Hallo,ich habe ein Keylogger auf dem PC.
Woher ich das weis
- Ein Freund ruft mich an um circa 4 Uhr morgens und sagt: Spielst du wieder WoW.(Meine reaktion kann man sich denken ).
Mein Battlenet passwort wurde geändert(ich rufe heute noch den Support an usw.)

Ich hab viele Ordner circa 200-300 Gigabyte gelöscht und OTL drüberlaufen lassen
Der Log :
OTL logfile created on: 20.03.2014 18:25:59 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\RedWidow\Desktop\Downloads
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.11.9600.16521)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

15,98 Gb Total Physical Memory | 13,54 Gb Available Physical Memory | 84,73% Memory free
31,96 Gb Paging File | 28,90 Gb Available in Paging File | 90,42% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 931,41 Gb Total Space | 656,18 Gb Free Space | 70,45% Space Free | Partition Type: NTFS

Computer Name: REDWIDOW-PC | User Name: RedWidow | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 7 Days

========== Processes (SafeList) ==========

PRC - [2014.03.20 18:25:40 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\RedWidow\Desktop\Downloads\otl.exe
PRC - [2014.02.26 19:57:32 | 003,814,736 | ---- | M] (LogMeIn Inc.) -- C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
PRC - [2014.02.15 15:35:41 | 000,223,112 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\Google\Update\1.3.22.5\GoogleCrashHandler.exe
PRC - [2014.02.14 18:31:24 | 000,275,568 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
PRC - [2014.01.09 14:03:15 | 001,171,968 | ---- | M] (Spotify Ltd) -- C:\Users\RedWidow\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
PRC - [2013.12.25 21:11:57 | 000,076,888 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe
PRC - [2013.10.15 12:27:38 | 003,921,880 | ---- | M] (Safer-Networking Ltd.) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
PRC - [2013.09.20 10:57:28 | 006,214,480 | ---- | M] (Safer-Networking Ltd.) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWelcome.exe
PRC - [2013.09.20 10:51:08 | 003,885,120 | ---- | M] (Safer-Networking Ltd.) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe
PRC - [2013.09.13 10:38:30 | 000,171,416 | ---- | M] (Safer-Networking Ltd.) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
PRC - [2013.08.30 08:47:34 | 004,858,968 | ---- | M] (AVAST Software) -- C:\Programme\AVAST Software\Avast\AvastUI.exe
PRC - [2013.08.30 08:47:33 | 000,046,808 | ---- | M] (AVAST Software) -- C:\Programme\AVAST Software\Avast\AvastSvc.exe
PRC - [2013.08.01 20:53:22 | 000,664,344 | ---- | M] (Logitech Inc.) -- C:\Programme\Logitech Gaming Software\Applets\LCDMedia.exe
PRC - [2013.07.25 11:19:26 | 005,624,784 | ---- | M] (Safer-Networking Ltd.) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
PRC - [2013.07.05 06:22:36 | 000,327,432 | ---- | M] (CyberLink) -- C:\Program Files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSServerPDVD13.exe
PRC - [2013.07.05 06:22:34 | 000,077,576 | ---- | M] (CyberLink) -- C:\Program Files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSMonitorServicePDVD13.exe
PRC - [2013.06.05 01:02:10 | 004,489,472 | ---- | M] (Akamai Technologies, Inc.) -- C:\Users\RedWidow\AppData\Local\Akamai\netsession_win.exe
PRC - [2012.01.18 05:44:52 | 000,450,848 | ---- | M] (Logitech Inc.) -- C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
PRC - [2010.01.22 11:29:40 | 000,106,496 | ---- | M] (NEC Electronics Corporation) -- C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
PRC - [2009.07.07 12:13:38 | 000,241,789 | ---- | M] (Creative Technology Ltd) -- C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe
PRC - [2009.02.23 04:43:56 | 000,307,200 | ---- | M] (Creative Technology Ltd) -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe


========== Modules (No Company Name) ==========

MOD - [2014.02.14 18:31:23 | 003,578,992 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
MOD - [2013.09.05 00:14:10 | 004,300,456 | ---- | M] () -- C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf
MOD - [2013.05.16 10:55:28 | 000,161,112 | ---- | M] () -- C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
MOD - [2013.05.16 10:55:26 | 000,113,496 | ---- | M] () -- C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
MOD - [2013.05.16 10:55:24 | 000,416,600 | ---- | M] () -- C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
MOD - [2012.08.23 10:38:24 | 000,574,840 | ---- | M] () -- C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
MOD - [2009.07.30 13:54:04 | 000,170,496 | ---- | M] () -- C:\Windows\SysWOW64\APOMngr.DLL
MOD - [2009.02.06 17:52:24 | 000,073,728 | ---- | M] () -- C:\Windows\SysWOW64\CmdRtr.DLL


========== Services (SafeList) ==========

SRV:64bit: - [2014.03.01 05:33:34 | 000,111,616 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\IEEtwCollector.exe -- (IEEtwCollectorService)
SRV:64bit: - [2013.08.30 23:57:54 | 000,239,616 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2013.08.30 18:46:48 | 000,344,064 | ---- | M] (Advanced Micro Devices, Inc.) [Auto | Running] -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe -- (AMD FUEL Service)
SRV:64bit: - [2009.07.14 02:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2014.03.12 14:54:25 | 000,257,928 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2014.02.26 19:57:32 | 002,224,976 | ---- | M] (LogMeIn Inc.) [Auto | Running] -- C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe -- (Hamachi2Svc)
SRV - [2014.02.26 09:50:04 | 000,377,616 | ---- | M] (LogMeIn, Inc.) [Auto | Running] -- C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe -- (LMIGuardianSvc)
SRV - [2014.02.14 18:31:23 | 000,118,896 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013.12.25 21:11:57 | 000,076,888 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
SRV - [2013.11.25 21:00:59 | 004,979,992 | ---- | M] (INCA Internet Co., Ltd.) [On_Demand | Stopped] -- C:\Windows\SysWOW64\GameMon.des -- (npggsvc)
SRV - [2013.10.23 08:15:08 | 000,172,192 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2013.10.08 15:47:47 | 000,008,192 | ---- | M] () [Auto | Stopped] -- C:\Windows\SysWOW64\srvany.exe -- (KMService)
SRV - [2013.09.11 21:21:54 | 000,105,144 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2013.08.30 08:47:33 | 000,046,808 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Programme\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV - [2013.07.05 06:22:36 | 000,327,432 | ---- | M] (CyberLink) [Auto | Running] -- C:\Program Files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSServerPDVD13.exe -- (CyberLink PowerDVD 13 Media Server Service)
SRV - [2013.07.05 06:22:34 | 000,077,576 | ---- | M] (CyberLink) [Auto | Running] -- C:\Program Files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSMonitorServicePDVD13.exe -- (CyberLink PowerDVD 13 Media Server Monitor Service)
SRV - [2012.01.18 05:44:52 | 000,450,848 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe -- (UMVPFSrv)
SRV - [2010.01.09 20:34:24 | 004,925,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)
SRV - [2010.01.09 20:20:56 | 000,174,440 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose64)
SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009.02.23 04:43:56 | 000,307,200 | ---- | M] (Creative Technology Ltd) [Auto | Running] -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe -- (CTAudSvcService)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2014.02.27 12:15:44 | 000,231,376 | ---- | M] (TrueCrypt Foundation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\truecrypt.sys -- (truecrypt)
DRV:64bit: - [2013.11.29 17:39:19 | 000,283,064 | ---- | M] (Disc Soft Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV:64bit: - [2013.08.31 01:11:28 | 012,528,640 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)
DRV:64bit: - [2013.08.30 23:32:32 | 000,618,496 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2013.08.30 08:48:10 | 001,030,952 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\SysNative\drivers\aswSnx.sys -- (aswSnx)
DRV:64bit: - [2013.08.30 08:48:10 | 000,378,944 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswSP.sys -- (aswSP)
DRV:64bit: - [2013.08.30 08:48:10 | 000,204,880 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\aswVmm.sys -- (aswVmm)
DRV:64bit: - [2013.08.30 08:48:10 | 000,072,016 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswRdr2.sys -- (aswRdr)
DRV:64bit: - [2013.08.30 08:48:10 | 000,065,336 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\aswRvrt.sys -- (aswRvrt)
DRV:64bit: - [2013.08.30 08:48:10 | 000,064,288 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswTdi.sys -- (aswTdi)
DRV:64bit: - [2013.08.30 08:48:09 | 000,080,816 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV:64bit: - [2013.08.30 08:48:09 | 000,033,400 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV:64bit: - [2013.08.20 06:02:12 | 000,204,568 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudmdm.sys -- (ssudmdm)
DRV:64bit: - [2013.08.20 06:02:12 | 000,103,576 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudbus.sys -- (dg_ssudbus)
DRV:64bit: - [2013.07.05 09:40:38 | 000,096,256 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService)
DRV:64bit: - [2013.06.21 02:09:46 | 000,042,184 | ---- | M] (Anchorfree Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\taphss6.sys -- (taphss6)
DRV:64bit: - [2013.05.30 16:16:40 | 000,064,280 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGSHidFilt.Sys -- (LGSHidFilt)
DRV:64bit: - [2013.04.15 19:51:58 | 000,102,808 | ---- | M] (Logitech) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ladfGSRamd64.sys -- (LADF_RenderOnly)
DRV:64bit: - [2013.04.15 19:51:52 | 000,410,008 | ---- | M] (Logitech) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ladfGSCamd64.sys -- (LADF_CaptureOnly)
DRV:64bit: - [2013.02.12 05:12:06 | 000,019,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usb8023x.sys -- (usb_rndisx)
DRV:64bit: - [2012.08.23 15:10:20 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:64bit: - [2012.08.23 15:07:35 | 000,057,856 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2012.03.01 07:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2012.01.18 05:44:36 | 004,865,568 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\lvuvc64.sys -- (LVUVC64)
DRV:64bit: - [2011.03.11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.20 14:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.03.17 11:24:00 | 000,401,696 | ---- | M] (Marvell) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\yk62x64.sys -- (yukonw7)
DRV:64bit: - [2010.03.02 12:30:20 | 001,301,504 | ---- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\viahduaa.sys -- (VIAHdAudAddService)
DRV:64bit: - [2010.01.22 11:22:22 | 000,180,224 | ---- | M] (NEC Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3xhc.sys -- (nusb3xhc)
DRV:64bit: - [2010.01.22 11:22:18 | 000,077,824 | ---- | M] (NEC Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3hub.sys -- (nusb3hub)
DRV:64bit: - [2009.11.24 01:38:00 | 000,016,008 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGVirHid.sys -- (LGVirHid)
DRV:64bit: - [2009.11.24 01:37:50 | 000,022,408 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGBusEnum.sys -- (LGBusEnum)
DRV:64bit: - [2009.10.29 09:14:38 | 000,115,824 | ---- | M] (JMicron Technology Corp.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\jraid.sys -- (JRAID)
DRV:64bit: - [2009.10.19 13:45:54 | 000,039,480 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\usbfilter.sys -- (usbfilter)
DRV:64bit: - [2009.09.30 02:34:32 | 000,121,872 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV:64bit: - [2009.07.31 04:40:34 | 000,025,600 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VMfilt64.sys -- (VMfilt)
DRV:64bit: - [2009.07.16 04:38:40 | 000,015,416 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ASACPI.sys -- (MTsensor)
DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.03.18 17:35:42 | 000,033,856 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\hamachi.sys -- (hamachi)
DRV - [2013.07.05 23:48:36 | 000,130,320 | ---- | M] (CyberLink Corp.) [2013/10/08 18:03:15] [Kernel | Auto | Running] -- C:\Program Files (x86)\CyberLink\PowerDVD13\Common\NavFilter\000.fcl -- ({09F57980-3432-4AFC-957D-27AC45FAE1F5})
DRV - [2012.11.20 12:55:42 | 000,057,512 | ---- | M] (Advanced Micro Devices) [Kernel | Auto | Running] -- C:\Programme\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys -- (AODDriver4.2)
DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\URLSearchHook: {c95a4e8e-816d-4655-8c79-d736da1adb6d} - No CLSID value found
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-2172666858-744790929-553880742-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.bing.com
IE - HKU\S-1-5-21-2172666858-744790929-553880742-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.giga.de/ [binary data]
IE - HKU\S-1-5-21-2172666858-744790929-553880742-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.bing.com
IE - HKU\S-1-5-21-2172666858-744790929-553880742-1000\..\URLSearchHook: {c95a4e8e-816d-4655-8c79-d736da1adb6d} - No CLSID value found
IE - HKU\S-1-5-21-2172666858-744790929-553880742-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-2172666858-744790929-553880742-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE11SR
IE - HKU\S-1-5-21-2172666858-744790929-553880742-1000\..\SearchScopes\{46244704-D10A-4418-80AC-0799FB662C58}: "URL" = hxxp://search.softonic.com/MOY00621/tb_v1?q={searchTerms}&SearchSource=4&cc=&mi=ac80fcae000000000000f46d04005e8c&r=132
IE - HKU\S-1-5-21-2172666858-744790929-553880742-1000\..\SearchScopes\{FF1171C3-1834-4EDA-B649-BEDF427DB99A}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT1561552&CUI=UN86581855170247403&UM=4&SSPV=IE_NO_DUM_G_2
IE - HKU\S-1-5-21-2172666858-744790929-553880742-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-2172666858-744790929-553880742-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>

========== FireFox ==========

FF - prefs.js..CT1561552.browser.search.defaultthis.engineName: true
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.com/firefox"
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:27.0.1


FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.51.2: C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.51.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.4: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll File not found
FF - HKLM\Software\MozillaPlugins\@esn/npbattlelog,version=2.3.2: C:\Program Files (x86)\Battlelog Web Plugins\2.3.2\npbattlelog.dll File not found
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.45.2: C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.45.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@nsroblox.roblox.com/launcher: C:\Program Files (x86)\Roblox\Versions\version-79a62ec00b324436\\NPRobloxProxy.dll ()
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll File not found

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\AVAST Software\Avast\WebRep\FF [2013.10.08 15:56:04 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 27.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 27.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

[2013.10.01 13:17:03 | 000,000,000 | ---D | M] (No name found) -- C:\Users\RedWidow\AppData\Roaming\mozilla\Extensions
[2014.03.16 14:55:05 | 000,000,000 | ---D | M] (No name found) -- C:\Users\RedWidow\AppData\Roaming\mozilla\Firefox\Profiles\x7ow81t1.default\extensions
[2013.10.29 16:15:14 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\RedWidow\AppData\Roaming\mozilla\Firefox\Profiles\x7ow81t1.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2014.03.08 13:33:21 | 000,000,000 | ---D | M] (Hotspot Shield) -- C:\Users\RedWidow\AppData\Roaming\mozilla\Firefox\Profiles\x7ow81t1.default\extensions\{c95a4e8e-816d-4655-8c79-d736da1adb6d}
[2014.03.10 15:18:49 | 000,000,000 | ---D | M] ("Flash Video Downloader - Full HD Download") -- C:\Users\RedWidow\AppData\Roaming\mozilla\Firefox\Profiles\x7ow81t1.default\extensions\artur.dubovoy@gmail.com
[2013.11.29 17:36:11 | 000,000,000 | ---D | M] (No name found) -- C:\Users\RedWidow\AppData\Roaming\mozilla\Firefox\Profilesx7ow81t1.default\extensions
[2013.11.29 17:36:11 | 000,000,000 | ---D | M] (No name found) -- C:\Users\RedWidow\AppData\Roaming\mozilla\Firefox\Profilesx7ow81t1.default\extensions\staged
[2014.01.31 17:03:06 | 000,007,926 | ---- | M] () (No name found) -- C:\Users\RedWidow\AppData\Roaming\mozilla\firefox\profiles\x7ow81t1.default\extensions\5@thumbpro.net.xpi
[2013.12.24 13:50:10 | 000,395,578 | ---- | M] () (No name found) -- C:\Users\RedWidow\AppData\Roaming\mozilla\firefox\profiles\x7ow81t1.default\extensions\ffext_basicvideoext@startpage24.xpi
[2014.03.09 16:49:35 | 000,006,796 | ---- | M] () (No name found) -- C:\Users\RedWidow\AppData\Roaming\mozilla\firefox\profiles\x7ow81t1.default\extensions\info@youtube-mp3.org.xpi
[2014.03.09 16:50:08 | 000,019,335 | ---- | M] () (No name found) -- C:\Users\RedWidow\AppData\Roaming\mozilla\firefox\profiles\x7ow81t1.default\extensions\info@youtubespace.de.xpi
[2014.01.31 17:00:59 | 000,169,495 | ---- | M] () (No name found) -- C:\Users\RedWidow\AppData\Roaming\mozilla\firefox\profiles\x7ow81t1.default\extensions\jid0-Z0Vu9hJlqV0fhIAPqPfmUCNubYQ@jetpack.xpi
[2014.02.26 19:28:37 | 000,957,290 | ---- | M] () (No name found) -- C:\Users\RedWidow\AppData\Roaming\mozilla\firefox\profiles\x7ow81t1.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2014.02.14 16:59:07 | 000,287,566 | ---- | M] () (No name found) -- C:\Users\RedWidow\AppData\Roaming\mozilla\firefox\profiles\x7ow81t1.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi
[2013.10.26 18:07:16 | 000,002,544 | ---- | M] () -- C:\Users\RedWidow\AppData\Roaming\mozilla\firefox\profiles\x7ow81t1.default\searchplugins\ask-search.xml
[2014.03.08 13:40:13 | 000,001,102 | ---- | M] () -- C:\Users\RedWidow\AppData\Roaming\mozilla\firefox\profiles\x7ow81t1.default\searchplugins\hotspot-shield-customized-web-search.xml
[2013.11.02 18:09:35 | 000,001,434 | ---- | M] () -- C:\Users\RedWidow\AppData\Roaming\mozilla\firefox\profiles\x7ow81t1.default\searchplugins\softonic.xml
[2013.12.16 14:10:53 | 000,001,087 | ---- | M] () -- C:\Users\RedWidow\AppData\Roaming\mozilla\firefox\profiles\x7ow81t1.default\searchplugins\webwebweb.xml
[2014.03.16 14:54:21 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2014.03.16 14:54:21 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\browser\extensions
[2014.02.14 18:31:24 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\mozilla firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

