Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung

Log-Analyse und Auswertung: Laptop extrem langsam; Aufpoppendes Programm bei Systemstart verschwindet gleich wieder

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.

Antwort
Alt 06.04.2014, 15:29   #1
mogri
 
Laptop extrem langsam; Aufpoppendes Programm bei Systemstart verschwindet gleich wieder - Standard

Laptop extrem langsam; Aufpoppendes Programm bei Systemstart verschwindet gleich wieder



Hallo zusammen,
habe folgendes Problem: Mein Laptop ist extrem langsam. Wenn ich in einem Programm arbeite, z.B. Word etc. dann dauert der Programmstart plötzlich sehr lange, wenn dann alles geladen ist, funktionierts relativ flüssig. Möchte ich dann zu einem anderen bereits geöffneten Programm wechseln, z.B. Firefox, dann dauert dieser Wechsel extrem lange und es passiert nichts bis dieses Programm dann bereit ist.

Außerdem habe ich beobachtet, dass wenn ich das System Starte, was auch eine relativ langwierige Sache ist, bevor die Desktopikons angezeigt werden ein Programm oder Ordner ganz kurz aufpoppt, bevor man aber etwas erkennen kann schon wieder verschwunden ist und dann erst die Ikons geladen werden.

Habe dann etwas panisch MBAM laufen lassen, welches 1 PUP gefunden hat welches ich in Quarantäne verschieben hab lassen. Log findet sich unter Punkt 4
Hier die geforderten Logs:
1. Defogger
Code:
ATTFilter
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 11:14 on 06/04/2014 (Moritz)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
HKCU:DAEMON Tools Lite -> Removed

Checking for services/drivers...


-=E.O.F=-
         
2a) FRST Scan result

FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014
Ran by Moritz (administrator) on MORITZ-PC on 06-04-2014 11:16:12
Running from C:\Users\Moritz Eingeschränkt\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal


==================== Processes (Whitelisted) =================

(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieSvc.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(ABBYY (BIT Software)) C:\Program Files (x86)\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Garmin Ltd or its subsidiaries) C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe
() C:\Program Files (x86)\Hardcopy\hcdll2_ex_Win32.exe
() C:\Program Files (x86)\Hardcopy\hcdll2_ex_x64.exe
(Panda Security) C:\Program Files (x86)\Panda USB Vaccine\USBVaccine.exe
(SafeNet Inc.) C:\Windows\system32\hasplms.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\VS7Debug\mdm.exe
() C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieCtrl.exe
(SlySoft, Inc.) C:\Program Files (x86)\SlySoft\AnyDVD\AnyDVDtray.exe
(Dropbox, Inc.) C:\Users\Moritz Eingeschränkt\AppData\Roaming\Dropbox\bin\Dropbox.exe
(CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE
(Sony Corporation) C:\Program Files (x86)\Sony\Content Transfer\ContentTransferWMDetector.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
() C:\Program Files (x86)\SlySoft\AnyDVD\ADvdDiscHlp64.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
(Microsoft Corporation) C:\Windows\System32\alg.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [IntelWireless] - C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [1933584 2011-01-05] (Intel(R) Corporation)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2392360 2010-10-08] (Synaptics Incorporated)
HKLM\...\Run: [BCSSync] - C:\Program Files\Microsoft Office\Office14\BCSSync.exe [108144 2012-11-05] (Microsoft Corporation)
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [472984 2013-09-25] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [CanonSolutionMenuEx] - C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE [1316248 2010-12-02] (CANON INC.)
HKLM-x32\...\Run: [SwitchBoard] - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS5ServiceManager] - C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe [406992 2010-02-22] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [ContentTransferWMDetector.exe] - C:\Program Files (x86)\Sony\Content Transfer\ContentTransferWMDetector.exe [583016 2009-11-19] (Sony Corporation)
HKLM-x32\...\Run: [AvastUI.exe] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [3854640 2014-04-06] (AVAST Software)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\RunOnce: [20131224] - C:\Program Files\AVAST Software\Avast\setup\emupdate\3bf24771-0b7b-4033-ab0b-877ab5e62b85.exe /check [181136 2014-03-28] (AVAST Software)
HKLM-x32\...\RunOnce: [ Malwarebytes Anti-Malware  (cleanup)] - "C:\ProgramData\Malwarebytes\ Malwarebytes Anti-Malware \mbamdor.exe" "C:\ProgramData\Malwarebytes\ Malwarebytes Anti-Malware " [54072 2014-03-05] (Malwarebytes Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-686350309-1681273199-943402144-1000\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20922016 2014-02-10] (Skype Technologies S.A.)
HKU\S-1-5-21-686350309-1681273199-943402144-1000\...\Run: [GarminExpressTrayApp] - C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [1098072 2013-03-27] (Garmin Ltd or its subsidiaries)
HKU\S-1-5-21-686350309-1681273199-943402144-1000\...\Run: [AnyDVD] - C:\Program Files (x86)\SlySoft\AnyDVD\AnyDVD.exe [94296 2013-09-27] (SlySoft, Inc.)
HKU\S-1-5-21-686350309-1681273199-943402144-1000\...\Run: [MCW Startup] - C:\Program Files (x86)\Monitor Calibration Wizard\MCW.exe [321024 2002-12-20] ()
HKU\S-1-5-21-686350309-1681273199-943402144-1000\...\Policies\system: [LogonHoursAction] 2
HKU\S-1-5-21-686350309-1681273199-943402144-1000\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\S-1-5-21-686350309-1681273199-943402144-1001\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20922016 2014-02-10] (Skype Technologies S.A.)
HKU\S-1-5-21-686350309-1681273199-943402144-1001\...\Run: [SandboxieControl] - C:\Program Files\Sandboxie\SbieCtrl.exe [759496 2014-01-17] (Sandboxie Holdings, LLC)
HKU\S-1-5-21-686350309-1681273199-943402144-1001\...\Run: [AdobeBridge] - [X]
HKU\S-1-5-21-686350309-1681273199-943402144-1001\...\Run: [DAEMON Tools Lite] - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3675352 2013-10-28] (Disc Soft Ltd)
HKU\S-1-5-21-686350309-1681273199-943402144-1001\...\Run: [AnyDVD] - C:\Program Files (x86)\SlySoft\AnyDVD\AnyDVDtray.exe [7417944 2013-09-27] (SlySoft, Inc.)
HKU\S-1-5-21-686350309-1681273199-943402144-1001\...\Run: [MCW Startup] - C:\Program Files (x86)\Monitor Calibration Wizard\MCW.exe [321024 2002-12-20] ()
HKU\S-1-5-21-686350309-1681273199-943402144-1001\...\Policies\system: [LogonHoursAction] 2
HKU\S-1-5-21-686350309-1681273199-943402144-1001\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
Startup: C:\Users\Moritz Eingeschränkt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled ()
Startup: C:\Users\Moritz Eingeschränkt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Moritz\AppData\Roaming\Dropbox\bin\Dropbox.exe (No File)
GroupPolicyUsers\S-1-5-21-686350309-1681273199-943402144-1016\User: Group Policy restriction detected <======= ATTENTION
GroupPolicyUsers\S-1-5-21-686350309-1681273199-943402144-1001\User: Group Policy restriction detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.startfenster.de
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x2AE3486357C5CC01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://search.msn.com/spbasic.htm
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM - DefaultScope {D225BE3E-3581-4EA5-ACF9-2687307E2B07} URL = hxxp://www.sm.de/?q={searchTerms}
SearchScopes: HKLM - {D225BE3E-3581-4EA5-ACF9-2687307E2B07} URL = hxxp://www.sm.de/?q={searchTerms}
SearchScopes: HKCU - DefaultScope {D225BE3E-3581-4EA5-ACF9-2687307E2B07} URL = hxxp://www.sm.de/?q={searchTerms}
SearchScopes: HKCU - {D225BE3E-3581-4EA5-ACF9-2687307E2B07} URL = hxxp://www.sm.de/?q={searchTerms}
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 83.169.184.161 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\Moritz\AppData\Roaming\Mozilla\Firefox\Profiles\d19ehztj.default
FF DefaultSearchEngine: SuchMaschine
FF SearchEngineOrder.1: SuchMaschine
FF SelectedSearchEngine: SuchMaschine
FF Homepage: hxxp://www.startfenster.de
FF Keyword.URL: hxxp://www.sm.de/?q=
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()
FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin: @videolan.org/vlc,version=2.1.1 - C:\Program Files\VideoLAN\VLC\npvlc.dll No File
FF Plugin: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF Plugin-x32: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin-x32: @videolan.org/vlc,version=1.1.11 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.0.1 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin HKCU: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF SearchPlugin: C:\Users\Moritz\AppData\Roaming\Mozilla\Firefox\Profiles\d19ehztj.default\searchplugins\search_engine.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Adblock Plus - C:\Users\Moritz\AppData\Roaming\Mozilla\Firefox\Profiles\d19ehztj.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2011-12-28]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2012-04-22]

==================== Services (Whitelisted) =================

R2 ABBYY.Licensing.FineReader.Professional.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe [660768 2007-12-06] (ABBYY (BIT Software))
R3 AeLookupSvc; C:\Windows\SysWOW64\aelupsvc.dll [72192 2009-07-14] (Microsoft Corporation)
R3 ALG; C:\Windows\SysWOW64\alg.exe [79360 2009-07-14] (Microsoft Corporation)
R2 AudioSrv; C:\Windows\SysWOW64\Audiosrv.dll [679424 2010-11-21] (Microsoft Corporation)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-04-06] (AVAST Software)
R2 BITS; C:\Windows\SysWOW64\qmgr.dll [849920 2010-11-21] (Microsoft Corporation)
S3 CertPropSvc; C:\Windows\SysWOW64\certprop.dll [80384 2010-11-21] (Microsoft Corporation)
S3 Fax; C:\Windows\SysWOW64\fxssvc.exe [689152 2010-11-21] (Microsoft Corporation)
R2 Garmin Core Update Service; C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [185688 2013-03-27] (Garmin Ltd or its subsidiaries)
R2 hasplms; C:\Windows\system32\hasplms.exe [4412872 2012-08-23] (SafeNet Inc.)
R2 iphlpsvc; C:\Windows\SysWOW64\iphlpsvc.dll [569344 2010-11-21] (Microsoft Corporation)
S2 KMService; C:\Windows\SysWOW64\srvany.exe [8192 2013-03-27] ()
R2 LanmanServer; C:\Windows\SysWOW64\srvsvc.dll [236032 2010-11-21] (Microsoft Corporation)
S3 MSDTC; C:\Windows\SysWOW64\msdtc.exe [141824 2009-07-14] (Microsoft Corporation)
S3 MSiSCSI; C:\Windows\SysWOW64\iscsiexe.dll [156672 2009-07-14] (Microsoft Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2011-01-05] ()
R2 PassThru Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [167424 2012-12-07] ()
S3 RasAuto; C:\Windows\SysWOW64\rasauto.dll [99328 2009-07-14] (Microsoft Corporation)
R3 RasMan; C:\Windows\SysWOW64\rasmans.dll [344064 2010-11-21] (Microsoft Corporation)
S3 RpcLocator; C:\Windows\SysWOW64\locator.exe [10240 2009-07-14] (Microsoft Corporation)
R2 SbieSvc; C:\Program Files\Sandboxie\SbieSvc.exe [187592 2014-01-17] (Sandboxie Holdings, LLC)
R2 Schedule; C:\Windows\SysWOW64\schedsvc.dll [1110016 2010-11-21] (Microsoft Corporation)
S3 SCPolicySvc; C:\Windows\SysWOW64\certprop.dll [80384 2010-11-21] (Microsoft Corporation)
S3 SNMPTRAP; C:\Windows\SysWOW64\snmptrap.exe [14336 2009-07-14] (Microsoft Corporation)
R2 Spooler; C:\Windows\SysWOW64\spoolsv.exe [559104 2010-11-21] (Microsoft Corporation)
S2 sppsvc; C:\Windows\SysWOW64\sppsvc.exe [3524608 2010-11-21] (Microsoft Corporation)
S3 TermService; C:\Windows\SysWOW64\termsrv.dll [680960 2010-11-21] (Microsoft Corporation)
S3 UI0Detect; C:\Windows\SysWOW64\UI0Detect.exe [40960 2009-07-14] (Microsoft Corporation)
S3 vds; C:\Windows\SysWOW64\vds.exe [533504 2010-11-21] (Microsoft Corporation)
S3 VSS; C:\Windows\SysWOW64\vssvc.exe [1600512 2010-11-21] (Microsoft Corporation)
S3 wbengine; C:\Windows\SysWOW64\wbengine.exe [1504256 2010-11-21] (Microsoft Corporation)
R2 Winmgmt; C:\Windows\SysWOW64\wbem\WMIsvc.dll [242688 2009-07-14] (Microsoft Corporation)
S3 wmiApSrv; C:\Windows\SysWOW64\wbem\WmiApSrv.exe [203264 2009-07-14] (Microsoft Corporation)
R2 wuauserv; C:\Windows\SysWOW64\wuaueng.dll [2420736 2010-11-21] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

