - Oracle)
Java Auto Updater (Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
JDownloader 0.9 (Version: 0.9 - AppWork GmbH)
Junk Mail filter update (Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Launch Manager (Version: 2.0.03 - Acer Inc.)
League of Legends (Version: 1.3 - Riot Games)
Malwarebytes Anti-Malware Version 1.75.0.1300 (Version: 1.75.0.1300 - Malwarebytes Corporation)
McAfee Security Scan Plus (Version: 3.8.130.10 - McAfee, Inc.)
Metin2 (Version:  - Gameforge 4D GmbH)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 Language Pack SP1 - deu (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 3.5 SP1 (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5 (Version: 4.5.50709 - Microsoft Corporation)
Microsoft .NET Framework 4.5 (Version: 4.5.50709 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5 DEU Language Pack (Version: 4.5.50709 - Microsoft Corporation)
Microsoft .NET Framework 4.5 DEU Language Pack (Version: 4.5.50709 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6012.5000 - Microsoft Corporation) Hidden
Microsoft Choice Guard (Version: 2.0.48.0 - Microsoft Corporation) Hidden
Microsoft Office 2007 Service Pack 3 (SP3) (Version:  - Microsoft) Hidden
Microsoft Office Access MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Enterprise 2007 (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office FrontPage 2003 (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Office Groove MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Live Add-in 1.5 (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office OneNote MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (Version:  - Microsoft) Hidden
Microsoft Office Publisher MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office SharePoint Designer 2007 (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office SharePoint Designer 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office SharePoint Designer 2007 Service Pack 3 (SP3) (Version:  - Microsoft)
Microsoft Office SharePoint Designer 2007 Service Pack 3 (SP3) (Version:  - Microsoft) Hidden
Microsoft Office SharePoint Designer MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Sync Framework Runtime Native v1.0 (x86) (Version: 1.0.1215.0 - Microsoft Corporation)
Microsoft Sync Framework Services Native v1.0 (x86) (Version: 1.0.1215.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Works (Version: 9.7.0621 - Microsoft Corporation)
MinecraftAlpha (Version:  - )
Moo0 VoiceRecorder 1.32 (Version:  - )
MSVC80_x86_v2 (Version: 1.0.3.0 - Nokia) Hidden
MSVC90_x86 (Version: 1.0.1.2 - Nokia) Hidden
MSVCRT (Version: 14.0.1468.721 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0 - Microsoft Corporation)
MyWinLocker (Version: 3.1.59.0 - Egis Technology Inc.)
No23 Recorder (Version: 2.1.0.3 - No23)
Nokia Connectivity Cable Driver (Version: 7.1.41.0 - Nokia)
Nokia Ovi Player (Version: 2.0.1106 - Nokia Ovi Player)
Nokia Ovi Suite (Version: 3.1.0.84 - Nokia)
Nokia Ovi Suite (Version: 3.1.0.84 - Nokia) Hidden
Nokia Ovi Suite Software Updater (Version: 02.07.004.45780 - Nokia Corporation)
Nokia_Multimedia_Common_Components_2_5 (Version: 2.5.197 - Nokia)
NTI Backup Now 5 (Version: 5.1.2.616 - NewTech Infosystems)
NTI Backup Now Standard (Version: 5.1.2.616 - NewTech Infosystems) Hidden
NTI Media Maker 8 (Version: 8.0.2.6509 - NewTech Infosystems)
NTI Media Maker 8 (Version: 8.0.2.6509 - NewTech Infosystems) Hidden