========== Chrome ==========

CHR - default_search_provider: ()
CHR - default_search_provider: search_url =
CHR - default_search_provider: suggest_url =
CHR - homepage: chrome://newtab
CHR - Extension: No name found = C:\Users\RedWidow\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0\
CHR - Extension: No name found = C:\Users\RedWidow\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\
CHR - Extension: No name found = C:\Users\RedWidow\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\
CHR - Extension: No name found = C:\Users\RedWidow\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\
CHR - Extension: No name found = C:\Users\RedWidow\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\
CHR - Extension: No name found = C:\Users\RedWidow\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\

O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (avast! Online Security) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Programme\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O2:64bit: - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (Hotspot Shield Class) - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files (x86)\Hotspot Shield\HssIE\HssIE_64.dll File not found
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (no name) - {c95a4e8e-816d-4655-8c79-d736da1adb6d} - No CLSID value found.
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (avast! Online Security) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Programme\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (no name) - {c95a4e8e-816d-4655-8c79-d736da1adb6d} - No CLSID value found.
O3 - HKU\S-1-5-21-2172666858-744790929-553880742-1000\..\Toolbar\WebBrowser: (no name) - {C95A4E8E-816D-4655-8C79-D736DA1ADB6D} - No CLSID value found.
O4:64bit: - HKLM..\Run: [Launch LCore] C:\Program Files\Logitech Gaming Software\LCore.exe (Logitech Inc.)
O4:64bit: - HKLM..\Run: [RunDLLEntry] C:\Windows\SysNative\AmbRunE.DLL (Creative Technology Ltd.)
O4 - HKLM..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" File not found
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [BlueStacks Agent] C:\Program Files (x86)\BlueStacks\HD-Agent.exe File not found
O4 - HKLM..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe ()
O4 - HKLM..\Run: [LogMeIn Hamachi Ui] C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
O4 - HKLM..\Run: [NUSB3MON] C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (NEC Electronics Corporation)
O4 - HKLM..\Run: [PowerDVD13Agent] C:\Program Files (x86)\CyberLink\PowerDVD13\PowerDVD13Agent.exe (CyberLink Corp.)
O4 - HKLM..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime File not found
O4 - HKLM..\Run: [SDTray] C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe (Safer-Networking Ltd.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [UpdReg] C:\Windows\Updreg.EXE (Creative Technology Ltd.)
O4 - HKLM..\Run: [VolPanel] C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe (Creative Technology Ltd)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-2172666858-744790929-553880742-1000..\Run: [Akamai NetSession Interface] C:\Users\RedWidow\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc.)
O4 - HKU\S-1-5-21-2172666858-744790929-553880742-1000..\Run: [BackgroundContainer] C:\Users\RedWidow\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll (Conduit Ltd.)
O4 - HKU\S-1-5-21-2172666858-744790929-553880742-1000..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun File not found
O4 - HKU\S-1-5-21-2172666858-744790929-553880742-1000..\Run: [EADM] C:\Program Files (x86)\Origin\Origin.exe (Electronic Arts)
O4 - HKU\S-1-5-21-2172666858-744790929-553880742-1000..\Run: [Overwolf] C:\Program Files (x86)\Overwolf\Overwolf.exe -silent File not found
O4 - HKU\S-1-5-21-2172666858-744790929-553880742-1000..\Run: [Spotify] C:\Users\RedWidow\AppData\Roaming\Spotify\spotify.exe (Spotify Ltd)
O4 - HKU\S-1-5-21-2172666858-744790929-553880742-1000..\Run: [Spotify Web Helper] C:\Users\RedWidow\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Spotify Ltd)
O4 - HKU\S-1-5-21-2172666858-744790929-553880742-1000..\Run: [Steam] C:\Program Files (x86)\Steam\steam.exe (Valve Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKU\S-1-5-21-2172666858-744790929-553880742-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8:64bit: - Extra context menu item: An OneNote s&enden - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Programme\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: An OneNote s&enden - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Programme\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O9:64bit: - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKU\.DEFAULT\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKU\.DEFAULT\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKU\.DEFAULT\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKU\.DEFAULT\..Trusted Domains: sony.com ([]* in Trusted sites)
O15 - HKU\S-1-5-18\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKU\S-1-5-18\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKU\S-1-5-18\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKU\S-1-5-18\..Trusted Domains: sony.com ([]* in Trusted sites)
O15 - HKU\S-1-5-19\..Trusted Domains: clonewarsadventures.com ([]* in )
O15 - HKU\S-1-5-19\..Trusted Domains: freerealms.com ([]* in )
O15 - HKU\S-1-5-19\..Trusted Domains: soe.com ([]* in )
O15 - HKU\S-1-5-19\..Trusted Domains: sony.com ([]* in )
O15 - HKU\S-1-5-20\..Trusted Domains: clonewarsadventures.com ([]* in )
O15 - HKU\S-1-5-20\..Trusted Domains: freerealms.com ([]* in )
O15 - HKU\S-1-5-20\..Trusted Domains: soe.com ([]* in )
O15 - HKU\S-1-5-20\..Trusted Domains: sony.com ([]* in )
O15 - HKU\S-1-5-21-2172666858-744790929-553880742-1000\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-2172666858-744790929-553880742-1000\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-2172666858-744790929-553880742-1000\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-2172666858-744790929-553880742-1000\..Trusted Domains: sony.com ([]* in Trusted sites)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{90F38350-023C-449B-A58D-714D6191461B}: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18 - Protocol\Handler\ms-help - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL File not found
O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\SDWinLogon: DllName - (SDWinLogon.dll) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28:64bit: - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 7 Days ==========

[2014.03.20 18:20:21 | 000,000,000 | -H-D | C] -- C:\vthumb
[2014.03.20 18:20:21 | 000,000,000 | ---D | C] -- C:\ResBuffer
[2014.03.20 18:20:21 | 000,000,000 | ---D | C] -- C:\PlaytoAlbumArt
[2014.03.20 18:20:21 | 000,000,000 | ---D | C] -- C:\MOInfoBuffer
[2014.03.20 18:20:21 | 000,000,000 | ---D | C] -- C:\M3U8Buffer
[2014.03.20 18:18:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
[2014.03.20 18:18:28 | 000,021,040 | ---- | C] (Safer Networking Limited) -- C:\Windows\SysNative\sdnclean64.exe
[2014.03.20 18:18:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
[2014.03.20 18:18:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Spybot - Search & Destroy 2
[2014.03.20 15:49:13 | 000,000,000 | ---D | C] -- C:\Users\RedWidow\Desktop\try
[2014.03.20 15:22:54 | 000,000,000 | ---D | C] -- C:\test
[2014.03.19 18:50:49 | 000,000,000 | ---D | C] -- C:\Users\RedWidow\AppData\Local\Blizzard
[2014.03.19 16:48:56 | 000,000,000 | ---D | C] -- C:\Users\RedWidow\AppData\Local\Blizzard Entertainment
[2014.03.19 15:02:01 | 000,000,000 | ---D | C] -- C:\Users\RedWidow\AppData\Local\Battle.net
[2014.03.19 15:01:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Battle.net
[2014.03.15 20:33:17 | 000,000,000 | ---D | C] -- C:\Users\RedWidow\Desktop\costum
[2014.03.15 15:08:50 | 000,000,000 | ---D | C] -- C:\Users\RedWidow\AppData\Local\Roblox
[2014.03.15 15:05:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Roblox
[2014.03.15 15:05:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Roblox
[2014.03.15 08:13:08 | 000,000,000 | ---D | C] -- C:\Users\RedWidow\Documents\Arma 3 - Other Profiles
[2014.03.15 07:53:00 | 000,000,000 | ---D | C] -- C:\Users\RedWidow\Documents\Arma 3
[2014.03.15 07:52:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Bohemia Interactive
[2014.03.15 07:52:59 | 000,000,000 | ---D | C] -- C:\Users\RedWidow\AppData\Local\Arma 3
[2014.03.14 20:44:06 | 000,000,000 | ---D | C] -- C:\Users\RedWidow\Desktop\Arma 3
[2014.03.14 14:11:42 | 000,484,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wer.dll
[2014.03.14 14:11:41 | 000,381,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wer.dll
[2014.03.14 14:11:39 | 000,032,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll
[2014.03.14 14:11:38 | 000,051,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieetwproxystub.dll
[2014.03.14 14:11:38 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwcollectorres.dll
[2014.03.14 14:11:37 | 000,061,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll
[2014.03.14 14:11:37 | 000,033,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll
[2014.03.14 14:11:36 | 001,964,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2014.03.14 14:11:36 | 000,627,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2014.03.14 14:11:36 | 000,553,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript9diag.dll
[2014.03.14 14:11:36 | 000,440,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2014.03.14 14:11:36 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwproxystub.dll
[2014.03.14 14:11:35 | 002,041,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2014.03.14 14:11:35 | 000,218,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe
[2014.03.14 14:11:35 | 000,066,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll
[2014.03.14 14:11:34 | 000,703,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dll
[2014.03.14 14:11:34 | 000,164,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msrating.dll
[2014.03.14 14:11:34 | 000,112,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2014.03.14 14:11:34 | 000,111,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwcollector.exe
[2014.03.14 14:11:33 | 005,768,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2014.03.14 14:11:33 | 000,708,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9diag.dll
[2014.03.14 14:11:33 | 000,574,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2014.03.14 14:11:33 | 000,139,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe
[2014.03.14 14:11:32 | 000,940,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MsSpellCheckingFacility.exe
[2014.03.14 14:11:32 | 000,817,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dll
[2014.03.14 14:11:32 | 000,195,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msrating.dll
[2014.03.14 14:09:21 | 000,624,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\qedit.dll
[2014.03.14 14:09:21 | 000,509,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\qedit.dll
[2014.03.14 14:09:20 | 001,424,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WindowsCodecs.dll
[2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]

========== Files - Modified Within 7 Days ==========

[2014.03.20 18:27:13 | 000,014,192 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2014.03.20 18:27:13 | 000,014,192 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2014.03.20 18:21:02 | 000,000,148 | ---- | M] () -- C:\CLMSServer.ini
[2014.03.20 18:20:49 | 000,000,930 | ---- | M] () -- C:\CLMediaServer.ini
[2014.03.20 18:20:39 | 000,021,504 | ---- | M] () -- C:\MediaServer.db
[2014.03.20 18:20:28 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2014.03.20 18:20:23 | 000,005,528 | ---- | M] () -- C:\MS_StateVariable.ini
[2014.03.20 18:20:17 | 000,000,029 | ---- | M] () -- C:\GeneralInfo.ini
[2014.03.20 18:19:49 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2014.03.20 18:19:48 | 000,000,000 | ---- | M] () -- C:\Windows\SysNative\drivers\lvuvc.hs
[2014.03.20 18:19:46 | 4280,897,534 | -HS- | M] () -- C:\hiberfil.sys
[2014.03.20 18:18:41 | 000,000,656 | ---- | M] () -- C:\Windows\tasks\Check for updates (Spybot - Search & Destroy).job
[2014.03.20 18:18:41 | 000,000,628 | ---- | M] () -- C:\Windows\tasks\Refresh immunization (Spybot - Search & Destroy).job
[2014.03.20 18:18:41 | 000,000,458 | ---- | M] () -- C:\Windows\tasks\Scan the system (Spybot - Search & Destroy).job
[2014.03.20 18:18:30 | 000,001,379 | ---- | M] () -- C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
[2014.03.20 17:54:35 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2014.03.20 17:48:36 | 000,001,114 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2014.03.20 17:06:27 | 000,001,961 | ---- | M] () -- C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[2014.03.20 17:06:20 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\config.nt
[2014.03.18 19:52:47 | 000,001,272 | ---- | M] () -- C:\Users\RedWidow\Desktop\Snipping Tool.lnk
[2014.03.16 17:09:13 | 000,000,000 | ---- | M] () -- C:\Windows\SysNative\TASKLIST
[2014.03.16 07:51:41 | 000,000,222 | ---- | M] () -- C:\Users\RedWidow\Desktop\Call of Duty Black Ops II - Multiplayer.url
[2014.03.15 20:52:24 | 000,000,056 | ---- | M] () -- C:\Windows\SysWow64\root.dat
[2014.03.15 20:45:58 | 000,002,214 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2014.03.15 20:40:36 | 000,000,178 | ---- | M] () -- C:\Users\RedWidow\Desktop\Skin Installer Ultimate.url
[2014.03.15 15:07:13 | 000,001,354 | ---- | M] () -- C:\Users\RedWidow\Desktop\ROBLOX Player.lnk
[2014.03.15 15:07:13 | 000,001,173 | ---- | M] () -- C:\Users\RedWidow\Desktop\ROBLOX Studio 2013.lnk
[2014.03.15 07:43:25 | 000,000,986 | ---- | M] () -- C:\Users\RedWidow\Desktop\Badministrator - League of Ladies (prod. Thomas Prime) - YouTube.lnk
[2014.03.15 03:20:10 | 000,416,360 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2014.03.14 20:44:07 | 000,000,222 | ---- | M] () -- C:\Users\RedWidow\Desktop\Arma 3.url
[2014.03.14 20:40:51 | 000,000,222 | ---- | M] () -- C:\Users\RedWidow\Desktop\Call of Duty Black Ops II.url
[2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]

========== Files Created - No Company Name ==========

[2014.03.20 18:20:24 | 000,021,504 | ---- | C] () -- C:\MediaServer.db
[2014.03.20 18:20:23 | 000,005,528 | ---- | C] () -- C:\MS_StateVariable.ini
[2014.03.20 18:20:17 | 000,001,735 | ---- | C] () -- C:\PCMMediaServer.ini
[2014.03.20 18:20:17 | 000,000,930 | ---- | C] () -- C:\CLMediaServer.ini
[2014.03.20 18:20:17 | 000,000,452 | ---- | C] () -- C:\EncodingProfile.ini
[2014.03.20 18:20:17 | 000,000,148 | ---- | C] () -- C:\CLMSServer.ini
[2014.03.20 18:20:17 | 000,000,029 | ---- | C] () -- C:\GeneralInfo.ini
[2014.03.20 18:18:41 | 000,000,656 | ---- | C] () -- C:\Windows\tasks\Check for updates (Spybot - Search & Destroy).job
[2014.03.20 18:18:41 | 000,000,628 | ---- | C] () -- C:\Windows\tasks\Refresh immunization (Spybot - Search & Destroy).job
[2014.03.20 18:18:41 | 000,000,458 | ---- | C] () -- C:\Windows\tasks\Scan the system (Spybot - Search & Destroy).job
[2014.03.20 18:18:30 | 000,001,391 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
[2014.03.20 18:18:30 | 000,001,379 | ---- | C] () -- C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
[2014.03.20 17:06:27 | 000,001,961 | ---- | C] () -- C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[2014.03.18 19:52:47 | 000,001,272 | ---- | C] () -- C:\Users\RedWidow\Desktop\Snipping Tool.lnk
[2014.03.16 17:09:13 | 000,000,000 | ---- | C] () -- C:\Windows\SysNative\TASKLIST
[2014.03.16 07:51:41 | 000,000,222 | ---- | C] () -- C:\Users\RedWidow\Desktop\Call of Duty Black Ops II - Multiplayer.url
[2014.03.15 20:51:20 | 000,000,056 | ---- | C] () -- C:\Windows\SysWow64\root.dat
[2014.03.15 20:40:36 | 000,000,178 | ---- | C] () -- C:\Users\RedWidow\Desktop\Skin Installer Ultimate.url
[2014.03.15 15:07:11 | 000,001,354 | ---- | C] () -- C:\Users\RedWidow\Desktop\ROBLOX Player.lnk
[2014.03.15 15:05:17 | 000,001,173 | ---- | C] () -- C:\Users\RedWidow\Desktop\ROBLOX Studio 2013.lnk
[2014.03.14 20:44:07 | 000,000,222 | ---- | C] () -- C:\Users\RedWidow\Desktop\Arma 3.url
[2014.03.14 20:40:51 | 000,000,222 | ---- | C] () -- C:\Users\RedWidow\Desktop\Call of Duty Black Ops II.url
[2014.02.28 18:50:50 | 000,000,930 | ---- | C] () -- C:\Users\RedWidow\AppData\Local\_settings.ini
[2014.02.14 15:32:28 | 000,000,023 | ---- | C] () -- C:\Windows\BlendSettings.ini
[2014.01.02 19:18:18 | 000,007,602 | ---- | C] () -- C:\Users\RedWidow\AppData\Local\Resmon.ResmonCfg
[2013.10.26 21:32:02 | 000,291,128 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2013.10.26 21:32:01 | 000,076,888 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2013.10.23 19:16:29 | 000,021,504 | ---- | C] () -- C:\Windows\jestertb.dll
[2013.10.22 20:01:25 | 000,000,000 | ---- | C] () -- C:\ProgramData\CLDShowX.ini
[2013.10.08 15:47:57 | 000,008,192 | ---- | C] () -- C:\Windows\SysWow64\srvany.exe
[2013.10.01 15:24:59 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2013.10.01 15:17:02 | 001,592,628 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2013.10.01 08:57:59 | 000,002,773 | ---- | C] () -- C:\Windows\FF08_Render_Spk_Hp.ini
[2013.10.01 08:57:59 | 000,001,650 | ---- | C] () -- C:\Windows\FF08_Capture.ini
[2013.10.01 08:57:59 | 000,001,540 | ---- | C] () -- C:\Windows\FF08_Render.ini
[2013.10.01 08:57:58 | 000,170,496 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL
[2013.10.01 08:57:58 | 000,073,728 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL
[2013.10.01 08:53:54 | 000,046,986 | ---- | C] () -- C:\Windows\Ascd_log.ini
[2013.10.01 08:53:36 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini
[2013.10.01 08:53:33 | 000,033,927 | ---- | C] () -- C:\Windows\Ascd_tmp.ini
[2013.08.31 00:47:50 | 000,995,342 | ---- | C] () -- C:\Windows\SysWow64\amdocl_as32.exe
[2013.08.31 00:47:50 | 000,798,734 | ---- | C] () -- C:\Windows\SysWow64\amdocl_ld32.exe
[2013.08.31 00:04:52 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat
[2013.08.31 00:04:52 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat
[2013.08.30 18:53:48 | 000,038,912 | ---- | C] () -- C:\Windows\SysWow64\kdbsdk32.dll

========== ZeroAccess Check ==========

[2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2013.07.26 03:24:57 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013.07.26 02:55:59 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== Alternate Data Streams ==========

@Alternate Data Stream - 2560 bytes -> C:\ProgramData\CLDShowX.ini:Update.CL

< End of report >




Mein Problem : Hab ich noch den Keylogger drauf? Spybot usw. sagen nein,ich will mich nicht in meinen LoL-Account einloggen,da er circa 1200 euro wert ist.
Guten Abend noch!