R0 ACPI; C:\Windows\SysWOW64\drivers\ACPI.sys [334208 2010-11-21] (Microsoft Corporation)
R0 amdxata; C:\Windows\SysWOW64\drivers\amdxata.sys [27008 2011-03-11] (Advanced Micro Devices)
R3 AnyDVD; C:\Windows\System32\Drivers\AnyDVD.sys [139352 2013-07-31] (SlySoft, Inc.)
R3 AnyDVD; C:\Windows\SysWOW64\Drivers\AnyDVD.sys [139352 2013-07-31] (SlySoft, Inc.)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-04-06] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-04-06] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-04-06] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2014-04-06] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2014-04-06] (AVAST Software)
R3 aswStm; C:\Windows\system32\drivers\aswStm.sys [84816 2014-04-06] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208928 2014-04-06] ()
R3 AsyncMac; C:\Windows\SysWOW64\DRIVERS\asyncmac.sys [23040 2009-07-14] (Microsoft Corporation)
R0 atapi; C:\Windows\SysWOW64\drivers\atapi.sys [24128 2009-07-14] (Microsoft Corporation)
S3 b57nd60a; C:\Windows\SysWOW64\DRIVERS\b57nd60a.sys [270848 2009-06-10] (Broadcom Corporation)
S4 Beep; C:\Windows\SysWow64\Drivers\Beep.sys [6656 2009-07-14] (Microsoft Corporation)
R1 blbdrive; C:\Windows\SysWOW64\DRIVERS\blbdrive.sys [45056 2009-07-14] (Microsoft Corporation)
R3 bowser; C:\Windows\SysWOW64\DRIVERS\bowser.sys [90624 2011-02-23] (Microsoft Corporation)
R4 cdfs; C:\Windows\SysWOW64\DRIVERS\cdfs.sys [92160 2009-07-14] (Microsoft Corporation)
R1 cdrom; C:\Windows\SysWOW64\DRIVERS\cdrom.sys [147456 2010-11-21] (Microsoft Corporation)
R0 CLFS; C:\Windows\SysWOW64\CLFS.sys [367696 2009-07-14] (Microsoft Corporation)
R3 CmBatt; C:\Windows\SysWOW64\DRIVERS\CmBatt.sys [17664 2009-07-14] (Microsoft Corporation)
R0 CNG; C:\Windows\SysWOW64\Drivers\cng.sys [459248 2010-11-21] (Microsoft Corporation)
R0 Compbatt; C:\Windows\SysWOW64\DRIVERS\compbatt.sys [21584 2009-07-14] (Microsoft Corporation)
R3 CompositeBus; C:\Windows\SysWOW64\DRIVERS\CompositeBus.sys [38912 2010-11-21] (Microsoft Corporation)
R1 CSC; C:\Windows\SysWOW64\drivers\csc.sys [514560 2010-11-21] (Microsoft Corporation)
R1 DfsC; C:\Windows\SysWOW64\Drivers\dfsc.sys [102400 2010-11-21] (Microsoft Corporation)
R1 discache; C:\Windows\SysWOW64\drivers\discache.sys [40448 2009-07-14] (Microsoft Corporation)
R0 Disk; C:\Windows\SysWOW64\drivers\disk.sys [73280 2009-07-14] (Microsoft Corporation)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2013-12-17] (Disc Soft Ltd)
S3 exfat; C:\Windows\SysWow64\Drivers\exfat.sys [195072 2009-07-14] (Microsoft Corporation)
R3 fastfat; C:\Windows\SysWow64\Drivers\fastfat.sys [204800 2009-07-14] (Microsoft Corporation)
R0 FileInfo; C:\Windows\SysWOW64\drivers\fileinfo.sys [70224 2009-07-14] (Microsoft Corporation)
S3 Filetrace; C:\Windows\SysWOW64\drivers\filetrace.sys [34304 2009-07-14] (Microsoft Corporation)
R0 FltMgr; C:\Windows\SysWOW64\drivers\fltmgr.sys [289664 2010-11-21] (Microsoft Corporation)
S3 FsDepends; C:\Windows\SysWOW64\drivers\FsDepends.sys [55376 2009-07-14] (Microsoft Corporation)
U0 Fs_Rec; C:\Windows\SysWow64\Drivers\Fs_Rec.sys [23104 2009-07-14] (Microsoft Corporation)
R0 fvevol; C:\Windows\SysWOW64\DRIVERS\fvevol.sys [223248 2010-11-21] (Microsoft Corporation)
R2 hardlock; C:\Windows\system32\drivers\hardlock.sys [323584 2012-10-06] (SafeNet Inc.)
R3 HdAudAddService; C:\Windows\SysWOW64\drivers\HdAudio.sys [350208 2010-11-21] (Microsoft Corporation)
R3 HDAudBus; C:\Windows\SysWOW64\DRIVERS\HDAudBus.sys [122368 2010-11-21] (Microsoft Corporation)
R3 HidUsb; C:\Windows\SysWOW64\DRIVERS\hidusb.sys [30208 2010-11-21] (Microsoft Corporation)
R3 HTTP; C:\Windows\SysWOW64\drivers\HTTP.sys [753664 2010-11-21] (Microsoft Corporation)
R0 hwpolicy; C:\Windows\SysWOW64\drivers\hwpolicy.sys [14720 2010-11-21] (Microsoft Corporation)
R3 i8042prt; C:\Windows\SysWOW64\DRIVERS\i8042prt.sys [105472 2009-07-14] (Microsoft Corporation)
R3 igfx; C:\Windows\SysWOW64\DRIVERS\igdkmd64.sys [12262336 2011-03-25] (Intel Corporation)
R3 IntcDAud; C:\Windows\SysWOW64\DRIVERS\IntcDAud.sys [317440 2010-10-15] (Intel(R) Corporation)
R3 intelppm; C:\Windows\SysWOW64\DRIVERS\intelppm.sys [62464 2009-07-14] (Microsoft Corporation)
S3 IpFilterDriver; C:\Windows\SysWOW64\DRIVERS\ipfltdrv.sys [82944 2010-11-21] (Microsoft Corporation)
R3 IPNAT; C:\Windows\SysWOW64\drivers\ipnat.sys [116224 2009-07-14] (Microsoft Corporation)
S3 IRENUM; C:\Windows\SysWOW64\drivers\irenum.sys [17920 2009-07-14] (Microsoft Corporation)
R3 kbdclass; C:\Windows\SysWOW64\DRIVERS\kbdclass.sys [50768 2009-07-14] (Microsoft Corporation)
R0 KSecDD; C:\Windows\SysWOW64\Drivers\ksecdd.sys [95616 2010-11-21] (Microsoft Corporation)
R0 KSecPkg; C:\Windows\SysWOW64\Drivers\ksecpkg.sys [152960 2010-11-21] (Microsoft Corporation)
R3 L1C; C:\Windows\SysWOW64\DRIVERS\L1C62x64.sys [169584 2011-04-20] (Atheros Communications, Inc.)
R2 lltdio; C:\Windows\SysWOW64\DRIVERS\lltdio.sys [60928 2009-07-14] (Microsoft Corporation)
R3 ManyCam; C:\Windows\System32\DRIVERS\mcvidrv.sys [42016 2013-11-27] (Visicom Media Inc.)
R3 mcaudrv_simple; C:\Windows\System32\drivers\mcaudrv_x64.sys [35232 2013-12-06] (Visicom Media Inc.)
R3 MEIx64; C:\Windows\SysWOW64\DRIVERS\HECIx64.sys [56344 2010-10-20] (Intel Corporation)
S3 Modem; C:\Windows\SysWOW64\drivers\modem.sys [40448 2009-07-14] (Microsoft Corporation)
R3 monitor; C:\Windows\SysWOW64\DRIVERS\monitor.sys [30208 2009-07-14] (Microsoft Corporation)
R3 mouclass; C:\Windows\SysWOW64\DRIVERS\mouclass.sys [49216 2009-07-14] (Microsoft Corporation)
R3 mouhid; C:\Windows\SysWOW64\DRIVERS\mouhid.sys [31232 2009-07-14] (Microsoft Corporation)
R0 mountmgr; C:\Windows\SysWOW64\drivers\mountmgr.sys [94592 2010-11-21] (Microsoft Corporation)
R3 mpsdrv; C:\Windows\SysWOW64\drivers\mpsdrv.sys [77312 2009-07-14] (Microsoft Corporation)
R3 mrxsmb; C:\Windows\SysWOW64\DRIVERS\mrxsmb.sys [158208 2011-04-27] (Microsoft Corporation)
R3 mrxsmb10; C:\Windows\SysWOW64\DRIVERS\mrxsmb10.sys [288768 2011-07-09] (Microsoft Corporation)
R3 mrxsmb20; C:\Windows\SysWOW64\DRIVERS\mrxsmb20.sys [128000 2011-04-27] (Microsoft Corporation)
R0 msahci; C:\Windows\SysWOW64\drivers\msahci.sys [31104 2010-11-21] (Microsoft Corporation)
R1 Msfs; C:\Windows\SysWow64\Drivers\Msfs.sys [26112 2009-07-14] (Microsoft Corporation)
R0 msisadrv; C:\Windows\SysWOW64\drivers\msisadrv.sys [15424 2009-07-14] (Microsoft Corporation)
S3 MSKSSRV; C:\Windows\SysWOW64\drivers\MSKSSRV.sys [11136 2009-07-14] (Microsoft Corporation)
S3 MSPCLOCK; C:\Windows\SysWOW64\drivers\MSPCLOCK.sys [7168 2009-07-14] (Microsoft Corporation)
S3 MSPQM; C:\Windows\SysWOW64\drivers\MSPQM.sys [6784 2009-07-14] (Microsoft Corporation)
S3 MsRPC; C:\Windows\SysWow64\Drivers\MsRPC.sys [366976 2010-11-21] (Microsoft Corporation)
R1 mssmbios; C:\Windows\SysWOW64\DRIVERS\mssmbios.sys [32320 2009-07-14] (Microsoft Corporation)
S3 MSTEE; C:\Windows\SysWOW64\drivers\MSTEE.sys [8064 2009-07-14] (Microsoft Corporation)
R0 Mup; C:\Windows\SysWOW64\Drivers\mup.sys [60496 2009-07-14] (Microsoft Corporation)
R3 NativeWifiP; C:\Windows\SysWOW64\DRIVERS\nwifi.sys [318976 2009-07-14] (Microsoft Corporation)
R0 NDIS; C:\Windows\SysWOW64\drivers\ndis.sys [951680 2010-11-21] (Microsoft Corporation)
S3 NdisCap; C:\Windows\SysWOW64\DRIVERS\ndiscap.sys [35328 2009-07-14] (Microsoft Corporation)
R3 NdisTapi; C:\Windows\SysWOW64\DRIVERS\ndistapi.sys [24064 2009-07-14] (Microsoft Corporation)
R3 Ndisuio; C:\Windows\SysWOW64\DRIVERS\ndisuio.sys [56832 2010-11-21] (Microsoft Corporation)
R3 NdisWan; C:\Windows\SysWOW64\DRIVERS\ndiswan.sys [164352 2010-11-21] (Microsoft Corporation)
R3 NDProxy; C:\Windows\SysWow64\Drivers\NDProxy.sys [57856 2010-11-21] (Microsoft Corporation)
R1 NetBIOS; C:\Windows\SysWOW64\DRIVERS\netbios.sys [44544 2009-07-14] (Microsoft Corporation)
R1 NetBT; C:\Windows\SysWOW64\DRIVERS\netbt.sys [261632 2010-11-21] (Microsoft Corporation)
R3 NETwNs64; C:\Windows\SysWOW64\DRIVERS\NETwNs64.sys [8507392 2011-01-04] (Intel Corporation)
R1 Npfs; C:\Windows\SysWow64\Drivers\Npfs.sys [44032 2009-07-14] (Microsoft Corporation)
R1 nsiproxy; C:\Windows\SysWOW64\drivers\nsiproxy.sys [24576 2009-07-14] (Microsoft Corporation)
R3 Ntfs; C:\Windows\SysWow64\Drivers\Ntfs.sys [1659776 2011-03-11] (Microsoft Corporation)
R1 Null; C:\Windows\SysWow64\Drivers\Null.sys [6144 2009-07-14] (Microsoft Corporation)
R0 partmgr; C:\Windows\SysWOW64\drivers\partmgr.sys [75136 2010-11-21] (Microsoft Corporation)
R0 pci; C:\Windows\SysWOW64\drivers\pci.sys [184704 2010-11-21] (Microsoft Corporation)
R0 pcw; C:\Windows\SysWOW64\drivers\pcw.sys [50768 2009-07-14] (Microsoft Corporation)
R2 PEAUTH; C:\Windows\SysWOW64\drivers\peauth.sys [651264 2009-07-14] (Microsoft Corporation)
R3 PptpMiniport; C:\Windows\SysWOW64\DRIVERS\raspptp.sys [111104 2010-11-21] (Microsoft Corporation)
R1 Psched; C:\Windows\SysWOW64\DRIVERS\pacer.sys [131584 2010-11-21] (Microsoft Corporation)
S3 RasAcd; C:\Windows\SysWOW64\DRIVERS\rasacd.sys [14848 2009-07-14] (Microsoft Corporation)
R3 RasAgileVpn; C:\Windows\SysWOW64\DRIVERS\AgileVpn.sys [60416 2009-07-14] (Microsoft Corporation)
R3 Rasl2tp; C:\Windows\SysWOW64\DRIVERS\rasl2tp.sys [129536 2010-11-21] (Microsoft Corporation)
R3 RasPppoe; C:\Windows\SysWOW64\DRIVERS\raspppoe.sys [92672 2009-07-14] (Microsoft Corporation)
R3 RasSstp; C:\Windows\SysWOW64\DRIVERS\rassstp.sys [83968 2009-07-14] (Microsoft Corporation)
R1 rdbss; C:\Windows\SysWOW64\DRIVERS\rdbss.sys [309248 2010-11-21] (Microsoft Corporation)
R3 rdpbus; C:\Windows\SysWOW64\DRIVERS\rdpbus.sys [24064 2009-07-14] (Microsoft Corporation)
R1 RDPCDD; C:\Windows\SysWOW64\DRIVERS\RDPCDD.sys [7680 2009-07-14] (Microsoft Corporation)
S3 RDPDR; C:\Windows\SysWOW64\drivers\rdpdr.sys [165888 2010-11-21] (Microsoft Corporation)
R1 RDPENCDD; C:\Windows\SysWOW64\drivers\rdpencdd.sys [7680 2009-07-14] (Microsoft Corporation)
R1 RDPREFMP; C:\Windows\SysWOW64\drivers\rdprefmp.sys [8192 2009-07-14] (Microsoft Corporation)
S3 RDPWD; C:\Windows\SysWow64\Drivers\RDPWD.sys [210944 2010-11-21] (Microsoft Corporation)
R0 rdyboost; C:\Windows\SysWOW64\drivers\rdyboost.sys [213888 2010-11-21] (Microsoft Corporation)
R2 rspndr; C:\Windows\SysWOW64\DRIVERS\rspndr.sys [76800 2009-07-14] (Microsoft Corporation)
R3 SbieDrv; C:\Program Files\Sandboxie\SbieDrv.sys [202600 2014-01-17] (Sandboxie Holdings, LLC)
S3 scfilter; C:\Windows\SysWOW64\DRIVERS\scfilter.sys [29696 2010-11-21] (Microsoft Corporation)
R2 secdrv; C:\Windows\SysWow64\Drivers\secdrv.sys [23040 2009-06-10] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
S3 Smb; C:\Windows\SysWOW64\DRIVERS\smb.sys [93184 2009-07-14] (Microsoft Corporation)
R0 spldr; C:\Windows\SysWow64\Drivers\spldr.sys [19008 2009-07-14] (Microsoft Corporation)
R3 srv; C:\Windows\SysWOW64\DRIVERS\srv.sys [467456 2011-04-29] (Microsoft Corporation)
R3 srv2; C:\Windows\SysWOW64\DRIVERS\srv2.sys [410112 2011-04-29] (Microsoft Corporation)
R3 srvnet; C:\Windows\SysWOW64\DRIVERS\srvnet.sys [168448 2011-04-29] (Microsoft Corporation)
R0 storflt; C:\Windows\SysWOW64\drivers\vmstorfl.sys [46464 2010-11-21] (Microsoft Corporation)
R3 swenum; C:\Windows\SysWOW64\DRIVERS\swenum.sys [12496 2009-07-14] (Microsoft Corporation)
R3 SynTP; C:\Windows\SysWOW64\DRIVERS\SynTP.sys [1395248 2010-10-08] (Synaptics Incorporated)
R0 Tcpip; C:\Windows\SysWOW64\drivers\tcpip.sys [1923952 2011-09-29] (Microsoft Corporation)
S3 TCPIP6; C:\Windows\SysWOW64\DRIVERS\tcpip.sys [1923952 2011-09-29] (Microsoft Corporation)
R2 tcpipreg; C:\Windows\SysWOW64\drivers\tcpipreg.sys [45056 2010-11-21] (Microsoft Corporation)
S3 TDPIPE; C:\Windows\SysWOW64\drivers\tdpipe.sys [15872 2009-07-14] (Microsoft Corporation)
S3 TDTCP; C:\Windows\SysWOW64\drivers\tdtcp.sys [23552 2009-07-14] (Microsoft Corporation)
R1 tdx; C:\Windows\SysWOW64\DRIVERS\tdx.sys [119296 2010-11-21] (Microsoft Corporation)
R1 TermDD; C:\Windows\SysWOW64\DRIVERS\termdd.sys [63360 2010-11-21] (Microsoft Corporation)
S3 tssecsrv; C:\Windows\SysWOW64\DRIVERS\tssecsrv.sys [39424 2010-11-21] (Microsoft Corporation)
S3 TsUsbFlt; C:\Windows\SysWOW64\drivers\tsusbflt.sys [59392 2010-11-21] (Microsoft Corporation)
R3 tunnel; C:\Windows\SysWOW64\DRIVERS\tunnel.sys [125440 2010-11-21] (Microsoft Corporation)
R4 udfs; C:\Windows\SysWOW64\DRIVERS\udfs.sys [328192 2010-11-21] (Microsoft Corporation)
R1 UimBus; C:\Windows\System32\DRIVERS\uimx64.sys [59184 2011-11-17] (Windows (R) 2000 DDK provider)
R1 UimBus; C:\Windows\SysWOW64\DRIVERS\uimx64.sys [59184 2011-11-17] (Windows (R) 2000 DDK provider)
R1 Uim_IM; C:\Windows\System32\Drivers\Uim_IMx64.sys [572336 2011-11-17] (Paragon)
R1 Uim_IM; C:\Windows\SysWOW64\Drivers\Uim_IMx64.sys [572336 2011-11-17] (Paragon)
R1 Uim_VIM; C:\Windows\System32\Drivers\uim_vimx64.sys [352816 2011-11-17] (Paragon)
R1 Uim_VIM; C:\Windows\SysWOW64\Drivers\uim_vimx64.sys [352816 2011-11-17] (Paragon)
R3 umbus; C:\Windows\SysWOW64\DRIVERS\umbus.sys [48640 2010-11-21] (Microsoft Corporation)
R3 usbccgp; C:\Windows\SysWOW64\DRIVERS\usbccgp.sys [98816 2011-03-25] (Microsoft Corporation)
R3 usbhub; C:\Windows\SysWOW64\DRIVERS\usbhub.sys [343040 2011-03-25] (Microsoft Corporation)
S3 usbprint; C:\Windows\SysWOW64\DRIVERS\usbprint.sys [25088 2009-07-14] (Microsoft Corporation)
R3 USBSTOR; C:\Windows\SysWOW64\DRIVERS\USBSTOR.SYS [91648 2011-03-11] (Microsoft Corporation)
R0 vdrvroot; C:\Windows\SysWOW64\drivers\vdrvroot.sys [36432 2009-07-14] (Microsoft Corporation)
S3 vga; C:\Windows\SysWOW64\DRIVERS\vgapnp.sys [29184 2009-07-14] (Microsoft Corporation)
R0 volmgr; C:\Windows\SysWOW64\drivers\volmgr.sys [71552 2010-11-21] (Microsoft Corporation)
R0 volmgrx; C:\Windows\SysWOW64\drivers\volmgrx.sys [363392 2010-11-21] (Microsoft Corporation)
R0 volsnap; C:\Windows\SysWOW64\drivers\volsnap.sys [295808 2010-11-21] (Microsoft Corporation)
R3 vwifibus; C:\Windows\SysWOW64\DRIVERS\vwifibus.sys [24576 2009-07-14] (Microsoft Corporation)
R1 vwififlt; C:\Windows\SysWOW64\DRIVERS\vwififlt.sys [59904 2009-07-14] (Microsoft Corporation)
R3 vwifimp; C:\Windows\SysWOW64\DRIVERS\vwifimp.sys [17920 2009-07-14] (Microsoft Corporation)
S3 WANARP; C:\Windows\SysWOW64\DRIVERS\wanarp.sys [88576 2010-11-21] (Microsoft Corporation)
R1 Wanarpv6; C:\Windows\SysWOW64\DRIVERS\wanarp.sys [88576 2010-11-21] (Microsoft Corporation)
R0 Wdf01000; C:\Windows\SysWOW64\drivers\Wdf01000.sys [654928 2009-07-14] (Microsoft Corporation)
R1 WfpLwf; C:\Windows\SysWOW64\DRIVERS\wfplwf.sys [12800 2009-07-14] (Microsoft Corporation)
R3 WmiAcpi; C:\Windows\SysWOW64\DRIVERS\wmiacpi.sys [14336 2009-07-14] (Microsoft Corporation)
R3 WudfPf; C:\Windows\SysWOW64\drivers\WudfPf.sys [112128 2010-11-21] (Microsoft Corporation)
R3 WUDFRd; C:\Windows\SysWOW64\DRIVERS\WUDFRd.sys [172544 2010-11-21] (Microsoft Corporation)
U5 BattC; C:\Windows\SysWOW64\Drivers\BattC.sys [28240 2009-07-14] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-04-06 11:16 - 2014-04-06 11:16 - 00036278 _____ () C:\Users\Moritz Eingeschränkt\Desktop\FRST.txt
2014-04-06 11:16 - 2014-04-06 11:16 - 00000000 ____D () C:\FRST
2014-04-06 11:14 - 2014-04-06 11:15 - 00000544 _____ () C:\Users\Moritz Eingeschränkt\Desktop\defogger_disable.log
2014-04-06 11:13 - 2014-04-06 11:13 - 02157056 _____ (Farbar) C:\Users\Moritz Eingeschränkt\Desktop\FRST64.exe
2014-04-06 11:13 - 2014-04-06 11:13 - 00380416 _____ () C:\Users\Moritz Eingeschränkt\Desktop\07jcg32z.exe
2014-04-06 11:13 - 2014-04-06 11:13 - 00050477 _____ () C:\Users\Moritz Eingeschränkt\Desktop\Defogger.exe
2014-04-06 11:00 - 2014-04-06 11:00 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-04-06 10:31 - 2014-04-06 10:33 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-06 10:31 - 2014-04-06 10:33 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-04-06 10:31 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-06 10:31 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-06 10:29 - 2014-04-06 10:29 - 00613200 _____ (Chip Digital GmbH) C:\Users\Moritz Eingeschränkt\Desktop\Malwarebytes Anti Malware - CHIP-Downloader.exe
2014-04-05 16:14 - 2014-04-05 16:14 - 00000000 ____D () C:\Users\Moritz Eingeschränkt\Documents\Digibib4
2014-03-31 14:08 - 2014-03-31 14:08 - 00013574 _____ () C:\Users\Moritz\Downloads\V2B.P-Ws.F.i.P.G-R.part16.rar
2014-03-30 23:31 - 2014-03-30 23:40 - 00000000 ____D () C:\Users\Moritz\Downloads\V2B.P-Ws.F.i.P.G-R.part01
2014-03-30 12:21 - 2014-04-06 11:05 - 00003508 _____ () C:\Windows\System32\Tasks\AutoKMS
2014-03-30 12:21 - 2014-04-01 18:22 - 00000000 ____D () C:\Windows\AutoKMS
2014-03-29 14:55 - 2014-03-29 14:55 - 00000000 ____D () C:\Users\Moritz Eingeschränkt\AppData\Roaming\TeamViewer
2014-03-29 14:54 - 2014-03-29 14:54 - 04595080 _____ (TeamViewer) C:\Users\Moritz Eingeschränkt\Desktop\TeamViewerQS_de.exe
2014-03-29 11:29 - 2014-03-29 15:00 - 00000000 ____D () C:\Users\Moritz\Downloads\Share_online
2014-03-29 09:55 - 2014-03-29 09:55 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-03-28 18:04 - 2014-04-03 17:40 - 00000000 ____D () C:\Users\Moritz Eingeschränkt\AppData\Local\ManyCam
2014-03-28 18:03 - 2014-03-28 18:03 - 00001027 _____ () C:\Users\Public\Desktop\ManyCam.lnk
2014-03-28 18:01 - 2014-03-28 18:01 - 00000000 ____D () C:\Users\Moritz Eingeschränkt\AppData\Roaming\ManyCam
2014-03-28 17:55 - 2014-03-28 18:03 - 00000000 ____D () C:\Program Files (x86)\ManyCam
2014-03-23 01:05 - 2014-03-23 01:05 - 00000000 ____D () C:\Users\Moritz Eingeschränkt\AppData\Roaming\SaalDesignSoftware
2014-03-22 23:44 - 2014-03-22 23:44 - 00000977 _____ () C:\Users\Public\Desktop\SaalDesignSoftware.lnk
2014-03-22 23:44 - 2014-03-22 23:44 - 00000000 ____D () C:\Users\Moritz\AppData\Roaming\SaalDesignSoftware
2014-03-22 23:44 - 2014-03-22 23:44 - 00000000 ____D () C:\Program Files (x86)\SaalDesignSoftware
2014-03-19 18:47 - 2014-03-19 18:47 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-03-16 13:40 - 2014-03-16 13:40 - 00000000 ____D () C:\Users\Moritz Eingeschränkt\AppData\Roaming\JPEGsnoop
2014-03-13 19:54 - 2014-03-13 19:54 - 00000000 ____D () C:\Users\Moritz Eingeschränkt\AppData\Local\Skype
2014-03-13 19:53 - 2014-03-13 19:53 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-03-12 18:21 - 2014-03-01 08:05 - 23133696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-03-12 18:21 - 2014-03-01 07:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-03-12 18:21 - 2014-03-01 07:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-03-12 18:21 - 2014-03-01 06:58 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-03-12 18:21 - 2014-03-01 06:52 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-03-12 18:21 - 2014-03-01 06:51 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-03-12 18:21 - 2014-03-01 06:42 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-03-12 18:21 - 2014-03-01 06:40 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-03-12 18:21 - 2014-03-01 06:37 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-03-12 18:21 - 2014-03-01 06:33 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-03-12 18:21 - 2014-03-01 06:33 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-03-12 18:21 - 2014-03-01 06:32 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-03-12 18:21 - 2014-03-01 06:30 - 17074688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-03-12 18:21 - 2014-03-01 06:23 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-03-12 18:21 - 2014-03-01 06:17 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-03-12 18:21 - 2014-03-01 06:11 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-03-12 18:21 - 2014-03-01 06:02 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-03-12 18:21 - 2014-03-01 05:54 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-03-12 18:21 - 2014-03-01 05:52 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-03-12 18:21 - 2014-03-01 05:51 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-03-12 18:21 - 2014-03-01 05:47 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-03-12 18:21 - 2014-03-01 05:43 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-03-12 18:21 - 2014-03-01 05:43 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-03-12 18:21 - 2014-03-01 05:42 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-03-12 18:21 - 2014-03-01 05:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-03-12 18:21 - 2014-03-01 05:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-03-12 18:21 - 2014-03-01 05:37 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-03-12 18:21 - 2014-03-01 05:35 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-03-12 18:21 - 2014-03-01 05:18 - 13051904 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-03-12 18:21 - 2014-03-01 05:16 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-03-12 18:21 - 2014-03-01 05:14 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-03-12 18:21 - 2014-03-01 05:10 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-03-12 18:21 - 2014-03-01 05:03 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-03-12 18:21 - 2014-03-01 05:00 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-03-12 18:21 - 2014-03-01 04:57 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-03-12 18:21 - 2014-03-01 04:38 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-03-12 18:21 - 2014-03-01 04:32 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-03-12 18:21 - 2014-03-01 04:27 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-03-12 18:21 - 2014-03-01 04:25 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-03-12 18:21 - 2014-03-01 04:25 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-03-12 18:21 - 2014-02-07 03:23 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-03-12 18:21 - 2014-01-29 04:32 - 00484864 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
2014-03-12 18:21 - 2014-01-29 04:06 - 00381440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll
2014-03-12 18:21 - 2014-01-28 04:32 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2014-03-12 18:20 - 2014-02-04 04:32 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-03-12 18:20 - 2014-02-04 04:32 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-03-12 18:20 - 2014-02-04 04:04 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2014-03-12 18:20 - 2014-02-04 04:04 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll

==================== One Month Modified Files and Folders =======

2014-04-06 11:16 - 2014-04-06 11:16 - 00036278 _____ () C:\Users\Moritz Eingeschränkt\Desktop\FRST.txt
2014-04-06 11:16 - 2014-04-06 11:16 - 00000000 ____D () C:\FRST
2014-04-06 11:15 - 2014-04-06 11:14 - 00000544 _____ () C:\Users\Moritz Eingeschränkt\Desktop\defogger_disable.log
2014-04-06 11:14 - 2012-08-11 10:48 - 00000168 _____ () C:\Users\Moritz\defogger_reenable
2014-04-06 11:13 - 2014-04-06 11:13 - 02157056 _____ (Farbar) C:\Users\Moritz Eingeschränkt\Desktop\FRST64.exe
2014-04-06 11:13 - 2014-04-06 11:13 - 00380416 _____ () C:\Users\Moritz Eingeschränkt\Desktop\07jcg32z.exe
2014-04-06 11:13 - 2014-04-06 11:13 - 00050477 _____ () C:\Users\Moritz Eingeschränkt\Desktop\Defogger.exe
2014-04-06 11:10 - 2009-07-14 06:45 - 00032208 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-06 11:10 - 2009-07-14 06:45 - 00032208 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-06 11:07 - 2011-12-27 19:23 - 01854704 _____ () C:\Windows\WindowsUpdate.log
2014-04-06 11:07 - 2011-04-12 09:43 - 00699682 _____ () C:\Windows\system32\perfh007.dat
2014-04-06 11:07 - 2011-04-12 09:43 - 00149790 _____ () C:\Windows\system32\perfc007.dat
2014-04-06 11:07 - 2009-07-14 07:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-06 11:05 - 2014-03-30 12:21 - 00003508 _____ () C:\Windows\System32\Tasks\AutoKMS
2014-04-06 11:04 - 2012-07-23 18:43 - 00000000 ____D () C:\Users\Moritz Eingeschränkt\AppData\Roaming\Dropbox
2014-04-06 11:04 - 2011-12-28 18:55 - 00000000 ____D () C:\Users\Moritz Eingeschränkt\AppData\Roaming\Skype
2014-04-06 11:03 - 2012-07-23 18:47 - 00000000 ___RD () C:\Users\Moritz Eingeschränkt\Dropbox
2014-04-06 11:02 - 2012-10-20 17:22 - 00000040 ___SH () C:\ProgramData\.zreglib
2014-04-06 11:02 - 2011-12-28 18:14 - 00000436 _____ () C:\Windows\system32\Drivers\etc\hosts.ics
2014-04-06 11:01 - 2014-01-21 20:08 - 00067056 _____ () C:\Windows\PFRO.log
2014-04-06 11:01 - 2014-01-08 11:39 - 00017622 _____ () C:\Windows\setupact.log
2014-04-06 11:01 - 2012-03-28 10:40 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-04-06 11:01 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-06 11:00 - 2014-04-06 11:00 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-04-06 11:00 - 2014-01-20 20:18 - 00084816 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys
2014-04-06 11:00 - 2013-03-14 19:13 - 00208928 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-04-06 11:00 - 2013-03-14 19:13 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-04-06 11:00 - 2012-07-08 20:08 - 00003924 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-04-06 11:00 - 2012-04-22 20:51 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2014-04-06 11:00 - 2012-04-22 20:51 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2014-04-06 11:00 - 2012-04-22 20:51 - 00334648 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-04-06 11:00 - 2012-04-22 20:51 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2014-04-06 11:00 - 2012-04-22 20:51 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-04-06 11:00 - 2012-04-22 20:51 - 00001972 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-04-06 10:53 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\Performance
2014-04-06 10:33 - 2014-04-06 10:31 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-06 10:33 - 2014-04-06 10:31 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-04-06 10:33 - 2013-07-14 11:39 - 00001108 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-04-06 10:31 - 2012-08-15 19:47 - 00000000 ____D () C:\Users\Moritz\AppData\Roaming\Malwarebytes
2014-04-06 10:31 - 2012-08-15 19:47 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-06 10:29 - 2014-04-06 10:29 - 00613200 _____ (Chip Digital GmbH) C:\Users\Moritz Eingeschränkt\Desktop\Malwarebytes Anti Malware - CHIP-Downloader.exe
2014-04-06 10:19 - 2012-03-29 22:28 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-04-06 10:01 - 2012-03-28 10:40 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-04-05 16:19 - 2013-06-16 22:35 - 00000000 ____D () C:\Program Files (x86)\MyPhoneExplorer
2014-04-05 16:14 - 2014-04-05 16:14 - 00000000 ____D () C:\Users\Moritz Eingeschränkt\Documents\Digibib4
2014-04-05 15:43 - 2013-04-06 16:01 - 00000000 ____D () C:\Program Files\GIMP 2
2014-04-05 15:40 - 2013-06-30 13:52 - 00000000 ____D () C:\Users\Public\Documents\Audible
2014-04-05 15:40 - 2013-06-30 13:52 - 00000000 ____D () C:\Users\Moritz\Documents\Audible
2014-04-04 23:27 - 2012-07-04 10:10 - 00001940 _____ () C:\Windows\Sandboxie.ini
2014-04-03 17:40 - 2014-03-28 18:04 - 00000000 ____D () C:\Users\Moritz Eingeschränkt\AppData\Local\ManyCam
2014-04-03 10:34 - 2014-01-19 13:25 - 00000000 ____D () C:\Users\Moritz Eingeschränkt\AppData\Roaming\vlc
2014-04-03 09:51 - 2014-04-06 10:31 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-03 09:51 - 2014-04-06 10:31 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-03 09:50 - 2013-07-14 11:39 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-04-01 18:22 - 2014-03-30 12:21 - 00000000 ____D () C:\Windows\AutoKMS
2014-04-01 18:19 - 2012-10-18 22:54 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-03-31 14:08 - 2014-03-31 14:08 - 00013574 _____ () C:\Users\Moritz\Downloads\V2B.P-Ws.F.i.P.G-R.part16.rar
2014-03-30 23:40 - 2014-03-30 23:31 - 00000000 ____D () C:\Users\Moritz\Downloads\V2B.P-Ws.F.i.P.G-R.part01
2014-03-30 19:26 - 2013-12-09 22:02 - 00001456 _____ () C:\Users\Moritz Eingeschränkt\AppData\Local\Adobe Für Web speichern 13.0 Prefs
2014-03-30 16:56 - 2012-03-28 10:40 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-03-30 16:56 - 2012-03-28 10:40 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-03-29 15:00 - 2014-03-29 11:29 - 00000000 ____D () C:\Users\Moritz\Downloads\Share_online
2014-03-29 14:55 - 2014-03-29 14:55 - 00000000 ____D () C:\Users\Moritz Eingeschränkt\AppData\Roaming\TeamViewer
2014-03-29 14:54 - 2014-03-29 14:54 - 04595080 _____ (TeamViewer) C:\Users\Moritz Eingeschränkt\Desktop\TeamViewerQS_de.exe
2014-03-29 09:55 - 2014-03-29 09:55 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-03-28 23:22 - 2013-09-28 23:14 - 00000000 ____D () C:\Program Files (x86)\JDownloader
2014-03-28 23:03 - 2012-04-15 09:13 - 00000000 ____D () C:\Users\Moritz Eingeschränkt\AppData\Local\Adobe
2014-03-28 18:03 - 2014-03-28 18:03 - 00001027 _____ () C:\Users\Public\Desktop\ManyCam.lnk
2014-03-28 18:03 - 2014-03-28 17:55 - 00000000 ____D () C:\Program Files (x86)\ManyCam
2014-03-28 18:01 - 2014-03-28 18:01 - 00000000 ____D () C:\Users\Moritz Eingeschränkt\AppData\Roaming\ManyCam
2014-03-23 01:05 - 2014-03-23 01:05 - 00000000 ____D () C:\Users\Moritz Eingeschränkt\AppData\Roaming\SaalDesignSoftware
2014-03-22 23:44 - 2014-03-22 23:44 - 00000977 _____ () C:\Users\Public\Desktop\SaalDesignSoftware.lnk
2014-03-22 23:44 - 2014-03-22 23:44 - 00000000 ____D () C:\Users\Moritz\AppData\Roaming\SaalDesignSoftware
2014-03-22 23:44 - 2014-03-22 23:44 - 00000000 ____D () C:\Program Files (x86)\SaalDesignSoftware
2014-03-19 18:47 - 2014-03-19 18:47 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-03-16 19:12 - 2013-12-09 21:50 - 00000132 _____ () C:\Users\Moritz Eingeschränkt\AppData\Roaming\Adobe PNG-Format CC - Voreinstellungen
2014-03-16 13:40 - 2014-03-16 13:40 - 00000000 ____D () C:\Users\Moritz Eingeschränkt\AppData\Roaming\JPEGsnoop
2014-03-15 21:00 - 2009-07-14 06:45 - 05249704 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-03-15 20:58 - 2013-07-19 19:29 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-03-15 20:58 - 2013-07-19 19:29 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-03-15 20:08 - 2012-03-29 15:16 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-03-15 20:06 - 2013-07-26 12:01 - 00000000 ____D () C:\Windows\system32\MRT
2014-03-15 20:00 - 2011-12-28 16:07 - 90015360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-03-13 19:54 - 2014-03-13 19:54 - 00000000 ____D () C:\Users\Moritz Eingeschränkt\AppData\Local\Skype
2014-03-13 19:53 - 2014-03-13 19:53 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-03-13 19:53 - 2011-12-28 18:54 - 00000000 ____D () C:\ProgramData\Skype
2014-03-12 14:19 - 2012-03-29 22:28 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-03-12 14:19 - 2012-03-29 22:28 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-03-12 14:19 - 2011-12-28 19:41 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-03-12 08:23 - 2013-05-31 21:17 - 00000000 ____D () C:\Users\Moritz Eingeschränkt\AppData\Roaming\Audacity
2014-03-11 19:39 - 2012-10-17 19:43 - 00000000 ____D () C:\Users\Moritz Eingeschränkt\dwhelper

Files to move or delete:
====================
C:\Users\Moritz\AppData\Roaming\CamLayout.ini
C:\Users\Moritz\AppData\Roaming\CamShapes.ini


Some content of TEMP:
====================
C:\Users\Moritz\AppData\Local\Temp\PrefJsonCpp.exe
C:\Users\Moritz\AppData\Local\Temp\sqlite3.exe
C:\Users\Moritz Eingeschränkt\AppData\Local\Temp\AAMHelper.exe
C:\Users\Moritz Eingeschränkt\AppData\Local\Temp\AdobeApplicationManager.exe
C:\Users\Moritz Eingeschränkt\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Moritz Eingeschränkt\AppData\Local\Temp\vlc-2.1.1-win32.exe
C:\Users\Moritz Eingeschränkt\AppData\Local\Temp\vlc-2.1.2-win64.exe
C:\Users\Moritz Eingeschränkt\AppData\Local\Temp\vlc-2.1.3-win32.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-03-30 03:10

==================== End Of Log ============================
         
--- --- ---

--- --- ---

--- --- ---


2b) FRST Addition
Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 13-03-2014
Ran by Moritz at 2014-04-06 11:17:05
Running from C:\Users\Moritz Eingeschränkt\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version:  - )
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
ABBYY FineReader 9.0 Professional Edition (HKLM-x32\...\{F9000000-0001-0000-0000-074957833700}) (Version: 9.00.724.5507 - ABBYY)
Acer System Information (HKLM-x32\...\{72199E33-4F2A-4B7F-8E25-95DDDD50A678}) (Version: 1.0.0 - Acer)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 4.0.0.1390 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 4.0.0.1390 - Adobe Systems Incorporated) Hidden
Adobe Community Help (HKLM-x32\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 3.0.0.400 - Adobe Systems Incorporated)
Adobe Community Help (x32 Version: 3.0.0 - Adobe Systems Incorporated) Hidden
Adobe Creative Cloud (HKLM-x32\...\Adobe Creative Cloud) (Version: 2.2.1.260 - Adobe Systems Incorporated)
Adobe DNG Codec (HKLM-x32\...\Adobe DNG Codec) (Version: 2.0.0.0 - Adobe Systems Incorporated)
Adobe Flash Player 12 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 12.0.0.77 - Adobe Systems Incorporated)
Adobe Flash Player 12 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 12.0.0.77 - Adobe Systems Incorporated)
Adobe Media Player (HKLM-x32\...\com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 1.8 - Adobe Systems Incorporated)
Adobe Media Player (x32 Version: 1.8 - Adobe Systems Incorporated) Hidden
Adobe Photoshop CC (HKLM-x32\...\{2D99B50E-431D-4AA8-85C1-172A6F8BCF09}) (Version: 14.0 - Adobe Systems Incorporated)
Adobe Photoshop CS5 (HKLM-x32\...\{15FEDA5F-141C-4127-8D7E-B962D1742728}) (Version: 12.0 - Adobe Systems Incorporated)
AnyDVD (HKLM-x32\...\AnyDVD) (Version: 7.3.5.0 - SlySoft)
Apple Application Support (HKLM-x32\...\{5D09C772-ECB3-442B-9CC6-B4341C78FDC2}) (Version: 2.3.4 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Ashampoo Burning Studio 2012 v.10.0.15 (HKLM-x32\...\Ashampoo Burning Studio 2012_is1) (Version: 10.0.15 - Ashampoo GmbH & Co. KG)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 1.0.2.43 - Atheros Communications Inc.)
Audacity 2.0.3 (HKLM-x32\...\Audacity_is1) (Version: 2.0.3 - Audacity Team)
avast! Free Antivirus (HKLM-x32\...\avast) (Version: 9.0.2016 - Avast Software)
AWIN NotenBox 7 (HKLM-x32\...\NotenBox7_is1) (Version: 7 - AWIN Software)
Canon MP Navigator EX 4.0 (HKLM-x32\...\MP Navigator EX 4.0) (Version:  - )
Canon MP280 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP280_series) (Version:  - )
Canon My Printer (HKLM-x32\...\CanonMyPrinter) (Version:  - )
Canon Solution Menu EX (HKLM-x32\...\CanonSolutionMenuEX) (Version:  - )
CCleaner (HKLM\...\CCleaner) (Version: 4.10 - Piriform)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.2.4214 - CDBurnerXP)
Content Transfer (HKLM-x32\...\{CFADE4AF-C0CF-4A04-A776-741318F1658F}) (Version: 1.3.0.23190 - Sony Corporation)
ConvertHelper 2.2 (HKLM-x32\...\{27CC6AB1-E72B-4179-AF1A-EAE507EBAF51}_is1) (Version:  - DownloadHelper)
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.48.1.0347 - Disc Soft Ltd)
Definition Update for Microsoft Office 2010 (KB982726) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{DC4BC0CC-A928-4C48-BA40-AC24784F46E5}) (Version:  - Microsoft)
die TERRA CD-ROM Hauptschule BY GSE5 (HKLM-x32\...\TERRA CD-ROM Hauptschule BY GSE5_is1) (Version:  - )
dieTERRA CD-ROM Hauptschule BY 7 GSE (HKLM-x32\...\TERRA CD-ROM Hauptschule BY 7 GSE_is1) (Version:  - )
Digitale Bibliothek 4 (HKLM-x32\...\Digitale Bibliothek 4) (Version:  - )
DirSync  2.95 (HKLM-x32\...\DirSync) (Version:  - Stephen Kalisch)
Elevated Installer (x32 Version: 2.1.13 - Garmin Ltd or its subsidiaries) Hidden
FileHippo.com Update Checker (HKLM-x32\...\FileHippo.com) (Version:  - )
Firebird SQL Server - MAGIX Edition (HKLM-x32\...\{6C5F8503-55D2-4398-858C-362B7A7AF51C}) (Version: 2.1.31.0 - MAGIX AG)
FormatFactory 2.96 (HKLM-x32\...\FormatFactory) (Version: 2.96 - Free Time)
Free FLV Converter V 7.6.1 (HKLM-x32\...\Free FLV Converter_is1) (Version: 7.6.1.0 - Koyote Lab Inc.)
Free YouTube to MP3 Converter version 3.12.7.711 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.7.711 - DVDVideoSoft Ltd.)
Garmin Communicator Plugin x64 (HKLM\...\{550331CC-C34B-494F-BCDA-37CE4EF6E924}) (Version: 4.0.3 - Garmin Ltd or its subsidiaries)
Garmin Express (HKLM-x32\...\{e47a5c85-88a2-47d2-b380-fc2e763c2e6d}) (Version: 2.1.13 - Garmin Ltd or its subsidiaries)
Garmin Express (x32 Version: 2.1.13 - Garmin Ltd or its subsidiaries) Hidden
Garmin Express Tray (x32 Version: 2.1.13 - Garmin Ltd or its subsidiaries) Hidden
Garmin Update Service (x32 Version: 2.1.13 - Garmin Ltd or its subsidiaries) Hidden
GML Matting 0.3 (HKLM-x32\...\GML Matting_is1) (Version: 0.3 - GML Computer Vision Group)
Go For Files (HKCU\...\GoforFiles) (Version: 1.9.5 - hxxp://www.goforfiles.com/) <==== ATTENTION
Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.23.9 - Google Inc.) Hidden
GPL Ghostscript (HKLM\...\GPL Ghostscript 9.07) (Version: 9.07 - Artifex Software Inc.)
GPL Ghostscript (HKLM-x32\...\GPL Ghostscript 9.07) (Version: 9.07 - Artifex Software Inc.)
GSview 5.0 (HKLM\...\GSview 5.0) (Version: 5.0 - Ghostgum Software Pty Ltd)
Hardcopy (HKLM-x32\...\Hardcopy) (Version: 2012.08.01 - www.hardcopy.de)
HotPotatoes v 6.3.0.4 (HKLM-x32\...\hotpot_is1) (Version:  - HalfBaked)
HTC BMP USB Driver (HKLM-x32\...\{31A559C1-9E4D-423B-9DD3-34A6C5398752}) (Version: 1.0.5375 - HTC)
HTC Driver Installer (HKLM-x32\...\{4CEEE5D0-F905-4688-B9F9-ECC710507796}) (Version: 4.1.0.001 - HTC Corporation)
HTC Driver Installer (HKLM-x32\...\{6D6664A9-3342-4948-9B7E-034EFE366F0F}) (Version: 3.0.0.007 - HTC Corporation)
Intel PROSet Wireless (Version:  - ) Hidden
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.3347 - Intel Corporation)
Intel(R) PROSet/Wireless WiFi-Software (HKLM\...\{1927E640-A2C6-4BA7-8F43-FFD2AE3DFCF3}) (Version: 14.0.2000 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
IPTInstaller (HKLM-x32\...\{08208143-777D-4A06-BB54-71BF0AD1BB70}) (Version: 4.0.8 - HTC)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.37 - Irfan Skiljan)
Java 7 Update 51 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417051FF}) (Version: 7.0.510 - Oracle)
Java 7 Update 51 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217045FF}) (Version: 7.0.510 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
JDownloader 0.9 (HKLM-x32\...\5513-1208-7298-9440) (Version: 0.9 - AppWork GmbH)
K-Lite Codec Pack 5.5.0 (64-bit) (HKLM\...\KLiteCodecPack64_is1) (Version: 5.5.0 - )
MAGIX Speed burnR (MSI) (HKLM-x32\...\MAGIX_{DBA20D76-5414-4FA7-9EFE-D1EFC870123D}) (Version: 7.0.2.6 - MAGIX AG)
MAGIX Speed burnR (MSI) (Version: 7.0.2.6 - MAGIX AG) Hidden
MAGIX Video deluxe 2013 (HKLM-x32\...\MAGIX_{8C73E551-5AFA-42EE-B76E-64821590BCD3}) (Version: 12.0.0.32 - MAGIX AG)
MAGIX Video deluxe 2013 (Version: 12.0.0.32 - MAGIX AG) Hidden
MAGIX Video deluxe 2013 Update (Version: 12.0.4.2 - MAGIX AG) Hidden
Malwarebytes Anti-Malware Version 2.0.1.1004 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.1.1004 - Malwarebytes Corporation)
ManyCam 4.0.77 (HKLM-x32\...\ManyCam) (Version: 4.0.77 - Visicom Media Inc.)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Camera Codec Pack (HKLM\...\{3FF70821-58E6-44DA-B512-095F547F3F18}) (Version: 16.4.1734.1104 - Microsoft Corporation)
Microsoft Office Access MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Groove MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Office 32-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 32-bit MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft_VC80_ATL_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_ATL_x86_x64 (Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_CRT_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_CRT_x86_x64 (Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_MFC_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_MFC_x86_x64 (Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_MFCLOC_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_MFCLOC_x86_x64 (Version: 80.50727.4053 - Adobe) Hidden
Microsoft_VC90_ATL_x86 (x32 Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_ATL_x86_x64 (Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_CRT_x86 (x32 Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_CRT_x86_x64 (Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_MFC_x86 (x32 Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_MFC_x86_x64 (Version: 1.00.0000 - Adobe) Hidden
Monitor Calibration Wizard 1.0 (HKLM-x32\...\Monitor Calibration Wizard) (Version:  - )
Mozilla Firefox 28.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 28.0 (x86 de)) (Version: 28.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 28.0 - Mozilla)
Mozilla Thunderbird 24.4.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 24.4.0 (x86 de)) (Version: 24.4.0 - Mozilla)
Mp3tag v2.55 (HKLM-x32\...\Mp3tag) (Version: v2.55 - Florian Heidenreich)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
Panda USB Vaccine 1.0.1.4 (HKLM-x32\...\{55A41219-9B22-4098-BAE7-AE289B3C569A}_is1) (Version:  - Panda Security)
Paragon Backup & Recovery™ 2012 Free (HKLM-x32\...\{C268B5E1-A5DA-11DF-A289-005056C00008}) (Version: 90.00.0003 - Paragon Software)
PDF Settings CC (x32 Version: 12.0 - Adobe Systems Incorporated) Hidden
PDF Settings CS5 (x32 Version: 10.0 - Adobe Systems Incorporated) Hidden
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.7.2 - pdfforge)
PDF-Viewer (HKLM\...\{A278382D-4F1B-4D47-9885-8523F7261E8D}_is1) (Version: 2.5.210.0 - Tracker Software Products Ltd)
PDF-XChange Viewer (HKLM\...\{9ED333F8-3E6C-4A38-BAFA-728454121CDA}) (Version: 2.5.200.0 - Tracker Software Products Ltd.)
Qtrax (HKCU\...\Qtrax) (Version: 20.13.06.24 - Qtrax)
QuickTime (HKLM-x32\...\{B67BAFBA-4C9F-48FA-9496-933E3B255044}) (Version: 7.74.80.86 - Apple Inc.)
Saal Design Software (HKLM-x32\...\SaalDesignSoftware) (Version: 3.2.27 - SSW Software GmbH)
Saal Design Software (x32 Version: 3.2.27 - SSW Software GmbH) Hidden
Sandboxie 4.08 (64-bit) (HKLM\...\Sandboxie) (Version: 4.08 - Sandboxie Holdings, LLC)
SensMe Setup (HKLM-x32\...\InstallShield_{3D0C34D2-ED29-4F1B-B93C-F13980C0A607}) (Version: 1.0.0.38040 - Sony Corporation)
SensMe Setup (x32 Version: 1.0.0.38040 - Sony Corporation) Hidden
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{A3364707-2F53-4C83-8F68-C9877A9080C7}) (Version:  - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (Version:  - Microsoft) Hidden
Skype™ 6.14 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.14.104 - Skype Technologies S.A.)
StreamTransport version: 1.0.2.2171 (HKLM-x32\...\{FA0BBB87-91A1-4BFD-9005-EB058BBA0E14}_is1) (Version:  - )
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.1.18.0 - Synaptics Incorporated)
UBitMenuDE (HKLM-x32\...\{CBCFD97D-FE82-43F4-A978-996CACF71E6B}_is1) (Version: 01.04 - UBit Schweiz AG)
Update for Microsoft Access 2010 (KB2553446) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{FEF4C57D-0975-4D3C-ACC7-DCD038C3788F}) (Version:  - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2837594) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{99A0DB9A-71FC-4F98-BC1F-78A18195C677}) (Version:  - Microsoft)
Update for Microsoft InfoPath 2010 (KB2817369) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{DB0B0CDF-77EC-47B0-94E2-4738573A1E58}) (Version:  - Microsoft)
Update for Microsoft InfoPath 2010 (KB2817396) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{1AA82E2E-7DB7-4C70-910C-BBB657A6B3A5}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2494150) (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{428CB7A0-1068-4CE1-8835-39C7ECD297ED}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{79C725A1-3964-421C-A528-78C1C083C7C7}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{95BE5D45-A3DD-4CB1-8C35-D75DD7B4D862}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 64-Bit Edition (HKLM\...\{90140000-0043-0000-1000-0000000FF1CE}_Office14.PROPLUS_{95BE5D45-A3DD-4CB1-8C35-D75DD7B4D862}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589375) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{EBD18DE5-BC84-4B57-9A30-097044871F9A}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{4AD36582-256B-433D-8593-F31773A15CA4}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 64-Bit Edition (HKLM\...\{90140000-0043-0000-1000-0000000FF1CE}_Office14.PROPLUS_{4AD36582-256B-433D-8593-F31773A15CA4}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{F216169C-2B40-429B-8370-B5BA06EC5423}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 64-Bit Edition (HKLM\...\{90140000-0043-0000-1000-0000000FF1CE}_Office14.PROPLUS_{F216169C-2B40-429B-8370-B5BA06EC5423}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760631) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{B6AD7E27-012A-4B63-82BA-AF62893E5435}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{07DC9C6C-E916-4F42-8677-716930ED0393}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2825640) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{43F59F4D-7179-497E-BE99-BC6F7D1DDCBA}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2825640) 64-Bit Edition (HKLM\...\{90140000-0044-0407-1000-0000000FF1CE}_Office14.PROPLUS_{43F59F4D-7179-497E-BE99-BC6F7D1DDCBA}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 64-Bit Edition (HKLM\...\{90140000-001F-0407-1000-0000000FF1CE}_Office14.PROPLUS_{64D96F30-CF4C-4CCE-AAF2-F8909348BF35}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 64-Bit Edition (HKLM\...\{90140000-001F-040C-1000-0000000FF1CE}_Office14.PROPLUS_{9F6507AC-7D8F-46C1-B90F-59C7828E0E0D}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2863818) 64-Bit Edition (HKLM\...\{90140000-001F-0409-1000-0000000FF1CE}_Office14.PROPLUS_{A9C4BE58-07E0-473D-AE68-ECBA13FBF77E}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2878225) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{8A6BDA63-4D23-4485-A466-8979E10BCF49}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2878225) 64-Bit Edition (HKLM\...\{90140000-0043-0000-1000-0000000FF1CE}_Office14.PROPLUS_{8A6BDA63-4D23-4485-A466-8979E10BCF49}) (Version:  - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{3029C408-1DD1-4273-8E58-87CB1B638FC8}) (Version:  - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 64-Bit Edition (HKLM\...\{90140000-0043-0000-1000-0000000FF1CE}_Office14.PROPLUS_{3029C408-1DD1-4273-8E58-87CB1B638FC8}) (Version:  - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{DDDC32A5-9528-4771-B91A-97A8E1D7957B}) (Version:  - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 64-Bit Edition (HKLM\...\{90140000-001A-0407-1000-0000000FF1CE}_Office14.PROPLUS_{6164E0E5-C903-488C-93AF-1B7AF7EBC331}) (Version:  - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2553145) 64-Bit Edition (HKLM\...\{90140000-0018-0407-1000-0000000FF1CE}_Office14.PROPLUS_{BEA3259E-14B5-4D89-87FF-ED9F1D0D81C8}) (Version:  - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2775360) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{BE1D254A-E5CD-4E76-9BE8-7B2E5FDBA6AF}) (Version:  - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{77374F16-2DC6-4EEF-AFAD-C59FDA2E010D}) (Version:  - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 64-Bit Edition (HKLM\...\{90140000-0043-0000-1000-0000000FF1CE}_Office14.PROPLUS_{77374F16-2DC6-4EEF-AFAD-C59FDA2E010D}) (Version:  - Microsoft)
Update for Microsoft Visio 2010 (KB2878227) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{04DED3FB-DDB2-4C1E-A057-2A1FB97BE42D}) (Version:  - Microsoft)
Update for Microsoft Visio Viewer 2010 (KB2810066) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{DF33B92A-5381-4F03-AB54-2D67086B357E}) (Version:  - Microsoft)
Update for Microsoft Word 2010 (KB2837593) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{A82E26EF-680E-427D-B7D0-FD7997DDC217}) (Version:  - Microsoft)
virtualPhotographer 1.5.6 (HKLM-x32\...\virtualPhotographer_is1) (Version:  - optikVerve Labs)
VLC media player 2.1.3 (HKLM-x32\...\VLC media player) (Version: 2.1.3 - VideoLAN)
WINZD 2013-08 Rev. 2 (HKLM-x32\...\WINZD_is1) (Version:  - R. Aquila, F. Ostermeier)
XMind (HKLM-x32\...\XMind) (Version: 3.3.0 - XMind Ltd.)