Ocean Express (Version:  - Oberon Media)
OpenOffice.org 3.4.1 (Version: 3.41.9593 - Apache Software Foundation)
Optical Drive Power Management (Version: 1.00.3006 - Acer Incorporated)
Orion (Version: 2.5.0 - Convesoft)
osu! (Version: 0.0.0.0 - peppy)
Overwolf (Version: 0.44.256 - Overwolf)
Ovi Desktop Sync Engine (Version: 1.5.257.0 - Nokia) Hidden
OviMPlatform (Version: 2.7.66.0 - Nokia) Hidden
Paint.NET v3.5.10 (Version: 3.60.0 - dotPDN LLC)
Pando Media Booster (Version: 2.6.0.9 - Pando Networks Inc.)
PC Connectivity Solution (Version: 11.4.15.0 - Nokia)
PHANTASY STAR UNIVERSE (Version:  - SEGA SONIC TEAM)
Pinnacle VideoSpin (Version: 2.0.0.669 - Pinnacle Systems)
Pokemon Online 2.2.4c (Version:  - Dreambelievers)
PowerDVD (Version: 7.0.4028.0 - CyberLink Corp.)
Project64 1.6 (Version: 1.6 - Project64)
PSPdisp v0.6 (Version: v0.6 - JJS)
Puzzle Express (Version:  - Oberon Media)
RaidCall (Version: 7.1.8-1.0.4843.13 - raidcall.com)
Razer Game Booster (Version: 3.7 - Razer USA Ltd)
Realtek High Definition Audio Driver (Version: 6.0.1.5830 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (Version: 6.0.6000.20113 - Realtek Semiconductor Corp.)
S4 League_EU (Version: 1.00.0000 - )
Skype™ 6.11 (Version: 6.11.102 - Skype Technologies S.A.)
Softwarenetz Kassenbuch4 (Version:  - )
Softwarenetz Rechnung3 (Version:  - )
Spotify (Version: 0.9.6.81.gd359a796 - Spotify AB)
swMSM (Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Synaptics Pointing Device Driver (Version: 12.2.2.0 - Synaptics Incorporated)
Tales of Pirates II (Version: 1.0.63 - IGG,Inc.)
Tales of Pirates Online (Version: 2.00 - IGG,Inc.)
TeamSpeak 3 Client (Version: 3.0.13 - TeamSpeak Systems GmbH)
Tri-Peaks Solitaire To Go (Version:  - Oberon Media)
Unity Web Player (Version:  - Unity Technologies ApS)
Update for 2007 Microsoft Office System (KB967642) (Version:  - Microsoft)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (Version: 1 - Microsoft Corporation)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2850085) 32-Bit Edition (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (Version:  - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (Version:  - Microsoft)
Windows Live Call (Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live Communications Platform (Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Windows Live Essentials (Version: 14.0.8117.0416 - Microsoft Corporation)
Windows Live Essentials (Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Windows Live ID-Anmelde-Assistent (Version: 6.500.3165.0 - Microsoft Corporation)
Windows Live Mail (Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live Messenger (Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live Movie Maker (Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live OneCare safety scanner (Version:  - Microsoft Corporation)
Windows Live OneCare safety scanner (Version: 1.0.0.0 - Microsoft Corporation) Hidden
Windows Live Sync (Version: 14.0.8117.416 - Microsoft Corporation)
Windows Live Writer (Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live-Uploadtool (Version: 14.0.8014.1029 - Microsoft Corporation)
Windows Media Encoder 9-Reihe (Version:  - )
Windows Media Encoder 9-Reihe (Version: 9.00.3374 - Microsoft Corporation) Hidden
Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0) (Version: 08/22/2008 7.0.0.0 - Nokia)
WinRAR (Version:  - )
YGOPro DevPro Version 1.9.6 r0 (Version: 1.9.6 r0 - YGOPro DevPro Online)