Mein Name ist Jürgen und ich werde Dir bei Deinem Problem behilflich sein. Zusammen schaffen wir das...

• Bitte arbeite alle Schritte der Reihe nach ab.
• Lese die Anleitungen sorgfältig durch bevor Du beginnst. Wenn es Probleme gibt oder Du etwas nicht verstehst, dann stoppe mit Deiner Ausführung und beschreibe mir das Problem.
• Führe bitte nur Scans durch zu denen Du von mir aufgefordert wirst.
• Bitte kein Crossposting (posten in mehreren Foren).
• Installiere oder deinstalliere während der Bereinigung keine Software, außer Du wurdest dazu aufgefordert.
• Speichere alle unsere Tools auf dem Desktop ab.
• Poste die Logfiles direkt in deinen Thread in Code-Tags.
• Bedenke, dass wir hier alle während unserer Freizeit tätig sind, wenn du innerhalb von 2 Tagen nichts von mir hörst, dann schreibe mir bitte eine PM.

Hinweise: Ich kann Dir niemals eine Garantie geben, dass wir alle schädlichen Dateien finden werden. Eine Formatierung ist meist der schnellere und immer der sicherste Weg, aber auch nur bei wirklicher Malware empfehlenswert. Adware & Co können wir sehr gut entfernen.
Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis Dir jemand vom Team sagt, dass Du clean bist.

Bitte beachte, dass alle meine Antworten zuerst von einem Ausbilder freigegeben werden müssen, bevor ich diese hier posten darf. Das dauert dann zwar ein paar Stunden länger, garantiert aber, dass Du kompetente Hilfe und geprüfte Antworten bekommst. Siehe hier...

Ich bedanke mich für Deine Geduld!

Schritt 1 (Scan mit FRST)
Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

• Starte jetzt FRST.
• Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
• Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
• Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

• Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
• Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
• Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
• Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

Der Hacker steuert auch meine Maus(vieleicht hilft diese Information) Hier erstmal die Addition

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 13-03-2014
Ran by RedWidow at 2014-03-21 07:53:24
Running from C:\Users\RedWidow\Desktop\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: avast! Antivirus (Enabled - Up to date) {2B2D1395-420B-D5C9-657E-930FE358FC3C}
AS: avast! Antivirus (Enabled - Up to date) {904CF271-6431-DA47-5FCE-A87D98DFB681}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Out of date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}

==================== Installed Programs ======================

Adobe Flash Player 12 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 12.0.0.77 - Adobe Systems Incorporated)
Akamai NetSession Interface (HKCU\...\Akamai) (Version:  - Akamai Technologies, Inc)
AMD Accelerated Video Transcoding (Version: 13.15.100.30830 - Advanced Micro Devices, Inc.) Hidden
AMD Catalyst Control Center (x32 Version: 2013.0830.1944.33589 - Ihr Firmenname) Hidden
AMD Catalyst Install Manager (HKLM\...\{13351E83-6DCD-4E97-2A8C-5D496259A47F}) (Version: 8.0.915.0 - Advanced Micro Devices, Inc.)
AMD Drag and Drop Transcoding (Version: 2.00.0000 - Advanced Micro Devices, Inc.) Hidden
AMD Fuel (Version: 2013.0830.1944.33589 - Ihr Firmenname) Hidden
AMD Media Foundation Decoders (Version: 1.0.80830.1925 - Advanced Micro Devices, Inc.) Hidden
AMD USB Filter Driver (x32 Version: 1.0.14.91 - Advanced Micro Devices, Inc.) Hidden
Apple Application Support (HKLM-x32\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Arma 3 (HKLM-x32\...\Steam App 107410) (Version:  - Bohemia Interactive)
Audiosurf (HKLM-x32\...\Steam App 12900) (Version:  - Dylan Fitterer)
avast! Free Antivirus (HKLM-x32\...\avast) (Version: 8.0.1497.0 - AVAST Software)
Awesomenauts (HKLM-x32\...\Steam App 204300) (Version:  - Ronimo Games)
Battlefield 4™ (HKLM-x32\...\{ABADE36E-EC37-413B-8179-B432AD3FACE7}) (Version: 1.2.0.0 - Electronic Arts)
Battlelog Web Plugins (HKLM-x32\...\Battlelog Web Plugins) (Version: 2.3.2 - EA Digital Illusions CE AB)
BioShock Infinite (HKLM-x32\...\Steam App 8870) (Version:  - Irrational Games)
BlueStacks App Player (HKLM-x32\...\BlueStacks App Player) (Version: 0.8.4.3036 - BlueStack Systems, Inc.)
BlueStacks Notification Center (HKLM-x32\...\{44181DF6-2751-48C7-B918-72F14508F127}) (Version: 0.8.4.3036 - BlueStack Systems, Inc.)
Brick-Force (HKLM-x32\...\{9853ABB2-6416-4C87-8650-DD8E528FF564}}_is1) (Version: 3.10.274.74.11 - Infernum Productions AG)
Call of Duty: Black Ops II - Multiplayer (HKLM-x32\...\Steam App 202990) (Version:  - )
Call of Duty: Black Ops II (HKLM-x32\...\Steam App 202970) (Version:  - Treyarch)
Call of Duty: Modern Warfare 3 - Multiplayer (HKLM-x32\...\Steam App 42690) (Version:  - Infinity Ward)
Call of Duty: World at War (HKLM-x32\...\Steam App 10090) (Version:  - Treyarch)
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2013.0830.1944.33589 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2013.0830.1944.33589 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2013.0830.1944.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2013.0830.1944.33589 - Advanced Micro Devices, Inc.) Hidden
Cheat Engine 6.3 (HKLM-x32\...\Cheat Engine 6.3_is1) (Version:  - Cheat Engine)
Counter-Strike: Global Offensive (HKLM-x32\...\Steam App 730) (Version:  - Valve)
Counter-Strike: Source (HKLM-x32\...\Steam App 240) (Version:  - Valve)
Craften Terminal 3.5.5 (HKLM-x32\...\{4e7c3936-7c06-4ef0-928b-c5d92f372578}_is1) (Version: 3.5.5 - Craften.de)
CyberLink PowerDVD 13 (HKLM-x32\...\InstallShield_{3CFDF154-7E60-4E98-A8DF-C693A4F8E6B6}) (Version: 13.0.3105.58 - CyberLink Corp.)
CyberLink PowerDVD 13 (x32 Version: 13.0.3105.58 - CyberLink Corp.) Hidden
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.48.1.0347 - Disc Soft Ltd)
Definition Update for Microsoft Office 2010 (KB982726) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{DC4BC0CC-A928-4C48-BA40-AC24784F46E5}) (Version:  - Microsoft)
Dota 2 (HKLM-x32\...\Steam App 570) (Version:  - Valve)
Fable - The Lost Chapters (HKLM-x32\...\Steam App 204030) (Version:  - Lionhead Studios)
FileZilla Client 3.7.3 (HKLM-x32\...\FileZilla Client) (Version: 3.7.3 - Tim Kosse)
Flyff (HKLM-x32\...\{7E210E1C-52A1-40E3-817B-D504E9F64DFA}_is1) (Version: Flyff - Gala Networks Europe Limited)
Fraps (HKLM-x32\...\Fraps) (Version:  - )
Free Video Dub version 2.0.21.827 (HKLM-x32\...\Free Video Dub_is1) (Version: 2.0.21.827 - DVDVideoSoft Ltd.)
Gameforge Live 1.10.1 "Legend" (HKLM-x32\...\{9C98989A-3A15-42DA-A3B9-D20331437D67}}_is1) (Version: 1.10.1 - Gameforge)
Garry's Mod (HKLM-x32\...\Steam App 4000) (Version:  - Garry)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 33.0.1750.154 - Google Inc.)
Google Update Helper (x32 Version: 1.3.22.5 - Google Inc.) Hidden
HLSW v1.4.0.2 (HKLM-x32\...\HLSW_is1) (Version:  - Stripf Software)
Hotspot Shield Toolbar for IE (HKLM-x32\...\IECT1561552) (Version: 6.17.2.11 - Hotspot Shield) <==== ATTENTION
Java 7 Update 45 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217045FF}) (Version: 7.0.450 - Oracle)
Java 7 Update 51 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417051FF}) (Version: 7.0.510 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
JMicron JMB36X Driver (HKLM-x32\...\{3A1B5D40-41E9-43FA-8C7B-A8667F5586EF}) (Version: 1.00.0000 - JMicron Technology Corp.)
Killing Floor (HKLM-x32\...\Steam App 1250) (Version:  - Tripwire Interactive)
League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games )
League of Legends (x32 Version: 3.0.1 - Riot Games ) Hidden
Logitech Gaming Software (Version: 8.45.88 - Logitech Inc.) Hidden
Logitech Gaming Software 8.50 (HKLM\...\Logitech Gaming Software) (Version: 8.50.281 - Logitech Inc.)
LogMeIn Hamachi (HKLM-x32\...\LogMeIn Hamachi) (Version: 2.2.0.173 - LogMeIn, Inc.)
LogMeIn Hamachi (x32 Version: 2.2.0.173 - LogMeIn, Inc.) Hidden
LOLReplay (HKLM-x32\...\LOLReplay) (Version: 0.8.6 - www.leaguereplays.com)
Magicka (HKLM-x32\...\Steam App 42910) (Version:  - Arrowhead Game Studios)
Marvell Miniport Driver (HKLM-x32\...\Marvell Miniport Driver) (Version: 11.24.10.3 - Marvell)
Metin2 (HKLM-x32\...\Metin2_is1) (Version:  - Gameforge 4D GmbH)
Metro 2033 (HKLM-x32\...\Steam App 43110) (Version:  - 4A Games)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Groove MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Office 32-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 32-bit MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{db012557-340e-4a46-adae-81a6b0f6a1e9}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{e6edaf4d-f9a1-4023-be00-d6189343feb9}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.61030 (Version: 11.0.61030 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.61030 (Version: 11.0.61030 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 (x32 Version: 11.0.61030 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 (x32 Version: 11.0.61030 - Microsoft Corporation) Hidden
Microsoft XNA Framework Redistributable 3.1 (HKLM-x32\...\{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}) (Version: 3.1.10527.0 - Microsoft Corporation)
Mozilla Firefox 27.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 27.0.1 (x86 de)) (Version: 27.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 27.0.1 - Mozilla)
Natural Selection 2 (HKLM-x32\...\Steam App 4920) (Version:  - Unknown Worlds Entertainment)
NEC Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{D7BF9739-8A68-4335-BBEE-37752AD9E86B}) (Version: 1.0.19.0 - NEC Electronics Corporation)
NEC Electronics USB 3.0 Host Controller Driver (x32 Version: 1.0.19.0 - NEC Electronics Corporation) Hidden
OpenAL (HKLM-x32\...\OpenAL) (Version:  - )
Orcs Must Die! 2 (HKLM-x32\...\Steam App 201790) (Version:  - Robot Entertainment)
Origin (HKLM-x32\...\Origin) (Version: 9.3.6.4639 - Electronic Arts, Inc.)
ORION: Dino Horde (HKLM-x32\...\Steam App 104900) (Version:  - Spiral Game Studios)
osu! (HKLM-x32\...\{C3592426-531E-4110-911D-BFECE2CE284C}) (Version: 0.0.0.0 - peppy)
Overwolf (HKLM-x32\...\{A7234617-513C-4292-A013-7DD915493BDA}) (Version: 0.49.305 - Overwolf)
Pando Media Booster (HKLM-x32\...\{980A182F-E0A2-4A40-94C1-AE0C1235902E}) (Version: 2.6.0.7 - Pando Networks Inc.)
Path of Exile (HKLM-x32\...\Steam App 238960) (Version:  - Grinding Gear Games)
PlanetSide 2 (HKCU\...\SOE-PlanetSide 2 PSG) (Version: 1.0.3.183 - Sony Online Entertainment)
Platform (x32 Version: 1.34 - VIA Technologies, Inc.) Hidden
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.993 - Even Balance, Inc.)
QuickTime 7 (HKLM-x32\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)
ROBLOX Player (HKLM-x32\...\{373B1718-8CC5-4567-8EE2-9033AD08A680}) (Version:  - ROBLOX Corporation)
Security Task Manager 1.8g (HKLM-x32\...\Security Task Manager) (Version: 1.8g - Neuber Software)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{A3364707-2F53-4C83-8F68-C9877A9080C7}) (Version:  - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (Version:  - Microsoft) Hidden
Shutdown Timer (HKLM-x32\...\{0B1BBEE3-C10D-44BE-A6BE-EEC867315F87}) (Version: 3.3.4 - Sinvise Systems)
Skype™ 6.14 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.14.104 - Skype Technologies S.A.)
Sniper Elite (HKLM-x32\...\Steam App 3700) (Version:  - Rebellion)
Sound Blaster X-Fi MB (HKLM-x32\...\{818690C7-8DA5-4623-BBA8-A73CFBD44077}) (Version: 1.0 - Creative Technology Limited)
Spotify (HKCU\...\Spotify) (Version: 0.9.7.16.g4b197456 - Spotify AB)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.2.25 - Safer-Networking Ltd.)
StarCraft II (HKLM-x32\...\StarCraft II) (Version:  - Blizzard Entertainment)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
Team Fortress 2 (HKLM-x32\...\Steam App 440) (Version:  - Valve)
TeamSpeak 3 Client (HKCU\...\TeamSpeak 3 Client) (Version: 3.0.14 - TeamSpeak Systems GmbH)
TeamSpeak 3 Client (HKLM-x32\...\TeamSpeak 3 Client) (Version: 3.0.14 - TeamSpeak Systems GmbH)
The Elder Scrolls IV: Oblivion  (HKLM-x32\...\Steam App 22330) (Version:  - Bethesda Game Studios)
TortoiseSVN 1.8.4.24972 (64 bit) (HKLM\...\{A2EFDE01-96B3-4E55-8834-81617ED6BCBE}) (Version: 1.8.24972 - TortoiseSVN)
TrueCrypt (HKLM-x32\...\TrueCrypt) (Version: 7.1a - TrueCrypt Foundation)
Update for Microsoft Access 2010 (KB2553446) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{FEF4C57D-0975-4D3C-ACC7-DCD038C3788F}) (Version:  - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2837594) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{99A0DB9A-71FC-4F98-BC1F-78A18195C677}) (Version:  - Microsoft)
Update for Microsoft InfoPath 2010 (KB2817369) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{DB0B0CDF-77EC-47B0-94E2-4738573A1E58}) (Version:  - Microsoft)
Update for Microsoft InfoPath 2010 (KB2817396) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{1AA82E2E-7DB7-4C70-910C-BBB657A6B3A5}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{79C725A1-3964-421C-A528-78C1C083C7C7}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{95BE5D45-A3DD-4CB1-8C35-D75DD7B4D862}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 64-Bit Edition (HKLM\...\{90140000-0043-0000-1000-0000000FF1CE}_Office14.PROPLUS_{95BE5D45-A3DD-4CB1-8C35-D75DD7B4D862}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589375) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{EBD18DE5-BC84-4B57-9A30-097044871F9A}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{4AD36582-256B-433D-8593-F31773A15CA4}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 64-Bit Edition (HKLM\...\{90140000-0043-0000-1000-0000000FF1CE}_Office14.PROPLUS_{4AD36582-256B-433D-8593-F31773A15CA4}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{F216169C-2B40-429B-8370-B5BA06EC5423}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 64-Bit Edition (HKLM\...\{90140000-0043-0000-1000-0000000FF1CE}_Office14.PROPLUS_{F216169C-2B40-429B-8370-B5BA06EC5423}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760631) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{B6AD7E27-012A-4B63-82BA-AF62893E5435}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{07DC9C6C-E916-4F42-8677-716930ED0393}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2825640) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{43F59F4D-7179-497E-BE99-BC6F7D1DDCBA}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2825640) 64-Bit Edition (HKLM\...\{90140000-0044-0407-1000-0000000FF1CE}_Office14.PROPLUS_{43F59F4D-7179-497E-BE99-BC6F7D1DDCBA}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 64-Bit Edition (HKLM\...\{90140000-001F-0407-1000-0000000FF1CE}_Office14.PROPLUS_{64D96F30-CF4C-4CCE-AAF2-F8909348BF35}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 64-Bit Edition (HKLM\...\{90140000-001F-040C-1000-0000000FF1CE}_Office14.PROPLUS_{9F6507AC-7D8F-46C1-B90F-59C7828E0E0D}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2863818) 64-Bit Edition (HKLM\...\{90140000-001F-0409-1000-0000000FF1CE}_Office14.PROPLUS_{A9C4BE58-07E0-473D-AE68-ECBA13FBF77E}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2878225) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{8A6BDA63-4D23-4485-A466-8979E10BCF49}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2878225) 64-Bit Edition (HKLM\...\{90140000-0043-0000-1000-0000000FF1CE}_Office14.PROPLUS_{8A6BDA63-4D23-4485-A466-8979E10BCF49}) (Version:  - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{3029C408-1DD1-4273-8E58-87CB1B638FC8}) (Version:  - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 64-Bit Edition (HKLM\...\{90140000-0043-0000-1000-0000000FF1CE}_Office14.PROPLUS_{3029C408-1DD1-4273-8E58-87CB1B638FC8}) (Version:  - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{DDDC32A5-9528-4771-B91A-97A8E1D7957B}) (Version:  - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 64-Bit Edition (HKLM\...\{90140000-001A-0407-1000-0000000FF1CE}_Office14.PROPLUS_{6164E0E5-C903-488C-93AF-1B7AF7EBC331}) (Version:  - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2553145) 64-Bit Edition (HKLM\...\{90140000-0018-0407-1000-0000000FF1CE}_Office14.PROPLUS_{BEA3259E-14B5-4D89-87FF-ED9F1D0D81C8}) (Version:  - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2775360) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{BE1D254A-E5CD-4E76-9BE8-7B2E5FDBA6AF}) (Version:  - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{77374F16-2DC6-4EEF-AFAD-C59FDA2E010D}) (Version:  - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 64-Bit Edition (HKLM\...\{90140000-0043-0000-1000-0000000FF1CE}_Office14.PROPLUS_{77374F16-2DC6-4EEF-AFAD-C59FDA2E010D}) (Version:  - Microsoft)
Update for Microsoft Visio 2010 (KB2878227) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{04DED3FB-DDB2-4C1E-A057-2A1FB97BE42D}) (Version:  - Microsoft)
Update for Microsoft Visio Viewer 2010 (KB2810066) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{DF33B92A-5381-4F03-AB54-2D67086B357E}) (Version:  - Microsoft)
Update for Microsoft Word 2010 (KB2837593) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{A82E26EF-680E-427D-B7D0-FD7997DDC217}) (Version:  - Microsoft)
VIA Plattform-Geräte-Manager (HKLM-x32\...\InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}) (Version: 1.34 - VIA Technologies, Inc.)
VLC media player 2.1.2 (HKLM-x32\...\VLC media player) (Version: 2.1.2 - VideoLAN)
WinRAR 5.00 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.00.0 - win.rar GmbH)
Worms Revolution (HKLM-x32\...\Steam App 200170) (Version:  - Team17 Digital Ltd.)
YGOPro DevPro Version 1.9.6 r0 (HKLM-x32\...\{3CF2634F-3F38-4DD3-9201-CB2FE6B5FF23}_is1) (Version: 1.9.6 r0 - YGOPro DevPro Online)