==================== Restore Points  =========================

04-04-2014 15:10:36 Windows Update
05-04-2014 13:43:21 Removed PDF Architect
05-04-2014 14:11:37 Removed Google Earth.
06-04-2014 08:58:45 avast! antivirus system restore point

==================== Scheduled Tasks (whitelisted) =============

Task: {0879820D-1AE1-4EE8-AD74-76EFCE96F3B6} - System32\Tasks\AutoKMS => C:\Windows\AutoKMS\AutoKMS.exe [2014-04-01] ()
Task: {0E93115E-8246-4A16-BDC2-E6895D4EF8B1} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-01-21] (Piriform Ltd)
Task: {10380D26-125D-4701-9048-66432CA0DB3F} - System32\Tasks\{F62CD2FD-AE05-4F83-AA17-911B1ABEF1E6} => Firefox.exe hxxp://ui.skype.com/ui/0/5.8.0.158/de/go/help.faq.installer?source=lightinstaller&amp;LastError=1618
Task: {1B3B01AC-3A9A-45DC-94F5-7A0436E91ABB} - System32\Tasks\hcdll2_ex_x64 => C:\Program Files (x86)\Hardcopy\hcdll2_ex_x64.exe [2012-07-05] ()
Task: {568D1A66-23BB-45E0-A862-593CD70164F6} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-03-28] (Google Inc.)
Task: {9F9A9C99-41C2-494A-A23A-7BE00FA76FE4} - System32\Tasks\PandaUSBVaccine => C:\Program Files (x86)\Panda USB Vaccine\RunInteractiveWin.exe [2009-09-23] ()
Task: {A1EF9F4C-62B5-409E-A1FB-F63F3286858D} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-03-28] (Google Inc.)
Task: {AEDA6196-6B2A-4395-A7B2-5585AA0A6010} - System32\Tasks\{A1DA5CE5-A6AA-47EA-80BF-78FB6E240E36} => C:\Program Files (x86)\Skype\Phone\Skype.exe [2014-02-10] (Skype Technologies S.A.)
Task: {C18870D7-8C92-4A18-AD68-1D9CB6621E56} - System32\Tasks\AdobeAAMUpdater-1.0-Moritz-PC-Moritz => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2013-09-25] (Adobe Systems Incorporated)
Task: {D58991F1-E03B-4285-AF94-CE77DB99D978} - System32\Tasks\Launch HTC Sync Loader => C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe
Task: {DF38991A-FFFF-475E-A6A0-36E0CE755840} - System32\Tasks\{0F36FB45-A3BC-43C4-8F9E-A6A348C1943A} => Firefox.exe hxxp://ui.skype.com/ui/0/6.3.0.105/de/abandoninstall?source=lightinstaller&amp;page=tsInstall
Task: {E632CA44-0A44-4A0C-B4EF-E041EE025980} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-03-12] (Adobe Systems Incorporated)
Task: {E7A51427-60DD-488B-B722-AEE60F0AE53D} - \GoforFilesUpdate No Task File
Task: {EF67ED4B-3D0A-4FBC-8806-81FC7C768F25} - System32\Tasks\{3F86EAAE-F035-4492-8C1F-56A317D7517B} => C:\Program Files (x86)\Skype\Phone\Skype.exe [2014-02-10] (Skype Technologies S.A.)
Task: {F116946E-1C28-4D80-BFCC-42C8D6211179} - System32\Tasks\hcdll2_ex_Win32 => C:\Program Files (x86)\Hardcopy\hcdll2_ex_Win32.exe [2012-07-05] ()
Task: {F3EBE63D-6551-4304-A334-2E02A2AC063D} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {FFD8AD5E-7A96-4F46-BA9F-8B224220A492} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-04-06] (AVAST Software)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2011-01-05 13:53 - 2011-01-05 13:53 - 01501696 _____ () C:\Program Files\Common Files\Intel\WirelessCommon\Libeay32.dll
2012-08-06 12:03 - 2012-07-05 15:56 - 00037440 _____ () C:\Program Files (x86)\Hardcopy\hcdll2_ex_Win32.exe
2012-08-06 12:03 - 2012-07-05 15:56 - 00044608 _____ () C:\Program Files (x86)\Hardcopy\hcdll2_ex_x64.exe
2013-10-16 19:02 - 2013-10-16 19:02 - 03358064 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_x64.dll
2013-09-05 01:17 - 2013-09-05 01:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2013-06-16 22:44 - 2012-12-07 17:26 - 00167424 _____ () C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
2011-01-05 13:53 - 2011-01-05 13:53 - 01501696 _____ () C:\Program Files\Common Files\Intel\WirelessCommon\LIBEAY32.dll
2011-03-25 18:28 - 2011-03-25 18:28 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2013-08-04 14:00 - 2013-08-04 14:00 - 00075864 _____ () C:\Program Files (x86)\SlySoft\AnyDVD\ADvdDiscHlp64.exe
2014-04-06 10:55 - 2014-04-06 09:21 - 02189824 _____ () C:\Program Files\AVAST Software\Avast\defs\14040600\algo.dll
2012-08-06 12:03 - 2012-07-05 15:56 - 00052800 _____ () C:\Program Files (x86)\Hardcopy\hardcopy_05.dll
2013-09-05 01:14 - 2013-09-05 01:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2013-10-19 01:55 - 2013-10-19 01:55 - 25100288 _____ () C:\Users\Moritz Eingeschränkt\AppData\Roaming\Dropbox\bin\libcef.dll
2013-12-07 14:04 - 2013-12-07 14:04 - 19336120 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2014-03-29 09:55 - 2014-03-29 09:55 - 03642480 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2014-03-19 18:47 - 2014-03-19 18:47 - 03018864 _____ () C:\Program Files (x86)\Mozilla Thunderbird\mozjs.dll
2014-03-19 18:47 - 2014-03-19 18:47 - 00158832 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAP32V60.dll
2014-03-19 18:47 - 2014-03-19 18:47 - 00023152 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAPPR32V60.dll
2014-03-12 14:19 - 2014-03-12 14:19 - 16276872 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== Disabled items from MSCONFIG ==============

MSCONFIG\startupreg: Adobe Creative Cloud => "C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe" --showwindow=false --onOSstartup=true
MSCONFIG\startupreg: AdobeAAMUpdater-1.0 => "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
MSCONFIG\startupreg: AdobeBridge => 
MSCONFIG\startupreg: BCSSync => "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices
MSCONFIG\startupreg: CanonMyPrinter => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
MSCONFIG\startupreg: DAEMON Tools Lite => "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
MSCONFIG\startupreg: FileHippo.com => "C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe" /background
MSCONFIG\startupreg: InnoSetupRegFile.0000000001 => "C:\Windows\is-M4UUH.exe" /REG /REGSVRMODE
MSCONFIG\startupreg:  Malwarebytes Anti-Malware  => C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
MSCONFIG\startupreg:  Malwarebytes Anti-Malware  (cleanup) => rundll32.exe "C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll",ProcessCleanupScript
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (04/06/2014 11:02:26 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/06/2014 10:54:37 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/05/2014 05:32:48 PM) (Source: Application Hang) (User: )
Description: Programm Photoshop.exe, Version 14.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 14bc

Startzeit: 01cf50bf6fe95f3d

Endzeit: 1757

Anwendungspfad: C:\Program Files\Adobe\Adobe Photoshop CC (64 Bit)\Photoshop.exe

Berichts-ID:

Error: (04/05/2014 04:09:03 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: MyPhoneExplorer.exe, Version: 1.8.0.4, Zeitstempel: 0x50257c74
Name des fehlerhaften Moduls: DropboxExt.22.dll, Version: 1.0.0.22, Zeitstempel: 0x522fb121
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000726b
ID des fehlerhaften Prozesses: 0x810
Startzeit der fehlerhaften Anwendung: 0xMyPhoneExplorer.exe0
Pfad der fehlerhaften Anwendung: MyPhoneExplorer.exe1
Pfad des fehlerhaften Moduls: MyPhoneExplorer.exe2
Berichtskennung: MyPhoneExplorer.exe3

Error: (04/05/2014 01:05:38 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/04/2014 11:27:16 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/01/2014 06:20:14 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (03/30/2014 07:00:15 PM) (Source: Windows Backup) (User: )
Description: Die Sicherung wurde aufgrund eines Fehlers beim Schreiben am Sicherungsspeicherort "I:\" nicht abgeschlossen. Fehler: "Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)"

Error: (03/28/2014 11:11:29 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (03/28/2014 05:52:42 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: ManyCamSetup.exe, Version: 4.0.77.5404, Zeitstempel: 0x4b1ae3c6
Name des fehlerhaften Moduls: inetc.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x5212eb98
Ausnahmecode: 0xc0000005
Fehleroffset: 0x031136fa
ID des fehlerhaften Prozesses: 0x290
Startzeit der fehlerhaften Anwendung: 0xManyCamSetup.exe0
Pfad der fehlerhaften Anwendung: ManyCamSetup.exe1
Pfad des fehlerhaften Moduls: ManyCamSetup.exe2
Berichtskennung: ManyCamSetup.exe3


System errors:
=============
Error: (04/06/2014 10:54:23 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Garmin Core Update Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (04/06/2014 10:54:23 AM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Garmin Core Update Service erreicht.

Error: (04/05/2014 05:35:40 PM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 10. Der interne Fehlerstatus lautet: 10.

Error: (04/05/2014 01:44:46 PM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR2 gefunden.

Error: (04/05/2014 01:44:46 PM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR2 gefunden.

Error: (04/05/2014 01:44:45 PM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR2 gefunden.

Error: (04/05/2014 01:44:45 PM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR2 gefunden.

Error: (04/05/2014 01:44:44 PM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR2 gefunden.

Error: (04/05/2014 01:11:57 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows Update" wurde nicht richtig gestartet.

Error: (04/05/2014 01:10:23 PM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 10. Der interne Fehlerstatus lautet: 10.


Microsoft Office Sessions:
=========================
Error: (04/06/2014 11:02:26 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/06/2014 10:54:37 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/05/2014 05:32:48 PM) (Source: Application Hang)(User: )
Description: Photoshop.exe14.0.0.014bc01cf50bf6fe95f3d1757C:\Program Files\Adobe\Adobe Photoshop CC (64 Bit)\Photoshop.exe

Error: (04/05/2014 04:09:03 PM) (Source: Application Error)(User: )
Description: MyPhoneExplorer.exe1.8.0.450257c74DropboxExt.22.dll1.0.0.22522fb121c00000050000726b81001cf50d8888eec2bC:\Program Files (x86)\MyPhoneExplorer\MyPhoneExplorer.exeC:\Users\Moritz Eingeschränkt\AppData\Roaming\Dropbox\bin\DropboxExt.22.dlld707d9fc-bccb-11e3-998b-e89a8fbc8374

Error: (04/05/2014 01:05:38 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/04/2014 11:27:16 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/01/2014 06:20:14 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (03/30/2014 07:00:15 PM) (Source: Windows Backup)(User: )
Description: I:\Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)

Error: (03/28/2014 11:11:29 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (03/28/2014 05:52:42 PM) (Source: Application Error)(User: )
Description: ManyCamSetup.exe4.0.77.54044b1ae3c6inetc.dll_unloaded0.0.0.05212eb98c0000005031136fa29001cf4a9db43d867bC:\Users\Moritz Eingeschränkt\Desktop\ManyCamSetup.exeinetc.dllfe5ccddd-b690-11e3-93f3-e89a8fbc8374


==================== Memory info =========================== 

Percentage of memory in use: 51%
Total physical RAM: 3947.86 MB
Available physical RAM: 1915.52 MB
Total Pagefile: 7893.9 MB
Available Pagefile: 5744.41 MB
Total Virtual: 8192 MB
Available Virtual: 8191.8 MB

==================== Drives ================================

Drive c: (System) (Fixed) (Total:108.73 GB) (Free:29.5 GB) NTFS
Drive d: (Datenpartition) (Fixed) (Total:356.93 GB) (Free:133.3 GB) NTFS
Drive e: (DVDVOLUME) (CDROM) (Total:7.71 GB) (Free:0 GB) UDF
Drive f: (photoshop_cc_for) (CDROM) (Total:1.91 GB) (Free:0 GB) CDFS
Drive h: (NIKON D5100) (Removable) (Total:14.83 GB) (Free:14.83 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 5F088D0D)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=109 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=357 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 15 GB) (Disk ID: 00000000)

Partition: GPT Partition Type.