==================== Restore Points  =========================

01-01-2014 18:51:14 Windows Defender Checkpoint
01-01-2014 20:12:17 Windows Defender Checkpoint
01-01-2014 22:32:21 Windows Defender Checkpoint
03-01-2014 04:27:47 Windows Defender Checkpoint
08-01-2014 18:56:33 Geplanter Prüfpunkt

==================== Hosts content: ==========================

2006-11-02 11:23 - 2014-01-04 18:42 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {1CC81347-6204-4B83-900C-01E02F50F067} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {320124A7-D70F-41DE-A9D1-D5E8E19D5D91} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {3BCDF251-CA5C-4045-A1FC-8FCEF9FBDC93} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {44980BEE-7809-44A9-AC24-D6E578A3B7DF} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\System32\RacAgent.exe [2008-01-21] (Microsoft Corporation)
Task: {66F4192C-CB24-483F-9921-4419A21887F1} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance => C:\Program Files\TuneUp Utilities 2010\OneClick.exe
Task: {934DCA32-97E5-44D7-9D50-F59EA48F6F05} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-01-09] (Adobe Systems Incorporated)
Task: {9F19DC2B-EF0B-4D5C-B441-F7E52C62CE00} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2012-06-17] (Google Inc.)
Task: {B71A2F7D-B177-4953-8E43-E2A87B54E842} - System32\Tasks\Razer_Game_Booster_AutoUpdate => C:\Program Files\Razer\Razer Game Booster\AutoUpdate.exe [2013-06-05] ()
Task: {C563A681-F725-4797-A49A-3CF91A72630B} - System32\Tasks\Microsoft\Windows\RestartManager\{89FF3A27-10E6-4625-A0C3-C87A29BD3920} => C:\Windows\System32\RmClient.exe [2006-11-02] (Microsoft Corporation)
Task: {CB86B84B-8BA3-4309-830A-B4A8D36F94FF} - System32\Tasks\Microsoft\Windows\RestartManager\{F1DAADE9-048D-4c73-AB80-23FE9E867D86} => C:\Windows\System32\RmClient.exe [2006-11-02] (Microsoft Corporation)
Task: {CD5EFA92-F851-4E18-A578-6C147CC39750} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-76954294-2760295059-2378521770-1000UA => C:\Users\highend-outlets\AppData\Local\Google\Update\GoogleUpdate.exe [2011-05-06] (Google Inc.)
Task: {E5150B95-F9B4-4D5D-95A2-7EC1ACBA95F8} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\System32\gatherWirelessInfo.vbs [2008-01-21] ()
Task: {E56B1436-3183-444C-B2DF-AC953488D3CB} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2012-06-17] (Google Inc.)
Task: {E71B9867-B33A-497A-A2DF-6CD647551137} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Signature Update => C:\Program Files\Windows Defender\MpCmdRun.exe [2008-01-21] (Microsoft Corporation)
Task: {ECFD679D-C93F-4B61-A36A-22657793F7EA} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-76954294-2760295059-2378521770-1000Core => C:\Users\highend-outlets\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-09-02] (Facebook Inc.)
Task: {EDECC2FA-CDF1-4E4D-9512-91877876D395} - System32\Tasks\Java Update Scheduler => C:\Program Files\Common Files\Java\Java Update\jusched.exe [2013-07-02] (Oracle Corporation)
Task: {F07446DC-AB25-47C8-BFB7-8ADF973A0FF8} - System32\Tasks\Adobe Reader and Acrobat Manager => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2011-06-06] (Adobe Systems Incorporated)
Task: {F0F13B91-2E61-4F83-92F9-D051598F9CB2} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-76954294-2760295059-2378521770-1000Core => C:\Users\highend-outlets\AppData\Local\Google\Update\GoogleUpdate.exe [2011-05-06] (Google Inc.)
Task: {F30C6B22-2347-460B-A064-5116DEF5E245} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-76954294-2760295059-2378521770-1000UA => C:\Users\highend-outlets\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-09-02] (Facebook Inc.)
Task: {FD7B84A3-1A67-4505-B821-27E689A7FA9E} - System32\Tasks\Game_Booster_AutoUpdate => C:\Program Files\IObit\Game Booster 3\AutoUpdate.exe
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-76954294-2760295059-2378521770-1000Core.job => C:\Users\highend-outlets\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-76954294-2760295059-2378521770-1000UA.job => C:\Users\highend-outlets\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-76954294-2760295059-2378521770-1000Core.job => C:\Users\highend-outlets\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-76954294-2760295059-2378521770-1000UA.job => C:\Users\highend-outlets\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\User_Feed_Synchronization-{96A8A4AD-CD8F-4D37-8F51-72C50F28B58B}.job => C:\Windows\system32\msfeedssync.exe