==================== Restore Points  =========================

18-03-2014 13:17:58 Windows Update
18-03-2014 20:33:02 Windows Update
21-03-2014 06:39:23 Windows Update
21-03-2014 06:46:30 Datei in Quarantäne Ordner verschieben: {c95a4e8e-816d-4655-8c79

==================== Hosts content: ==========================

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {0D3A7766-6AE2-4E90-A96A-C03C81FA54CE} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-10-31] (Google Inc.)
Task: {3BD4288E-88B0-4D74-BB62-D7C54366F36E} - System32\Tasks\ASUS\RunDAOD => C:\Windows\DAODx.exe
Task: {52C01199-DCAC-4808-AFB1-9D7CF022BF4E} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {539EF053-4624-4569-A7DA-80FC55D48532} - System32\Tasks\BackgroundContainer Startup Task => Rundll32.exe "C:\Users\RedWidow\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll",DllRun <==== ATTENTION
Task: {5F575768-A924-40CD-A5C1-CFD3D5FF98CD} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-03-12] (Adobe Systems Incorporated)
Task: {77FD0ABE-2EE4-4973-9EED-A6953D43B987} - System32\Tasks\Yef
Task: {9A3B1F9B-28CD-4117-AB29-9BB2B91D9A3D} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2013-08-30] (AVAST Software)
Task: {AD10B861-F695-4C5B-9E4D-4883CF3B6C32} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-10-31] (Google Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\Check for updates (Spybot - Search & Destroy).job => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\Refresh immunization (Spybot - Search & Destroy).job => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe
Task: C:\Windows\Tasks\Scan the system (Spybot - Search & Destroy).job => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe

==================== Loaded Modules (whitelisted) =============

2013-11-24 13:37 - 2013-11-24 13:37 - 00075504 _____ () C:\Program Files\TortoiseSVN\bin\TortoiseStub.dll
2013-11-24 13:36 - 2013-11-24 13:36 - 00088304 _____ () C:\Program Files\TortoiseSVN\bin\libsasl.dll
2013-09-05 00:17 - 2013-09-05 00:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2010-01-02 15:42 - 2010-01-02 15:42 - 00098304 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext_64.dll
2013-08-30 18:47 - 2013-08-30 18:47 - 00214528 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.PerformanceTuning.dll
2012-10-22 13:41 - 2012-10-22 13:41 - 00749056 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Device.dll
2012-10-22 13:42 - 2012-10-22 13:42 - 03645952 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Platform.dll
2013-10-26 21:32 - 2013-12-25 21:11 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2013-08-30 18:47 - 2013-08-30 18:47 - 00102400 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2013-06-12 17:11 - 2013-10-01 13:30 - 01294336 _____ () C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe
2013-10-01 13:31 - 2014-03-20 19:04 - 05325152 _____ () C:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.0.204\deploy\LoLLauncher.exe
2013-10-04 11:17 - 2013-10-01 15:43 - 00074752 _____ () C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.77\deploy\LolClient.exe
2014-03-20 22:24 - 2014-03-20 21:20 - 02283520 _____ () C:\Program Files\AVAST Software\Avast\defs\14032000\algo.dll
2014-02-14 03:29 - 2014-03-10 19:41 - 00962560 _____ () C:\Program Files (x86)\Origin\platforms\qwindows.dll
2014-02-14 03:29 - 2014-03-10 19:41 - 00024064 _____ () C:\Program Files (x86)\Origin\imageformats\qgif.dll
2014-02-14 03:29 - 2014-03-10 19:41 - 00025088 _____ () C:\Program Files (x86)\Origin\imageformats\qico.dll
2014-02-14 03:29 - 2014-03-10 19:41 - 00217088 _____ () C:\Program Files (x86)\Origin\imageformats\qjpeg.dll
2014-02-14 03:29 - 2014-03-10 19:41 - 00261632 _____ () C:\Program Files (x86)\Origin\imageformats\qmng.dll
2014-02-14 03:29 - 2014-03-10 19:41 - 00019968 _____ () C:\Program Files (x86)\Origin\imageformats\qtga.dll
2014-02-14 03:29 - 2014-03-10 19:41 - 00302592 _____ () C:\Program Files (x86)\Origin\imageformats\qtiff.dll
2014-02-14 03:29 - 2014-03-10 19:41 - 00018944 _____ () C:\Program Files (x86)\Origin\imageformats\qwbmp.dll
2013-10-01 08:57 - 2009-02-06 17:52 - 00073728 _____ () C:\Windows\SysWOW64\CmdRtr.DLL
2013-10-01 08:57 - 2009-07-30 13:54 - 00170496 _____ () C:\Windows\SysWOW64\APOMngr.DLL
2014-03-20 18:18 - 2013-05-16 10:55 - 00113496 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2014-03-20 18:18 - 2013-05-16 10:55 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2014-03-20 18:18 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2014-03-20 18:18 - 2013-05-16 10:55 - 00161112 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2014-03-20 18:18 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2014-02-28 14:33 - 2014-02-28 14:33 - 00148480 _____ () C:\Users\RedWidow\teamspeak3\quazip.dll
2014-02-27 14:46 - 2014-02-27 14:46 - 00864768 _____ () C:\Users\RedWidow\teamspeak3\platforms\qwindows.dll
2014-02-27 14:45 - 2014-02-27 14:45 - 00677376 _____ () C:\Users\RedWidow\teamspeak3\sqldrivers\qsqlite.dll
2014-02-28 14:41 - 2014-02-28 14:41 - 00092104 _____ () C:\Users\RedWidow\teamspeak3\soundbackends\directsound_win32.dll
2014-02-28 14:41 - 2014-02-28 14:41 - 00105416 _____ () C:\Users\RedWidow\teamspeak3\soundbackends\windowsaudiosession_win32.dll
2014-02-27 14:46 - 2014-02-27 14:46 - 00025600 _____ () C:\Users\RedWidow\teamspeak3\imageformats\qgif.dll
2014-02-27 14:46 - 2014-02-27 14:46 - 00242688 _____ () C:\Users\RedWidow\teamspeak3\imageformats\qjpeg.dll
2014-02-28 14:42 - 2014-02-28 14:42 - 00477128 _____ () C:\Users\RedWidow\teamspeak3\plugins\clientquery_plugin.dll
2014-02-28 14:42 - 2014-02-28 14:42 - 00483784 _____ () C:\Users\RedWidow\teamspeak3\plugins\teamspeak_control_plugin.dll
2014-02-27 14:46 - 2014-02-27 14:46 - 00123904 _____ () C:\Users\RedWidow\teamspeak3\accessible\qtaccessiblewidgets.dll
2013-12-09 01:18 - 2013-12-09 01:18 - 00113664 _____ () C:\Program Files (x86)\VideoLAN\VLC\libvlc.dll
2013-12-09 01:19 - 2013-12-09 01:19 - 02342912 _____ () C:\Program Files (x86)\VideoLAN\VLC\libvlccore.dll
2013-12-09 01:18 - 2013-12-09 01:18 - 00246784 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\access\libdshow_plugin.dll
2013-12-09 01:19 - 2013-12-09 01:19 - 00047616 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\audio_output\libdirectsound_plugin.dll
2013-12-09 01:19 - 2013-12-09 01:19 - 00050688 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\audio_output\libwaveout_plugin.dll
2013-12-09 01:18 - 2013-12-09 01:18 - 00079360 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\video_output\libdirectdraw_plugin.dll
2013-12-09 01:18 - 2013-12-09 01:18 - 02029568 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\access\liblibbluray_plugin.dll
2013-12-09 01:18 - 2013-12-09 01:18 - 00100352 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\access\libaccess_bd_plugin.dll
2013-12-09 01:18 - 2013-12-09 01:18 - 00258560 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\access\libdvdnav_plugin.dll
2013-12-09 01:18 - 2013-12-09 01:18 - 00076288 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\access\libaccess_vdr_plugin.dll
2013-12-09 01:18 - 2013-12-09 01:18 - 00046592 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\access\libfilesystem_plugin.dll
2013-12-09 01:18 - 2013-12-09 01:18 - 00061440 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\stream_filter\libsmooth_plugin.dll
2013-12-09 01:18 - 2013-12-09 01:18 - 00465920 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\stream_filter\libhttplive_plugin.dll
2013-12-09 01:18 - 2013-12-09 01:18 - 00719872 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\stream_filter\libdash_plugin.dll
2013-12-09 01:18 - 2013-12-09 01:18 - 00114688 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\access\libzip_plugin.dll
2013-12-09 01:18 - 2013-12-09 01:18 - 00039936 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\access\libstream_filter_rar_plugin.dll
2013-12-09 01:18 - 2013-12-09 01:18 - 00036864 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\stream_filter\librecord_plugin.dll
2013-12-09 01:18 - 2013-12-09 01:18 - 00136704 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libplaylist_plugin.dll
2013-12-09 01:18 - 2013-12-09 01:18 - 01449472 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\meta_engine\libtaglib_plugin.dll
2013-12-09 01:18 - 2013-12-09 01:18 - 00300032 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\lua\liblua_plugin.dll
2013-12-09 01:18 - 2013-12-09 01:18 - 01283584 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\misc\libxml_plugin.dll
2013-12-09 01:18 - 2013-12-09 01:18 - 00056320 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\control\libhotkeys_plugin.dll
2013-12-09 01:18 - 2013-12-09 01:18 - 00192512 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libmp4_plugin.dll
2013-12-09 01:18 - 2013-12-09 01:18 - 00038912 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\control\libglobalhotkeys_plugin.dll
2013-12-09 01:19 - 2013-12-09 01:19 - 11747840 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\gui\libqt4_plugin.dll
2013-12-09 01:18 - 2013-12-09 01:18 - 00037888 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\meta_engine\libfolder_plugin.dll
2013-12-09 01:19 - 2013-12-09 01:19 - 00292864 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libpng_plugin.dll
2013-12-09 01:19 - 2013-12-09 01:19 - 00040448 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libcdg_plugin.dll
2013-12-09 01:18 - 2013-12-09 01:18 - 01297920 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libschroedinger_plugin.dll
2013-12-09 01:19 - 2013-12-09 01:19 - 00041472 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libdts_plugin.dll
2013-12-09 01:19 - 2013-12-09 01:19 - 00350720 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libtheora_plugin.dll
2013-12-09 01:18 - 2013-12-09 01:18 - 00359424 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libfaad_plugin.dll
2013-12-09 01:18 - 2013-12-09 01:18 - 00209408 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libflac_plugin.dll
2013-12-09 01:18 - 2013-12-09 01:18 - 00049152 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libg711_plugin.dll
2013-12-09 01:18 - 2013-12-09 01:18 - 00037888 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libaes3_plugin.dll
2013-12-09 01:19 - 2013-12-09 01:19 - 01384960 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\liblibass_plugin.dll
2013-12-09 01:18 - 2013-12-09 01:18 - 00144896 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libspeex_plugin.dll
2013-12-09 01:18 - 2013-12-09 01:18 - 00044032 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\liblpcm_plugin.dll
2013-12-09 01:18 - 2013-12-09 01:18 - 01723904 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libvorbis_plugin.dll
2013-12-09 01:18 - 2013-12-09 01:18 - 00041472 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libmpeg_audio_plugin.dll
2013-12-09 01:18 - 2013-12-09 01:18 - 00048640 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libaraw_plugin.dll
2013-12-09 01:18 - 2013-12-09 01:18 - 00188928 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libopus_plugin.dll
2013-12-09 01:19 - 2013-12-09 01:19 - 00040448 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\liba52_plugin.dll
2013-12-09 01:18 - 2013-12-09 01:18 - 00042496 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libspudec_plugin.dll
2013-12-09 01:18 - 2013-12-09 01:18 - 09262080 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libavcodec_plugin.dll
2013-12-09 01:18 - 2013-12-09 01:18 - 00731136 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\text_renderer\libfreetype_plugin.dll
2013-12-09 01:18 - 2013-12-09 01:18 - 00052224 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\sse2\libi420_yuy2_sse2_plugin.dll
2013-12-09 01:18 - 2013-12-09 01:18 - 00044032 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\mmx\libi420_yuy2_mmx_plugin.dll
2013-12-09 01:18 - 2013-12-09 01:18 - 00384000 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\video_filter\libswscale_plugin.dll
2013-12-09 01:18 - 2013-12-09 01:18 - 00137728 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\sse2\libi420_rgb_sse2_plugin.dll
2013-12-09 01:18 - 2013-12-09 01:18 - 00051712 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\sse2\libi422_yuy2_sse2_plugin.dll
2013-12-09 01:18 - 2013-12-09 01:18 - 00043008 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\mmx\libi422_yuy2_mmx_plugin.dll
2013-12-09 01:18 - 2013-12-09 01:18 - 00076800 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\mmx\libi420_rgb_mmx_plugin.dll
2013-12-09 01:18 - 2013-12-09 01:18 - 00038912 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\video_chroma\libyuy2_i422_plugin.dll
2013-12-09 01:18 - 2013-12-09 01:18 - 00037376 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\video_chroma\libgrey_yuv_plugin.dll
2013-12-09 01:18 - 2013-12-09 01:18 - 00055808 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\video_chroma\libi420_rgb_plugin.dll
2013-12-09 01:18 - 2013-12-09 01:18 - 00041984 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\video_chroma\libi420_yuy2_plugin.dll
2013-12-09 01:18 - 2013-12-09 01:18 - 00043008 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\video_chroma\libyuy2_i420_plugin.dll
2013-12-09 01:18 - 2013-12-09 01:18 - 00040448 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\video_chroma\libi422_yuy2_plugin.dll
2013-12-09 01:18 - 2013-12-09 01:18 - 00037376 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\video_chroma\libi422_i420_plugin.dll
2013-12-09 01:18 - 2013-12-09 01:18 - 00036864 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\video_filter\libscale_plugin.dll
2013-12-09 01:18 - 2013-12-09 01:18 - 00035840 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\video_filter\libyuvp_plugin.dll
2013-12-09 01:18 - 2013-12-09 01:18 - 00079872 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\video_output\libdirect3d_plugin.dll
2013-12-09 01:18 - 2013-12-09 01:18 - 00034816 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\audio_mixer\libfloat_mixer_plugin.dll
2013-12-09 01:18 - 2013-12-09 01:18 - 00040960 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\libscaletempo_plugin.dll
2013-12-09 01:18 - 2013-12-09 01:18 - 01518592 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\libsamplerate_plugin.dll
2013-10-01 13:31 - 2014-03-20 19:06 - 00265056 _____ () C:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.0.204\deploy\RiotLauncher.dll
2013-09-05 00:14 - 2013-09-05 00:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2014-02-14 18:31 - 2014-02-14 18:31 - 03578992 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\ProgramData\CLDShowX.ini:Update.CL

==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Hamachi2Svc => ""="Service"

==================== Disabled items from MSCONFIG ==============


==================== Faulty Device Manager Devices =============

Name: BlueStacks Hypervisor
Description: BlueStacks Hypervisor
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer: 
Service: BstHdDrv
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.