==================== End Of Log ============================
         
3. GMER
Code:
ATTFilter
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-04-06 11:35:41
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 ST9500325AS rev.0001SDM1 465,76GB
Running: 07jcg32z.exe; Driver: C:\Users\Moritz\AppData\Local\Temp\fxliypod.sys


---- Kernel code sections - GMER 2.1 ----

INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528                                                                                                                                                           fffff80003007000 16 bytes [8B, E3, 41, 5F, 41, 5E, 41, ...]
INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 545                                                                                                                                                           fffff80003007011 35 bytes {LEA ECX, [RSP+0x70]; CALL 0x3d64f}

---- User code sections - GMER 2.1 ----

.text     C:\Windows\system32\wininit.exe[500] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                   000000007775eecd 1 byte [62]
.text     C:\Windows\system32\services.exe[556] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                  000000007775eecd 1 byte [62]
.text     C:\Windows\system32\winlogon.exe[588] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                  000000007775eecd 1 byte [62]
.text     C:\Windows\system32\svchost.exe[724] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                   000000007775eecd 1 byte [62]
.text     C:\Windows\system32\svchost.exe[824] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                   000000007775eecd 1 byte [62]
.text     C:\Windows\System32\svchost.exe[924] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                   000000007775eecd 1 byte [62]
.text     C:\Windows\System32\svchost.exe[960] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                   000000007775eecd 1 byte [62]
.text     C:\Windows\system32\svchost.exe[988] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                   000000007775eecd 1 byte [62]
.text     C:\Windows\system32\svchost.exe[1012] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                  000000007775eecd 1 byte [62]
.text     C:\Windows\system32\svchost.exe[1204] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                  000000007775eecd 1 byte [62]
.text     C:\Windows\system32\WLANExt.exe[1284] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                  000000007775eecd 1 byte [62]
.text     C:\Windows\System32\spoolsv.exe[1540] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                  000000007775eecd 1 byte [62]
.text     C:\Windows\system32\svchost.exe[1568] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                  000000007775eecd 1 byte [62]
.text     C:\Program Files (x86)\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe[1656] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                  00000000763ca2ba 1 byte [62]
.text     C:\Program Files\Intel\WiFi\bin\EvtEng.exe[1784] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                       000000007775eecd 1 byte [62]
.text     C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe[1824] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112                                                                   00000000763ca2ba 1 byte [62]
.text     C:\Windows\system32\taskhost.exe[2040] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                 000000007775eecd 1 byte [62]
.text     C:\Windows\system32\Dwm.exe[2112] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                      000000007775eecd 1 byte [62]
.text     C:\Windows\Explorer.EXE[2136] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                          000000007775eecd 1 byte [62]
.text     C:\Windows\system32\hasplms.exe[2892] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                                                                                  00000000763ca2ba 1 byte [62]
.text     C:\Program Files (x86)\Common Files\Microsoft Shared\VS7Debug\mdm.exe[2996] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                                            00000000763ca2ba 1 byte [62]
.text     C:\Program Files (x86)\Common Files\Microsoft Shared\VS7Debug\mdm.exe[2996] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69                                                                                          0000000076501465 2 bytes [50, 76]
.text     C:\Program Files (x86)\Common Files\Microsoft Shared\VS7Debug\mdm.exe[2996] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155                                                                                         00000000765014bb 2 bytes [50, 76]
.text     ...                                                                                                                                                                                                                          * 2
.text     C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe[3052] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                                                 00000000763ca2ba 1 byte [62]
.text     C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe[1720] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                  000000007775eecd 1 byte [62]
.text     C:\Windows\system32\svchost.exe[2264] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                  000000007775eecd 1 byte [62]
.text     C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2848] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                    000000007775eecd 1 byte [62]
.text     C:\Windows\System32\hkcmd.exe[288] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                     000000007775eecd 1 byte [62]
.text     C:\Windows\System32\igfxpers.exe[2444] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                 000000007775eecd 1 byte [62]
.text     C:\Program Files (x86)\Skype\Phone\Skype.exe[3396] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                                                                     00000000763ca2ba 1 byte [62]
.text     C:\Program Files (x86)\Skype\Phone\Skype.exe[3396] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                   0000000076501465 2 bytes [50, 76]
.text     C:\Program Files (x86)\Skype\Phone\Skype.exe[3396] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                  00000000765014bb 2 bytes [50, 76]
.text     ...                                                                                                                                                                                                                          * 2
.text     C:\Program Files\Sandboxie\SbieCtrl.exe[3412] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                          000000007775eecd 1 byte [62]
.text     C:\Windows\system32\wbem\wmiprvse.exe[3460] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                            000000007775eecd 1 byte [62]
.text     C:\Program Files (x86)\SlySoft\AnyDVD\AnyDVDtray.exe[3636] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                                                             00000000763ca2ba 1 byte [62]
.text     C:\Program Files (x86)\SlySoft\AnyDVD\AnyDVDtray.exe[3636] C:\Windows\syswow64\wintrust.dll!WinVerifyTrust                                                                                                                   00000000775d26d4 5 bytes [33, C0, C2, 0C, 00]
.text     C:\Users\Moritz Eingeschränkt\AppData\Roaming\Dropbox\bin\Dropbox.exe[3856] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                                            00000000763ca2ba 1 byte [62]
.text     C:\Users\Moritz Eingeschränkt\AppData\Roaming\Dropbox\bin\Dropbox.exe[3856] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 69                                                                                          0000000076501465 2 bytes [50, 76]
.text     C:\Users\Moritz Eingeschränkt\AppData\Roaming\Dropbox\bin\Dropbox.exe[3856] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 155                                                                                         00000000765014bb 2 bytes [50, 76]
.text     ...                                                                                                                                                                                                                          * 2
.text     C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE[3872] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                                                       00000000763ca2ba 1 byte [62]
.text     C:\Program Files (x86)\Sony\Content Transfer\ContentTransferWMDetector.exe[3908] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                                       00000000763ca2ba 1 byte [62]
.text     C:\Program Files\AVAST Software\Avast\AvastUI.exe[3984] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter                                                                                                         00000000763a8769 8 bytes [31, C0, C2, 04, 00, 90, 90, ...]
.text     C:\Program Files\AVAST Software\Avast\AvastUI.exe[3984] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                                                                00000000763ca2ba 1 byte [62]
.text     C:\Program Files (x86)\SlySoft\AnyDVD\ADvdDiscHlp64.exe[460] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                           000000007775eecd 1 byte [62]
.text     C:\Windows\system32\SearchIndexer.exe[3580] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                            000000007775eecd 1 byte [62]
.text     C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe[3780] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                           00000000763ca2ba 1 byte [62]
.text     C:\Windows\splwow64.exe[2980] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                          000000007775eecd 1 byte [62]
.text     C:\Windows\system32\svchost.exe[4404] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                  000000007775eecd 1 byte [62]
.text     C:\Program Files\Windows Media Player\wmpnetwk.exe[4760] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                               000000007775eecd 1 byte [62]
.text     C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe[5660] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                                         00000000763ca2ba 1 byte [62]
.text     C:\Windows\System32\svchost.exe[5744] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                  000000007775eecd 1 byte [62]
.text     C:\Users\Moritz Eingeschränkt\Desktop\07jcg32z.exe[5624] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                                                               00000000763ca2ba 1 byte [62]

---- Threads - GMER 2.1 ----

Thread    C:\Windows\System32\svchost.exe [5744:5708]                                                                                                                                                                                  000007fef24a9688
---- Processes - GMER 2.1 ----

Library   C:\Users\Moritz Eingeschränkt\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll (*** suspicious ***) @ C:\Users\Moritz Eingeschränkt\AppData\Roaming\Dropbox\bin\Dropbox.exe [3856](2014-01-03 00:45:04)                          0000000004090000
Library   C:\Users\Moritz Eingeschränkt\AppData\Roaming\Dropbox\bin\libcef.dll (*** suspicious ***) @ C:\Users\Moritz Eingeschränkt\AppData\Roaming\Dropbox\bin\Dropbox.exe [3856](2013-10-18 23:55:02)                                0000000064ca0000
Library   C:\Users\Moritz Eingeschränkt\AppData\Roaming\Dropbox\bin\icudt.dll (*** suspicious ***) @ C:\Users\Moritz Eingeschränkt\AppData\Roaming\Dropbox\bin\Dropbox.exe [3856] (ICU Data DLL/The ICU Project)(2013-10-18 23:55:00)  0000000066870000

---- EOF - GMER 2.1 ----
         
4. MBAM
Code:
ATTFilter
 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 06.04.2014
Suchlauf-Zeit: 10:51:02
Logdatei: MBAM.txt
Administrator: Ja

Version: 2.00.1.1004
Malware Datenbank: v2014.04.06.04
Rootkit Datenbank: v2014.03.27.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Chameleon: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: Moritz

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 318796
Verstrichene Zeit: 17 Min, 38 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Shuriken: Aktiviert
PUP: Warnen
PUM: Aktiviert

Prozesse: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registrierungsschlüssel: 0
(No malicious items detected)

Registrierungswerte: 0
(No malicious items detected)

Registrierungsdaten: 0
(No malicious items detected)

Ordner: 0
(No malicious items detected)

Dateien: 1
PUP.Optional.OpenCandy, C:\Users\Moritz\Desktop\cdbxp_setup_4.5.2.4214.exe, In Quarantäne, [41db2cfb5229c86e1846bc6398689d63], 

Physische Sektoren: 0
(No malicious items detected)


(end)
         
bereits im Vorraus
Mogri

Geändert von mogri (06.04.2014 um 15:37 Uhr)

Alt 06.04.2014, 16:02   #2
schrauber
/// the machine
/// TB-Ausbilder
 

Laptop extrem langsam; Aufpoppendes Programm bei Systemstart verschwindet gleich wieder - Standard

Laptop extrem langsam; Aufpoppendes Programm bei Systemstart verschwindet gleich wieder



hi,

Scan mit Combofix
WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link
  • WICHTIG: Speichere Combofix auf deinem Desktop.
  • Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
  • Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
  • Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
  • Wenn Combofix fertig ist, wird es ein Logfile erstellen.
  • Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).
Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

__________________

__________________

Alt 06.04.2014, 18:58   #3
mogri
 
Laptop extrem langsam; Aufpoppendes Programm bei Systemstart verschwindet gleich wieder - Standard

Laptop extrem langsam; Aufpoppendes Programm bei Systemstart verschwindet gleich wieder



Hi,
so habe nun Combofix ald Admin laufen lassen. Nachdem deises fertig war sah mein Desktop völlig anders aus (Ikons, Schnellstartsymbole) und auch firefox hatte eine andere Startseite. Ich hab dann mal runtergefahren und wieder hoch. Dann hat sich alles wieder so eingestellt wies war. Hab die Vermutung, dass das die Ansicht des Admins ist (hab ein Adminkonto schon eweig nicht mehr benutzt, da ich immer als Benutzer arbeite) obwohl das Hintergrundbild das normale des eingeschränkten Benutzerkontos war.

Dabei habe ich das aufpoppende Programm identifizieren können. Dabei handelt es sich um den Monitor Calibration Wizard. Das kann gut möglich sein, da ich damit versucht hab meinen Monitor zu kalibrieren und ihm gesagt hab er soll beim Systemstart immer das neue Profil anwenden. Also wäre das problem wohl gelöst. Das mit der Geschwindigkeit ist immer noch rätselhaft.

Hier Das Log von Combofix
Code:
ATTFilter
ComboFix 14-04-06.01 - Moritz 06.04.2014  19:23:30.1.2 - x64
Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.3948.2196 [GMT 2:00]
ausgeführt von:: c:\users\Moritz Eingeschrõnkt\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\Roaming
c:\windows\IsUn0407.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2014-03-06 bis 2014-04-06  ))))))))))))))))))))))))))))))
.
.
2014-04-06 17:33 . 2014-04-06 17:33	--------	d-----w-	c:\users\Schüler\AppData\Local\temp
2014-04-06 17:33 . 2014-04-06 17:33	--------	d-----w-	c:\users\Default\AppData\Local\temp
2014-04-06 17:33 . 2014-04-06 17:33	--------	d-----w-	c:\users\Moritz\AppData\Local\temp
2014-04-06 09:16 . 2014-04-06 09:17	--------	d-----w-	C:\FRST
2014-04-06 09:00 . 2014-04-06 09:00	43152	----a-w-	c:\windows\avastSS.scr
2014-04-06 08:31 . 2014-04-06 08:33	119512	----a-w-	c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-04-06 08:31 . 2014-04-03 07:51	63192	----a-w-	c:\windows\system32\drivers\mwac.sys
2014-04-06 08:31 . 2014-04-03 07:51	88280	----a-w-	c:\windows\system32\drivers\mbamchameleon.sys
2014-04-06 08:31 . 2014-04-06 08:33	--------	d-----w-	c:\program files (x86)\ Malwarebytes Anti-Malware 
2014-04-05 13:45 . 2014-04-05 13:45	--------	d-----w-	c:\program files (x86)\Common Files\PDF Architect
2014-04-04 15:42 . 2014-04-06 17:22	75888	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{A374ABFD-296B-482B-ABEE-35F5829530EE}\offreg.dll
2014-04-04 15:12 . 2014-03-07 04:43	10521840	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{A374ABFD-296B-482B-ABEE-35F5829530EE}\mpengine.dll
2014-03-30 10:21 . 2014-04-01 16:22	--------	d-----w-	c:\windows\AutoKMS
2014-03-29 12:55 . 2014-03-29 12:55	--------	d-----w-	c:\users\Moritz Eingeschränkt\AppData\Roaming\TeamViewer
2014-03-28 16:04 . 2014-04-03 15:40	--------	d-----w-	c:\users\Moritz Eingeschränkt\AppData\Local\ManyCam
2014-03-28 16:01 . 2014-03-28 16:01	--------	d-----w-	c:\users\Moritz Eingeschränkt\AppData\Roaming\ManyCam
2014-03-28 15:55 . 2014-03-28 16:03	--------	d-----w-	c:\program files (x86)\ManyCam
2014-03-22 23:05 . 2014-03-22 23:05	--------	d-----w-	c:\users\Moritz Eingeschränkt\AppData\Roaming\SaalDesignSoftware
2014-03-22 21:44 . 2014-03-22 21:44	--------	d-----w-	c:\users\Moritz\AppData\Roaming\SaalDesignSoftware
2014-03-22 21:44 . 2014-03-22 21:44	--------	d-----w-	c:\program files (x86)\SaalDesignSoftware
2014-03-19 16:47 . 2014-03-19 16:47	--------	d-----w-	c:\program files (x86)\Mozilla Thunderbird
2014-03-16 11:40 . 2014-03-16 11:40	--------	d-----w-	c:\users\Moritz Eingeschränkt\AppData\Roaming\JPEGsnoop
2014-03-13 17:54 . 2014-03-13 17:54	--------	d-----w-	c:\users\Moritz Eingeschränkt\AppData\Local\Skype
2014-03-13 17:53 . 2014-03-13 17:53	--------	d-----w-	c:\program files (x86)\Common Files\Skype
2014-03-13 17:53 . 2014-03-13 17:53	--------	d-----r-	c:\program files (x86)\Skype
2014-03-12 16:20 . 2014-02-04 02:32	624128	----a-w-	c:\windows\system32\qedit.dll
2014-03-12 16:20 . 2014-02-04 02:04	509440	----a-w-	c:\windows\SysWow64\qedit.dll
2014-03-12 16:20 . 2014-02-04 02:32	1424384	----a-w-	c:\windows\system32\WindowsCodecs.dll
2014-03-12 16:20 . 2014-02-04 02:04	1230336	----a-w-	c:\windows\SysWow64\WindowsCodecs.dll
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-04-06 09:00 . 2014-01-20 18:18	84816	----a-w-	c:\windows\system32\drivers\aswstm.sys
2014-04-06 09:00 . 2013-03-14 17:13	208928	----a-w-	c:\windows\system32\drivers\aswVmm.sys
2014-04-06 09:00 . 2013-03-14 17:13	65776	----a-w-	c:\windows\system32\drivers\aswRvrt.sys
2014-04-06 09:00 . 2012-04-22 18:51	423240	----a-w-	c:\windows\system32\drivers\aswSP.sys
2014-04-06 09:00 . 2012-04-22 18:51	93568	----a-w-	c:\windows\system32\drivers\aswRdr2.sys
2014-04-06 09:00 . 2012-04-22 18:51	1039096	----a-w-	c:\windows\system32\drivers\aswSnx.sys
2014-04-06 09:00 . 2012-04-22 18:51	79184	----a-w-	c:\windows\system32\drivers\aswMonFlt.sys
2014-04-06 09:00 . 2012-04-22 18:51	334648	----a-w-	c:\windows\system32\aswBoot.exe
2014-04-03 07:50 . 2013-07-14 09:39	25816	----a-w-	c:\windows\system32\drivers\mbam.sys
2014-03-15 18:00 . 2011-12-28 14:07	90015360	----a-w-	c:\windows\system32\MRT.exe
2014-03-12 12:19 . 2012-03-29 20:28	692616	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2014-03-12 12:19 . 2011-12-28 17:41	71048	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-02-09 12:55 . 2014-02-09 12:55	108968	----a-w-	c:\windows\system32\WindowsAccessBridge-64.dll
2014-02-09 12:55 . 2014-02-09 12:55	312744	----a-w-	c:\windows\system32\javaws.exe
2014-02-09 12:55 . 2014-02-09 12:55	189352	----a-w-	c:\windows\system32\javaw.exe
2014-02-09 12:55 . 2014-02-09 12:55	189352	----a-w-	c:\windows\system32\java.exe
2003-03-21 11:45 . 2012-09-22 15:46	250544	----a-w-	c:\program files (x86)\Common Files\keyhelp.ocx
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2014-02-10 20922016]
"GarminExpressTrayApp"="c:\program files (x86)\Garmin\Express Tray\ExpressTray.exe" [2013-03-27 1098072]
"AnyDVD"="c:\program files (x86)\SlySoft\AnyDVD\AnyDVD.exe" [2013-09-27 94296]
"MCW Startup"="c:\program files (x86)\Monitor Calibration Wizard\MCW.exe" [2002-12-20 321024]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"CanonSolutionMenuEx"="c:\program files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE" [2010-12-02 1316248]
"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992]
"ContentTransferWMDetector.exe"="c:\program files (x86)\Sony\Content Transfer\ContentTransferWMDetector.exe" [2009-11-19 583016]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2014-04-06 3854640]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-21 59720]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2013-05-01 421888]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]
"20131224"="c:\program files\AVAST Software\Avast\setup\emupdate\3bf24771-0b7b-4033-ab0b-877ab5e62b85.exe" [2014-03-28 181136]
" Malwarebytes Anti-Malware  (cleanup)"="c:\programdata\Malwarebytes\ Malwarebytes Anti-Malware \mbamdor.exe" [2014-03-05 54072]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 KMService;KMService;c:\windows\system32\srvany.exe;c:\windows\SYSNATIVE\srvany.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys;c:\windows\SYSNATIVE\drivers\aswStm.sys [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [x]
R3 HTCAND64;HTC Device Driver;c:\windows\system32\Drivers\ANDROIDUSB.sys;c:\windows\SYSNATIVE\Drivers\ANDROIDUSB.sys [x]
R3 htcnprot;HTC NDIS Protocol Driver;c:\windows\system32\DRIVERS\htcnprot.sys;c:\windows\SYSNATIVE\DRIVERS\htcnprot.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [x]
R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S0 aswRvrt;avast! Revert; [x]
S0 aswVmm;avast! VM Monitor; [x]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys;c:\windows\SYSNATIVE\drivers\aswSnx.sys [x]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys;c:\windows\SYSNATIVE\drivers\aswSP.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]
S1 Uim_VIM;UIM Virtual Image Plugin;c:\windows\system32\Drivers\uim_vimx64.sys;c:\windows\SYSNATIVE\Drivers\uim_vimx64.sys [x]
S2 ABBYY.Licensing.FineReader.Professional.9.0;ABBYY FineReader 9.0 PE Licensing Service;c:\program files (x86)\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe;c:\program files (x86)\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe [x]
S2 aksdf;aksdf;c:\windows\system32\drivers\aksdf.sys;c:\windows\SYSNATIVE\drivers\aksdf.sys [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
S2 Fabs;FABS - Helping agent for MAGIX media database;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [x]
S2 Garmin Core Update Service;Garmin Core Update Service;c:\program files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe;c:\program files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [x]
S2 hasplms;Sentinel Local License Manager;c:\windows\system32\hasplms.exe  -run;c:\windows\SYSNATIVE\hasplms.exe  -run [x]
S2 PassThru Service;Internet Pass-Through Service;c:\program files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe;c:\program files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [x]
S3 ICCS;Intel(R) Integrated Clock Controller Service - Intel(R) ICCS;c:\program files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe;c:\program files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe [x]
S3 IntcDAud;Intel(R) Display-Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys;c:\windows\SYSNATIVE\DRIVERS\L1C62x64.sys [x]
S3 ManyCam;ManyCam Virtual Webcam;c:\windows\system32\DRIVERS\mcvidrv.sys;c:\windows\SYSNATIVE\DRIVERS\mcvidrv.sys [x]
S3 mcaudrv_simple;ManyCam Virtual Microphone;c:\windows\system32\drivers\mcaudrv_x64.sys;c:\windows\SYSNATIVE\drivers\mcaudrv_x64.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2014-04-06 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-29 12:19]
.
2014-04-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-03-28 08:40]
.
2014-04-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-03-28 08:40]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ AccExtIco1]
@="{AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47}"
[HKEY_CLASSES_ROOT\CLSID\{AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47}]
2013-10-16 17:02	3358064	----a-w-	c:\program files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_x64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ AccExtIco2]
@="{853B7E05-C47D-4985-909A-D0DC5C6D7303}"
[HKEY_CLASSES_ROOT\CLSID\{853B7E05-C47D-4985-909A-D0DC5C6D7303}]
2013-10-16 17:02	3358064	----a-w-	c:\program files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_x64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ AccExtIco3]
@="{42D38F2E-98E9-4382-B546-E24E4D6D04BB}"
[HKEY_CLASSES_ROOT\CLSID\{42D38F2E-98E9-4382-B546-E24E4D6D04BB}]
2013-10-16 17:02	3358064	----a-w-	c:\program files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_x64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2014-04-06 09:00	290888	----a-w-	c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelWireless"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2011-01-05 1933584]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2013-11-15 172016]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2013-11-15 399856]
"Persistence"="c:\windows\system32\igfxpers.exe" [2013-11-15 442352]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2012-11-05 108144]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2013-09-25 472984]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.startfenster.de
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: An OneNote s&enden - c:\progra~1\MICROS~1\Office14\ONBttnIE.dll/105
IE: Free YouTube Download - c:\program files (x86)\Common Files\DVDVideoSoft\plugins\freeytvdownloader.htm
IE: Free YouTube to MP3 Converter - c:\program files (x86)\Common Files\DVDVideoSoft\plugins\freeytmp3downloader.htm
IE: Nach Microsoft &Excel exportieren - c:\progra~2\MICROS~1\Office10\EXCEL.EXE/3000
IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~1\Office14\EXCEL.EXE/3000
TCP: DhcpNameServer = 83.169.184.161 192.168.0.1
FF - ProfilePath - c:\users\Moritz\AppData\Roaming\Mozilla\Firefox\Profiles\d19ehztj.default\
FF - prefs.js: browser.search.selectedEngine - SuchMaschine
FF - prefs.js: browser.startup.homepage - hxxp://www.startfenster.de
FF - prefs.js: keyword.URL - hxxp://www.sm.de/?q=
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
ShellIconOverlayIdentifiers-{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} - (no file)
c:\users\Moritz Eingeschränkt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk - c:\users\Moritz\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
ShellIconOverlayIdentifiers-{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-{FA0BBB87-91A1-4BFD-9005-EB058BBA0E14}_is1 - g:\streamtransport\unins000.exe
AddRemove-GoforFiles - c:\program files (x86)\GoforFiles\uninstall.exe
AddRemove-Qtrax - c:\users\Moritz\Qtrax\Player\uninstall.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_77_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_77_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_77_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_77_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_77.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.12"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_77.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_77.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_77.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-04-06  19:36:57
ComboFix-quarantined-files.txt  2014-04-06 17:36
.
Vor Suchlauf: 17 Verzeichnis(se), 28.939.374.592 Bytes frei
Nach Suchlauf: 21 Verzeichnis(se), 36.951.076.864 Bytes frei
.
- - End Of File - - 997F4DE621DC03E0A59371DAFD796D6A
A36C5E4F47E84449FF07ED3517B43A31
         
LG Mogri
__________________

Alt 07.04.2014, 13:50   #4
schrauber
/// the machine
/// TB-Ausbilder
 

Laptop extrem langsam; Aufpoppendes Programm bei Systemstart verschwindet gleich wieder - Standard

Laptop extrem langsam; Aufpoppendes Programm bei Systemstart verschwindet gleich wieder



Wir entfernen noch en bissl Adware.

Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


und ein frisches FRST log bitte.
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 07.04.2014, 16:35   #5
mogri
 
Laptop extrem langsam; Aufpoppendes Programm bei Systemstart verschwindet gleich wieder - Standard

Laptop extrem langsam; Aufpoppendes Programm bei Systemstart verschwindet gleich wieder



Hi, also habe alle neuen logs erstellt:
von Adwcleaner hab ich 2 logs (bezeichnet mit R1 und S1) poste einfach mal beide:
R1:
Code:
ATTFilter
# AdwCleaner v3.023 - Bericht erstellt am 07/04/2014 um 16:54:36
# Aktualisiert 01/04/2014 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzername : Moritz - MORITZ-PC
# Gestartet von : C:\Users\Moritz Eingeschränkt\Desktop\adwcleaner.exe
# Option : Suchen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Datei Gefunden : C:\Users\Moritz\AppData\Roaming\Microsoft\Windows\Start Menu\Startfenster.lnk
Datei Gefunden : C:\Users\Moritz\Desktop\Startfenster.lnk
Ordner Gefunden C:\Users\Moritz\AppData\Roaming\pdfforge

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gefunden : HKCU\Software\GoforFiles
Schlüssel Gefunden : HKCU\Software\OCS
Schlüssel Gefunden : [x64] HKCU\Software\GoforFiles
Schlüssel Gefunden : [x64] HKCU\Software\OCS
Schlüssel Gefunden : HKLM\Software\GoforFiles
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.16521

Einstellung Gefunden : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page] - hxxp://www.startfenster.de

-\\ Mozilla Firefox v28.0 (de)

[ Datei : C:\Users\Moritz\AppData\Roaming\Mozilla\Firefox\Profiles\d19ehztj.default\prefs.js ]

Zeile gefunden : user_pref("browser.startup.homepage", "hxxp://www.startfenster.de");

[ Datei : C:\Users\Moritz Eingeschränkt\AppData\Roaming\Mozilla\Firefox\Profiles\31pj1otc.default-1394400304110\prefs.js ]

Zeile gefunden : user_pref("extensions.skipscreen.hostMatchStr", "hxxp://www.4shared.com/(get|audio|file|document|dir)/.*|hxxp://.*depositfiles.com/(([a-z]{2})/files/|auth-).*|hxxp://(www.)*digg.com/(.{5}|.{6})$|hxxp:[...]

[ Datei : C:\Users\Moritz Eingeschränkt\AppData\Roaming\Mozilla\Firefox\Profiles\3xwg2m9l.Standard-Benutzer\prefs.js ]


*************************

AdwCleaner[R1].txt - [1892 octets] - [07/04/2014 16:54:36]

########## EOF - \AdwCleaner\AdwCleaner[R1].txt - [1952 octets] ##########
         
S1:
Code:
ATTFilter
# AdwCleaner v3.023 - Bericht erstellt am 07/04/2014 um 16:57:17
# Aktualisiert 01/04/2014 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzername : Moritz - MORITZ-PC
# Gestartet von : C:\Users\Moritz Eingeschränkt\Desktop\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\Users\Moritz\AppData\Roaming\pdfforge
Datei Gelöscht : C:\Users\Moritz\AppData\Roaming\Microsoft\Windows\Start Menu\Startfenster.lnk
Datei Gelöscht : C:\Users\Moritz\Desktop\Startfenster.lnk

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Schlüssel Gelöscht : HKCU\Software\GoforFiles
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKLM\Software\GoforFiles

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.16521

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]

-\\ Mozilla Firefox v28.0 (de)

[ Datei : C:\Users\Moritz\AppData\Roaming\Mozilla\Firefox\Profiles\d19ehztj.default\prefs.js ]

Zeile gelöscht : user_pref("browser.startup.homepage", "hxxp://www.startfenster.de");

[ Datei : C:\Users\Moritz Eingeschränkt\AppData\Roaming\Mozilla\Firefox\Profiles\31pj1otc.default-1394400304110\prefs.js ]

Zeile gelöscht : user_pref("extensions.skipscreen.hostMatchStr", "hxxp://www.4shared.com/(get|audio|file|document|dir)/.*|hxxp://.*depositfiles.com/(([a-z]{2})/files/|auth-).*|hxxp://(www.)*digg.com/(.{5}|.{6})$|hxxp:[...]

[ Datei : C:\Users\Moritz Eingeschränkt\AppData\Roaming\Mozilla\Firefox\Profiles\3xwg2m9l.Standard-Benutzer\prefs.js ]


*************************

AdwCleaner[R1].txt - [2042 octets] - [07/04/2014 16:54:36]
AdwCleaner[S1].txt - [1844 octets] - [07/04/2014 16:57:17]

########## EOF - \AdwCleaner\AdwCleaner[S1].txt - [1904 octets] ##########
         
JRT:
Code:
ATTFilter
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Professional x64
Ran by Moritz on 07.04.2014 at 17:11:36,58
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files

Successfully deleted: [File] "C:\Users\Moritz\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\user pinned\taskbar\startfenster.lnk"



~~~ Folders



~~~ FireFox

Emptied folder: C:\Users\Moritz\AppData\Roaming\mozilla\firefox\profiles\d19ehztj.default\minidumps [5 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 07.04.2014 at 17:22:36,79
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         
FRST:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014
Ran by Moritz (administrator) on MORITZ-PC on 07-04-2014 17:26:00
Running from C:\Users\Moritz Eingeschränkt\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieSvc.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(ABBYY (BIT Software)) C:\Program Files (x86)\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Garmin Ltd or its subsidiaries) C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe
(SafeNet Inc.) C:\Windows\system32\hasplms.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\VS7Debug\mdm.exe
() C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Microsoft Corporation) C:\Windows\System32\alg.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
(MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
() C:\Program Files (x86)\Hardcopy\hcdll2_ex_x64.exe
() C:\Program Files (x86)\Hardcopy\hcdll2_ex_Win32.exe
(Panda Security) C:\Program Files (x86)\Panda USB Vaccine\USBVaccine.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieCtrl.exe
(SlySoft, Inc.) C:\Program Files (x86)\SlySoft\AnyDVD\AnyDVDtray.exe
(CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE
(Sony Corporation) C:\Program Files (x86)\Sony\Content Transfer\ContentTransferWMDetector.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
() C:\Program Files (x86)\SlySoft\AnyDVD\ADvdDiscHlp64.exe
(Microsoft Corporation) C:\Windows\splwow64.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [IntelWireless] - C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [1933584 2011-01-05] (Intel(R) Corporation)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2392360 2010-10-08] (Synaptics Incorporated)
HKLM\...\Run: [BCSSync] - C:\Program Files\Microsoft Office\Office14\BCSSync.exe [108144 2012-11-05] (Microsoft Corporation)
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [472984 2013-09-25] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [CanonSolutionMenuEx] - C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE [1316248 2010-12-02] (CANON INC.)
HKLM-x32\...\Run: [SwitchBoard] - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS5ServiceManager] - C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe [406992 2010-02-22] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [ContentTransferWMDetector.exe] - C:\Program Files (x86)\Sony\Content Transfer\ContentTransferWMDetector.exe [583016 2009-11-19] (Sony Corporation)
HKLM-x32\...\Run: [AvastUI.exe] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [3854640 2014-04-06] (AVAST Software)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\RunOnce: [20131224] - C:\Program Files\AVAST Software\Avast\setup\emupdate\3bf24771-0b7b-4033-ab0b-877ab5e62b85.exe /check [181136 2014-03-28] (AVAST Software)
HKLM-x32\...\RunOnce: [ Malwarebytes Anti-Malware  (cleanup)] - "C:\ProgramData\Malwarebytes\ Malwarebytes Anti-Malware \mbamdor.exe" "C:\ProgramData\Malwarebytes\ Malwarebytes Anti-Malware " [54072 2014-03-05] (Malwarebytes Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-686350309-1681273199-943402144-1000\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20922016 2014-02-10] (Skype Technologies S.A.)
HKU\S-1-5-21-686350309-1681273199-943402144-1000\...\Run: [GarminExpressTrayApp] - C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [1098072 2013-03-27] (Garmin Ltd or its subsidiaries)
HKU\S-1-5-21-686350309-1681273199-943402144-1000\...\Run: [AnyDVD] - C:\Program Files (x86)\SlySoft\AnyDVD\AnyDVD.exe [94296 2013-09-27] (SlySoft, Inc.)
HKU\S-1-5-21-686350309-1681273199-943402144-1000\...\Run: [MCW Startup] - C:\Program Files (x86)\Monitor Calibration Wizard\MCW.exe [321024 2002-12-20] ()
HKU\S-1-5-21-686350309-1681273199-943402144-1000\...\Policies\system: [LogonHoursAction] 2
HKU\S-1-5-21-686350309-1681273199-943402144-1000\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\S-1-5-21-686350309-1681273199-943402144-1001\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20922016 2014-02-10] (Skype Technologies S.A.)
HKU\S-1-5-21-686350309-1681273199-943402144-1001\...\Run: [SandboxieControl] - C:\Program Files\Sandboxie\SbieCtrl.exe [759496 2014-01-17] (Sandboxie Holdings, LLC)
HKU\S-1-5-21-686350309-1681273199-943402144-1001\...\Run: [AdobeBridge] - [X]
HKU\S-1-5-21-686350309-1681273199-943402144-1001\...\Run: [DAEMON Tools Lite] - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3675352 2013-10-28] (Disc Soft Ltd)
HKU\S-1-5-21-686350309-1681273199-943402144-1001\...\Run: [AnyDVD] - C:\Program Files (x86)\SlySoft\AnyDVD\AnyDVDtray.exe [7417944 2013-09-27] (SlySoft, Inc.)
HKU\S-1-5-21-686350309-1681273199-943402144-1001\...\Run: [MCW Startup] - C:\Program Files (x86)\Monitor Calibration Wizard\MCW.exe [321024 2002-12-20] ()
HKU\S-1-5-21-686350309-1681273199-943402144-1001\...\Policies\system: [LogonHoursAction] 2
HKU\S-1-5-21-686350309-1681273199-943402144-1001\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
Startup: C:\Users\Moritz Eingeschränkt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled ()
GroupPolicyUsers\S-1-5-21-686350309-1681273199-943402144-1016\User: Group Policy restriction detected <======= ATTENTION
GroupPolicyUsers\S-1-5-21-686350309-1681273199-943402144-1001\User: Group Policy restriction detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x2AE3486357C5CC01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {D225BE3E-3581-4EA5-ACF9-2687307E2B07} URL = hxxp://www.sm.de/?q={searchTerms}
SearchScopes: HKLM - {D225BE3E-3581-4EA5-ACF9-2687307E2B07} URL = hxxp://www.sm.de/?q={searchTerms}
SearchScopes: HKCU - {D225BE3E-3581-4EA5-ACF9-2687307E2B07} URL = hxxp://www.sm.de/?q={searchTerms}
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 83.169.184.161 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\Moritz\AppData\Roaming\Mozilla\Firefox\Profiles\d19ehztj.default
FF DefaultSearchEngine: SuchMaschine
FF SearchEngineOrder.1: SuchMaschine
FF SelectedSearchEngine: SuchMaschine
FF Keyword.URL: hxxp://www.sm.de/?q=
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()
FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin: @videolan.org/vlc,version=2.1.1 - C:\Program Files\VideoLAN\VLC\npvlc.dll No File
FF Plugin: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF Plugin-x32: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin-x32: @videolan.org/vlc,version=1.1.11 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.0.1 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin HKCU: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF SearchPlugin: C:\Users\Moritz\AppData\Roaming\Mozilla\Firefox\Profiles\d19ehztj.default\searchplugins\search_engine.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Adblock Plus - C:\Users\Moritz\AppData\Roaming\Mozilla\Firefox\Profiles\d19ehztj.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2011-12-28]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2012-04-22]

==================== Services (Whitelisted) =================

R2 ABBYY.Licensing.FineReader.Professional.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe [660768 2007-12-06] (ABBYY (BIT Software))
R3 AeLookupSvc; C:\Windows\SysWOW64\aelupsvc.dll [72192 2009-07-14] (Microsoft Corporation)
R3 ALG; C:\Windows\SysWOW64\alg.exe [79360 2009-07-14] (Microsoft Corporation)
R2 AudioSrv; C:\Windows\SysWOW64\Audiosrv.dll [679424 2010-11-21] (Microsoft Corporation)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-04-06] (AVAST Software)
R2 BITS; C:\Windows\SysWOW64\qmgr.dll [849920 2010-11-21] (Microsoft Corporation)
S3 CertPropSvc; C:\Windows\SysWOW64\certprop.dll [80384 2010-11-21] (Microsoft Corporation)
S3 Fax; C:\Windows\SysWOW64\fxssvc.exe [689152 2010-11-21] (Microsoft Corporation)
R2 Garmin Core Update Service; C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [185688 2013-03-27] (Garmin Ltd or its subsidiaries)
R2 hasplms; C:\Windows\system32\hasplms.exe [4412872 2012-08-23] (SafeNet Inc.)
R2 iphlpsvc; C:\Windows\SysWOW64\iphlpsvc.dll [569344 2010-11-21] (Microsoft Corporation)
S2 KMService; C:\Windows\SysWOW64\srvany.exe [8192 2013-03-27] ()
R2 LanmanServer; C:\Windows\SysWOW64\srvsvc.dll [236032 2010-11-21] (Microsoft Corporation)
S3 MSDTC; C:\Windows\SysWOW64\msdtc.exe [141824 2009-07-14] (Microsoft Corporation)
S3 MSiSCSI; C:\Windows\SysWOW64\iscsiexe.dll [156672 2009-07-14] (Microsoft Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2011-01-05] ()
R2 PassThru Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [167424 2012-12-07] ()
S3 RasAuto; C:\Windows\SysWOW64\rasauto.dll [99328 2009-07-14] (Microsoft Corporation)
R3 RasMan; C:\Windows\SysWOW64\rasmans.dll [344064 2010-11-21] (Microsoft Corporation)
S3 RpcLocator; C:\Windows\SysWOW64\locator.exe [10240 2009-07-14] (Microsoft Corporation)
R2 SbieSvc; C:\Program Files\Sandboxie\SbieSvc.exe [187592 2014-01-17] (Sandboxie Holdings, LLC)
R2 Schedule; C:\Windows\SysWOW64\schedsvc.dll [1110016 2010-11-21] (Microsoft Corporation)
S3 SCPolicySvc; C:\Windows\SysWOW64\certprop.dll [80384 2010-11-21] (Microsoft Corporation)
S3 SNMPTRAP; C:\Windows\SysWOW64\snmptrap.exe [14336 2009-07-14] (Microsoft Corporation)
R2 Spooler; C:\Windows\SysWOW64\spoolsv.exe [559104 2010-11-21] (Microsoft Corporation)
S2 sppsvc; C:\Windows\SysWOW64\sppsvc.exe [3524608 2010-11-21] (Microsoft Corporation)
S3 TermService; C:\Windows\SysWOW64\termsrv.dll [680960 2010-11-21] (Microsoft Corporation)
S3 UI0Detect; C:\Windows\SysWOW64\UI0Detect.exe [40960 2009-07-14] (Microsoft Corporation)
S3 vds; C:\Windows\SysWOW64\vds.exe [533504 2010-11-21] (Microsoft Corporation)
S3 VSS; C:\Windows\SysWOW64\vssvc.exe [1600512 2010-11-21] (Microsoft Corporation)
S3 wbengine; C:\Windows\SysWOW64\wbengine.exe [1504256 2010-11-21] (Microsoft Corporation)
R2 Winmgmt; C:\Windows\SysWOW64\wbem\WMIsvc.dll [242688 2009-07-14] (Microsoft Corporation)
S3 wmiApSrv; C:\Windows\SysWOW64\wbem\WmiApSrv.exe [203264 2009-07-14] (Microsoft Corporation)
R2 wuauserv; C:\Windows\SysWOW64\wuaueng.dll [2420736 2010-11-21] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