==================== Loaded Modules (whitelisted) =============

2014-01-01 19:51 - 2014-01-01 19:51 - 00025600 _____ () C:\Users\highend-outlets\AppData\Local\ATworks\CompatObjclass16.dll
2009-07-16 08:27 - 2003-06-07 22:30 - 00057344 _____ () C:\Program Files\Launch Manager\PowerUtl.dll
2009-02-02 16:33 - 2009-02-02 16:33 - 00460199 _____ () C:\Program Files\NewTech Infosystems\Acer Backup Manager\sqlite3.dll
2013-07-03 19:51 - 2012-08-01 14:44 - 00519600 _____ () C:\Program Files\Razer\Razer Game Booster\sqlite3.dll
2013-07-03 19:51 - 2013-06-04 15:07 - 00535480 _____ () C:\Program Files\Razer\Razer Game Booster\K_fps.dll
2013-07-03 19:51 - 2013-06-04 15:07 - 00272360 _____ () C:\Program Files\Razer\Razer Game Booster\D3DX8Wrapper.dll
2013-07-03 19:51 - 2013-06-04 15:07 - 00133280 _____ () C:\Program Files\Razer\Razer Game Booster\Mpeg2Video.dll
2013-07-03 19:51 - 2013-01-30 16:48 - 07477262 _____ () C:\Program Files\Razer\Razer Game Booster\avcodec-54.dll
2013-07-03 19:51 - 2013-01-30 16:48 - 00156174 _____ () C:\Program Files\Razer\Razer Game Booster\keutil-51.dll
2013-07-03 19:51 - 2013-01-30 16:48 - 01191950 _____ () C:\Program Files\Razer\Razer Game Booster\avformat-54.dll
2013-07-03 19:51 - 2013-01-30 16:48 - 00333326 _____ () C:\Program Files\Razer\Razer Game Booster\swscale-2.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\ProgramData\TEMP:3B3A35EC
AlternateDataStreams: C:\ProgramData\TEMP:4F636E25
AlternateDataStreams: C:\ProgramData\TEMP:798A3728
AlternateDataStreams: C:\ProgramData\TEMP:814B9485
AlternateDataStreams: C:\ProgramData\TEMP:8750DCE4
AlternateDataStreams: C:\ProgramData\TEMP:9E22BBE8
AlternateDataStreams: C:\ProgramData\TEMP:ABE89FFE
AlternateDataStreams: C:\ProgramData\TEMP:ADE16379
AlternateDataStreams: C:\ProgramData\TEMP:B203B914
AlternateDataStreams: C:\ProgramData\TEMP:B623B5B8
AlternateDataStreams: C:\ProgramData\TEMP:BB24555F
AlternateDataStreams: C:\ProgramData\TEMP:CDFF58FE
AlternateDataStreams: C:\ProgramData\TEMP:CE0A077E

==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MpfService => ""="Service"

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (01/09/2014 11:55:49 PM) (Source: Application Hang) (User: )
Description: Programm League of Legends.exe, Version 3.15.0.260 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen.
Prozess-ID: 9a0
Anfangszeit: 01cf0d8db385e480
Zeitpunkt der Beendigung: 10

Error: (01/09/2014 09:33:54 PM) (Source: Application Error) (User: )
Description: Fehlerhafte Anwendung rundll32.exe, Version 6.0.6000.16386, Zeitstempel 0x4549b0e1, fehlerhaftes Modul kernel32.dll, Version 6.0.6001.18631, Zeitstempel 0x4da467f0, Ausnahmecode 0x0eedfade, Fehleroffset 0x00044503,
Prozess-ID 0x14f8, Anwendungsstartzeit rundll32.exe0.

Error: (01/09/2014 01:31:00 PM) (Source: Windows Search Service) (User: )
Description: Eintrag <C:\USERS\HIGHEND-OUTLETS\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\CYBERLINK POWERDVD\POWERDVD DEINSTALLIEREN.LNK> in der Hash-Zuordnung kann nicht aktualisiert werden.

Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)

Error: (01/09/2014 01:31:00 PM) (Source: Windows Search Service) (User: )
Description: Eintrag <C:\USERS\HIGHEND-OUTLETS\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\CYBERLINK POWERDVD\POWERDVD DEINSTALLIEREN.LNK> in der Hash-Zuordnung kann nicht aktualisiert werden.

Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)

Error: (01/09/2014 01:31:00 PM) (Source: Windows Search Service) (User: )
Description: Eintrag <C:\USERS\HIGHEND-OUTLETS\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\CYBERLINK POWERDVD\README.LNK> in der Hash-Zuordnung kann nicht aktualisiert werden.

Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)

Error: (01/09/2014 01:31:00 PM) (Source: Windows Search Service) (User: )
Description: Eintrag <C:\USERS\HIGHEND-OUTLETS\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\CYBERLINK POWERDVD\README.LNK> in der Hash-Zuordnung kann nicht aktualisiert werden.

Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)

Error: (01/09/2014 01:31:00 PM) (Source: Windows Search Service) (User: )
Description: Eintrag <C:\USERS\HIGHEND-OUTLETS\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\CYBERLINK POWERDVD\ONLINE-REGISTRIERUNG.LNK> in der Hash-Zuordnung kann nicht aktualisiert werden.

Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)

Error: (01/09/2014 01:31:00 PM) (Source: Windows Search Service) (User: )
Description: Eintrag <C:\USERS\HIGHEND-OUTLETS\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\CYBERLINK POWERDVD\ONLINE-REGISTRIERUNG.LNK> in der Hash-Zuordnung kann nicht aktualisiert werden.

Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)

Error: (01/09/2014 01:31:00 PM) (Source: Windows Search Service) (User: )
Description: Eintrag <C:\USERS\HIGHEND-OUTLETS\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\CYBERLINK POWERDVD\POWERDVD-HILFE.LNK> in der Hash-Zuordnung kann nicht aktualisiert werden.

Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)

Error: (01/09/2014 01:31:00 PM) (Source: Windows Search Service) (User: )
Description: Eintrag <C:\USERS\HIGHEND-OUTLETS\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\CYBERLINK POWERDVD\POWERDVD-HILFE.LNK> in der Hash-Zuordnung kann nicht aktualisiert werden.

Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)


System errors:
=============
Error: (01/10/2014 02:14:01 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)

Error: (01/10/2014 02:13:14 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}NT-AUTORITÄTLOKALER DIENSTS-1-5-19LocalHost (unter Verwendung von LRPC)

Error: (01/10/2014 01:32:42 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)

Error: (01/10/2014 01:31:55 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}NT-AUTORITÄTLOKALER DIENSTS-1-5-19LocalHost (unter Verwendung von LRPC)

Error: (01/10/2014 01:22:42 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)

Error: (01/10/2014 01:21:56 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}NT-AUTORITÄTLOKALER DIENSTS-1-5-19LocalHost (unter Verwendung von LRPC)

Error: (01/10/2014 01:54:35 AM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)

Error: (01/10/2014 01:53:49 AM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}NT-AUTORITÄTLOKALER DIENSTS-1-5-19LocalHost (unter Verwendung von LRPC)

Error: (01/10/2014 01:44:35 AM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)

Error: (01/10/2014 01:43:49 AM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}NT-AUTORITÄTLOKALER DIENSTS-1-5-19LocalHost (unter Verwendung von LRPC)


Microsoft Office Sessions:
=========================
Error: (01/21/2013 08:37:04 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 156 seconds with 120 seconds of active time.  This session ended with a crash.

Error: (12/06/2012 09:28:27 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 12 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (10/26/2012 03:59:23 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6661.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 20 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (08/19/2012 09:57:53 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6661.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 218 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (08/18/2012 02:41:14 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6661.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 3 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (08/10/2012 10:42:21 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6661.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 7 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (08/06/2012 02:35:26 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6661.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 9 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (08/04/2012 02:38:04 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6661.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 4 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (08/02/2012 08:49:26 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6661.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 18 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (08/01/2012 07:40:24 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6661.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 265 seconds with 120 seconds of active time.  This session ended with a crash.


CodeIntegrity Errors:
===================================
  Date: 2014-01-10 14:13:45.607
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-01-10 14:13:45.416
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-01-10 14:13:45.229
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-01-10 14:13:45.037
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-01-10 14:13:44.809
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-01-10 14:13:44.606
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-01-10 14:13:44.388
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-01-10 14:13:44.129
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-01-09 13:21:36.617
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-01-09 13:21:36.436
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Percentage of memory in use: 34%
Total physical RAM: 3002.86 MB
Available physical RAM: 1966.91 MB
Total Pagefile: 6206.77 MB
Available Pagefile: 4746.98 MB
Total Virtual: 2047.88 MB
Available Virtual: 1923.47 MB

==================== Drives ================================

Drive c: (ACER) (Fixed) (Total:223.12 GB) (Free:84.9 GB) NTFS ==>[Drive with boot components (obtained from BCD)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 233 GB) (Disk ID: BE0AF550)
Partition 1: (Not Active) - (Size=10 GB) - (Type=27)
Partition 2: (Active) - (Size=223 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

Alt 11.01.2014, 12:35   #14
schrauber
/// the machine
/// TB-Ausbilder
 

Vista: schwerwiegender Trojanerbefall von Necrus!A und ähnlichem - Standard

Vista: schwerwiegender Trojanerbefall von Necrus!A und ähnlichem



Downloade dir bitte Windows Repair (All In One) von hier.
  • Installiere das Programm. Starte es, nachdem die Installation abgeschlossen wurde.
  • Klicke auf Step 2 und drücke unter Check Disk auf Do It.

  • Wenn der Vorgang abgeschlossen ist, klicke auf Step 3 und drücke unter System File Check auf Do It.

  • Nachdem der Vorgang abgeschlossen ist, klicke auf Start Repairs, wähle den Advanced Mode und drücke Start.

  • Gehe bitte sicher, dass die Kästchen wie unten zu sehen angehakt sind. Bitte hake zusätzlich noch Set Windows Services to Default Startup an.
  • Hake Restart System when Finished an.
  • Drücke Start.