==================== Event log errors: =========================

Application errors:
==================
Error: (03/20/2014 07:30:46 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: rads_user_kernel.exe, Version: 0.0.0.0, Zeitstempel: 0x4e65c1ac
Name des fehlerhaften Moduls: rads_user_kernel.exe, Version: 0.0.0.0, Zeitstempel: 0x4e65c1ac
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000b8554
ID des fehlerhaften Prozesses: 0x1034
Startzeit der fehlerhaften Anwendung: 0xrads_user_kernel.exe0
Pfad der fehlerhaften Anwendung: rads_user_kernel.exe1
Pfad des fehlerhaften Moduls: rads_user_kernel.exe2
Berichtskennung: rads_user_kernel.exe3

Error: (03/20/2014 07:06:58 PM) (Source: Application Hang) (User: )
Description: Programm rads_user_kernel.exe, Version 0.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: bb0

Startzeit: 01cf44671a8022c3

Endzeit: 15

Anwendungspfad: C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe

Berichts-ID: 6bb6661a-b05a-11e3-a67c-f46d04005e8c

Error: (03/20/2014 07:04:26 PM) (Source: Application Hang) (User: )
Description: Programm rads_user_kernel.exe, Version 0.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 108

Startzeit: 01cf4466bdac91cf

Endzeit: 15

Anwendungspfad: C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe

Berichts-ID: 11752269-b05a-11e3-a67c-f46d04005e8c

Error: (03/20/2014 07:03:25 PM) (Source: Application Hang) (User: )
Description: Programm rads_user_kernel.exe, Version 0.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1554

Startzeit: 01cf4466895d740b

Endzeit: 15

Anwendungspfad: C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe

Berichts-ID: ed35e2fa-b059-11e3-a67c-f46d04005e8c

Error: (03/20/2014 07:02:18 PM) (Source: Application Hang) (User: )
Description: Programm rads_user_kernel.exe, Version 0.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: c20

Startzeit: 01cf44666cc082aa

Endzeit: 14

Anwendungspfad: C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe

Berichts-ID: b791b788-b059-11e3-a67c-f46d04005e8c

Error: (03/20/2014 05:08:51 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: LCDClock.exe, Version: 8.50.281.0, Zeitstempel: 0x51fabc08
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521eaf24
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000018713
ID des fehlerhaften Prozesses: 0xa9c
Startzeit der fehlerhaften Anwendung: 0xLCDClock.exe0
Pfad der fehlerhaften Anwendung: LCDClock.exe1
Pfad des fehlerhaften Moduls: LCDClock.exe2
Berichtskennung: LCDClock.exe3

Error: (03/20/2014 03:56:35 PM) (Source: Wininit) (User: )
Description: Ein kritischer Systemprozess C:\Windows\system32\lsass.exe ist fehlgeschlagen mit den Statuscode 1. Der Computer muss neu gestartet werden.

Error: (03/20/2014 03:40:45 PM) (Source: Wininit) (User: )
Description: Ein kritischer Systemprozess C:\Windows\system32\lsass.exe ist fehlgeschlagen mit den Statuscode 1. Der Computer muss neu gestartet werden.

Error: (03/20/2014 03:01:28 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (03/19/2014 02:13:02 PM) (Source: Application Hang) (User: )
Description: Programm rads_user_kernel.exe, Version 0.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 12e0

Startzeit: 01cf4374d6727f71

Endzeit: 22

Anwendungspfad: C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe

Berichts-ID: 31067d32-af68-11e3-9595-f46d04005e8c


System errors:
=============
Error: (03/21/2014 07:35:37 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Spybot-S&D 2 Updating Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (03/21/2014 07:35:37 AM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Spybot-S&D 2 Updating Service erreicht.

Error: (03/21/2014 07:35:04 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "BlueStacks Android Service" ist vom Dienst "BlueStacks Hypervisor" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%3

Error: (03/21/2014 07:34:51 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Spybot-S&D 2 Scanner Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (03/21/2014 07:34:51 AM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Spybot-S&D 2 Scanner Service erreicht.

Error: (03/21/2014 07:33:59 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "BlueStacks Log Rotator Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (03/21/2014 07:33:59 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "BlueStacks Hypervisor" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%3

Error: (03/20/2014 10:25:59 PM) (Source: DCOM) (User: )
Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF}

Error: (03/20/2014 06:21:41 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Spybot-S&D 2 Updating Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (03/20/2014 06:21:41 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Spybot-S&D 2 Updating Service erreicht.


Microsoft Office Sessions:
=========================
Error: (03/20/2014 07:30:46 PM) (Source: Application Error)(User: )
Description: rads_user_kernel.exe0.0.0.04e65c1acrads_user_kernel.exe0.0.0.04e65c1acc0000005000b8554103401cf446a819386a1C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exeC:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exec03273f7-b05d-11e3-a67c-f46d04005e8c

Error: (03/20/2014 07:06:58 PM) (Source: Application Hang)(User: )
Description: rads_user_kernel.exe0.0.0.0bb001cf44671a8022c315C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe6bb6661a-b05a-11e3-a67c-f46d04005e8c

Error: (03/20/2014 07:04:26 PM) (Source: Application Hang)(User: )
Description: rads_user_kernel.exe0.0.0.010801cf4466bdac91cf15C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe11752269-b05a-11e3-a67c-f46d04005e8c

Error: (03/20/2014 07:03:25 PM) (Source: Application Hang)(User: )
Description: rads_user_kernel.exe0.0.0.0155401cf4466895d740b15C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exeed35e2fa-b059-11e3-a67c-f46d04005e8c

Error: (03/20/2014 07:02:18 PM) (Source: Application Hang)(User: )
Description: rads_user_kernel.exe0.0.0.0c2001cf44666cc082aa14C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exeb791b788-b059-11e3-a67c-f46d04005e8c

Error: (03/20/2014 05:08:51 PM) (Source: Application Error)(User: )
Description: LCDClock.exe8.50.281.051fabc08ntdll.dll6.1.7601.18247521eaf24c00000050000000000018713a9c01cf4456a76964a9C:\Program Files\Logitech Gaming Software\Applets\LCDClock.exeC:\Windows\SYSTEM32\ntdll.dllecb3603a-b049-11e3-bb91-f46d04005e8c

Error: (03/20/2014 03:56:35 PM) (Source: Wininit)(User: )
Description: C:\Windows\system32\lsass.exe1

Error: (03/20/2014 03:40:45 PM) (Source: Wininit)(User: )
Description: C:\Windows\system32\lsass.exe1

Error: (03/20/2014 03:01:28 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\$Recycle.Bin\S-1-5-21-2172666858-744790929-553880742-1000\$RVVCGTT.exe

Error: (03/19/2014 02:13:02 PM) (Source: Application Hang)(User: )
Description: rads_user_kernel.exe0.0.0.012e001cf4374d6727f7122C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe31067d32-af68-11e3-9595-f46d04005e8c


==================== Memory info =========================== 

Percentage of memory in use: 18%
Total physical RAM: 16366.11 MB
Available physical RAM: 13307.93 MB
Total Pagefile: 32730.41 MB
Available Pagefile: 29184.39 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:931.41 GB) (Free:654.42 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 669CBF05)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=931 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

Hier die FRST
FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014
Ran by RedWidow (administrator) on REDWIDOW-PC on 21-03-2014 07:52:20
Running from C:\Users\RedWidow\Desktop\Downloads
Windows 7 Ultimate Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe
(Logitech Inc.) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
(Microsoft Corporation) C:\Windows\system32\AUDIODG.EXE
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
(AMD) C:\Windows\system32\atieclxx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSMonitorServicePDVD13.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\LCore.exe
(Spotify Ltd) C:\Users\RedWidow\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Akamai Technologies, Inc.) C:\Users\RedWidow\AppData\Local\Akamai\netsession_win.exe
(Electronic Arts) C:\Program Files (x86)\Origin\Origin.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSServerPDVD13.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\Applets\LCDRSS.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\Applets\LCDClock.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\Applets\LCDPop3.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\Applets\LCDCountdown.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe
(Akamai Technologies, Inc.) C:\Users\RedWidow\AppData\Local\Akamai\netsession_win.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.5\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.5\GoogleCrashHandler64.exe
(hxxp://tortoisesvn.net) C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe
(NEC Electronics Corporation) C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Creative Technology Ltd.) C:\Windows\system32\AMBSpiE.exe
(Microsoft Corporation) C:\Windows\system32\taskmgr.exe
(TeamSpeak Systems GmbH) C:\Users\RedWidow\teamspeak3\ts3client_win32.exe
(VideoLAN) C:\Program Files (x86)\VideoLAN\VLC\vlc.exe
() C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe
() C:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.0.204\deploy\LoLLauncher.exe
() C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.77\deploy\LolClient.exe
(Microsoft Corporation) C:\Windows\system32\msiexec.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RunDLLEntry] - C:\Windows\system32\AmbRunE.dll [17920 2009-02-26] (Creative Technology Ltd.)
HKLM\...\Run: [Launch LCore] - C:\Program Files\Logitech Gaming Software\LCore.exe [8290584 2013-08-01] (Logitech Inc.)
HKLM\...\Run: [BCSSync] - C:\Program Files\Microsoft Office\Office14\BCSSync.exe [108144 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [VolPanel] - C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe [241789 2009-07-07] (Creative Technology Ltd)
HKLM-x32\...\Run: [UpdReg] - C:\Windows\UpdReg.EXE [90112 2000-05-11] (Creative Technology Ltd.)
HKLM-x32\...\Run: [JMB36X IDE Setup] - C:\Windows\RaidTool\xInsIDE.exe [36864 2007-03-20] ()
HKLM-x32\...\Run: [NUSB3MON] - C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [106496 2010-01-22] (NEC Electronics Corporation)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-08-30] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [avast] - C:\Program Files\AVAST Software\Avast\avastUI.exe [4858968 2013-08-30] (AVAST Software)
HKLM-x32\...\Run: [PowerDVD13Agent] - C:\Program Files (x86)\CyberLink\PowerDVD13\PowerDVD13Agent.exe [517144 2013-07-05] (CyberLink Corp.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [BlueStacks Agent] - C:\Program Files (x86)\BlueStacks\HD-Agent.exe
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] - C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [3814736 2014-02-26] (LogMeIn Inc.)
HKLM-x32\...\Run: [APSDaemon] - "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
HKLM-x32\...\Run: [QuickTime Task] - "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
HKLM-x32\...\Run: [SDTray] - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-2172666858-744790929-553880742-1000\...\Run: [Steam] - C:\Program Files (x86)\Steam\steam.exe [1821888 2014-02-25] (Valve Corporation)
HKU\S-1-5-21-2172666858-744790929-553880742-1000\...\Run: [Overwolf] - C:\Program Files (x86)\Overwolf\Overwolf.exe -silent
HKU\S-1-5-21-2172666858-744790929-553880742-1000\...\Run: [Spotify Web Helper] - C:\Users\RedWidow\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171968 2014-01-09] (Spotify Ltd)
HKU\S-1-5-21-2172666858-744790929-553880742-1000\...\Run: [Akamai NetSession Interface] - C:\Users\RedWidow\AppData\Local\Akamai\netsession_win.exe [4489472 2013-06-05] (Akamai Technologies, Inc.)
HKU\S-1-5-21-2172666858-744790929-553880742-1000\...\Run: [DAEMON Tools Lite] - "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
HKU\S-1-5-21-2172666858-744790929-553880742-1000\...\Run: [EADM] - C:\Program Files (x86)\Origin\Origin.exe [3588952 2014-03-10] (Electronic Arts)
HKU\S-1-5-21-2172666858-744790929-553880742-1000\...\Run: [Spotify] - C:\Users\RedWidow\AppData\Roaming\Spotify\spotify.exe [6118400 2014-01-09] (Spotify Ltd)
HKU\S-1-5-21-2172666858-744790929-553880742-1000\...\Run: [BackgroundContainer] - "C:\Windows\SysWOW64\Rundll32.exe" "C:\Users\RedWidow\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll",DllRun <===== ATTENTION

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.giga.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.bing.com
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.bing.com
URLSearchHook: HKLM-x32 - (No Name) - {c95a4e8e-816d-4655-8c79-d736da1adb6d} - No File
URLSearchHook: HKCU - (No Name) - {c95a4e8e-816d-4655-8c79-d736da1adb6d} - No File
SearchScopes: HKCU - {46244704-D10A-4418-80AC-0799FB662C58} URL = hxxp://search.softonic.com/MOY00621/tb_v1?q={searchTerms}&SearchSource=4&cc=&mi=ac80fcae000000000000f46d04005e8c&r=132
SearchScopes: HKCU - {FF1171C3-1834-4EDA-B649-BEDF427DB99A} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT1561552&CUI=UN86581855170247403&UM=4&SSPV=IE_NO_DUM_G_2
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: Hotspot Shield Class - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files (x86)\Hotspot Shield\HssIE\HssIE_64.dll No File
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Toolbar: HKLM-x32 - No Name - {c95a4e8e-816d-4655-8c79-d736da1adb6d} -  No File
Toolbar: HKCU - No Name - {C95A4E8E-816D-4655-8C79-D736DA1ADB6D} -  No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL No File

FireFox:
========
FF ProfilePath: C:\Users\RedWidow\AppData\Roaming\Mozilla\Firefox\Profiles\x7ow81t1.default
FF user.js: detected! => C:\Users\RedWidow\AppData\Roaming\Mozilla\Firefox\Profiles\x7ow81t1.default\user.js
FF SelectedSearchEngine: Google
FF Homepage: hxxp://www.google.com/firefox
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()
FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll No File
FF Plugin-x32: @esn/npbattlelog,version=2.3.2 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.2\npbattlelog.dll No File
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @nsroblox.roblox.com/launcher - C:\Program Files (x86)\Roblox\Versions\version-79a62ec00b324436\\NPRobloxProxy.dll ( ROBLOX Corporation)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF SearchPlugin: C:\Users\RedWidow\AppData\Roaming\Mozilla\Firefox\Profiles\x7ow81t1.default\searchplugins\ask-search.xml
FF SearchPlugin: C:\Users\RedWidow\AppData\Roaming\Mozilla\Firefox\Profiles\x7ow81t1.default\searchplugins\hotspot-shield-customized-web-search.xml
FF SearchPlugin: C:\Users\RedWidow\AppData\Roaming\Mozilla\Firefox\Profiles\x7ow81t1.default\searchplugins\softonic.xml
FF SearchPlugin: C:\Users\RedWidow\AppData\Roaming\Mozilla\Firefox\Profiles\x7ow81t1.default\searchplugins\webwebweb.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Flash Video Downloader - Full HD Download - C:\Users\RedWidow\AppData\Roaming\Mozilla\Firefox\Profiles\x7ow81t1.default\Extensions\artur.dubovoy@gmail.com [2014-03-10]
FF Extension: DownloadHelper - C:\Users\RedWidow\AppData\Roaming\Mozilla\Firefox\Profiles\x7ow81t1.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2013-10-29]
FF Extension: Hotspot Shield  - C:\Users\RedWidow\AppData\Roaming\Mozilla\Firefox\Profiles\x7ow81t1.default\Extensions\{c95a4e8e-816d-4655-8c79-d736da1adb6d} [2014-03-08]
FF Extension: Easy YouTube MP3 Downloader - C:\Users\RedWidow\AppData\Roaming\Mozilla\Firefox\Profiles\x7ow81t1.default\Extensions\5@thumbpro.net.xpi [2014-01-31]
FF Extension: Video Downloader professional - C:\Users\RedWidow\AppData\Roaming\Mozilla\Firefox\Profiles\x7ow81t1.default\Extensions\ffext_basicvideoext@startpage24.xpi [2013-12-16]
FF Extension: YouTube mp3 - C:\Users\RedWidow\AppData\Roaming\Mozilla\Firefox\Profiles\x7ow81t1.default\Extensions\info@youtube-mp3.org.xpi [2013-10-29]
FF Extension: YouTube MP3 Pro - C:\Users\RedWidow\AppData\Roaming\Mozilla\Firefox\Profiles\x7ow81t1.default\Extensions\info@youtubespace.de.xpi [2013-10-29]
FF Extension: YouTube MP3 Download - C:\Users\RedWidow\AppData\Roaming\Mozilla\Firefox\Profiles\x7ow81t1.default\Extensions\jid0-Z0Vu9hJlqV0fhIAPqPfmUCNubYQ@jetpack.xpi [2014-01-31]
FF Extension: Adblock Plus - C:\Users\RedWidow\AppData\Roaming\Mozilla\Firefox\Profiles\x7ow81t1.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-10-04]
FF Extension: Greasemonkey - C:\Users\RedWidow\AppData\Roaming\Mozilla\Firefox\Profiles\x7ow81t1.default\Extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi [2013-11-28]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-10-08]