R0 ACPI; C:\Windows\SysWOW64\drivers\ACPI.sys [334208 2010-11-21] (Microsoft Corporation)
R0 amdxata; C:\Windows\SysWOW64\drivers\amdxata.sys [27008 2011-03-11] (Advanced Micro Devices)
R3 AnyDVD; C:\Windows\System32\Drivers\AnyDVD.sys [139352 2013-07-31] (SlySoft, Inc.)
R3 AnyDVD; C:\Windows\SysWOW64\Drivers\AnyDVD.sys [139352 2013-07-31] (SlySoft, Inc.)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-04-06] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-04-06] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-04-06] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2014-04-06] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2014-04-06] (AVAST Software)
R3 aswStm; C:\Windows\system32\drivers\aswStm.sys [84816 2014-04-06] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208928 2014-04-06] ()
R3 AsyncMac; C:\Windows\SysWOW64\DRIVERS\asyncmac.sys [23040 2009-07-14] (Microsoft Corporation)
R0 atapi; C:\Windows\SysWOW64\drivers\atapi.sys [24128 2009-07-14] (Microsoft Corporation)
S3 b57nd60a; C:\Windows\SysWOW64\DRIVERS\b57nd60a.sys [270848 2009-06-10] (Broadcom Corporation)
R1 Beep; C:\Windows\SysWow64\Drivers\Beep.sys [6656 2009-07-14] (Microsoft Corporation)
R1 blbdrive; C:\Windows\SysWOW64\DRIVERS\blbdrive.sys [45056 2009-07-14] (Microsoft Corporation)
R3 bowser; C:\Windows\SysWOW64\DRIVERS\bowser.sys [90624 2011-02-23] (Microsoft Corporation)
S3 BridgeMP; C:\Windows\SysWOW64\DRIVERS\bridge.sys [95232 2009-07-14] (Microsoft Corporation)
S4 cdfs; C:\Windows\SysWOW64\DRIVERS\cdfs.sys [92160 2009-07-14] (Microsoft Corporation)
R1 cdrom; C:\Windows\SysWOW64\DRIVERS\cdrom.sys [147456 2010-11-21] (Microsoft Corporation)
R0 CLFS; C:\Windows\SysWOW64\CLFS.sys [367696 2009-07-14] (Microsoft Corporation)
R3 CmBatt; C:\Windows\SysWOW64\DRIVERS\CmBatt.sys [17664 2009-07-14] (Microsoft Corporation)
R0 CNG; C:\Windows\SysWOW64\Drivers\cng.sys [459248 2010-11-21] (Microsoft Corporation)
R0 Compbatt; C:\Windows\SysWOW64\DRIVERS\compbatt.sys [21584 2009-07-14] (Microsoft Corporation)
R3 CompositeBus; C:\Windows\SysWOW64\DRIVERS\CompositeBus.sys [38912 2010-11-21] (Microsoft Corporation)
R1 CSC; C:\Windows\SysWOW64\drivers\csc.sys [514560 2010-11-21] (Microsoft Corporation)
R1 DfsC; C:\Windows\SysWOW64\Drivers\dfsc.sys [102400 2010-11-21] (Microsoft Corporation)
R1 discache; C:\Windows\SysWOW64\drivers\discache.sys [40448 2009-07-14] (Microsoft Corporation)
R0 Disk; C:\Windows\SysWOW64\drivers\disk.sys [73280 2009-07-14] (Microsoft Corporation)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2013-12-17] (Disc Soft Ltd)
S3 exfat; C:\Windows\SysWow64\Drivers\exfat.sys [195072 2009-07-14] (Microsoft Corporation)
R3 fastfat; C:\Windows\SysWow64\Drivers\fastfat.sys [204800 2009-07-14] (Microsoft Corporation)
R0 FileInfo; C:\Windows\SysWOW64\drivers\fileinfo.sys [70224 2009-07-14] (Microsoft Corporation)
S3 Filetrace; C:\Windows\SysWOW64\drivers\filetrace.sys [34304 2009-07-14] (Microsoft Corporation)
R0 FltMgr; C:\Windows\SysWOW64\drivers\fltmgr.sys [289664 2010-11-21] (Microsoft Corporation)
S3 FsDepends; C:\Windows\SysWOW64\drivers\FsDepends.sys [55376 2009-07-14] (Microsoft Corporation)
U0 Fs_Rec; C:\Windows\SysWow64\Drivers\Fs_Rec.sys [23104 2009-07-14] (Microsoft Corporation)
R0 fvevol; C:\Windows\SysWOW64\DRIVERS\fvevol.sys [223248 2010-11-21] (Microsoft Corporation)
R2 hardlock; C:\Windows\system32\drivers\hardlock.sys [323584 2012-10-06] (SafeNet Inc.)
R3 HdAudAddService; C:\Windows\SysWOW64\drivers\HdAudio.sys [350208 2010-11-21] (Microsoft Corporation)
R3 HDAudBus; C:\Windows\SysWOW64\DRIVERS\HDAudBus.sys [122368 2010-11-21] (Microsoft Corporation)
R3 HidUsb; C:\Windows\SysWOW64\DRIVERS\hidusb.sys [30208 2010-11-21] (Microsoft Corporation)
R3 HTTP; C:\Windows\SysWOW64\drivers\HTTP.sys [753664 2010-11-21] (Microsoft Corporation)
R0 hwpolicy; C:\Windows\SysWOW64\drivers\hwpolicy.sys [14720 2010-11-21] (Microsoft Corporation)
R3 i8042prt; C:\Windows\SysWOW64\DRIVERS\i8042prt.sys [105472 2009-07-14] (Microsoft Corporation)
R3 igfx; C:\Windows\SysWOW64\DRIVERS\igdkmd64.sys [12262336 2011-03-25] (Intel Corporation)
R3 IntcDAud; C:\Windows\SysWOW64\DRIVERS\IntcDAud.sys [317440 2010-10-15] (Intel(R) Corporation)
R3 intelppm; C:\Windows\SysWOW64\DRIVERS\intelppm.sys [62464 2009-07-14] (Microsoft Corporation)
S3 IpFilterDriver; C:\Windows\SysWOW64\DRIVERS\ipfltdrv.sys [82944 2010-11-21] (Microsoft Corporation)
R3 IPNAT; C:\Windows\SysWOW64\drivers\ipnat.sys [116224 2009-07-14] (Microsoft Corporation)
S3 IRENUM; C:\Windows\SysWOW64\drivers\irenum.sys [17920 2009-07-14] (Microsoft Corporation)
R3 kbdclass; C:\Windows\SysWOW64\DRIVERS\kbdclass.sys [50768 2009-07-14] (Microsoft Corporation)
R0 KSecDD; C:\Windows\SysWOW64\Drivers\ksecdd.sys [95616 2010-11-21] (Microsoft Corporation)
R0 KSecPkg; C:\Windows\SysWOW64\Drivers\ksecpkg.sys [152960 2010-11-21] (Microsoft Corporation)
R3 L1C; C:\Windows\SysWOW64\DRIVERS\L1C62x64.sys [169584 2011-04-20] (Atheros Communications, Inc.)
R2 lltdio; C:\Windows\SysWOW64\DRIVERS\lltdio.sys [60928 2009-07-14] (Microsoft Corporation)
R3 ManyCam; C:\Windows\System32\DRIVERS\mcvidrv.sys [42016 2013-11-27] (Visicom Media Inc.)
R3 mcaudrv_simple; C:\Windows\System32\drivers\mcaudrv_x64.sys [35232 2013-12-06] (Visicom Media Inc.)
R3 MEIx64; C:\Windows\SysWOW64\DRIVERS\HECIx64.sys [56344 2010-10-20] (Intel Corporation)
S3 Modem; C:\Windows\SysWOW64\drivers\modem.sys [40448 2009-07-14] (Microsoft Corporation)
R3 monitor; C:\Windows\SysWOW64\DRIVERS\monitor.sys [30208 2009-07-14] (Microsoft Corporation)
R3 mouclass; C:\Windows\SysWOW64\DRIVERS\mouclass.sys [49216 2009-07-14] (Microsoft Corporation)
R3 mouhid; C:\Windows\SysWOW64\DRIVERS\mouhid.sys [31232 2009-07-14] (Microsoft Corporation)
R0 mountmgr; C:\Windows\SysWOW64\drivers\mountmgr.sys [94592 2010-11-21] (Microsoft Corporation)
R3 mpsdrv; C:\Windows\SysWOW64\drivers\mpsdrv.sys [77312 2009-07-14] (Microsoft Corporation)
R3 mrxsmb; C:\Windows\SysWOW64\DRIVERS\mrxsmb.sys [158208 2011-04-27] (Microsoft Corporation)
R3 mrxsmb10; C:\Windows\SysWOW64\DRIVERS\mrxsmb10.sys [288768 2011-07-09] (Microsoft Corporation)
R3 mrxsmb20; C:\Windows\SysWOW64\DRIVERS\mrxsmb20.sys [128000 2011-04-27] (Microsoft Corporation)
R0 msahci; C:\Windows\SysWOW64\drivers\msahci.sys [31104 2010-11-21] (Microsoft Corporation)
R1 Msfs; C:\Windows\SysWow64\Drivers\Msfs.sys [26112 2009-07-14] (Microsoft Corporation)
R0 msisadrv; C:\Windows\SysWOW64\drivers\msisadrv.sys [15424 2009-07-14] (Microsoft Corporation)
S3 MSKSSRV; C:\Windows\SysWOW64\drivers\MSKSSRV.sys [11136 2009-07-14] (Microsoft Corporation)
S3 MSPCLOCK; C:\Windows\SysWOW64\drivers\MSPCLOCK.sys [7168 2009-07-14] (Microsoft Corporation)
S3 MSPQM; C:\Windows\SysWOW64\drivers\MSPQM.sys [6784 2009-07-14] (Microsoft Corporation)
S3 MsRPC; C:\Windows\SysWow64\Drivers\MsRPC.sys [366976 2010-11-21] (Microsoft Corporation)
R1 mssmbios; C:\Windows\SysWOW64\DRIVERS\mssmbios.sys [32320 2009-07-14] (Microsoft Corporation)
S3 MSTEE; C:\Windows\SysWOW64\drivers\MSTEE.sys [8064 2009-07-14] (Microsoft Corporation)
R0 Mup; C:\Windows\SysWOW64\Drivers\mup.sys [60496 2009-07-14] (Microsoft Corporation)
R3 NativeWifiP; C:\Windows\SysWOW64\DRIVERS\nwifi.sys [318976 2009-07-14] (Microsoft Corporation)
R0 NDIS; C:\Windows\SysWOW64\drivers\ndis.sys [951680 2010-11-21] (Microsoft Corporation)
S3 NdisCap; C:\Windows\SysWOW64\DRIVERS\ndiscap.sys [35328 2009-07-14] (Microsoft Corporation)
R3 NdisTapi; C:\Windows\SysWOW64\DRIVERS\ndistapi.sys [24064 2009-07-14] (Microsoft Corporation)
R3 Ndisuio; C:\Windows\SysWOW64\DRIVERS\ndisuio.sys [56832 2010-11-21] (Microsoft Corporation)
R3 NdisWan; C:\Windows\SysWOW64\DRIVERS\ndiswan.sys [164352 2010-11-21] (Microsoft Corporation)
R3 NDProxy; C:\Windows\SysWow64\Drivers\NDProxy.sys [57856 2010-11-21] (Microsoft Corporation)
R1 NetBIOS; C:\Windows\SysWOW64\DRIVERS\netbios.sys [44544 2009-07-14] (Microsoft Corporation)
R1 NetBT; C:\Windows\SysWOW64\DRIVERS\netbt.sys [261632 2010-11-21] (Microsoft Corporation)
R3 NETwNs64; C:\Windows\SysWOW64\DRIVERS\NETwNs64.sys [8507392 2011-01-04] (Intel Corporation)
R1 Npfs; C:\Windows\SysWow64\Drivers\Npfs.sys [44032 2009-07-14] (Microsoft Corporation)
R1 nsiproxy; C:\Windows\SysWOW64\drivers\nsiproxy.sys [24576 2009-07-14] (Microsoft Corporation)
R3 Ntfs; C:\Windows\SysWow64\Drivers\Ntfs.sys [1659776 2011-03-11] (Microsoft Corporation)
R1 Null; C:\Windows\SysWow64\Drivers\Null.sys [6144 2009-07-14] (Microsoft Corporation)
R0 partmgr; C:\Windows\SysWOW64\drivers\partmgr.sys [75136 2010-11-21] (Microsoft Corporation)
R0 pci; C:\Windows\SysWOW64\drivers\pci.sys [184704 2010-11-21] (Microsoft Corporation)
R0 pcw; C:\Windows\SysWOW64\drivers\pcw.sys [50768 2009-07-14] (Microsoft Corporation)
R2 PEAUTH; C:\Windows\SysWOW64\drivers\peauth.sys [651264 2009-07-14] (Microsoft Corporation)
R3 PptpMiniport; C:\Windows\SysWOW64\DRIVERS\raspptp.sys [111104 2010-11-21] (Microsoft Corporation)
R1 Psched; C:\Windows\SysWOW64\DRIVERS\pacer.sys [131584 2010-11-21] (Microsoft Corporation)
S3 RasAcd; C:\Windows\SysWOW64\DRIVERS\rasacd.sys [14848 2009-07-14] (Microsoft Corporation)
R3 RasAgileVpn; C:\Windows\SysWOW64\DRIVERS\AgileVpn.sys [60416 2009-07-14] (Microsoft Corporation)
R3 Rasl2tp; C:\Windows\SysWOW64\DRIVERS\rasl2tp.sys [129536 2010-11-21] (Microsoft Corporation)
R3 RasPppoe; C:\Windows\SysWOW64\DRIVERS\raspppoe.sys [92672 2009-07-14] (Microsoft Corporation)
R3 RasSstp; C:\Windows\SysWOW64\DRIVERS\rassstp.sys [83968 2009-07-14] (Microsoft Corporation)
R1 rdbss; C:\Windows\SysWOW64\DRIVERS\rdbss.sys [309248 2010-11-21] (Microsoft Corporation)
R3 rdpbus; C:\Windows\SysWOW64\DRIVERS\rdpbus.sys [24064 2009-07-14] (Microsoft Corporation)
R1 RDPCDD; C:\Windows\SysWOW64\DRIVERS\RDPCDD.sys [7680 2009-07-14] (Microsoft Corporation)
S3 RDPDR; C:\Windows\SysWOW64\drivers\rdpdr.sys [165888 2010-11-21] (Microsoft Corporation)
R1 RDPENCDD; C:\Windows\SysWOW64\drivers\rdpencdd.sys [7680 2009-07-14] (Microsoft Corporation)
R1 RDPREFMP; C:\Windows\SysWOW64\drivers\rdprefmp.sys [8192 2009-07-14] (Microsoft Corporation)
S3 RDPWD; C:\Windows\SysWow64\Drivers\RDPWD.sys [210944 2010-11-21] (Microsoft Corporation)
R0 rdyboost; C:\Windows\SysWOW64\drivers\rdyboost.sys [213888 2010-11-21] (Microsoft Corporation)
R2 rspndr; C:\Windows\SysWOW64\DRIVERS\rspndr.sys [76800 2009-07-14] (Microsoft Corporation)
R3 SbieDrv; C:\Program Files\Sandboxie\SbieDrv.sys [202600 2014-01-17] (Sandboxie Holdings, LLC)
S3 scfilter; C:\Windows\SysWOW64\DRIVERS\scfilter.sys [29696 2010-11-21] (Microsoft Corporation)
R2 secdrv; C:\Windows\SysWow64\Drivers\secdrv.sys [23040 2009-06-10] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
S3 Smb; C:\Windows\SysWOW64\DRIVERS\smb.sys [93184 2009-07-14] (Microsoft Corporation)
R0 spldr; C:\Windows\SysWow64\Drivers\spldr.sys [19008 2009-07-14] (Microsoft Corporation)
R3 srv; C:\Windows\SysWOW64\DRIVERS\srv.sys [467456 2011-04-29] (Microsoft Corporation)
R3 srv2; C:\Windows\SysWOW64\DRIVERS\srv2.sys [410112 2011-04-29] (Microsoft Corporation)
R3 srvnet; C:\Windows\SysWOW64\DRIVERS\srvnet.sys [168448 2011-04-29] (Microsoft Corporation)
R0 storflt; C:\Windows\SysWOW64\drivers\vmstorfl.sys [46464 2010-11-21] (Microsoft Corporation)
R3 swenum; C:\Windows\SysWOW64\DRIVERS\swenum.sys [12496 2009-07-14] (Microsoft Corporation)
R3 SynTP; C:\Windows\SysWOW64\DRIVERS\SynTP.sys [1395248 2010-10-08] (Synaptics Incorporated)
R0 Tcpip; C:\Windows\SysWOW64\drivers\tcpip.sys [1923952 2011-09-29] (Microsoft Corporation)
S3 TCPIP6; C:\Windows\SysWOW64\DRIVERS\tcpip.sys [1923952 2011-09-29] (Microsoft Corporation)
R2 tcpipreg; C:\Windows\SysWOW64\drivers\tcpipreg.sys [45056 2010-11-21] (Microsoft Corporation)
S3 TDPIPE; C:\Windows\SysWOW64\drivers\tdpipe.sys [15872 2009-07-14] (Microsoft Corporation)
S3 TDTCP; C:\Windows\SysWOW64\drivers\tdtcp.sys [23552 2009-07-14] (Microsoft Corporation)
R1 tdx; C:\Windows\SysWOW64\DRIVERS\tdx.sys [119296 2010-11-21] (Microsoft Corporation)
R1 TermDD; C:\Windows\SysWOW64\DRIVERS\termdd.sys [63360 2010-11-21] (Microsoft Corporation)
S3 tssecsrv; C:\Windows\SysWOW64\DRIVERS\tssecsrv.sys [39424 2010-11-21] (Microsoft Corporation)
S3 TsUsbFlt; C:\Windows\SysWOW64\drivers\tsusbflt.sys [59392 2010-11-21] (Microsoft Corporation)
R3 tunnel; C:\Windows\SysWOW64\DRIVERS\tunnel.sys [125440 2010-11-21] (Microsoft Corporation)
R4 udfs; C:\Windows\SysWOW64\DRIVERS\udfs.sys [328192 2010-11-21] (Microsoft Corporation)
R1 UimBus; C:\Windows\System32\DRIVERS\uimx64.sys [59184 2011-11-17] (Windows (R) 2000 DDK provider)
R1 UimBus; C:\Windows\SysWOW64\DRIVERS\uimx64.sys [59184 2011-11-17] (Windows (R) 2000 DDK provider)
R1 Uim_IM; C:\Windows\System32\Drivers\Uim_IMx64.sys [572336 2011-11-17] (Paragon)
R1 Uim_IM; C:\Windows\SysWOW64\Drivers\Uim_IMx64.sys [572336 2011-11-17] (Paragon)
R1 Uim_VIM; C:\Windows\System32\Drivers\uim_vimx64.sys [352816 2011-11-17] (Paragon)
R1 Uim_VIM; C:\Windows\SysWOW64\Drivers\uim_vimx64.sys [352816 2011-11-17] (Paragon)
R3 umbus; C:\Windows\SysWOW64\DRIVERS\umbus.sys [48640 2010-11-21] (Microsoft Corporation)
R3 usbccgp; C:\Windows\SysWOW64\DRIVERS\usbccgp.sys [98816 2011-03-25] (Microsoft Corporation)
R3 usbhub; C:\Windows\SysWOW64\DRIVERS\usbhub.sys [343040 2011-03-25] (Microsoft Corporation)
S3 usbprint; C:\Windows\SysWOW64\DRIVERS\usbprint.sys [25088 2009-07-14] (Microsoft Corporation)
R3 USBSTOR; C:\Windows\SysWOW64\DRIVERS\USBSTOR.SYS [91648 2011-03-11] (Microsoft Corporation)
R0 vdrvroot; C:\Windows\SysWOW64\drivers\vdrvroot.sys [36432 2009-07-14] (Microsoft Corporation)
S3 vga; C:\Windows\SysWOW64\DRIVERS\vgapnp.sys [29184 2009-07-14] (Microsoft Corporation)
R0 volmgr; C:\Windows\SysWOW64\drivers\volmgr.sys [71552 2010-11-21] (Microsoft Corporation)
R0 volmgrx; C:\Windows\SysWOW64\drivers\volmgrx.sys [363392 2010-11-21] (Microsoft Corporation)
R0 volsnap; C:\Windows\SysWOW64\drivers\volsnap.sys [295808 2010-11-21] (Microsoft Corporation)
R3 vwifibus; C:\Windows\SysWOW64\DRIVERS\vwifibus.sys [24576 2009-07-14] (Microsoft Corporation)
R1 vwififlt; C:\Windows\SysWOW64\DRIVERS\vwififlt.sys [59904 2009-07-14] (Microsoft Corporation)
R3 vwifimp; C:\Windows\SysWOW64\DRIVERS\vwifimp.sys [17920 2009-07-14] (Microsoft Corporation)
S3 WANARP; C:\Windows\SysWOW64\DRIVERS\wanarp.sys [88576 2010-11-21] (Microsoft Corporation)
R1 Wanarpv6; C:\Windows\SysWOW64\DRIVERS\wanarp.sys [88576 2010-11-21] (Microsoft Corporation)
R0 Wdf01000; C:\Windows\SysWOW64\drivers\Wdf01000.sys [654928 2009-07-14] (Microsoft Corporation)
R1 WfpLwf; C:\Windows\SysWOW64\DRIVERS\wfplwf.sys [12800 2009-07-14] (Microsoft Corporation)
R3 WmiAcpi; C:\Windows\SysWOW64\DRIVERS\wmiacpi.sys [14336 2009-07-14] (Microsoft Corporation)
R3 WudfPf; C:\Windows\SysWOW64\drivers\WudfPf.sys [112128 2010-11-21] (Microsoft Corporation)
R3 WUDFRd; C:\Windows\SysWOW64\DRIVERS\WUDFRd.sys [172544 2010-11-21] (Microsoft Corporation)
U5 BattC; C:\Windows\SysWOW64\Drivers\BattC.sys [28240 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-04-07 17:26 - 2014-04-07 17:26 - 00035608 _____ () C:\Users\Moritz Eingeschränkt\Desktop\FRST.txt
2014-04-07 17:23 - 2014-04-07 17:23 - 00000902 _____ () C:\Users\Moritz Eingeschränkt\Desktop\JRT.txt
2014-04-07 17:22 - 2014-04-07 17:22 - 00000902 _____ () C:\Users\Moritz\Desktop\JRT.txt
2014-04-07 17:10 - 2014-04-07 17:10 - 01016261 _____ (Thisisu) C:\Users\Moritz Eingeschränkt\Desktop\JRT.exe
2014-04-07 17:01 - 2014-04-07 17:02 - 00000872 _____ () C:\Users\Moritz Eingeschränkt\Desktop\DesktopOK.ini
2014-04-06 20:15 - 2014-02-17 21:28 - 00176128 _____ (Nenad Hrg SoftwareOK) C:\Users\Moritz Eingeschränkt\Desktop\DesktopOK.exe
2014-04-06 20:14 - 2014-04-07 17:24 - 00000000 ____D () C:\Users\Moritz Eingeschränkt\Desktop\Safety Stuff
2014-04-06 19:36 - 2014-04-06 19:36 - 00021913 _____ () C:\ComboFix.txt
2014-04-06 19:19 - 2014-04-06 19:37 - 00000000 ____D () C:\Qoobox
2014-04-06 19:19 - 2014-04-06 19:35 - 00000000 ____D () C:\Windows\erdnt
2014-04-06 19:19 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-04-06 19:19 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-04-06 19:19 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-04-06 19:19 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-04-06 19:19 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-04-06 19:19 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-04-06 19:19 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-04-06 19:19 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-04-06 11:16 - 2014-04-07 17:26 - 00000000 ____D () C:\FRST
2014-04-06 11:13 - 2014-04-06 11:13 - 02157056 _____ (Farbar) C:\Users\Moritz Eingeschränkt\Desktop\FRST64.exe
2014-04-06 11:00 - 2014-04-06 11:00 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-04-06 10:31 - 2014-04-06 10:33 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-06 10:31 - 2014-04-06 10:33 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-04-06 10:31 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-06 10:31 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-05 16:14 - 2014-04-05 16:14 - 00000000 ____D () C:\Users\Moritz Eingeschränkt\Documents\Digibib4
2014-03-31 14:08 - 2014-03-31 14:08 - 00013574 _____ () C:\Users\Moritz\Downloads\V2B.P-Ws.F.i.P.G-R.part16.rar
2014-03-30 23:31 - 2014-03-30 23:40 - 00000000 ____D () C:\Users\Moritz\Downloads\V2B.P-Ws.F.i.P.G-R.part01
2014-03-30 12:21 - 2014-04-07 17:10 - 00003506 _____ () C:\Windows\System32\Tasks\AutoKMS
2014-03-30 12:21 - 2014-04-01 18:22 - 00000000 ____D () C:\Windows\AutoKMS
2014-03-29 14:55 - 2014-03-29 14:55 - 00000000 ____D () C:\Users\Moritz Eingeschränkt\AppData\Roaming\TeamViewer
2014-03-29 14:54 - 2014-03-29 14:54 - 04595080 _____ (TeamViewer) C:\Users\Moritz Eingeschränkt\Desktop\TeamViewerQS_de.exe
2014-03-29 11:29 - 2014-03-29 15:00 - 00000000 ____D () C:\Users\Moritz\Downloads\Share_online
2014-03-29 09:55 - 2014-03-29 09:55 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-03-28 18:04 - 2014-04-03 17:40 - 00000000 ____D () C:\Users\Moritz Eingeschränkt\AppData\Local\ManyCam
2014-03-28 18:03 - 2014-03-28 18:03 - 00001027 _____ () C:\Users\Public\Desktop\ManyCam.lnk
2014-03-28 18:01 - 2014-03-28 18:01 - 00000000 ____D () C:\Users\Moritz Eingeschränkt\AppData\Roaming\ManyCam
2014-03-28 17:55 - 2014-03-28 18:03 - 00000000 ____D () C:\Program Files (x86)\ManyCam
2014-03-23 01:05 - 2014-03-23 01:05 - 00000000 ____D () C:\Users\Moritz Eingeschränkt\AppData\Roaming\SaalDesignSoftware
2014-03-22 23:44 - 2014-03-22 23:44 - 00000977 _____ () C:\Users\Public\Desktop\SaalDesignSoftware.lnk
2014-03-22 23:44 - 2014-03-22 23:44 - 00000000 ____D () C:\Users\Moritz\AppData\Roaming\SaalDesignSoftware
2014-03-22 23:44 - 2014-03-22 23:44 - 00000000 ____D () C:\Program Files (x86)\SaalDesignSoftware
2014-03-19 18:47 - 2014-03-19 18:47 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-03-16 13:40 - 2014-03-16 13:40 - 00000000 ____D () C:\Users\Moritz Eingeschränkt\AppData\Roaming\JPEGsnoop
2014-03-13 19:54 - 2014-03-13 19:54 - 00000000 ____D () C:\Users\Moritz Eingeschränkt\AppData\Local\Skype
2014-03-13 19:53 - 2014-03-13 19:53 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-03-12 18:21 - 2014-03-01 08:05 - 23133696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-03-12 18:21 - 2014-03-01 07:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-03-12 18:21 - 2014-03-01 07:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-03-12 18:21 - 2014-03-01 06:58 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-03-12 18:21 - 2014-03-01 06:52 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-03-12 18:21 - 2014-03-01 06:51 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-03-12 18:21 - 2014-03-01 06:42 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-03-12 18:21 - 2014-03-01 06:40 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-03-12 18:21 - 2014-03-01 06:37 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-03-12 18:21 - 2014-03-01 06:33 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-03-12 18:21 - 2014-03-01 06:33 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-03-12 18:21 - 2014-03-01 06:32 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-03-12 18:21 - 2014-03-01 06:30 - 17074688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-03-12 18:21 - 2014-03-01 06:23 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-03-12 18:21 - 2014-03-01 06:17 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-03-12 18:21 - 2014-03-01 06:11 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-03-12 18:21 - 2014-03-01 06:02 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-03-12 18:21 - 2014-03-01 05:54 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-03-12 18:21 - 2014-03-01 05:52 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-03-12 18:21 - 2014-03-01 05:51 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-03-12 18:21 - 2014-03-01 05:47 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-03-12 18:21 - 2014-03-01 05:43 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-03-12 18:21 - 2014-03-01 05:43 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-03-12 18:21 - 2014-03-01 05:42 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-03-12 18:21 - 2014-03-01 05:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-03-12 18:21 - 2014-03-01 05:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-03-12 18:21 - 2014-03-01 05:37 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-03-12 18:21 - 2014-03-01 05:35 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-03-12 18:21 - 2014-03-01 05:18 - 13051904 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-03-12 18:21 - 2014-03-01 05:16 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-03-12 18:21 - 2014-03-01 05:14 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-03-12 18:21 - 2014-03-01 05:10 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-03-12 18:21 - 2014-03-01 05:03 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-03-12 18:21 - 2014-03-01 05:00 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-03-12 18:21 - 2014-03-01 04:57 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-03-12 18:21 - 2014-03-01 04:38 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-03-12 18:21 - 2014-03-01 04:32 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-03-12 18:21 - 2014-03-01 04:27 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-03-12 18:21 - 2014-03-01 04:25 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-03-12 18:21 - 2014-03-01 04:25 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-03-12 18:21 - 2014-02-07 03:23 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-03-12 18:21 - 2014-01-29 04:32 - 00484864 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
2014-03-12 18:21 - 2014-01-29 04:06 - 00381440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll
2014-03-12 18:21 - 2014-01-28 04:32 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2014-03-12 18:20 - 2014-02-04 04:32 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-03-12 18:20 - 2014-02-04 04:32 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-03-12 18:20 - 2014-02-04 04:04 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2014-03-12 18:20 - 2014-02-04 04:04 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll

==================== One Month Modified Files and Folders =======

2014-04-07 17:26 - 2014-04-07 17:26 - 00035608 _____ () C:\Users\Moritz Eingeschränkt\Desktop\FRST.txt
2014-04-07 17:26 - 2014-04-06 11:16 - 00000000 ____D () C:\FRST
2014-04-07 17:24 - 2014-04-06 20:14 - 00000000 ____D () C:\Users\Moritz Eingeschränkt\Desktop\Safety Stuff
2014-04-07 17:24 - 2011-12-28 18:55 - 00000000 ____D () C:\Users\Moritz Eingeschränkt\AppData\Roaming\Skype
2014-04-07 17:23 - 2014-04-07 17:23 - 00000902 _____ () C:\Users\Moritz Eingeschränkt\Desktop\JRT.txt
2014-04-07 17:23 - 2012-10-20 17:22 - 00000040 ___SH () C:\ProgramData\.zreglib
2014-04-07 17:23 - 2012-03-28 10:40 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-04-07 17:22 - 2014-04-07 17:22 - 00000902 _____ () C:\Users\Moritz\Desktop\JRT.txt
2014-04-07 17:19 - 2012-03-29 22:28 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-04-07 17:13 - 2009-07-14 06:45 - 00032208 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-07 17:13 - 2009-07-14 06:45 - 00032208 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-07 17:10 - 2014-04-07 17:10 - 01016261 _____ (Thisisu) C:\Users\Moritz Eingeschränkt\Desktop\JRT.exe
2014-04-07 17:10 - 2014-03-30 12:21 - 00003506 _____ () C:\Windows\System32\Tasks\AutoKMS
2014-04-07 17:10 - 2011-04-12 09:43 - 00699682 _____ () C:\Windows\system32\perfh007.dat
2014-04-07 17:10 - 2011-04-12 09:43 - 00149790 _____ () C:\Windows\system32\perfc007.dat
2014-04-07 17:10 - 2009-07-14 07:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-07 17:07 - 2011-12-28 18:14 - 00000436 _____ () C:\Windows\system32\Drivers\etc\hosts.ics
2014-04-07 17:06 - 2014-01-08 11:39 - 00017846 _____ () C:\Windows\setupact.log
2014-04-07 17:06 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-07 17:05 - 2013-09-24 15:49 - 00000000 ____D () C:\AdwCleaner
2014-04-07 17:05 - 2011-12-27 19:23 - 01893257 _____ () C:\Windows\WindowsUpdate.log
2014-04-07 17:02 - 2014-04-07 17:01 - 00000872 _____ () C:\Users\Moritz Eingeschränkt\Desktop\DesktopOK.ini
2014-04-07 17:01 - 2012-07-08 20:08 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-04-07 17:01 - 2012-03-28 10:40 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-04-07 16:57 - 2012-07-04 10:10 - 00001940 _____ () C:\Windows\Sandboxie.ini
2014-04-07 16:52 - 2014-01-19 13:25 - 00000000 ____D () C:\Users\Moritz Eingeschränkt\AppData\Roaming\vlc
2014-04-06 19:48 - 2014-01-21 20:08 - 00067602 _____ () C:\Windows\PFRO.log
2014-04-06 19:37 - 2014-04-06 19:19 - 00000000 ____D () C:\Qoobox
2014-04-06 19:36 - 2014-04-06 19:36 - 00021913 _____ () C:\ComboFix.txt
2014-04-06 19:35 - 2014-04-06 19:19 - 00000000 ____D () C:\Windows\erdnt
2014-04-06 19:35 - 2011-12-28 16:19 - 00000000 ___RD () C:\Users\Moritz Eingeschränkt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-04-06 19:33 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-04-06 19:11 - 2012-07-23 18:43 - 00000000 ____D () C:\Users\Moritz Eingeschränkt\AppData\Roaming\Dropbox
2014-04-06 19:10 - 2012-07-23 18:47 - 00000000 ___RD () C:\Users\Moritz Eingeschränkt\Dropbox
2014-04-06 11:14 - 2012-08-11 10:48 - 00000168 _____ () C:\Users\Moritz\defogger_reenable
2014-04-06 11:13 - 2014-04-06 11:13 - 02157056 _____ (Farbar) C:\Users\Moritz Eingeschränkt\Desktop\FRST64.exe
2014-04-06 11:00 - 2014-04-06 11:00 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-04-06 11:00 - 2014-01-20 20:18 - 00084816 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys
2014-04-06 11:00 - 2013-03-14 19:13 - 00208928 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-04-06 11:00 - 2013-03-14 19:13 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-04-06 11:00 - 2012-04-22 20:51 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2014-04-06 11:00 - 2012-04-22 20:51 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2014-04-06 11:00 - 2012-04-22 20:51 - 00334648 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-04-06 11:00 - 2012-04-22 20:51 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2014-04-06 11:00 - 2012-04-22 20:51 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-04-06 11:00 - 2012-04-22 20:51 - 00001972 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-04-06 10:53 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\Performance
2014-04-06 10:33 - 2014-04-06 10:31 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-06 10:33 - 2014-04-06 10:31 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-04-06 10:33 - 2013-07-14 11:39 - 00001108 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-04-06 10:31 - 2012-08-15 19:47 - 00000000 ____D () C:\Users\Moritz\AppData\Roaming\Malwarebytes
2014-04-06 10:31 - 2012-08-15 19:47 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-05 16:19 - 2013-06-16 22:35 - 00000000 ____D () C:\Program Files (x86)\MyPhoneExplorer
2014-04-05 16:14 - 2014-04-05 16:14 - 00000000 ____D () C:\Users\Moritz Eingeschränkt\Documents\Digibib4
2014-04-05 15:43 - 2013-04-06 16:01 - 00000000 ____D () C:\Program Files\GIMP 2
2014-04-05 15:40 - 2013-06-30 13:52 - 00000000 ____D () C:\Users\Public\Documents\Audible
2014-04-05 15:40 - 2013-06-30 13:52 - 00000000 ____D () C:\Users\Moritz\Documents\Audible
2014-04-03 17:40 - 2014-03-28 18:04 - 00000000 ____D () C:\Users\Moritz Eingeschränkt\AppData\Local\ManyCam
2014-04-03 09:51 - 2014-04-06 10:31 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-03 09:51 - 2014-04-06 10:31 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-03 09:50 - 2013-07-14 11:39 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-04-01 18:22 - 2014-03-30 12:21 - 00000000 ____D () C:\Windows\AutoKMS
2014-04-01 18:19 - 2012-10-18 22:54 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-03-31 14:08 - 2014-03-31 14:08 - 00013574 _____ () C:\Users\Moritz\Downloads\V2B.P-Ws.F.i.P.G-R.part16.rar
2014-03-30 23:40 - 2014-03-30 23:31 - 00000000 ____D () C:\Users\Moritz\Downloads\V2B.P-Ws.F.i.P.G-R.part01
2014-03-30 19:26 - 2013-12-09 22:02 - 00001456 _____ () C:\Users\Moritz Eingeschränkt\AppData\Local\Adobe Für Web speichern 13.0 Prefs
2014-03-30 16:56 - 2012-03-28 10:40 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-03-30 16:56 - 2012-03-28 10:40 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-03-29 15:00 - 2014-03-29 11:29 - 00000000 ____D () C:\Users\Moritz\Downloads\Share_online
2014-03-29 14:55 - 2014-03-29 14:55 - 00000000 ____D () C:\Users\Moritz Eingeschränkt\AppData\Roaming\TeamViewer
2014-03-29 14:54 - 2014-03-29 14:54 - 04595080 _____ (TeamViewer) C:\Users\Moritz Eingeschränkt\Desktop\TeamViewerQS_de.exe
2014-03-29 09:55 - 2014-03-29 09:55 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-03-28 23:22 - 2013-09-28 23:14 - 00000000 ____D () C:\Program Files (x86)\JDownloader
2014-03-28 23:03 - 2012-04-15 09:13 - 00000000 ____D () C:\Users\Moritz Eingeschränkt\AppData\Local\Adobe
2014-03-28 18:03 - 2014-03-28 18:03 - 00001027 _____ () C:\Users\Public\Desktop\ManyCam.lnk
2014-03-28 18:03 - 2014-03-28 17:55 - 00000000 ____D () C:\Program Files (x86)\ManyCam
2014-03-28 18:01 - 2014-03-28 18:01 - 00000000 ____D () C:\Users\Moritz Eingeschränkt\AppData\Roaming\ManyCam
2014-03-23 01:05 - 2014-03-23 01:05 - 00000000 ____D () C:\Users\Moritz Eingeschränkt\AppData\Roaming\SaalDesignSoftware
2014-03-22 23:44 - 2014-03-22 23:44 - 00000977 _____ () C:\Users\Public\Desktop\SaalDesignSoftware.lnk
2014-03-22 23:44 - 2014-03-22 23:44 - 00000000 ____D () C:\Users\Moritz\AppData\Roaming\SaalDesignSoftware
2014-03-22 23:44 - 2014-03-22 23:44 - 00000000 ____D () C:\Program Files (x86)\SaalDesignSoftware
2014-03-19 18:47 - 2014-03-19 18:47 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-03-16 19:12 - 2013-12-09 21:50 - 00000132 _____ () C:\Users\Moritz Eingeschränkt\AppData\Roaming\Adobe PNG-Format CC - Voreinstellungen
2014-03-16 13:40 - 2014-03-16 13:40 - 00000000 ____D () C:\Users\Moritz Eingeschränkt\AppData\Roaming\JPEGsnoop
2014-03-15 21:00 - 2009-07-14 06:45 - 05249704 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-03-15 20:58 - 2013-07-19 19:29 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-03-15 20:58 - 2013-07-19 19:29 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-03-15 20:08 - 2012-03-29 15:16 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-03-15 20:06 - 2013-07-26 12:01 - 00000000 ____D () C:\Windows\system32\MRT
2014-03-15 20:00 - 2011-12-28 16:07 - 90015360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-03-13 19:54 - 2014-03-13 19:54 - 00000000 ____D () C:\Users\Moritz Eingeschränkt\AppData\Local\Skype
2014-03-13 19:53 - 2014-03-13 19:53 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-03-13 19:53 - 2011-12-28 18:54 - 00000000 ____D () C:\ProgramData\Skype
2014-03-12 14:19 - 2012-03-29 22:28 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-03-12 14:19 - 2012-03-29 22:28 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-03-12 14:19 - 2011-12-28 19:41 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-03-12 08:23 - 2013-05-31 21:17 - 00000000 ____D () C:\Users\Moritz Eingeschränkt\AppData\Roaming\Audacity
2014-03-11 19:39 - 2012-10-17 19:43 - 00000000 ____D () C:\Users\Moritz Eingeschränkt\dwhelper

Files to move or delete:
====================
C:\Users\Moritz\AppData\Roaming\CamLayout.ini
C:\Users\Moritz\AppData\Roaming\CamShapes.ini


Some content of TEMP:
====================
C:\Users\Moritz\AppData\Local\temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-03-30 03:10

==================== End Of Log ============================
         
--- --- ---


Hatt ich eigentlich einen Virus? Was macht Combofix eigentlich genau?
LG Mogri


Alt 08.04.2014, 11:19   #6
schrauber
/// the machine
/// TB-Ausbilder
 

Laptop extrem langsam; Aufpoppendes Programm bei Systemstart verschwindet gleich wieder - Standard

Laptop extrem langsam; Aufpoppendes Programm bei Systemstart verschwindet gleich wieder



Malware entfernen. Einzelheiten darf ich aber keine posten (malware-schreiber lesen auch mit )


Jede Menge Adware auf dem System. Jetzt aber nur noch Kontrollscans:


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?
__________________
--> Laptop extrem langsam; Aufpoppendes Programm bei Systemstart verschwindet gleich wieder

Antwort

Themen zu Laptop extrem langsam; Aufpoppendes Programm bei Systemstart verschwindet gleich wieder
antivirus, browser, converter, cpu, device driver, dvdvideosoft ltd., error, excel, firefox, flash player, homepage, koyote, langsam, launch, monitor, mozilla, mp3, panda usb vaccine, problem, programm, registry, rundll, scan, schutz, security, software, svchost.exe, system, tracker, tunnel, usb, warnung



Ähnliche Themen: Laptop extrem langsam; Aufpoppendes Programm bei Systemstart verschwindet gleich wieder


  1. Laptop extrem langsam
    Log-Analyse und Auswertung - 18.11.2015 (25)
  2. Windows 7: Laptop extrem langsam
    Log-Analyse und Auswertung - 24.09.2015 (12)
  3. LapTop und Internet ist extrem Langsam
    Log-Analyse und Auswertung - 04.04.2015 (1)
  4. Pop Up System32 beim starten des PC verschwindet sofort wieder PC ist sehr langsam geworden.
    Log-Analyse und Auswertung - 22.02.2015 (20)
  5. Windows 7: Laptop extrem langsam
    Log-Analyse und Auswertung - 22.05.2014 (14)
  6. Laptop extrem langsam
    Plagegeister aller Art und deren Bekämpfung - 16.03.2014 (23)
  7. Windows 7: Laptop extrem langsam
    Alles rund um Windows - 03.02.2014 (3)
  8. Systemstart (Win7) extrem langsam
    Plagegeister aller Art und deren Bekämpfung - 31.10.2013 (18)
  9. Laptop extrem langsam - CPU Auslastung 100%
    Plagegeister aller Art und deren Bekämpfung - 31.07.2013 (9)
  10. Laptop mit Vista extrem langsam
    Alles rund um Windows - 22.03.2013 (5)
  11. Internet/Seitenaufbau ist nach dem Systemstart oft (nicht immer) extrem langsam
    Plagegeister aller Art und deren Bekämpfung - 24.08.2011 (13)
  12. Laptop plötzlich extrem langsam
    Log-Analyse und Auswertung - 13.04.2011 (17)
  13. CPU-Auslastung 100% Laptop extrem langsam
    Plagegeister aller Art und deren Bekämpfung - 19.03.2011 (1)
  14. Laptop hängt sich nach Start gleich wieder auf
    Alles rund um Windows - 16.06.2009 (0)
  15. Laptop extrem langsam
    Log-Analyse und Auswertung - 14.02.2009 (2)
  16. noch zu retten ?? laptop ist extrem langsam
    Mülltonne - 25.05.2008 (0)
  17. Laufendes Programm bei Rechnerstart, Firefox extrem langsam
    Log-Analyse und Auswertung - 23.05.2006 (7)

Zum Thema Laptop extrem langsam; Aufpoppendes Programm bei Systemstart verschwindet gleich wieder - Hallo zusammen, habe folgendes Problem: Mein Laptop ist extrem langsam. Wenn ich in einem Programm arbeite, z.B. Word etc. dann dauert der Programmstart plötzlich sehr lange, wenn dann alles geladen - Laptop extrem langsam; Aufpoppendes Programm bei Systemstart verschwindet gleich wieder...
Archiv
Du betrachtest: Laptop extrem langsam; Aufpoppendes Programm bei Systemstart verschwindet gleich wieder auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.