__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 14.01.2014, 16:39   #15
Singed
 
Vista: schwerwiegender Trojanerbefall von Necrus!A und ähnlichem - Standard

Vista: schwerwiegender Trojanerbefall von Necrus!A und ähnlichem



Danke aber leider funktionieren tut das auch nicht ...
Aber ich sage trotzdem danke. Ich formatiere am Wochenende die Festplatte und hau Win 7 druff. wenn ich dann Probleme habe melde ich mich wieder hier.
Tut mir leid, wenn ich deine Zeit verschwendet habe aber trotzdem vielen vielen Dank

Antwort

Themen zu Vista: schwerwiegender Trojanerbefall von Necrus!A und ähnlichem
adware.installbrain, antivir, boot, exploit.drop.gs, exploit.drop.gslad, iexplorer.exe, infiziert, laptop, malware.packer.ukn, probleme, pup.optional.freenew.a, pup.optional.installcore.a, scannen, service, system32, taskmanager, tr/crypt.xpack.39878, tr/dropper.vb.8966, tr/necursx.a.17, trojan.agent, trojan.dorkbot.ed, trojan.downloader, viren



Ähnliche Themen: Vista: schwerwiegender Trojanerbefall von Necrus!A und ähnlichem


  1. Rechner in Netzwerk mit ähnlichem Problem (Werbung, wo keine sein sollte)
    Plagegeister aller Art und deren Bekämpfung - 23.12.2014 (3)
  2. System mit BKA-Trojaner ähnlichem Schädling infiziert (Win7 Home Premium)
    Log-Analyse und Auswertung - 17.04.2014 (7)
  3. Windows Vista, Trojanerbefall Win32/Kryptik.BXAT trojan Antivirenprogramm kann nicht mehr gestartet werden
    Log-Analyse und Auswertung - 28.03.2014 (19)
  4. Vermeintliche Links in Texten entpuppen sich als Werbefenster oder ähnlichem
    Plagegeister aller Art und deren Bekämpfung - 22.10.2013 (14)
  5. D-Link-Router mit schwerwiegender UPnP-Lücke
    Nachrichten - 10.07.2013 (0)
  6. Überreste von SMART HDD oder ähnlichem
    Plagegeister aller Art und deren Bekämpfung - 19.10.2012 (34)
  7. Polizei - Computer gesperrt, Trojanerbefall auf Windows Vista
    Plagegeister aller Art und deren Bekämpfung - 05.08.2012 (4)
  8. Infizierung mit Csrss oder ähnlichem?
    Plagegeister aller Art und deren Bekämpfung - 11.07.2012 (16)
  9. Schwerwiegender Systemfehler -> K7 Total Security /Steganos Antivirus 12
    Antiviren-, Firewall- und andere Schutzprogramme - 05.12.2010 (3)
  10. Minidump/ sysdata.xml - Bluescreen und Schwerwiegender Fehler
    Alles rund um Windows - 17.04.2010 (24)
  11. schwerwiegender Systemfehler
    Plagegeister aller Art und deren Bekämpfung - 06.09.2009 (2)
  12. Bluescreen und Schwerwiegender Fehler: Minidump/ sysdata.xml
    Alles rund um Windows - 22.06.2009 (3)
  13. Scheinbar schwerwiegender Virus/Wurm
    Plagegeister aller Art und deren Bekämpfung - 29.05.2009 (17)
  14. Zonealarm 7.0 (Schwerwiegender Fehler)
    Antiviren-, Firewall- und andere Schutzprogramme - 13.04.2007 (11)
  15. Pc auf standby...schwerwiegender fehler
    Alles rund um Windows - 20.02.2005 (4)
  16. Neuer (schwerwiegender) Bug im Internet Explorer
    Alles rund um Windows - 28.02.2003 (1)
  17. E-Mails unterwegs mit PDA oder Ähnlichem
    Netzwerk und Hardware - 04.01.2003 (2)

Zum Thema Vista: schwerwiegender Trojanerbefall von Necrus!A und ähnlichem - Guten Mittag liebe community, seit etwa 2 Tagen habe ich nen relativ akuten Befall von Trojanern. ich dachte wenn ich einmal mein Antivir Premium drüber scannen lasse, sei die Sache - Vista: schwerwiegender Trojanerbefall von Necrus!A und ähnlichem...
Archiv
Du betrachtest: Vista: schwerwiegender Trojanerbefall von Necrus!A und ähnlichem auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.