Chrome: 
=======
CHR HomePage: chrome://newtab
CHR RestoreOnStartup: "hxxp://www.google.com/"
CHR DefaultSearchKeyword: softonic
CHR DefaultSearchProvider: Search the web (Softonic)
CHR DefaultSearchURL: hxxp://search.softonic.com/MOY00621/tb_v1?q={searchTerms}&SearchSource=49&cc=&mi=ac80fcae000000000000f46d04005e8c
CHR DefaultNewTabURL: 
CHR Extension: (Google Docs) - C:\Users\RedWidow\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-10-31]
CHR Extension: (Google Drive) - C:\Users\RedWidow\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-10-31]
CHR Extension: (YouTube) - C:\Users\RedWidow\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-10-31]
CHR Extension: (Google Search) - C:\Users\RedWidow\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-10-31]
CHR Extension: (Google Wallet) - C:\Users\RedWidow\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-10-31]
CHR Extension: (Gmail) - C:\Users\RedWidow\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-10-31]
CHR HKCU\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2013-08-30] (Advanced Micro Devices, Inc.)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808 2013-08-30] (AVAST Software)
R2 CyberLink PowerDVD 13 Media Server Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSMonitorServicePDVD13.exe [77576 2013-07-05] (CyberLink)
R2 CyberLink PowerDVD 13 Media Server Service; C:\Program Files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSServerPDVD13.exe [327432 2013-07-05] (CyberLink)
S2 KMService; C:\Windows\SysWOW64\srvany.exe [8192 2013-10-08] ()
R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe [377616 2014-02-26] (LogMeIn, Inc.)
S3 npggsvc; C:\Windows\SysWOW64\GameMon.des [4979992 2013-11-25] (INCA Internet Co., Ltd.)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-12-25] ()
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.)
S2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.)
S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [X]
S2 BstHdAndroidSvc; "C:\Program Files (x86)\BlueStacks\HD-Service.exe" BstHdAndroidSvc Android [X]
S2 BstHdLogRotatorSvc; C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe [X]
S3 Creative ALchemy AL6 Licensing Service; "C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe" [X]
S3 Creative Audio Engine Licensing Service; "C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe" [X]
S3 OverwolfUpdaterService; C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe [X]
S3 Steam Client Service; "C:\Program Files (x86)\Common Files\Steam\SteamService.exe" /RunAsService [X]

==================== Drivers (Whitelisted) ====================

R2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [33400 2013-08-30] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [80816 2013-08-30] (AVAST Software)
R1 aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [72016 2013-08-30] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65336 2013-08-30] ()
R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [1030952 2013-08-30] (AVAST Software)
R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [378944 2013-08-30] (AVAST Software)
R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-08-30] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [204880 2013-08-30] ()
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2013-11-29] (Disc Soft Ltd)
R3 LGSHidFilt; C:\Windows\System32\DRIVERS\LGSHidFilt.Sys [64280 2013-05-30] (Logitech Inc.)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-16] ()
S3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42184 2013-06-21] (Anchorfree Inc.)
R3 VMfilt; C:\Windows\System32\drivers\VMfilt64.sys [25600 2009-07-31] (Creative Technology Ltd.)
R2 {09F57980-3432-4AFC-957D-27AC45FAE1F5}; C:\Program Files (x86)\CyberLink\PowerDVD13\Common\NavFilter\000.fcl [130320 2013-07-05] (CyberLink Corp.)
S2 BstHdDrv; \??\C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [X]
S3 CEDRIVER60; \??\C:\Program Files (x86)\Cheat Engine 6.3\dbk64.sys [X]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
S3 X6va015; \??\C:\Windows\SysWOW64\Drivers\X6va015 [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-03-21 07:52 - 2014-03-21 07:52 - 00000000 ____D () C:\FRST
2014-03-21 07:45 - 2014-03-21 07:48 - 00000000 ____D () C:\ProgramData\SecTaskMan
2014-03-21 07:43 - 2014-03-21 07:43 - 00000000 ____D () C:\Program Files (x86)\Security Task Manager
2014-03-21 07:35 - 2014-03-21 07:35 - 00003388 _____ () C:\Windows\System32\Tasks\BackgroundContainer Startup Task
2014-03-21 07:34 - 2014-03-21 07:34 - 00000000 ____D () C:\ResBuffer
2014-03-21 07:34 - 2014-03-21 07:34 - 00000000 ____D () C:\PlaytoAlbumArt
2014-03-21 07:34 - 2014-03-21 07:34 - 00000000 ____D () C:\MOInfoBuffer
2014-03-21 07:34 - 2014-03-21 07:34 - 00000000 ____D () C:\M3U8Buffer
2014-03-20 19:47 - 2014-03-20 19:47 - 00000000 ____D () C:\Users\RedWidow\AppData\Roaming\Battle.net
2014-03-20 19:00 - 2014-03-21 07:44 - 00000000 ____D () C:\Users\RedWidow\AppData\Roaming\TS3Client
2014-03-20 19:00 - 2014-03-20 19:00 - 00000000 ____D () C:\Users\RedWidow\teamspeak3
2014-03-20 18:59 - 2014-03-20 18:59 - 00000000 ____D () C:\Users\RedWidow\ts34
2014-03-20 18:59 - 2014-03-20 18:59 - 00000000 ____D () C:\Users\RedWidow\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client
2014-03-20 18:57 - 2014-03-20 18:57 - 00000000 ____D () C:\Program Files (x86)\TeamSpeak 3 Client
2014-03-20 18:20 - 2014-03-21 07:35 - 00000148 _____ () C:\CLMSServer.ini
2014-03-20 18:20 - 2014-03-21 07:34 - 00000029 _____ () C:\GeneralInfo.ini
2014-03-20 18:20 - 2014-03-20 18:20 - 00021504 _____ () C:\MediaServer.db
2014-03-20 18:20 - 2014-03-20 18:20 - 00005528 _____ () C:\MS_StateVariable.ini
2014-03-20 18:20 - 2014-03-20 18:20 - 00000930 _____ () C:\CLMediaServer.ini
2014-03-20 18:20 - 2014-03-20 18:20 - 00000000 ___HD () C:\vthumb
2014-03-20 18:20 - 2013-07-05 05:25 - 00001735 _____ () C:\PCMMediaServer.ini
2014-03-20 18:20 - 2013-06-06 07:20 - 00000452 _____ () C:\EncodingProfile.ini
2014-03-20 18:18 - 2014-03-20 18:24 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-03-20 18:18 - 2014-03-20 18:22 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-03-20 18:18 - 2014-03-20 18:18 - 00001379 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-03-20 18:18 - 2014-03-20 18:18 - 00000656 _____ () C:\Windows\Tasks\Check for updates (Spybot - Search & Destroy).job
2014-03-20 18:18 - 2014-03-20 18:18 - 00000628 _____ () C:\Windows\Tasks\Refresh immunization (Spybot - Search & Destroy).job
2014-03-20 18:18 - 2014-03-20 18:18 - 00000458 _____ () C:\Windows\Tasks\Scan the system (Spybot - Search & Destroy).job
2014-03-20 18:18 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2014-03-20 17:06 - 2014-03-20 17:06 - 00001961 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-03-20 15:49 - 2014-03-20 19:08 - 00000000 ____D () C:\Users\RedWidow\Desktop\try
2014-03-20 15:22 - 2014-03-20 15:23 - 00000000 ____D () C:\test
2014-03-19 18:50 - 2014-03-19 18:50 - 00000000 ____D () C:\Users\RedWidow\AppData\Local\Blizzard
2014-03-19 16:48 - 2014-03-19 16:48 - 00000000 ____D () C:\Users\RedWidow\AppData\Local\Blizzard Entertainment
2014-03-19 16:03 - 2014-03-19 16:03 - 00000000 _____ () C:\Users\RedWidow\Desktop\WoW Rogue.txt
2014-03-19 15:02 - 2014-03-20 22:25 - 00000000 ____D () C:\Users\RedWidow\AppData\Local\Battle.net
2014-03-19 15:01 - 2014-03-20 19:46 - 00000000 ____D () C:\Program Files (x86)\Battle.net
2014-03-18 19:52 - 2014-03-18 19:52 - 00001272 _____ () C:\Users\RedWidow\Desktop\Snipping Tool.lnk
2014-03-16 17:09 - 2014-03-16 17:09 - 00000000 _____ () C:\Windows\system32\TASKLIST
2014-03-16 07:51 - 2014-03-16 07:51 - 00000222 _____ () C:\Users\RedWidow\Desktop\Call of Duty Black Ops II - Multiplayer.url
2014-03-15 20:51 - 2014-03-15 20:52 - 00000056 _____ () C:\Windows\SysWOW64\root.dat
2014-03-15 20:40 - 2014-03-15 20:40 - 00000178 _____ () C:\Users\RedWidow\Desktop\Skin Installer Ultimate.url
2014-03-15 20:33 - 2014-03-18 20:31 - 00000000 ____D () C:\Users\RedWidow\Desktop\costum
2014-03-15 15:08 - 2014-03-15 15:09 - 00000000 ____D () C:\Users\RedWidow\AppData\Local\Roblox
2014-03-15 15:07 - 2014-03-15 15:07 - 00001354 _____ () C:\Users\RedWidow\Desktop\ROBLOX Player.lnk
2014-03-15 15:05 - 2014-03-20 17:02 - 00000000 ____D () C:\Program Files (x86)\Roblox
2014-03-15 15:05 - 2014-03-15 15:07 - 00001173 _____ () C:\Users\RedWidow\Desktop\ROBLOX Studio 2013.lnk
2014-03-15 15:05 - 2014-03-15 15:05 - 00000000 ____D () C:\ProgramData\Roblox
2014-03-15 07:53 - 2014-03-15 08:09 - 00000000 ____D () C:\Users\RedWidow\Documents\Arma 3
2014-03-15 07:52 - 2014-03-15 08:40 - 00000000 ____D () C:\Users\RedWidow\AppData\Local\Arma 3
2014-03-15 07:52 - 2014-03-15 07:52 - 00000000 ____D () C:\ProgramData\Bohemia Interactive
2014-03-15 06:41 - 2014-03-15 06:41 - 00003508 _____ () C:\Windows\System32\Tasks\Yef
2014-03-14 20:44 - 2014-03-20 17:01 - 00000000 ____D () C:\Users\RedWidow\Desktop\Arma 3
2014-03-14 20:44 - 2014-03-14 20:44 - 00000222 _____ () C:\Users\RedWidow\Desktop\Arma 3.url
2014-03-14 20:40 - 2014-03-14 20:40 - 00000222 _____ () C:\Users\RedWidow\Desktop\Call of Duty Black Ops II.url
2014-03-14 14:11 - 2014-03-01 07:05 - 23133696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-03-14 14:11 - 2014-03-01 06:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-03-14 14:11 - 2014-03-01 06:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-03-14 14:11 - 2014-03-01 05:58 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-03-14 14:11 - 2014-03-01 05:52 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-03-14 14:11 - 2014-03-01 05:51 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-03-14 14:11 - 2014-03-01 05:42 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-03-14 14:11 - 2014-03-01 05:40 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-03-14 14:11 - 2014-03-01 05:37 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-03-14 14:11 - 2014-03-01 05:33 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-03-14 14:11 - 2014-03-01 05:33 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-03-14 14:11 - 2014-03-01 05:32 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-03-14 14:11 - 2014-03-01 05:30 - 17074688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-03-14 14:11 - 2014-03-01 05:23 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-03-14 14:11 - 2014-03-01 05:17 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-03-14 14:11 - 2014-03-01 05:11 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-03-14 14:11 - 2014-03-01 05:02 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-03-14 14:11 - 2014-03-01 04:54 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-03-14 14:11 - 2014-03-01 04:52 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-03-14 14:11 - 2014-03-01 04:51 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-03-14 14:11 - 2014-03-01 04:47 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-03-14 14:11 - 2014-03-01 04:43 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-03-14 14:11 - 2014-03-01 04:43 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-03-14 14:11 - 2014-03-01 04:42 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-03-14 14:11 - 2014-03-01 04:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-03-14 14:11 - 2014-03-01 04:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-03-14 14:11 - 2014-03-01 04:37 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-03-14 14:11 - 2014-03-01 04:35 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-03-14 14:11 - 2014-03-01 04:18 - 13051904 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-03-14 14:11 - 2014-03-01 04:16 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-03-14 14:11 - 2014-03-01 04:14 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-03-14 14:11 - 2014-03-01 04:10 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-03-14 14:11 - 2014-03-01 04:03 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-03-14 14:11 - 2014-03-01 04:00 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-03-14 14:11 - 2014-03-01 03:57 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-03-14 14:11 - 2014-03-01 03:38 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-03-14 14:11 - 2014-03-01 03:32 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-03-14 14:11 - 2014-03-01 03:27 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-03-14 14:11 - 2014-03-01 03:25 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-03-14 14:11 - 2014-03-01 03:25 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-03-14 14:11 - 2014-02-07 02:23 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-03-14 14:11 - 2014-01-29 03:32 - 00484864 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
2014-03-14 14:11 - 2014-01-29 03:06 - 00381440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll
2014-03-14 14:11 - 2014-01-28 03:32 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2014-03-14 14:09 - 2014-02-04 03:32 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-03-14 14:09 - 2014-02-04 03:32 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-03-14 14:09 - 2014-02-04 03:04 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2014-03-14 14:09 - 2014-02-04 03:04 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-03-13 16:05 - 2014-03-13 16:05 - 00000000 ____D () C:\Users\RedWidow\AppData\Local\Skype
2014-03-13 16:04 - 2014-03-13 16:04 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-03-13 14:58 - 2014-03-16 16:55 - 00000397 _____ () C:\Users\RedWidow\Desktop\Rivals Rebels.txt
2014-03-10 15:16 - 2014-03-10 15:16 - 00000000 ____D () C:\Users\RedWidow\AppData\Roaming\.electriciansjourney
2014-03-10 14:46 - 2014-03-13 14:41 - 00000000 ____D () C:\Users\RedWidow\AppData\Roaming\.crazycraft
2014-03-10 14:46 - 2014-03-13 13:46 - 00000000 ____D () C:\Users\RedWidow\AppData\Roaming\.beta-pokepack
2014-03-10 14:46 - 2014-03-13 13:46 - 00000000 ____D () C:\Users\RedWidow\AppData\Roaming\.beta-jurassiccraft
2014-03-10 14:46 - 2014-03-10 14:46 - 00000000 ____D () C:\Users\RedWidow\AppData\Roaming\.aethericcrusade
2014-03-10 14:40 - 2014-03-10 14:40 - 00000000 ____D () C:\Users\RedWidow\AppData\Roaming\Apple Computer
2014-03-09 16:56 - 2014-03-09 16:56 - 00001884 _____ () C:\Users\Public\Desktop\QuickTime Player.lnk
2014-03-09 16:56 - 2014-03-09 16:56 - 00000000 ____D () C:\ProgramData\Apple Computer
2014-03-09 16:55 - 2014-03-09 16:55 - 00000000 ____D () C:\Windows\System32\Tasks\Apple
2014-03-09 16:55 - 2014-03-09 16:55 - 00000000 ____D () C:\Users\RedWidow\AppData\Local\Apple
2014-03-09 16:55 - 2014-03-09 16:55 - 00000000 ____D () C:\ProgramData\Apple
2014-03-09 16:55 - 2014-03-09 16:55 - 00000000 ____D () C:\Program Files (x86)\Apple Software Update
2014-03-09 16:48 - 2014-03-09 16:48 - 00000000 ____D () C:\Users\RedWidow\Desktop\Audiosurfer
2014-03-09 16:29 - 2014-03-09 16:29 - 00000221 _____ () C:\Users\RedWidow\Desktop\Audiosurf.url
2014-03-09 12:19 - 2014-03-09 12:19 - 00000000 _____ () C:\Users\RedWidow\Desktop\Neues Textdokument.txt
2014-03-08 21:30 - 2014-03-08 21:30 - 00000924 _____ () C:\Users\Public\Desktop\osu!.lnk
2014-03-08 15:39 - 2014-03-08 15:39 - 00000019 _____ () C:\Users\RedWidow\Desktop\S P.txt
2014-03-08 13:33 - 2014-03-08 13:33 - 00000000 ____D () C:\Users\RedWidow\AppData\Local\Conduit
2014-03-08 13:33 - 2014-03-08 13:33 - 00000000 ____D () C:\ProgramData\Conduit
2014-03-08 11:58 - 2012-01-29 14:04 - 00135168 _____ () C:\Users\RedWidow\Desktop\LOIC.exe
2014-03-07 17:20 - 2014-03-07 17:20 - 00001940 _____ () C:\Users\Public\Desktop\LOL Recorder.lnk
2014-03-07 15:42 - 2014-03-08 10:04 - 00000250 _____ () C:\Users\RedWidow\Desktop\hi.txt
2014-03-07 14:59 - 2014-03-08 08:13 - 00001444 _____ () C:\Users\RedWidow\Desktop\cmd.lnk
2014-03-07 14:55 - 2014-03-07 14:59 - 00001601 _____ () C:\Users\RedWidow\Desktop\see ya fucking nerds!.lnk
2014-03-07 14:51 - 2014-03-07 14:51 - 00001237 _____ () C:\Users\RedWidow\Desktop\cheatengine.dll.rar
2014-03-07 14:42 - 2014-03-07 14:42 - 00001301 _____ () C:\Users\RedWidow\Desktop\shutdown.lnk
2014-03-06 16:09 - 2014-03-20 17:02 - 00000000 ____D () C:\Users\RedWidow\Desktop\css2
2014-03-06 16:07 - 2014-02-23 22:23 - 00000515 _____ () C:\Users\RedWidow\Desktop\Read Me.txt
2014-03-05 21:52 - 2014-03-05 21:52 - 00000000 ____D () C:\Users\RedWidow\AppData\Roaming\Sinvise Systems
2014-03-05 21:52 - 2014-03-05 21:52 - 00000000 ____D () C:\Program Files (x86)\Sinvise Systems
2014-03-04 21:13 - 2014-03-20 17:02 - 00000000 ____D () C:\Program Files\Metin2Philippines
2014-03-02 17:31 - 2014-03-02 17:31 - 00001944 _____ () C:\Users\Public\Desktop\Metin2.lnk
2014-03-02 16:38 - 2014-03-02 16:38 - 00001106 _____ () C:\Users\Public\Desktop\Gameforge Live.lnk
2014-03-02 16:38 - 2014-03-02 16:38 - 00000000 ____D () C:\Users\RedWidow\AppData\Local\Gameforge4d
2014-03-02 10:42 - 2014-03-02 10:42 - 00013245 _____ () C:\Users\RedWidow\Desktop\Maus - Verknüpfung (2).lnk
2014-02-28 18:50 - 2014-03-02 22:08 - 00000930 _____ () C:\Users\RedWidow\AppData\Local\_settings.ini
2014-02-28 08:22 - 2014-02-28 08:22 - 00000000 ____D () C:\Users\RedWidow\AppData\Roaming\steamvr
2014-02-27 16:56 - 2014-02-27 16:56 - 00013245 _____ () C:\Users\RedWidow\Desktop\Maus - Verknüpfung.lnk
2014-02-27 16:40 - 2014-02-27 16:51 - 00000000 ____D () C:\Users\RedWidow\Desktop\CSS
2014-02-27 14:33 - 2014-02-27 14:33 - 00000000 _____ () C:\Users\RedWidow\Desktop\INSTALOK.txt
2014-02-27 12:16 - 2014-02-27 12:19 - 00000000 ____D () C:\Users\RedWidow\AppData\Roaming\TrueCrypt
2014-02-27 12:15 - 2014-03-20 17:02 - 00000000 ____D () C:\Program Files\TrueCrypt
2014-02-27 12:15 - 2014-02-27 12:15 - 00231376 _____ (TrueCrypt Foundation) C:\Windows\system32\Drivers\truecrypt.sys
2014-02-27 12:15 - 2014-02-27 12:15 - 00000914 _____ () C:\Users\Public\Desktop\TrueCrypt.lnk
2014-02-27 12:02 - 2014-02-27 12:02 - 00000219 _____ () C:\Users\RedWidow\Desktop\Team Fortress 2.url
2014-02-27 11:54 - 2014-02-27 11:55 - 00000000 ____D () C:\Program Files (x86)\LogMeIn Hamachi
2014-02-26 21:17 - 2014-02-26 21:17 - 00001916 _____ () C:\Users\RedWidow\Desktop\Start BlueStacks.lnk
2014-02-26 21:04 - 2014-02-26 21:04 - 00002167 _____ () C:\Users\RedWidow\Desktop\Clash of Clans.lnk
2014-02-26 20:55 - 2014-02-26 20:55 - 00001846 _____ () C:\Users\Public\Desktop\Start BlueStacks.lnk
2014-02-26 20:55 - 2014-02-26 20:55 - 00001821 _____ () C:\Users\Public\Desktop\Apps.lnk
2014-02-26 20:54 - 2014-02-26 20:54 - 00000000 ____D () C:\ProgramData\BlueStacks
2014-02-26 20:53 - 2014-02-26 20:53 - 00000000 ____D () C:\Windows\system32\appmgmt
2014-02-25 17:55 - 2013-11-25 21:00 - 04979992 _____ (INCA Internet Co., Ltd.) C:\Windows\SysWOW64\GameMon.des
2014-02-25 17:54 - 2014-02-25 17:54 - 00000000 ____D () C:\Program Files\Common Files\INCA Shared
2014-02-25 17:50 - 2014-02-25 17:50 - 00001569 _____ () C:\Users\Public\Desktop\Flyff.lnk
2014-02-25 17:47 - 2014-03-20 17:02 - 00000000 ____D () C:\Program Files\gPotato.eu
2014-02-24 18:16 - 2014-03-21 07:39 - 00000000 ___RD () C:\Users\RedWidow\Desktop\cheatengine.dll
2014-02-24 18:09 - 2014-02-24 18:09 - 00000000 ____D () C:\Users\RedWidow\Desktop\CMD-ExE
2014-02-24 18:05 - 2014-02-24 18:06 - 00000000 __RHD () C:\Users\RedWidow\Desktop\Stealth
2014-02-24 17:59 - 2014-02-26 20:54 - 00000000 ____D () C:\ProgramData\BlueStacksSetup

==================== One Month Modified Files and Folders =======

2014-03-21 07:52 - 2014-03-21 07:52 - 00000000 ____D () C:\FRST
2014-03-21 07:48 - 2014-03-21 07:45 - 00000000 ____D () C:\ProgramData\SecTaskMan
2014-03-21 07:44 - 2014-03-20 19:00 - 00000000 ____D () C:\Users\RedWidow\AppData\Roaming\TS3Client
2014-03-21 07:44 - 2013-10-01 08:50 - 01894295 _____ () C:\Windows\WindowsUpdate.log
2014-03-21 07:43 - 2014-03-21 07:43 - 00000000 ____D () C:\Program Files (x86)\Security Task Manager
2014-03-21 07:43 - 2013-10-08 15:41 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-03-21 07:43 - 2013-10-01 10:01 - 00000000 ____D () C:\Windows\system32\MRT
2014-03-21 07:42 - 2013-10-31 20:19 - 00001114 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-03-21 07:42 - 2009-07-14 05:45 - 00014192 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-03-21 07:42 - 2009-07-14 05:45 - 00014192 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-03-21 07:41 - 2014-01-06 22:39 - 00000000 ____D () C:\Users\RedWidow\AppData\Local\LogMeIn Hamachi
2014-03-21 07:39 - 2014-02-24 18:16 - 00000000 ___RD () C:\Users\RedWidow\Desktop\cheatengine.dll
2014-03-21 07:39 - 2010-02-09 23:33 - 90015360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-03-21 07:35 - 2014-03-21 07:35 - 00003388 _____ () C:\Windows\System32\Tasks\BackgroundContainer Startup Task
2014-03-21 07:35 - 2014-03-20 18:20 - 00000148 _____ () C:\CLMSServer.ini
2014-03-21 07:35 - 2013-10-27 20:45 - 00000000 ____D () C:\Users\RedWidow\AppData\Roaming\Spotify
2014-03-21 07:35 - 2013-10-08 15:57 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-03-21 07:35 - 2013-10-01 15:32 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-03-21 07:34 - 2014-03-21 07:34 - 00000000 ____D () C:\ResBuffer
2014-03-21 07:34 - 2014-03-21 07:34 - 00000000 ____D () C:\PlaytoAlbumArt
2014-03-21 07:34 - 2014-03-21 07:34 - 00000000 ____D () C:\MOInfoBuffer
2014-03-21 07:34 - 2014-03-21 07:34 - 00000000 ____D () C:\M3U8Buffer
2014-03-21 07:34 - 2014-03-20 18:20 - 00000029 _____ () C:\GeneralInfo.ini
2014-03-21 07:34 - 2013-12-25 19:24 - 00000000 ____D () C:\Program Files (x86)\Origin
2014-03-21 07:34 - 2013-10-31 20:19 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-03-21 07:33 - 2013-10-01 09:11 - 00198246 _____ () C:\Windows\PFRO.log
2014-03-21 07:33 - 2013-10-01 09:05 - 00000000 _____ () C:\Windows\system32\Drivers\lvuvc.hs
2014-03-21 07:33 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-03-21 07:33 - 2009-07-14 05:51 - 00045254 _____ () C:\Windows\setupact.log
2014-03-20 22:25 - 2014-03-19 15:02 - 00000000 ____D () C:\Users\RedWidow\AppData\Local\Battle.net
2014-03-20 22:15 - 2013-12-06 14:38 - 00000000 ____D () C:\Users\RedWidow\AppData\Roaming\Skype
2014-03-20 21:54 - 2013-10-02 20:51 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-03-20 19:47 - 2014-03-20 19:47 - 00000000 ____D () C:\Users\RedWidow\AppData\Roaming\Battle.net
2014-03-20 19:46 - 2014-03-19 15:01 - 00000000 ____D () C:\Program Files (x86)\Battle.net
2014-03-20 19:08 - 2014-03-20 15:49 - 00000000 ____D () C:\Users\RedWidow\Desktop\try
2014-03-20 19:00 - 2014-03-20 19:00 - 00000000 ____D () C:\Users\RedWidow\teamspeak3
2014-03-20 19:00 - 2013-10-01 15:13 - 00000935 _____ () C:\Users\RedWidow\Desktop\TeamSpeak 3 Client.lnk
2014-03-20 19:00 - 2013-10-01 08:52 - 00000000 ____D () C:\Users\RedWidow
2014-03-20 18:59 - 2014-03-20 18:59 - 00000000 ____D () C:\Users\RedWidow\ts34
2014-03-20 18:59 - 2014-03-20 18:59 - 00000000 ____D () C:\Users\RedWidow\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client
2014-03-20 18:57 - 2014-03-20 18:57 - 00000000 ____D () C:\Program Files (x86)\TeamSpeak 3 Client
2014-03-20 18:24 - 2014-03-20 18:18 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-03-20 18:23 - 2013-10-19 11:01 - 00000000 ____D () C:\ProgramData\Origin
2014-03-20 18:22 - 2014-03-20 18:18 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-03-20 18:20 - 2014-03-20 18:20 - 00021504 _____ () C:\MediaServer.db
2014-03-20 18:20 - 2014-03-20 18:20 - 00005528 _____ () C:\MS_StateVariable.ini
2014-03-20 18:20 - 2014-03-20 18:20 - 00000930 _____ () C:\CLMediaServer.ini
2014-03-20 18:20 - 2014-03-20 18:20 - 00000000 ___HD () C:\vthumb
2014-03-20 18:18 - 2014-03-20 18:18 - 00001379 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-03-20 18:18 - 2014-03-20 18:18 - 00000656 _____ () C:\Windows\Tasks\Check for updates (Spybot - Search & Destroy).job
2014-03-20 18:18 - 2014-03-20 18:18 - 00000628 _____ () C:\Windows\Tasks\Refresh immunization (Spybot - Search & Destroy).job
2014-03-20 18:18 - 2014-03-20 18:18 - 00000458 _____ () C:\Windows\Tasks\Scan the system (Spybot - Search & Destroy).job
2014-03-20 17:08 - 2013-10-01 15:14 - 00000000 ____D () C:\Users\RedWidow\AppData\Local\Overwolf
2014-03-20 17:07 - 2014-01-06 11:07 - 00000000 ____D () C:\Users\RedWidow\AppData\Local\TSVNCache
2014-03-20 17:06 - 2014-03-20 17:06 - 00001961 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-03-20 17:06 - 2013-10-08 15:57 - 00000000 _____ () C:\Windows\SysWOW64\config.nt
2014-03-20 17:02 - 2014-03-15 15:05 - 00000000 ____D () C:\Program Files (x86)\Roblox
2014-03-20 17:02 - 2014-03-06 16:09 - 00000000 ____D () C:\Users\RedWidow\Desktop\css2
2014-03-20 17:02 - 2014-03-04 21:13 - 00000000 ____D () C:\Program Files\Metin2Philippines
2014-03-20 17:02 - 2014-02-27 12:15 - 00000000 ____D () C:\Program Files\TrueCrypt
2014-03-20 17:02 - 2014-02-25 17:47 - 00000000 ____D () C:\Program Files\gPotato.eu
2014-03-20 17:02 - 2014-01-09 14:30 - 00000000 ____D () C:\Users\RedWidow\AppData\Roaming\vlc
2014-03-20 17:02 - 2013-11-04 10:15 - 00000000 ____D () C:\Users\RedWidow\Desktop\Name is not da  (2)
2014-03-20 17:02 - 2013-11-04 10:01 - 00000000 ____D () C:\Users\RedWidow\AppData\Local\Akamai
2014-03-20 17:02 - 2013-11-04 10:01 - 00000000 ____D () C:\AeriaGames
2014-03-20 17:02 - 2013-10-10 19:11 - 00000000 ____D () C:\Program Files (x86)\StarCraft II
2014-03-20 17:02 - 2013-10-08 17:01 - 00000000 ____D () C:\Program Files (x86)\CyberLink
2014-03-20 17:02 - 2013-10-01 13:29 - 00000000 ____D () C:\Riot Games
2014-03-20 17:02 - 2013-10-01 13:24 - 00000000 ____D () C:\ProgramData\PMB Files
2014-03-20 17:01 - 2014-03-14 20:44 - 00000000 ____D () C:\Users\RedWidow\Desktop\Arma 3
2014-03-20 17:01 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\registration
2014-03-20 16:49 - 2013-10-01 08:50 - 00000000 __SHD () C:\Recovery
2014-03-20 15:23 - 2014-03-20 15:22 - 00000000 ____D () C:\test
2014-03-19 20:48 - 2013-10-01 13:24 - 00000000 ____D () C:\Users\RedWidow\AppData\Local\PMB Files
2014-03-19 18:50 - 2014-03-19 18:50 - 00000000 ____D () C:\Users\RedWidow\AppData\Local\Blizzard
2014-03-19 16:48 - 2014-03-19 16:48 - 00000000 ____D () C:\Users\RedWidow\AppData\Local\Blizzard Entertainment
2014-03-19 16:03 - 2014-03-19 16:03 - 00000000 _____ () C:\Users\RedWidow\Desktop\WoW Rogue.txt
2014-03-18 20:31 - 2014-03-15 20:33 - 00000000 ____D () C:\Users\RedWidow\Desktop\costum
2014-03-18 19:52 - 2014-03-18 19:52 - 00001272 _____ () C:\Users\RedWidow\Desktop\Snipping Tool.lnk
2014-03-16 17:09 - 2014-03-16 17:09 - 00000000 _____ () C:\Windows\system32\TASKLIST
2014-03-16 16:55 - 2014-03-13 14:58 - 00000397 _____ () C:\Users\RedWidow\Desktop\Rivals Rebels.txt
2014-03-16 15:16 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-03-16 14:49 - 2014-02-16 21:02 - 00000000 ____D () C:\Users\RedWidow\Desktop\LoL Replays
2014-03-16 09:17 - 2013-10-26 17:57 - 00000000 ____D () C:\Users\RedWidow\AppData\Roaming\.minecraft
2014-03-16 07:51 - 2014-03-16 07:51 - 00000222 _____ () C:\Users\RedWidow\Desktop\Call of Duty Black Ops II - Multiplayer.url
2014-03-16 07:51 - 2013-10-02 13:46 - 00000000 ____D () C:\Users\RedWidow\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2014-03-15 20:52 - 2014-03-15 20:51 - 00000056 _____ () C:\Windows\SysWOW64\root.dat
2014-03-15 20:45 - 2013-10-31 20:22 - 00002214 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-03-15 20:40 - 2014-03-15 20:40 - 00000178 _____ () C:\Users\RedWidow\Desktop\Skin Installer Ultimate.url
2014-03-15 15:09 - 2014-03-15 15:08 - 00000000 ____D () C:\Users\RedWidow\AppData\Local\Roblox
2014-03-15 15:08 - 2009-07-14 03:34 - 00000505 _____ () C:\Windows\win.ini
2014-03-15 15:07 - 2014-03-15 15:07 - 00001354 _____ () C:\Users\RedWidow\Desktop\ROBLOX Player.lnk
2014-03-15 15:07 - 2014-03-15 15:05 - 00001173 _____ () C:\Users\RedWidow\Desktop\ROBLOX Studio 2013.lnk
2014-03-15 15:05 - 2014-03-15 15:05 - 00000000 ____D () C:\ProgramData\Roblox
2014-03-15 08:40 - 2014-03-15 07:52 - 00000000 ____D () C:\Users\RedWidow\AppData\Local\Arma 3
2014-03-15 08:09 - 2014-03-15 07:53 - 00000000 ____D () C:\Users\RedWidow\Documents\Arma 3
2014-03-15 07:52 - 2014-03-15 07:52 - 00000000 ____D () C:\ProgramData\Bohemia Interactive
2014-03-15 07:52 - 2013-10-03 09:15 - 00150509 _____ () C:\Windows\DirectX.log
2014-03-15 07:43 - 2014-02-12 16:13 - 00000986 _____ () C:\Users\RedWidow\Desktop\Badministrator - League of Ladies (prod. Thomas Prime) - YouTube.lnk
2014-03-15 06:41 - 2014-03-15 06:41 - 00003508 _____ () C:\Windows\System32\Tasks\Yef
2014-03-15 03:20 - 2009-07-14 05:45 - 00416360 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-03-14 20:44 - 2014-03-14 20:44 - 00000222 _____ () C:\Users\RedWidow\Desktop\Arma 3.url
2014-03-14 20:40 - 2014-03-14 20:40 - 00000222 _____ () C:\Users\RedWidow\Desktop\Call of Duty Black Ops II.url
2014-03-13 16:05 - 2014-03-13 16:05 - 00000000 ____D () C:\Users\RedWidow\AppData\Local\Skype
2014-03-13 16:04 - 2014-03-13 16:04 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-03-13 16:04 - 2013-12-06 14:38 - 00000000 ____D () C:\ProgramData\Skype
2014-03-13 14:41 - 2014-03-10 14:46 - 00000000 ____D () C:\Users\RedWidow\AppData\Roaming\.crazycraft
2014-03-13 13:46 - 2014-03-10 14:46 - 00000000 ____D () C:\Users\RedWidow\AppData\Roaming\.beta-pokepack
2014-03-13 13:46 - 2014-03-10 14:46 - 00000000 ____D () C:\Users\RedWidow\AppData\Roaming\.beta-jurassiccraft
2014-03-13 13:46 - 2013-11-01 09:19 - 00000000 ____D () C:\Users\RedWidow\AppData\Roaming\Craften Terminal
2014-03-12 14:54 - 2013-10-02 20:51 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-03-12 14:54 - 2013-10-02 20:51 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-03-12 14:54 - 2013-10-02 20:51 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-03-10 15:16 - 2014-03-10 15:16 - 00000000 ____D () C:\Users\RedWidow\AppData\Roaming\.electriciansjourney
2014-03-10 14:46 - 2014-03-10 14:46 - 00000000 ____D () C:\Users\RedWidow\AppData\Roaming\.aethericcrusade
2014-03-10 14:40 - 2014-03-10 14:40 - 00000000 ____D () C:\Users\RedWidow\AppData\Roaming\Apple Computer
2014-03-09 16:56 - 2014-03-09 16:56 - 00001884 _____ () C:\Users\Public\Desktop\QuickTime Player.lnk
2014-03-09 16:56 - 2014-03-09 16:56 - 00000000 ____D () C:\ProgramData\Apple Computer
2014-03-09 16:55 - 2014-03-09 16:55 - 00000000 ____D () C:\Windows\System32\Tasks\Apple
2014-03-09 16:55 - 2014-03-09 16:55 - 00000000 ____D () C:\Users\RedWidow\AppData\Local\Apple
2014-03-09 16:55 - 2014-03-09 16:55 - 00000000 ____D () C:\ProgramData\Apple
2014-03-09 16:55 - 2014-03-09 16:55 - 00000000 ____D () C:\Program Files (x86)\Apple Software Update
2014-03-09 16:48 - 2014-03-09 16:48 - 00000000 ____D () C:\Users\RedWidow\Desktop\Audiosurfer
2014-03-09 16:29 - 2014-03-09 16:29 - 00000221 _____ () C:\Users\RedWidow\Desktop\Audiosurf.url
2014-03-09 12:19 - 2014-03-09 12:19 - 00000000 _____ () C:\Users\RedWidow\Desktop\Neues Textdokument.txt
2014-03-09 08:52 - 2013-10-27 20:46 - 00000000 ____D () C:\Users\RedWidow\AppData\Local\Spotify
2014-03-08 21:30 - 2014-03-08 21:30 - 00000924 _____ () C:\Users\Public\Desktop\osu!.lnk
2014-03-08 15:39 - 2014-03-08 15:39 - 00000019 _____ () C:\Users\RedWidow\Desktop\S P.txt
2014-03-08 13:33 - 2014-03-08 13:33 - 00000000 ____D () C:\Users\RedWidow\AppData\Local\Conduit
2014-03-08 13:33 - 2014-03-08 13:33 - 00000000 ____D () C:\ProgramData\Conduit
2014-03-08 13:31 - 2013-10-08 17:02 - 00000000 ____D () C:\ProgramData\CyberLink
2014-03-08 13:30 - 2014-02-14 18:31 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-03-08 10:04 - 2014-03-07 15:42 - 00000250 _____ () C:\Users\RedWidow\Desktop\hi.txt
2014-03-08 08:13 - 2014-03-07 14:59 - 00001444 _____ () C:\Users\RedWidow\Desktop\cmd.lnk
2014-03-07 17:20 - 2014-03-07 17:20 - 00001940 _____ () C:\Users\Public\Desktop\LOL Recorder.lnk
2014-03-07 14:59 - 2014-03-07 14:55 - 00001601 _____ () C:\Users\RedWidow\Desktop\see ya fucking nerds!.lnk
2014-03-07 14:51 - 2014-03-07 14:51 - 00001237 _____ () C:\Users\RedWidow\Desktop\cheatengine.dll.rar
2014-03-07 14:42 - 2014-03-07 14:42 - 00001301 _____ () C:\Users\RedWidow\Desktop\shutdown.lnk
2014-03-05 21:52 - 2014-03-05 21:52 - 00000000 ____D () C:\Users\RedWidow\AppData\Roaming\Sinvise Systems
2014-03-05 21:52 - 2014-03-05 21:52 - 00000000 ____D () C:\Program Files (x86)\Sinvise Systems
2014-03-05 15:48 - 2013-12-07 22:49 - 00000000 ____D () C:\Users\RedWidow\Desktop\world
2014-03-02 22:08 - 2014-02-28 18:50 - 00000930 _____ () C:\Users\RedWidow\AppData\Local\_settings.ini
2014-03-02 17:31 - 2014-03-02 17:31 - 00001944 _____ () C:\Users\Public\Desktop\Metin2.lnk
2014-03-02 16:38 - 2014-03-02 16:38 - 00001106 _____ () C:\Users\Public\Desktop\Gameforge Live.lnk
2014-03-02 16:38 - 2014-03-02 16:38 - 00000000 ____D () C:\Users\RedWidow\AppData\Local\Gameforge4d
2014-03-02 10:42 - 2014-03-02 10:42 - 00013245 _____ () C:\Users\RedWidow\Desktop\Maus - Verknüpfung (2).lnk
2014-03-01 08:17 - 2013-11-29 17:35 - 00000000 ____D () C:\Users\RedWidow\AppData\Roaming\uTorrent
2014-03-01 07:05 - 2014-03-14 14:11 - 23133696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-03-01 06:17 - 2014-03-14 14:11 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-03-01 06:16 - 2014-03-14 14:11 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-03-01 05:58 - 2014-03-14 14:11 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-03-01 05:52 - 2014-03-14 14:11 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-03-01 05:51 - 2014-03-14 14:11 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-03-01 05:42 - 2014-03-14 14:11 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-03-01 05:40 - 2014-03-14 14:11 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-03-01 05:37 - 2014-03-14 14:11 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-03-01 05:33 - 2014-03-14 14:11 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-03-01 05:33 - 2014-03-14 14:11 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-03-01 05:32 - 2014-03-14 14:11 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-03-01 05:30 - 2014-03-14 14:11 - 17074688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-03-01 05:23 - 2014-03-14 14:11 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-03-01 05:17 - 2014-03-14 14:11 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-03-01 05:11 - 2014-03-14 14:11 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-03-01 05:02 - 2014-03-14 14:11 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-03-01 04:54 - 2014-03-14 14:11 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-03-01 04:52 - 2014-03-14 14:11 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-03-01 04:51 - 2014-03-14 14:11 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-03-01 04:47 - 2014-03-14 14:11 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-03-01 04:43 - 2014-03-14 14:11 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-03-01 04:43 - 2014-03-14 14:11 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-03-01 04:42 - 2014-03-14 14:11 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-03-01 04:40 - 2014-03-14 14:11 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-03-01 04:38 - 2014-03-14 14:11 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-03-01 04:37 - 2014-03-14 14:11 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-03-01 04:35 - 2014-03-14 14:11 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-03-01 04:18 - 2014-03-14 14:11 - 13051904 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-03-01 04:16 - 2014-03-14 14:11 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-03-01 04:14 - 2014-03-14 14:11 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-03-01 04:10 - 2014-03-14 14:11 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-03-01 04:03 - 2014-03-14 14:11 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-03-01 04:00 - 2014-03-14 14:11 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-03-01 03:57 - 2014-03-14 14:11 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-03-01 03:38 - 2014-03-14 14:11 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-03-01 03:32 - 2014-03-14 14:11 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-03-01 03:27 - 2014-03-14 14:11 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-03-01 03:25 - 2014-03-14 14:11 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-03-01 03:25 - 2014-03-14 14:11 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-02-28 08:22 - 2014-02-28 08:22 - 00000000 ____D () C:\Users\RedWidow\AppData\Roaming\steamvr
2014-02-28 03:02 - 2013-10-01 15:17 - 01592628 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-02-28 03:02 - 2009-07-14 18:58 - 00699092 _____ () C:\Windows\system32\perfh007.dat
2014-02-28 03:02 - 2009-07-14 18:58 - 00149232 _____ () C:\Windows\system32\perfc007.dat
2014-02-28 03:02 - 2009-07-14 06:13 - 01592628 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-27 17:02 - 2013-11-06 16:54 - 00000000 ____D () C:\Users\RedWidow\AppData\Roaming\.technic
2014-02-27 16:56 - 2014-02-27 16:56 - 00013245 _____ () C:\Users\RedWidow\Desktop\Maus - Verknüpfung.lnk
2014-02-27 16:51 - 2014-02-27 16:40 - 00000000 ____D () C:\Users\RedWidow\Desktop\CSS
2014-02-27 14:33 - 2014-02-27 14:33 - 00000000 _____ () C:\Users\RedWidow\Desktop\INSTALOK.txt
2014-02-27 12:19 - 2014-02-27 12:16 - 00000000 ____D () C:\Users\RedWidow\AppData\Roaming\TrueCrypt
2014-02-27 12:15 - 2014-02-27 12:15 - 00231376 _____ (TrueCrypt Foundation) C:\Windows\system32\Drivers\truecrypt.sys
2014-02-27 12:15 - 2014-02-27 12:15 - 00000914 _____ () C:\Users\Public\Desktop\TrueCrypt.lnk
2014-02-27 12:02 - 2014-02-27 12:02 - 00000219 _____ () C:\Users\RedWidow\Desktop\Team Fortress 2.url
2014-02-27 11:55 - 2014-02-27 11:54 - 00000000 ____D () C:\Program Files (x86)\LogMeIn Hamachi
2014-02-26 21:17 - 2014-02-26 21:17 - 00001916 _____ () C:\Users\RedWidow\Desktop\Start BlueStacks.lnk
2014-02-26 21:04 - 2014-02-26 21:04 - 00002167 _____ () C:\Users\RedWidow\Desktop\Clash of Clans.lnk
2014-02-26 20:55 - 2014-02-26 20:55 - 00001846 _____ () C:\Users\Public\Desktop\Start BlueStacks.lnk
2014-02-26 20:55 - 2014-02-26 20:55 - 00001821 _____ () C:\Users\Public\Desktop\Apps.lnk
2014-02-26 20:55 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Public\Libraries
2014-02-26 20:54 - 2014-02-26 20:54 - 00000000 ____D () C:\ProgramData\BlueStacks
2014-02-26 20:54 - 2014-02-24 17:59 - 00000000 ____D () C:\ProgramData\BlueStacksSetup
2014-02-26 20:53 - 2014-02-26 20:53 - 00000000 ____D () C:\Windows\system32\appmgmt
2014-02-25 17:54 - 2014-02-25 17:54 - 00000000 ____D () C:\Program Files\Common Files\INCA Shared
2014-02-25 17:50 - 2014-02-25 17:50 - 00001569 _____ () C:\Users\Public\Desktop\Flyff.lnk
2014-02-24 18:09 - 2014-02-24 18:09 - 00000000 ____D () C:\Users\RedWidow\Desktop\CMD-ExE
2014-02-24 18:06 - 2014-02-24 18:05 - 00000000 __RHD () C:\Users\RedWidow\Desktop\Stealth
2014-02-23 22:23 - 2014-03-06 16:07 - 00000515 _____ () C:\Users\RedWidow\Desktop\Read Me.txt
2014-02-23 10:46 - 2014-02-14 15:32 - 00000023 _____ () C:\Windows\BlendSettings.ini

Some content of TEMP:
====================
C:\Users\RedWidow\AppData\Local\Temp\ose00000.exe
C:\Users\RedWidow\AppData\Local\Temp\Tsu4339085D.dll


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-03-14 21:16

==================== End Of Log ============================
         

--- --- ---

--- --- ---

Hallo!
Deine Frage ob der KL noch da ist, setzt voraus, dass er mal da war. Hast Du ein derartiges Schadprogramm mit einem Scanner gefunden und/oder gelöscht? Wenn ja, kannst Du bitte die Logs posten?

Weiter gibst Du an, dass jemand Kontrolle über Deine Maus hat. Wie äußert sich das genau?


Wir fangen so an:


Schritt 1

Bitte lasse die Datei aus der Code-Box bei Virustotal überprüfen.

• Klicke auf Wählen Sie eine
• Kopiere nun folgendes in die Suchleiste
  

  C:\Windows\system32\AMBSpiE.exe
           

• und klicke auf Öffnen.
• Klicke auf Scannen!.
• Warte bitte bis die Datei vollständig hochgeladen wurde. Solltest Du folgende Meldung bekommen
  
  klicke auf Neu analysieren.
• Warte bis dir das Analysedatum angezeigt wird und der Scan abgeschlossen ist.
• Kopiere den Link aus der Browser-Adresszeile und poste ihn hier.

Wiederhole die selben Schritte mit folgender Datei:

C:\Windows\SysWOW64\srvany.exe
         

Schritt 2

Downloade dir bitte Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.

• Starte bitte die mbar.exe.
• Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
• Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
• Klicke auf den CleanUp Button und erlaube den Neustart.
• Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
• Nach dem Neustart starte die mbar.exe erneut.
• Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.

Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers


Poste mir bitte die virustotal-Links und das Log von Malwarebytes Antirootkit

So ich scanne grade man System mit Malwarebytes Antirootkit,meine Maus wurde nach unten gezogen er hat aber nicht irg. was angeklickt.Zu den Virustotal files ich finde diese Files nicht mehr,ich glaubesie wurden von Malwarebytes Anti-Malware gelöscht. Log :

 Malwarebytes Anti-Malware  (Test) 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2014.03.21.02

Windows 7 Service Pack 1 x64 NTFS (Abgesichertenmodus/Netzwerkfähig)
Internet Explorer 11.0.9600.16521
RedWidow :: REDWIDOW-PC [Administrator]

Schutz: Deaktiviert

21.03.2014 12:22:05
mbam-log-2014-03-21 (12-22-05).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|F:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 458384
Laufzeit: 1 Stunde(n), 7 Minute(n), 17 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|BackgroundContainer (PUP.Optional.Conduit) -> Daten: "C:\Windows\SysWOW64\Rundll32.exe" "C:\Users\RedWidow\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll",DllRun -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 2
C:\Users\RedWidow\AppData\Local\Google\Chrome\User Data\Default\File System\001\t\00\00000000 (PUP.Optional.InstalleRex) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\RedWidow\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XSWP5180\statisticsstub[1].exe (PUP.Optional.Conduit.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
         

Der Malwarebytes Antirootkit Log wird direkt gepostet wenn er fertig ist

Hi, es fehlt noch das Log vom Rootkit-Scan...

Hi,

ich hab schon länger keine Antwort mehr von Dir erhalten. Brauchst du noch Hilfe?

Hinweis: Wir sind noch nicht fertig! Sollte ich die nächsten 24h keine Nachricht von Dir bekommen, lösche ich das Thema aus meinen Abos und werde daher über Änderungen oder Beiträge nicht weiter informiert.